CVE Vulnerability Catalog

An information disclosure vulnerability in HCL Connections due to improper handling of request data. A user can obtain sensitive information they are not entitled to.

A vulnerability in ggml-org whisper.cpp 1.8.4-58 in the function log_mel_spectrogram in file src/whisper.cpp. Manipulation leads to an out-of-bounds read. Local access is required. A pull request with a fix is pending acceptance.

The ZTE File Manager application contains a vulnerability that allows third-party apps to launch the FilePreViewActivity and supply arbitrary file paths. This enables reading files with the file manager's privileges, including system directories like /data/data and /data/local/tmp on unrooted devices.

The WPBot WordPress plugin before version 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query. Users with administrator access can perform SQL injection that executes when a visitor triggers a search.

ImageMagick before 7.1.2-27 has a memory leak vulnerability in the magick CLI when invalid options are provided. Attackers can repeatedly supply malformed arguments to cause memory exhaustion.

A flaw was found in pki-core where the certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs. This allows an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.

A stack-based buffer overflow in `/usr/bin/ltsudo` `cmd_ipaddr_conflict` in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows a `superadmin`-group attacker to trigger a SUID-root process abort or potentially elevate privileges via an overly long interface-name argument.

In GNU coreutils unexpand, a heap-based buffer overflow occurs due to an integer overflow during buffer allocation when processing large -t values. This can lead to out-of-bounds heap write and potentially achieve a heap write primitive.

The ProfileGrid WordPress plugin before version 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwrite the site's premium license settings.

A security issue was discovered in the Kubernetes Java client library where a compromised pod may be able to create new files in arbitrary locations on the client machine executing copy operations via non-tar copyDirectoryFromPod when enableTarCompressing is false.

Improper output neutralization (XML injection) in QDom comment, CDATA, and processing-instruction serialization in Qt XML from 4.0.0 through 6.11 allows untrusted text serialized by an application into those nodes to inject arbitrary XML markup, because the node terminators are not escaped under the default InvalidDataPolicy (AcceptInvalidChars). Fixed in Qt 6.12.

In JetBrains GoLand before 2026.2 sensitive configuration values are written to log files by default.

Vulnerability in DNSSEC validation allows bypassing signature verification for wildcard expansion proofs (NSEC/NSEC3) when the answer is a CNAME or DNAME record.

A DNS issue occurs when the authoritative server responds very slowly and records expire in the meantime. In this case, TTL capping is not enforced due to lack of data. This does not happen during normal resolution.

In Unbound from version 1.6.0 up to 1.25.1, the 'view_local_data' and 'view_local_datas' commands in 'unbound-control' create a bare local zone tree for a view without default-protected zones (e.g., RFC 1918 reverse, AS112, .onion, .localhost). This causes queries for these names to be forwarded to public DNS instead of being answered locally, bypassing local policy.

In NLnet Labs Unbound from 1.18.0 up to 1.25.1, when listening on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node validates for every PROXYv2-declared source behind that node. An off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks.

A heap-based buffer overflow in the diff3 tool from GNU diffutils due to multiple signed integer overflows in line-mapping calculations. An attacker controlling diff3 input (e.g., via --diff-program) can trigger out-of-bounds writes, leading to a crash or potentially remote code execution.

In Unbound from 1.6.2 up to 1.25.1, when configured with the 'respip' module in front of the validator together with a 'response-ip' redirect rule or an RPZ file with an RPZ-IP trigger, the rewriting handler does not check the security status of the upstream answer and can rewrite a BOGUS A/AAAA answer to point to an operator's configured IP. This results in the client receiving an INSECURE NOERROR reply rewritten by the operator's configured IP. An attacker can exploit this by spoofing BOGUS A/AAAA answers.

In NLnet Labs Unbound from 1.6.0 to 1.25.1, a wildcard RRset replay can be temporarily considered DNSSEC-secure based on RRSIG validation and cached. Later NSEC validation marks it as bogus, but another thread may use it for a reply, replacing a specific record with a wildcard. The attack requires a DNSSEC-signed domain and a CNAME record pointing to a sibling record of a wildcard.

In NLnet Labs Unbound 1.13.2 up to and including 1.25.1, an off-by-one error in the 'harden-below-nxdomain' logic allows stub or forward zones below a DNSSEC signed zone to be shadowed by a secure NXDOMAIN answer from the parent, bypassing the configuration.