CVE Vulnerability Catalog

Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary activity.

A vulnerability was detected in nibabel up to 5.4.2 in the array_from_file function of nibabel/volumeutils.py within the Header Handler component. Manipulation leads to uncontrolled memory allocation, and the attack can be carried out remotely. A pull request fixing the issue awaits acceptance.

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.

A weakness was identified in meshio up to 5.3.5 in an unknown function of meshio/_vtk_42.py within the VTK Reader component. Manipulating the DIMENSIONS argument can lead to uncontrolled memory allocation, and the attack can be executed remotely. The project was informed early via an issue report but has not responded yet.

A security flaw was discovered in feedfinder2 up to 0.0.4 affecting the find_feeds function in feedfinder2.py. Manipulation results in server-side request forgery, and remote exploitation is possible. The project was informed early via an issue report but has not responded yet.

A vulnerability was identified in inventariobasico (versions c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad931c218140df4fb23809d4fab) in unknown code of addlist.php within the Add Product Page component. Manipulation of the product name argument leads to cross site scripting, and the attack may be launched remotely. The exploit is publicly available and might be used; the product operates on a rolling release basis and the project has not responded to the issue report.

A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API without bounding its length. This vulnerability is addressed in swift-crypto version 5.0.3.

Prior to 1.2.27, any authenticated MailWatch user, including the U, D, and H roles, can release to inbox or permanently delete the quarantined mail of any other user or domain by supplying an arbitrary message id to mailscanner/quarantine_action.php. The action does not check message ownership or apply the per-role global_filter, and message identifiers are enumerable.

In Open Object from 2.4.3 until 2.5.1, 3.6.2, 4.0.2, and 4.1.1, a token scoped to read one ObjectType can read the full versioned record of an object of any other ObjectType via the history-detail endpoint GET /api/v2/objects/{uuid}/{index}. The history_detail action calls get_queryset() and get_object_or_404 directly, bypassing object permission checks. This is fixed in versions 2.5.1, 3.6.2, 4.0.2, and 4.1.1.

In Domoticz prior to 2026.3, the udevices JSON command handler (Cmd_UpdateDevices in main/WebServerCmds.cpp) performed no session.rights check before invoking a Lua parser script. A low-privilege authenticated user could trigger execution of an existing operator-installed Lua parser script with attacker-controlled input via GET /json.htm, and the script parameter lacked a path-traversal guard. Execution is limited to already-installed valid Lua files, and the issue is addressed in version 2026.3.

In InvoicePlane prior to 1.7.2-beta-1, guest users can approve or reject quotes belonging to any client, not just their assigned clients. The approve() and reject() methods in the Guest Quotes controller call approve_quote_by_id() and reject_quote_by_id() without the where_in('ip_quotes.client_id', $this->user_clients) scoping, and generate_pdf() calls mark_viewed() before checking client scope. These issues are fixed in version 1.7.2-beta-1 and the subsequent stable 1.7.2.

In D-Link DIR-505 1.10B02, the main function of /secmark1524.cgi in the Web Management CGI component allows manipulation of the accu/pass/code/hash/cmds arguments to cause a backdoor. The attack can be carried out remotely, and the exploit is publicly available.

A security flaw was discovered in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation results in information disclosure, and the attack can only be performed from the local network. The exploit has been publicly released and may be used for attacks, and the project was informed early via an issue report but has not responded yet.

A vulnerability was identified in MusicFreeDesktop 0.0.6/0.0.7/0.0.8 in an unknown function of the Request Forwarder component. Manipulation leads to server-side request forgery, and remote exploitation is possible. The exploit is publicly available and might be used; the patch identifier is b0d3876247a0a64fa0e430e4b21870e41f503182.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further vulnerability information is available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, and 11.7.x <= 11.7.10 fail to validate the target post ID in the Agents plugin's mention reminder component. An authenticated user who can post in a channel visible to a system administrator can cause the administrator's browser to send an unintended API request, resulting in replacement of an installed plugin and code execution on the server, via a crafted post containing a forged mention reminder that the administrator clicks.

Prior to 8.1.0, AVideo's view/queue.php uses pathinfo on the caller-controlled fileURI and stores its filename through setTitle in encoder_queue.title without neutralization. fileURI is not covered by the objects/security.php filter lists, and the Login::canUpload() capability can be self-granted, allowing an attacker to store an HTML title whose event handler runs in a privileged viewer's browser (an administrator or an operator on the attacker's streamer).

Prior to 8.1.0, AVideo's anonymous login interface reflects request values into HTML and JavaScript without output encoding. webSiteRootURL is returned verbatim by Streamer::getStreamerURL() and reaches navigation and form attributes as well as a JavaScript string in view/index.header.php, while the user and pass fields are filtered only for single quotes, allowing double quotes and angle brackets to break out of HTML attributes. Additionally, view/index.header.php reflects POST fields using json_encode without JSON_HEX_TAG, and locale/function.php stores the POST lang value in the session for unescaped reflection.