CVE Vulnerability Catalog

NVIDIA TensorRT-LLM contains a server-side request forgery (SSRF) vulnerability that an attacker could exploit. Successful exploitation may lead to information disclosure.

NVIDIA TensorRT-LLM contains a vulnerability in KvCacheAwareRouter tokenizer loading that allows inclusion of functionality from an untrusted control sphere. Successful exploitation may lead to code execution, information disclosure, data tampering, and denial of service.

NVIDIA PhysX contains an out-of-bounds write vulnerability that an attacker could exploit. Successful exploitation may lead to code execution, data tampering, denial of service, and information disclosure.

NVIDIA TensorRT-LLM contains a server-side request forgery (SSRF) vulnerability that an attacker could exploit. Successful exploitation may lead to information disclosure and data tampering.

Ontime improperly restricts excessive authentication attempts, enabling brute force attacks. The issue affects versions through 2026-10-27; the vendor did not respond to the disclosure.

Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Devolutions PowerShell Universal 2026.3.0 and earlier allows an authenticated user with notification creation permission to execute arbitrary JavaScript in the browser of another user via a crafted notification target URL.

Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local application logs and diagnostics bundles due to insufficient IPC payload redaction. An attacker with read access to these files could obtain the credentials; these OAuth tokens are not Docker account tokens. Versions 4.94.0 and 4.95.0 addressed known logging paths, but logs containing credentials can remain after upgrading, and version 4.97.0 fixes the issue and includes cleanup of existing host logs and crash dumps.

An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) impacts Qt. Under certain conditions, encoding text with QTextCodec may write outside an internal buffer, which can cause the application to crash and may affect data integrity.

An observable response discrepancy vulnerability in Agentis allows account footprinting. The issue affects versions before 4.8.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Stack-based Buffer Overflow vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Denial of service.

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain an Improper Access Control vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerProtect Data Domain contains an Improper Privilege Management vulnerability across multiple Feature Release, LTS2024, LTS2025 and LTS2026 versions. A high privileged attacker with remote access could exploit it to elevate privileges.

Dell PowerProtect Data Domain contains an Improper Privilege Management vulnerability across multiple Feature Release, LTS2024, LTS2025 and LTS2026 versions. A high privileged attacker with local access could exploit it to elevate privileges.

Dell PowerProtect Data Domain contains a Server-Side Request Forgery (SSRF) vulnerability across multiple Feature Release, LTS2024, LTS2025 and LTS2026 versions. An unauthenticated attacker with remote access could exploit it to perform server-side requests.

Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows an unauthenticated user to upload any type of file to the server, and to any path where the web server user has write permissions. This could also allow them to delete files.

Eaton easySoft improperly validates TLS certificates presented by easyE4 devices. A network-adjacent attacker could exploit this weakness to perform a man-in-the-middle attack and potentially intercept or modify communications between easySoft and easyE4.

Eaton easyE4 uses an insufficiently strong password policy. An attacker who obtains a password hash, including through CVE-2026-41020, could perform an offline password-guessing attack and potentially recover user credentials.

Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to captured authentication traffic to replay a valid authentication exchange and gain unauthorized access to the device.

An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute arbitrary system commands with full control over the device. The configuration daemon's time synchronization handler constructs a shell command by concatenating user-supplied input without sanitization or validation.