CVE Vulnerability Catalog

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x001a() caused by an unbounded strlen on embedded XML plist data. Attackers can supply a crafted FileVault 2 volume with non-NUL-terminated plist data, causing libfvde_volume_open() to read past the heap block buffer.

libfvde through 20260923 contains a heap out-of-bounds read vulnerability in libfvde_encrypted_metadata_read_type_0x0024() because xml_plist_data_size is not checked against the source metadata block. Attackers can supply a crafted FileVault 2 Core Storage volume that makes libfvde_volume_open() copy past the heap block buffer, crashing the application.

gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM command stream without bounds checks. Attackers can supply a crafted VGM file with wait opcodes and no 0x66 terminator to read past the heap buffer and crash the player.

Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify file length before scanning the GBR ROM title field. Attackers can supply a crafted GBR file of 0x21 to 0x162 bytes to read past the heap buffer, crashing gbsplay or leaking memory.

gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject ROM bank indexes beyond the ROM size, causing an underflowed bank length. Attackers can supply crafted .gbr, .gbs or .gb files with malicious bank indexes to make bank_get() read far past the heap ROM buffer and crash the player.

FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel buffer allocation from file-supplied width and height. Attackers can supply a crafted BMP or ICO file with large dimensions so row decoding writes file-derived data past the heap buffer, corrupting the application heap.

FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows attackers to corrupt stack memory by supplying an oversized BMP colors_used field. Attackers can craft BMP or ICO files with colors_used above 256 to overflow the 768-byte colormap array, causing crashes or potential code execution.

compress prior to 1.20.2 has a flaw in the zstd DecodeAll and streaming decoder paths that can panic when a crafted two-block frame reaches huff0.ReadTable with an FSE normalized count of 32768 stored in int16 as -32768. The wrapped count lets buildDtable retain stale decode-table state from the prior block, and nextFast derives an out-of-range state and indexes beyond the table instead of returning a decode error.

snappy-java is a Java port of the snappy, a fast C++ compresser/decompresser developed by Google. Prior to 1.1.10.9, Snappy.arrayCopy(Object src, int offset, int byteLength, Object dest, int destOffset) passes caller-supplied ranges to native memcpy without validating either array, allowing negative or oversized byteLength and offset values to read or write outside array bounds and crash the JVM. SnappyOutputStream.rawWrite and SnappyInputStream.rawRead, including their typed-array write and read methods, pass caller-controlled ranges through this primitive, and typed-array byte-size calculations can overflow int. This issue is fixed in version 1.1.10.9.

Datadog dd-trace-py, the Datadog Python APM client, from 3.13.0 until 4.15.5 does not properly handle certain internal errors in IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. An unhandled error can terminate the Python process and interrupt the work it is handling.

Datadog dd-trace-py, the Datadog Python APM client, from 1.5.0 until 3.19.9 and 4.15.6 has a default query-string obfuscation regular expression that can exhibit excessive backtracking while synchronously processing attacker-controlled URL query strings for HTTP span metadata. A remote attacker can cause prolonged CPU consumption, request latency, and service unavailability.

Go JOSE, a Go implementation of the JOSE standards (JWE, JWS, JWT), prior to 4.1.6 parses attacker-controlled RSA modulus and prime values from JWKs without enforcing size and consistency bounds before passing them to crypto/rsa.PrivateKey.Validate. On Go 1.24 and later, crafted large or degenerate RSA parameters can make validation consume cubic CPU time, allowing remote denial of service.

Prior to version 4.1.5, go-jose does not limit nesting depth when parsing attacker-controlled JSON. Deeply nested arrays or objects exceed Go's stack limit, causing a stack overflow and application crash.

Prior to version 4.1.5, decrypting untrusted JWE ciphertext with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 in go-jose can pass an empty ciphertext buffer to CBC-HMAC unpadding. Insufficient validation allows indexing of the empty buffer, causing a panic and denial of service.

In itsourcecode Online Book Store 1.0, manipulation of the bookisbn argument in /book.php leads to SQL injection. The attack can be carried out remotely, and a publicly disclosed exploit may be used.

In itsourcecode Airline Reservation System 1.0, manipulation of the max argument in /book_flight.php leads to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.

TOTOLINK A950RG 4.1.2cu.5268_B20221104 contains a stack-based buffer overflow in function sub_402340 of infostat.cgi (Device-Information CGI component). Manipulating the CONTENT_LENGTH argument causes overflow, and the exploit is publicly available.

In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the getLanguageCfg function in global.so discloses information when the token argument is manipulated. The attack may be launched remotely, and the exploit is publicly available.

A memory handling vulnerability was fixed across multiple Apple platforms (iOS, iPadOS, macOS, tvOS, visionOS, watchOS). Processing a maliciously crafted video file may lead to unexpected app termination.

A buffer overflow was addressed with improved bounds checking in Apple platforms (iOS, iPadOS, macOS, visionOS). Processing a maliciously crafted file may lead to unexpected process termination.