CVE Vulnerability Catalog

A vulnerability in the Zephyr Bluetooth host causes incorrect attribution of a bt_conn reservation to an advertising set during incoming peripheral connections. When multiple extended advertising sets are enabled (CONFIG_BT_EXT_ADV_MAX_ADV_SET > 1), find_pending_connect() may return a reservation belonging to a different, still-running set, permanently leaking a connection slot. An adjacent attacker can exploit this over the air without authentication, exhausting the connection pool and causing denial of service.

Vulnerability in the Object Transfer Service (OTS) server in the Zephyr Bluetooth stack. The oacp_ind_send() function appends the Checksum Value field to the OACP response regardless of the result code, while the response buffer is only filled on the success path. On validation failure (e.g., no object selected), net_buf_simple_pull_le32() is invoked on a zero-length buffer.

Johnson Controls Kantech Entrapass before 9.20 uses a hard-coded cryptographic key, allowing a padding oracle crypto attack.

Cleartext storage of sensitive information in memory in Johnson Controls Kantech Entrapass allows retrieval of embedded sensitive data. The issue affects Kantech Entrapass before 9.20.

The vulnerability affects the IPv6 stack in Zephyr RTOS, where the key used to generate stable (RFC 7217) and temporary (RFC 8981) interface identifiers was derived using sys_rand_get(), which is not cryptographically secure. As a result, an observer of network traffic can recover the generator state and reconstruct the key, allowing prediction of the device's IPv6 addresses and tracking across networks.

In GStreamer Editing Services (gst-editing-services), a GES project file can embed an arbitrary GStreamer pipeline description as an effect definition. When loaded, the pipeline description is parsed and instantiated without restriction on elements or properties, allowing a remote attacker to read or write arbitrary local files, issue outbound network requests, or crash the application.

Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in its PyrusSyncService Windows service. An attacker with unprivileged access can create files using the ISyncService contract.

The Easy Digital Downloads WordPress plugin (through version 3.7.1) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to leverage race conditions.

The Amelia WordPress plugin (through version 2.4.12) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.

The LightBox Block WordPress plugin (through version 1.2.0) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.

The Amelia WordPress plugin (through version 2.4.10) has missing authorization, allowing exploitation of incorrectly configured access control security levels. An attacker could perform operations they should not be permitted to.

A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0 affecting unknown code of the Backend component. Manipulation can lead to improper authorization, and the attack can be launched remotely. The exploit has been publicly released and the vendor did not respond.

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26 affecting an unknown function of the /login file. Manipulating the engrmode argument with the input admin can lead to improper authentication, and the attack may be launched remotely. The vendor did not respond.

A security flaw has been discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68. The affected element is the function loadstring of the Lua sandbox component, leading to type confusion. The attack may be initiated remotely, and the exploit has been released to the public and may be used for attacks. The patch is named Hotfix November 2026.

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one long audio clip that materializes full attention matrices and causes quadratic GPU-memory use, leading to out-of-memory and termination of EngineCore for all users.

Prior to 0.32.0, an authenticated caller in vLLM can place forged shared-memory address and monotonic_id values in public multimodal features.kwargs_data. In scale-out deployments with shared-memory multimodal caching enabled, workers trust those values and pass attacker-selected bytes to pickle.loads(), allowing arbitrary Python execution even when insecure serialization is disabled.

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker, so a nonterminating render can block /v1/responses and other chat-template users, while an output-expanding render can exhaust server memory.

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py places the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled, the attacker can be logged in as the victim.

From 1.3.0 until 9.0.0, the Rust zip library's ZipArchive::extract calls Vec::with_capacity for a symbolic link target using the attacker-controlled ZIP64 uncompressed_size before reading entry data. A small archive can request an impossible capacity, aborting the process in a way that cannot be contained with catch_unwind or a worker thread.

From 7.2.0 until 9.0.0, the Rust zip library's ZipArchive::extract and ZipArchive::extract_unwrapped_root_dir validate symbolic link targets with a lexical prefix comparison rather than resolving each intermediate link. An attacker who knows the extraction destination can create a chain whose apparent target stays under the destination while an intermediate symlink resolves outside it, allowing files to be created or overwritten with the extracting process's privileges.