CVE Vulnerability Catalog

A vulnerability in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network due to incorrect authorization.

A Server-Side Request Forgery (SSRF) vulnerability in Azure OpenAI allows an authorized attacker to elevate privileges over a network.

An open redirect vulnerability in M365 Copilot allows an unauthorized attacker to redirect users to a malicious site, potentially leading to privilege escalation over a network.

Improper access control in Azure Synapse allows an authorized attacker to elevate privileges over a network. The vulnerability affects authorization mechanisms in Microsoft's analytics service.

In Libreswan, the function RSA_authenticate_hash_signature_pkcs1_1_5_rsa() incorrectly verifies the DER encoding of the ASN.1 digest when the IKEv2 AUTH payload uses RSASSA-PKCS1-v1_5. A remote attacker can exploit a Bleichenbacher-style attack to forge the AUTH payload, leading to impersonation, or trigger an assertion causing denial-of-service.

Libreswan has a vulnerability in the RSA_authenticate_hash_signature_raw_rsa() function that incorrectly verifies the authentication hash length in IKEv1 packets using PKCS #1 RSA encoding. A remote attacker can forge the SIG payload via a Bleichenbacher-style attack, leading to impersonation, or cause denial-of-service by sending a shorter hash.

An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. An off-by-one error in the PASSERT assertion leads to daemon abort.

The react-native-receive-sharing-intent library contains a path traversal vulnerability that allows a malicious app to write files outside the intended cache directory by supplying a crafted _display_name value with dot-dot path components. Attackers can send an ACTION_SEND intent to the exported share-receiver activity to overwrite arbitrary files in the app's private data directory, including databases, shared preferences, and cached configuration.

A vulnerability in fast-mcp-telegram before version 0.19.1 allows a remote HTTP client to bypass authentication by manipulating the Bearer token with path separators. A token like '../fast-mcp-telegram/telegram' grants access to the default legacy session, bypassing the reserved session name control.

A vulnerability in the UTT nv518G router with firmware version nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_445C5C component.

A buffer overflow vulnerability in the UTT nv518G router (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_444C8C component.

A buffer overflow vulnerability in UTT nv518G device (firmware version nv518GV3v3.2.7-210919-161313) allows a remote attacker to cause a denial of service (DoS) via the gohead/sub_487330 component.

A buffer overflow vulnerability has been discovered in the UTT nv518G device running firmware version nv518GV3v3.2.7-210919-161313. A remote attacker can exploit the gohead//sub_497498 component to cause a denial of service (DoS).

Notepad3 up to version 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibrary(L"MSFTEDIT.DLL") with a bare DLL name, allowing a local attacker to place a malicious MSFTEDIT.DLL in the application directory or another preferred DLL search location and achieve arbitrary code execution in the context of the user when the About dialog is opened.

An out-of-bounds read issue was found in the GCS_MAVLink library of ArduPilot up to version Plane-4.6.3, specifically in the GCS_MAVLINK::handle_serial_control() function. This vulnerability may lead to unexpected behavior or data leakage.

A denial-of-service vulnerability in pdfcpu up to version 0.11.1 is caused by uncontrolled recursion in the PDF parser. Functions ParseObjectContext() and parseArray() in parse.go recursively process nested PDF objects without enforcing a maximum nesting depth, potentially leading to stack overflow.

CVE-2026-38969 record has been withdrawn by its CNA and should not be used. Further investigation showed it was not a security issue.

A vulnerability in ntopng up to version 6.6 allows predictable session identifiers, leading to session hijacking. HTTP session IDs are generated using weak time-seeded pseudo-randomness, making them deterministic or collision-prone.

Forgejo before version 15.0.3 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by setting a full name containing an HTML payload and triggering an Actions run. When the DEFAULT_SHOW_FULL_NAME option is enabled, the run description is assembled server-side with the user's display name interpolated into an HTML string via a translation function that does not escape its arguments, and the frontend renders the result using a Vue v-html binding, causing script execution for any user who views the affected Actions run page.

AutoBangumi before version 3.2.8 contains a server-side request forgery (SSRF) vulnerability that allows unauthenticated remote attackers to probe internal network services by supplying arbitrary host values to an unprotected setup endpoint. Attackers can send requests to the POST /api/v1/setup/test-downloader endpoint during the initial setup window, causing the server to issue HTTP GET requests to internal or reserved addresses and leak information through echoed connection-error messages.