CVE Vulnerability Catalog

The fix for CVE-2024-45337 regarding bypass of source address validation in SSH configurations is considered incomplete. If a callback type other than public key is used, source address validation may be skipped.

Vulnerability in the revocation mechanism of 'SignatureKey' belonging to a CA. Previously, a revoked key was not correctly checked; now both 'key' and 'key.SignatureKey' are verified for revocation.

When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused an infinite loop sending empty packets. The fix uses int64 for size comparison to prevent truncation.

The in-memory NewKeyring() function silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without confirmation, with no indication to the caller. NewKeyring() now returns an error when unsupported constraints are requested.

When adding a key to a remote agent, constraint extensions such as [email protected] were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host.

Vulnerability in the Verify() method for FIDO/U2F security keys ([email protected], [email protected]) – the User Presence flag was not checked. Signatures generated without physical touch were accepted, allowing unauthorized use of the key.

In an SSH library (likely Go), a malicious SSH peer can send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine cannot be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.

A cross-site scripting (XSS) vulnerability in SketchUp 2026's Dynamic Components feature allows remote code execution and local file exfiltration through maliciously crafted SKP files. The vulnerability stems from improper input sanitization in the component options window, enabling attackers to execute arbitrary system commands and read local files without user interaction by exploiting an embedded Internet Explorer 11 browser.

A malicious actor with network access and high privileges can exploit an Improper Input Validation vulnerability in UniFi OS devices to execute a Command Injection.

An arbitrary file upload vulnerability in the BookingPress Pro plugin for WordPress up to version 5.6. Missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function allows unauthenticated attackers to upload arbitrary files to the server.

Apache Fory PyFory before version 1.0.0 has a deserialization vulnerability in ReduceSerializer that can bypass DeserializationPolicy validation hooks during reduce-state restoration and global-name resolution. An application is vulnerable if it deserializes attacker-controlled data in Python-native mode with strict mode disabled.

The WP Directory Kit plugin for WordPress up to version 1.5.0 is vulnerable to blind SQL injection. An attacker can send malicious SQL queries through improperly sanitized input parameters.

A vulnerability in the Trend Micro Apex One management console (similar to CVE-2025-71210 but affecting a different executable) allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.

A vulnerability in the Trend Micro Apex One management console allows a remote attacker to upload malicious code and execute commands. Requires access to the management console. SaaS versions are already patched.

The Divi Form Builder plugin for WordPress up to version 5.1.2 allows privilege escalation. It accepts a user-controlled 'role' parameter from POST data during registration without validating it against the form's default_user_role setting, enabling unauthenticated attackers to create administrator accounts.

In the Linux kernel, a vulnerability exists in handling the IPv6 Source Routing Header (SRH). During decompression and recompression of SRH, if the recompressed header is larger than the received one, an out-of-bounds write can occur in ipv6_rthdr_rcv. The issue arises when headroom is insufficient, leading to memory corruption.

The Honeywell Control Network Module (CNM) contains a command injection vulnerability in the web interface, exploitable by an attacker via command delimiters, potentially leading to remote code execution (RCE).