CVE Vulnerability Catalog

A flaw was found in Nothings stb up to version 1.16 affecting the stbi_write_png_to_mem, stbi_write_jpg_core, and stbi_write_tga_core functions (stb_image_write.h) in the Image Encoding component. Manipulation leads to an integer overflow. The attack can be executed remotely, and the exploit is publicly available.

A vulnerability was detected in Nothings stb up to version 2c980bb59875b0d32144a71867fbdebb2f77cd20 affecting the hexwave_init function (stb_hexwave.h). Manipulation of the width/oversample arguments results in an integer overflow. Remote exploitation is possible, and the exploit is now public.

An improper authorization vulnerability in WatchGuard Fireware OS's SAML login process allows a remote, authenticated SAML user with access only to the Access Portal to obtain unauthorized Mobile VPN with SSL access through a specially crafted request.

An uncontrolled resource consumption vulnerability in Fireware OS's diagnostic tasks feature allows a low-privileged, authenticated user to cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI.

A path traversal vulnerability in the Fireware OS WebUI management agent allows an authenticated administrator to read or list arbitrary files on the local filesystem by sending a specially crafted management request.

The CentralNotice extension for MediaWiki contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

The MassMessage extension for MediaWiki contains a stored XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

The Cargo extension for MediaWiki contains a reflected XSS vulnerability due to improper neutralization of input during web page generation. This issue affects versions before 1.46.1.

The Collection extension for MediaWiki contains an open redirect vulnerability that allows faking the source of data. This issue affects versions before 1.46.1, 1.45.5, and 1.43.10.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - CentralAuth extension allows Stored XSS. This issue affects Mediawiki - CentralAuth extension: before 1.46.1, 1.45.5, 1.43.10.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Wikimedia Foundation MediaWiki - WikiLambda extension allows Stored XSS. This issue affects MediaWiki - WikiLambda extension: before 1.46.1.

Stored XSS vulnerability in the Refreshed skin of MediaWiki due to improper input neutralization during web page generation. Affects versions before 1.46.1, 1.45.5, and 1.43.10.

U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size against partition bounds. An attacker with physical access can supply crafted boot media with oversized headers to write past the load buffer into bootloader memory on devices without Android Verified Boot protection.

U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() when allocating the directory table buffer. An attacker can supply a crafted SquashFS image with an attacker-controlled superblock metablks_count value that causes heap buffer under-allocation and out-of-bounds writes, corrupting heap memory and crashing the bootloader.

U-Boot through 2026.10-rc5 contains an out-of-bounds write vulnerability in the video_display_rle8_bitmap function in drivers/video/video_bmp.c. An attacker can supply a crafted RLE8-compressed BMP image to corrupt memory adjacent to the framebuffer and crash the bootloader.

A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. The function MailController::templatePut in cmf-api/src/admin/controller/MailController.php of the Email Template component is affected. The manipulation leads to improper neutralization of special elements used in a template engine. The attack can be carried out remotely, and the exploit has been publicly disclosed.

An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission, through the library elements API or the equivalent App Platform resource. The update path did not check library panel create permission on the destination folder (incorrect authorization). No data from the destination folder is disclosed, and existing content there cannot be changed.

Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's data sources, including stored credentials for data sources using browser access (missing authorization). Deleting the shared dashboard does revoke the token.

virtualenv is a tool for creating isolated virtual Python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg._read_values() parses the file with str.splitlines() and accepts the last value for duplicate keys. An attacker who influences --prompt, VIRTUALENV_PROMPT, or configuration input can insert a recognized line boundary and additional keys, including home, causing consumers to use an attacker-selected base interpreter or corrupted environment metadata.

JupyterLab is an extensible environment for interactive and reproducible computing. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installation but passes uninstall names to PyPIExtensionManager.uninstall and python -m pip uninstall without rejecting option-like values. An authenticated user with extension API access can supply a pip requirements option to make the server read a local file or fetch an internal URL, and reflected parse errors can return the first unparsable line or response content.