CVE Vulnerability Catalog

UI misrepresentation in Omnibox in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. Chromium security severity: Low.

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page.

The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace a directory with a symbolic link, causing files outside of the temporary directory to be deleted or have their permissions and file flags reset, with the privileges of the process performing the cleanup. Note that platforms where shutil.rmtree.avoids_symlink_attacks is false, remain affected, and file flags may still be reset outside of the tree on all platforms.

PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the write chunk size parameter. Attackers with shell access can supply an excessively large value to the -c option to trigger stack overflow and crash the flight controller.

PX4 Autopilot through 1.17.0 contains a NULL pointer dereference vulnerability in the sd_stress command where the -b byte count parameter is parsed without validation before being passed to malloc() and memset(). Attackers with shell access, including through MAVLink, can supply invalid byte count values to crash the flight controller.

OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to execute MCP App tools requiring operator.write scope. Attackers with operator.read tokens can obtain a standalone ticket from mcp.app.view and redeem it at the MCP app view endpoint to invoke state-changing tools without proper authorization checks.

OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesystem isolation between sandboxed sessions. Sandboxed sessions or untrusted content can cause the Gateway to read files from sibling session sandboxes or shared workspace directories through media pipeline functions that fail to restrict reads to the active session.

NetX Secure TLS accepts an empty application-data record without verifying its message authentication code. In `_nx_secure_verify_mac`, a decrypted application record whose length equals the negotiated MAC size is treated as valid and returns success after advancing the receive sequence number. The received MAC is never generated or compared. Empty TLS application-data records are legal, and are commonly emitted by TLS 1.0 implementations as a BEAST mitigation.

`gx_binres_theme_load()` sizes its theme buffer for the theme it was asked for, and allocates it even when the resource holds no theme with that id. A theme id at or past the theme count declared by the resource gets a buffer of zero bytes. The load pass then walks past the end of the theme table, takes whatever follows as a theme header, and writes a `GX_THEME` and its tables into that zero-byte buffer.

In the FTP server of Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the first connection to a passive data port is accepted without verifying it comes from the client that requested passive mode. An unauthenticated network attacker connecting first to the predictable port receives the file an authenticated user downloads or supplies the content of the file the user uploads.

In the Eclipse ThreadX NetX Duo FTP client (versions 6.0 through 6.5.2.202603a) in IPv4 passive mode, the data connection is opened to whatever address the server names in its 227 reply instead of the server it is talking to. A malicious FTP server can make the client connect to any host and port the device can reach, using it to scan the internal network and deliver uploads to internal services.

In the Eclipse ThreadX NetX Duo TFTP client (versions 6.0 through 6.5.2.202603a), the copy of a received ERROR packet message is not bounded by the end of the datagram, and the TFTP server reads one byte past a minimal ERROR packet. A malicious TFTP server can make the client copy up to 64 bytes of adjacent packet-pool memory into the error string or fault on targets with memory protection.

In the Eclipse ThreadX NetX Duo DHCP client (versions 6.0 through 6.5.2.202603a), the option walk advances its offset one byte less than its read pointer for every option it skips. A DHCP server, or any host on the link that answers first, can make the client read up to about a kilobyte past the received message, and the same walk copies out-of-bounds bytes into the application's buffer when it retrieves a user option.

In the Eclipse ThreadX NetX Secure DTLS server (versions 6.0 through 6.5.2.202603a), HelloVerifyRequest cookies are filled from NX_RAND(), by default the C library rand(), with no key and no binding to the client. An attacker who can predict the generator's output can pass the cookie exchange from a spoofed address and make the server send its handshake flight to a victim, using it as a traffic reflector.

In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603 with DTLS server support, the NetX Secure DTLS server's ClientHello parser reads the session ID, cookie, and ciphersuite list without bounding them by the remaining message bytes. An unauthenticated peer can send a ClientHello declaring fields longer than the message, causing an out-of-bounds read; nothing read is sent back, and the read can fault the server only on targets that trap addresses beyond the buffer.

In the Eclipse ThreadX Module Manager (versions 6.0.1 through 6.5.2.202603), loaders take a module image without its length and trust the sizes and offsets in its preamble. A crafted module image can declare a code size larger than the image to read, or gain access to, the memory that follows it, and can place its entry points outside its code.

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic. An unprivileged database user can supply a crafted WKB payload with a negative length field, causing the PostgreSQL backend process to crash.

Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter. The cleanAttribute method removes HTML data URIs, but injected whitespace characters can circumvent that cleanup, causing an XSS vector.

Joomla! Core versions 1.5.0-5.4.8 and 6.0.0-6.1.3 have an XSS filter bypass in InputFilter due to an HTML5 entity decode mismatch. The checkAttribute method normalizes an attribute value before testing it against the "javascript:" scheme regex, but without decoding HTML5 entities beforehand, causing an XSS vector.

Joomla! Core versions 4.0.0-5.4.8 and 6.0.0-6.1.3 have improper ACL checks for various webservice edit tasks. An improper access check allows unauthorized users to perform edit actions on otherwise uneditable items.