CVE Vulnerability Catalog

A denial-of-service vulnerability exists in the PDF Viewer component. The vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

An uninitialized memory vulnerability in the Audio/Video: cubeb component of Firefox and Thunderbird. The issue was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the file /cgi-bin/mainfunction.cgi of the Apmupload component allows path traversal via manipulation of the action argument. The attack can be carried out remotely, and the exploit has been made public. Upgrading to version 1.5.1.7 resolves the issue.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the uploadlangs function in /cgi-bin/mainfunction.cgi of the Upload Endpoint component allows command injection. The attack can be executed remotely and the exploit has been publicly disclosed and may be used.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the sub_182B0 function in /cgi-bin/mainfunction.cgi of the CGI Interface component allows OS command injection via manipulation of the usefile/usescript/option argument. Remote exploitation is possible and the exploit has been published and may be used.

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire record-encryption trust model.

A reflected cross-site scripting (XSS) vulnerability due to improper neutralization of input during web page generation was found in the Ticimax E-Commerce Platform. The issue affects versions through 2026-09-02.

In the embedded co-browsing feature in Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 (on-premises and cloud), an unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session, via content rendered as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a session with the attacker; mobile co-apping is not affected.

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability. When ALLOW_EXTERNAL_IMAGE_SOURCES is enabled, an attacker can send a crafted email with malicious alt text or URL values in an external image tag, leading to arbitrary JavaScript execution in the victim's session.

A flaw was found in cockpit-machines where the VNC console password is passed directly as a command-line argument to a system utility. A local unprivileged attacker on a host allowing cross-user process inspection could read the exposed password from the process list.

A flaw was found in cockpit-machines where RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval. A local unprivileged attacker on a system permitting cross-user process inspection can view these arguments.

In DrayTek Vigor2960 1.5.1.6 Revision 8218, the set_table function in /cgi-bin/mainfunction.cgi of the CGI Process component allows command injection via manipulation of the sectiontype argument. The attack may be launched remotely and the exploit is now public and may be used.

A vulnerability was found in opensource-socialnetwork up to 9.11/10.1 affecting the input function in actions/administrator/cache/dynamic.php (Cache Settings component). Manipulation of host/port/username/password/type/status arguments leads to code injection, remotely exploitable, with a public exploit available. The patch is named 40945057cb451f0f35153110bc7e889c094400e1.

A vulnerability was found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android affecting the Class.forName function in ToggleGeneric.java. Manipulation of the Class argument leads to improper export of Android application components; local access is required. The exploit is public and version 9.0.90 addresses the issue.

Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint and without calling setDenyUncoveredHttpMethods(true). The servlet routes requests using Path.of(pathInfo).getFileName(), which strips leading segments and trailing slashes. Requests like POST /kafkacruisecontrol/x/rebalance bypass authentication but still dispatch to admin endpoints. All 15 admin endpoints become reachable without authentication. In AMQ Streams, the Strimzi operator's NetworkPolicy restricts Cruise Control port 9090 to operator pods only, reducing effective severity to Important.

A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container image. The operator deploys this image into a pod whose ServiceAccount is bound via ClusterRoleBinding to a ClusterRole granting cluster-wide get/list/watch on all Strimzi CRDs (including KafkaUsers), patch on Kafkas/KafkaRebalances, and cluster-monitoring-view. The attacker's code reads the projected SA token and gains cross-tenant Strimzi control-plane read+write access.

The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set spec.kafkaClusters[].credentials.kafkaUser.namespace to any namespace. The operator, running with cluster-wide Secrets RBAC, reads the victim-namespace KafkaUser Secret (SASL credentials or TLS private keys) and writes the plaintext material into a Secret in the attacker's namespace. No same-namespace check or allowlist exists anywhere in the code path.

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments. An authenticated remote attacker can read and change configuration properties of entities they aren't authorized to access, including other users, accounts, and in Unblu Cloud other customers' accounts.

A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipulation of the argument state can lead to open redirect. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.