CVE Vulnerability Catalog

A vulnerability has been found in luben zstd-jni up to 1.5.7-13. It affects the ZstdCompressCtx.loadDict function in ZstdCompressCtx.java of the Dictionary Sharing component. The manipulation leads to use after free. The attack can be executed remotely. Upgrading to version 1.5.7-14 resolves the issue.

Insufficient session expiration vulnerability in bizwell xClick allows authentication bypass. This issue affects xClick versions R2, R3, and R3.1.

Weights & Biases wandb before 0.29.0 fails to validate file names from server responses in the File.download function, allowing path traversal attacks. Attackers controlling the backend can supply file names with directory traversal sequences to write files outside the intended download directory, potentially enabling code execution through modification of shell startup files or Python import paths.

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. It affects an unknown functionality in the /College/login.php file. Manipulation of the User argument leads to SQL injection. The attack may be initiated remotely, and the exploit has been publicly disclosed.

GNU libextractor before 1.15 contains a stack-based buffer overflow vulnerability in the process_star_office function that sizes a variable-length stack array from attacker-controlled OLE2 stream data. Attackers can craft malicious StarOffice documents that allocate up to 4 MB on the stack, causing stack overflow and crashing any application extracting metadata from the document.

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new_id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directory and manipulate arbitrary files and directories on the filesystem.

A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1. It affects an unknown function in the /dets/forgot-password.php file. Manipulation of the email/contactno argument leads to SQL injection. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. It affects unknown code in the file /dets/index.php of the Login component. Manipulation of the email argument results in SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A vulnerability was detected in SabyasachiRana WebMap up to version 8b95fe4dc301a3c09ddf145b895de0bf9f8d2a25. It affects the nmap_newscan function in functions_nmap.py of the New Nmap Scan Handler component. Manipulation of target/params arguments leads to OS command injection. The attack can be launched remotely, and the exploit is public. A patch is available (3d52f65803a2716bff14d938352c6fef45b0cfb6).

A vulnerability was detected in PHPGurukul Blood Donor Management System 1.0. It affects an unknown functionality in the file /application/controllers/admin/Report.php of the Report Endpoint component. Manipulation of fromdate/todate arguments results in SQL injection. The attack can be launched remotely, and the exploit is public.

A vulnerability was detected in PHPGurukul Blood Donor Management System 1.0. It affects the __construct function in /application/controllers/admin/Dashboard.php of the Admin Controllers component. The manipulation leads to improper authentication. The attack can be initiated remotely, and the exploit is public.

DevSpace through 6.3.21 fails to reject parent-directory segments in tar entry names from the in-pod sync stream. Attackers operating a malicious container can stream tar entries with traversal sequences to write arbitrary files on the developer workstation, enabling code execution.

Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression filtering. Attackers can inject expressions beginning with #{ that are stored and later evaluated in the full Spring context when a mail task uses variable-backed body fields, enabling method invocation on application beans.

ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holding a share link can supply arbitrary file paths as query parameters to download any file under the shared base directory, bypassing the intended access restrictions.

goproxy through 15.3 fails to apply HTTP proxy basic authentication to CONNECT tunnel requests, allowing unauthenticated clients to bypass credential requirements. Attackers can issue CONNECT requests to establish tunnels through the authenticated proxy without providing credentials, enabling arbitrary TCP traffic relay and access to restricted destinations.

IBM Business Automation Workflow containers and traditional is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c allows a remote, unauthenticated attacker holding a valid Stripe Checkout Session id (cs_...) to retrieve the full session object, including the buyer's name, email, phone, billing address, amount paid and internal userId, because the GET handler calls stripe.checkout.sessions.retrieve() and returns the result without checking for an authenticated session or session ownership. The session_id is exposed in the buyer's own browser URL after payment (success_url = /result?session_id={CHECKOUT_SESSION_ID}), so it leaks through Referer headers, analytics tools, server access logs and shared-machine browser history, resulting in disclosure of the buyer's personal data to an unauthenticated actor.

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to gain root privileges.

A privacy issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, watchOS 27. An app may be able to track users across apps and websites without permission.