CVE Vulnerability Catalog

The gf_dm_get_chunk_data function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.

The stbsp_vsnprintf function in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via crafted input, causing a denial of service.

The stbtt_GetGlyphShape component in nothings stb (commit 31c1ad3) has an out-of-bounds read that can be exploited via a crafted TTF file, causing a denial of service.

The gf_dm_data_received function in GPAC version 26.07.0 has an out-of-bounds read that can be exploited via a crafted HTTP request, causing a denial of service. The vulnerability is fixed in a specific commit.

The gf_dash_get_timeline_duration function in GPAC version 26.07.0 has a divide-by-zero vulnerability that can be exploited via a crafted MPD SegmentTimeline, causing a denial of service. The vulnerability is fixed in a specific commit.

SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via crafted parameters to the User/mod interface, enabling account takeover.

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. When processing returns, the backend fails to filter or escape the goodsName parameter, directly concatenating it into the order log description; the frontend subsequently renders this content using v-html. An attacker with product creation privileges can inject a malicious JavaScript payload, causing unauthorized code execution when an administrator views the order logs.

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. Although the announcement content undergoes HTML escaping on the server side, the client-side preview code reverses the escaped entities using jQuery's `html().text()` method and subsequently injects the result into the DOM. An administrator or attacker capable of controlling the announcement content can exploit this vulnerability to execute arbitrary JavaScript code in the browsers of users viewing the affected pages, which may include the dashboard, activity feed, or login page, depending on the announcement's visibility settings.

The rattler_cache (before 0.9.0) and py-rattler (before 0.24.0) libraries are vulnerable to package-cache path traversal when handling package metadata from conda channels. A malicious channel can publish repodata with path separators in the build field, causing files to be written outside the cache directory.

The web-based management interface in CPPM guest account management services contains a vulnerability that allows an unauthenticated remote attacker to manipulate account settings. Successful exploitation could allow an attacker to extend network access beyond policy limits.

The ClearPass OnGuard agent contains a vulnerability that allows an authenticated remote attacker to elevate their own privileges on a vulnerable deployment. Successful exploitation could allow an attacker to obtain root privileges.

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object(). Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab.

In Cyrus IMAP before 3.12.4, there is a double-free vulnerability in the VPATCH BYPARAM mechanism. An authenticated calendar user can crash a CalDAV worker by sending a PATCH request with PATCH-ACTION="BYPARAM@..." against a resource with two or more properties of the matched kind. The memory holding the selector is freed multiple times during iteration over properties.

In Cyrus IMAP before 3.12.4, there is a Sieve mailbox existence oracle. An authenticated user can install a Sieve script that probes whether another user's private mailbox exists, or reads the value of shared mailbox annotations, by observing which fileinto branch fires during LMTP delivery.

A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial of Service (DoS) via sending a series of crafted RTSP and HTTP requests to the server.

In Cyrus IMAP before 3.12.4, JMAP snooze bypasses the destination-mailbox ACL. An authenticated user with insert permissions on another user's snoozed mailbox could cause insertion of mail to that user's inbox, or any other of their mailboxes whose id was known to the user, despite having no insert permissions to the target mailbox.

In WIngs3D v.2.4.1, there is an issue that allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file.

In the Thesycon DPC Latency Checker driver (dpc.sys) through 1.4.0, there is a vulnerability that allows local unprivileged users to cause a denial-of-service (BSOD) on Windows systems. The driver exposes an IOCTL interface (0x81772008) that accepts user-controlled input without validating pointers before passing them to kernel APIs. Specifically, it dereferences a user-supplied pointer and uses the resulting value in a call to ExSetTimerResolution, leading to arbitrary kernel memory access and system crash.

MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when accessed, enabling persistent stored XSS attacks.

The cupsUTF32ToUTF8() function in CUPS (cups/transcode.c) lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.