CVE Vulnerability Catalog

In Golioth Firmware SDK versions 0.10.0 through 0.22.0 (before commit 48f521b), a stack-based buffer overflow exists in Payload Utils. The golioth_payload_as_int() and golioth_payload_as_float() helpers copy network-supplied payload data into fixed-size stack buffers using memcpy() with a length derived from payload_size, with length checks only guarded by assert() which are compiled out in release builds. Payloads larger than 12 bytes (int) or 32 bytes (float) can overflow the stack, causing a crash/denial of service.

A TOCTOU vulnerability allows recently deleted-then-recreated data sources to be re-deleted without proper permissions.

Erlang/OTP has a relative path traversal vulnerability in the tftp_file modules, allowing access to files outside the intended directory. This affects OTP versions from 17.0 before 28.3.2, 27.3.4.8, and 26.2.5.17.

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., "^(a|a)*$") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation. This issue is also fixed in version 6.14.0.

A flaw in NetworkManager allows non-root users to access files owned by other users when configuring the network. The daemon runs with root privileges and can read files belonging to users other than the one who added the connection.

W libexpat przed wersją 2.7.4 funkcja XML_ExternalEntityParserCreate nie kopiuje danych użytkownika dla nieznanych obsługiwaczy kodowania. Może to prowadzić do nieprawidłowego przetwarzania danych XML.

A flaw was found in the libxml2 library where uncontrolled resource consumption occurs when processing XML catalogs with repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing redundant traversal of catalog chains.

A flaw was found in the RelaxNG parser of libxml2 related to handling external schema inclusions. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives, which can cause excessive recursion. Specially crafted schemas may lead to stack exhaustion and application crashes.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

A vulnerability was found in LigeroSmart up to 6.1.24 in the Environment Variable Handler component, where manipulation of the REQUEST_URI argument results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 or 6.3 mitigates this issue.

Podatność CVE-2025-13127 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w systemie GoldenHorn firmy TAC Information Services. Umożliwia to ataki typu Cross-Site Scripting (XSS).

A vulnerability was determined in motogadget mo.lock Ignition Lock up to 20251125. This affects an unknown functionality of the NFC Handler component. Manipulation can lead to the use of a hard-coded cryptographic key. The attack requires physical access to the device and is difficult to exploit.

W bibliotece libexpat do wersji 2.7.3, specjalnie przygotowany plik o przybliżonym rozmiarze 2 MiB może powodować znaczne opóźnienia w czasie przetwarzania, trwające nawet kilkanaście sekund.

An Improper Privilege Management vulnerability in Fortinet FortiOS and FortiPAM allows an authenticated administrator to bypass the trusted host policy via crafted CLI command.

In PyTorch versions 2.5 and 2.7.1, omitting profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

CVE-2025-58903 in Fortinet FortiOS versions 7.6.0 through 7.6.3 and before 7.4.8 has an Unchecked Return Value vulnerability that allows an authenticated user to cause a Null Pointer Dereference, crashing the http daemon via a specially crafted request.

A CWE-601 URL Redirection to Untrusted Site vulnerability in Fortinet FortiOS, FortiProxy, and FortiSASE allows an unauthenticated attacker to perform an open redirect attack via crafted HTTP requests. The issue affects multiple versions including FortiOS 7.6.0-7.6.3, 7.4.0-7.4.8, 7.0.x, 7.2.x, 6.4.x, FortiProxy 7.6.0-7.6.3, 7.4.x, 7.2.x, 7.0.x, and FortiSASE 25.2.a.

There is a vulnerability in Fortinet FortiOS and FortiProxy that allows for the insertion of sensitive information into log files. This affects FortiOS versions from 7.6.0 to 7.6.3 and all versions of 7.4, 7.2, 7.0, and 6.4, as well as FortiProxy from 7.6.0 to 7.6.3 and versions 7.4.0 to 7.4.13.

A flaw was found in the exsltFuncResultComp() function of libxslt, which handles EXSLT <func:result> elements during stylesheet parsing. Due to improper type handling, the function may treat an XML document node as a regular XML element node, resulting in a type confusion. This can cause unexpected memory reads and potential crashes.