CVE Vulnerability Catalog

An out-of-bounds read in macOS was addressed with improved bounds checking. The issue affects macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. An app may cause unexpected system termination or read kernel memory.

An integer overflow was addressed with improved input validation. The issue affects visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

A double free issue was addressed with improved memory management. The issue affects macOS Golden Gate 27.2, macOS Sequoia 15.8.2, and macOS Tahoe 26.7.2. A remote attacker may cause unexpected process termination.

In SecureConnector for Windows, when the 'Additional Appliance Connections' setting is enabled and the agent configuration file contains more than three trusted-server entries, some entries omit TLS certificate fingerprints. The agent can then accept and establish sessions with a malicious server to which an attacker redirects traffic.

The jose library exports password-encrypted private keys in PKCS#8 format using hardcoded PBES2 parameters: PBKDF2-HMAC-SHA256 with 2048 iterations and an 8-byte salt, neither of which can be overridden. These values are far below current guidance, enabling a cheap offline password-cracking attack to recover the private key. The issue affects versions from 1.10.0 before 1.11.13.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may cause a heap-use-after-free in PJSIP TCP/SDP handling by sending a SIP INVITE over a connection-oriented transport and disconnecting before Asterisk responds with 200 OK. The crash has so far only been reproduced when Asterisk is built with Address Sanitizer, which is not used in production systems.

Rembg prior to 2.0.82 passes attacker-controlled extras.sam_model into SAM filenames and GitHub download URLs without a pinned hash. An unauthenticated attacker can combine path traversal with URL fragment syntax to download malicious ONNX files beside a readable target file and disclose its contents in the returned PNG mask. The issue is fixed in version 2.0.82.

libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains an out-of-bounds read in iuup_rx_initialization() in src/gsm/iuup.c. This allows a remote attacker to obtain sensitive information.

libosmocore through 1.14.1 contains out-of-bounds reads in the GSM 04.80 supplementary-service component parsers in src/gsm/gsm0480.c. This allows a remote attacker to obtain sensitive information.

A vulnerability was detected in OctoPrint 1.0.0/1.1.0 in the Flask Secret Key Handler component, involving the use of a hard-coded cryptographic key. The attack may be performed remotely. The issue is fixed in version 1.11.1 (patch b4699825d6ab92d5451e5b1e3a06dfb81f86e777).

The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.

libosmocore through 1.14.1 contains out-of-bounds reads in the IPA CCM identity-tag parsers in src/gsm/ipa.c. This allows a remote attacker to obtain sensitive information.

osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker to cause a denial of service.

libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.c. This allows a remote attacker to cause a denial of service.

In Routinator, when parsing an AS range where the maximum value is smaller than the minimum value, Routinator will never reach the maximum and run out of memory.

Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as too long file names or folder names that overlap with existing file names.

When Routinator encounters a CRL with many entries, it may hang or run out of memory. If it encounters a CRL file with the wrong encoding, it may exit.

Routinator accepts and parses RRDP notification files with gaps in delta entries, potentially leading to missing data. If too many delta entries are encountered, it may run out of memory.

There is a denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote, unauthenticated attacker to supply crafted requests that may, under exceptional circumstances, consume all available worker threads and deny service to users.