CVE Vulnerability Catalog

Bendix EC80 Brake ECU is vulnerable to an out-of-bounds write, which could allow an attacker to deliver a payload that could establish an arbitrary write primitive, which could crash the ECU.

Wazuh versions 4.14.0 through 4.14.6 allow an authenticated low-privilege user to read the cluster secret from the manager configuration. This occurs because the masking logic is disabled by any update-config RBAC rule, including an explicit deny.

Wazuh versions 4.0.0 through 4.14.6 are vulnerable to a crash during agent enrollment when a malicious enrollment manager returns a malformed key response with fewer than four fields, causing a NULL pointer dereference. Fixed in version 4.14.7.

A Division-by-Zero vulnerability in the ff_sws_init_single_context function (/libswscale/utils.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via a crafted input.

An integer overflow in the libavfilter/vf_scale.c component of FFmpeg (version N-122528-gdd2976b9e1) allows attackers to cause a Denial of Service (DoS) by supplying a crafted video file.

In SiSDK v2026.6.0 and earlier, high network traffic loads can cause a dropped ACK leading to a denial of service. This affects EFR32MG24 and EFR32MG26 devices running concurrent multiprotocol Zigbee and Thread.

An unrestricted upload of file with dangerous type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the application origin. The photo validation rule classifies the file only by its content (magic bytes) and rejects only a fixed list of PHP extensions, while ProductSaveController::save() names the stored file using the client-supplied extension and copies it into the public web root. A file that begins with an image header and carries an HTML extension passes validation, is stored under public/asset/upload/product/, and is served with a text/html content type, turning the upload into first-party stored script execution.

A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. To exploit this flaw, an application using gdk-pixbuf must process the malicious JPEG image. Affected version >= 2.26.4.

A weakness has been identified in RooCodeInc Roo-Code up to 3.51.1. Affected by this issue is the function ExecaTerminalProcess of the component README File Handler. Executing a manipulation can lead to code injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor no longer supports this project.

A security flaw has been discovered in RooCodeInc Roo-Code up to 3.51.1. Affected by this vulnerability is the function optimizeQuery of the file src/utils/helpers.ts of the component CodeIndexManager. Performing a manipulation results in code injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The vendor no longer supports this project.

Frappe 15.11.0 through 16.32.0 stores and renders workspace card descriptions without XSS filtering. The description field is marked with ignore_xss_filter, and _sanitize_content() skips such fields, so the value is stored as submitted. It is then interpolated into a Bootstrap popover with html: true, allowing a user with the Workspace Manager role to execute arbitrary markup in the sessions of other desk users.

Dolibarr before 23.0.4 authorizes REST API document deletion against the wrong permission. Documents::delete() calls dol_check_secure_access_document() with mode 'read' instead of 'write', allowing an authenticated user with only read permissions to permanently delete module documents.

A weakness in the client-side encryption configuration surface of the MongoDB C# Driver causes sensitive key-management credential material to be reproduced verbatim in the driver's human-readable diagnostic representation of client settings, instead of being masked as other secret fields are.

A MongoDB C# driver document-replacement code path omits the element-name/shape validation that equivalent write paths apply, so a value supplied as a replacement is forwarded to the server without neutralization of query-language special elements.

A NoSQL/expression injection weakness exists in the LINQ-to-aggregation query translation layer of the MongoDB C# Driver, in both aggregation expression and query filter translation. Special elements in application-supplied values are not properly escaped before the query is sent to the database.

The MongoDB Rust Driver does not neutralize special characters in a caller-supplied target identifier before embedding it in the request it sends to the server. An actor able to influence that identifier may cause write operations to be applied to an unintended target within the same deployment.

A weakness in the MongoDB C Driver allows special elements in caller-supplied database and collection name components to pass without sanitization when the driver composes the target namespace for an operation. An application incorporating untrusted input into these names can have operations directed at a resource other than intended.

A missing input-validation issue in MongoDB libmongocrypt's automatic-encryption context setup allows a caller-supplied database identifier to be accepted without sanitization. The resulting impact is limited to incorrect schema selection, which may lead to limited disclosure or modification of information handled by the application.

The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace. An application passing untrusted input as a database name could have the write directed at a database and collection other than intended.

A Reflected XSS vulnerability in the doggo library (versions from 0.1.0 before 0.14.8) arises from improper input neutralization. Doggo.normalize_value/2 returns date field values wrapped in {:safe, ...} without escaping, so the value reaches the value attribute of the <input> unchanged. An attacker can exploit this through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value.