CVE Vulnerability Catalog

A use-after-free issue in the web content processing component was addressed with improved memory management. The flaw affects Safari, iOS, iPadOS, macOS Tahoe, tvOS, visionOS, and watchOS. Processing maliciously crafted web content may lead to an unexpected process termination.

An out-of-bounds access vulnerability in Safari was addressed with improved bounds checking. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved input validation. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.

The issue was addressed with improved checks. It is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, and visionOS 27. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A vulnerability in Safari was addressed with improved checks. Visiting a maliciously crafted website may leak sensitive data.

An information leakage was addressed with additional validation. This vulnerability affects Apple systems and may allow an app to leak sensitive kernel state.

A use-after-free vulnerability in Safari was addressed with improved memory management. Processing maliciously crafted web content may lead to an unexpected process crash.

Onyx is an open-source AI platform. Prior to 4.3.0, the Enterprise Edition lacks enforcement of curator permission validation in the PATCH /manage/admin/user-group/{user_group_id} and POST /manage/admin/user-group/{user_group_id}/add-users endpoints, allowing a curator to add accounts to arbitrary groups and gain document access. This is fixed in version 4.3.0.

Dokploy is a free, self-hostable PaaS. Prior to 0.29.6, the user update procedure does not delete other session rows after a password change, allowing a compromised session token to remain valid for up to three days. This is fixed in version 0.29.6.

A vulnerability in Safari was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected Safari crash.

A reachable assertion was addressed with improved input validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, visionOS 26.5, watchOS 26.5. An attacker in a privileged network position may be able to cause a denial-of-service.

The issue was addressed with improved memory handling. Processing maliciously crafted web content may lead to an unexpected Safari crash. The fix is included in Safari 26.5, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.5 and iPadOS 26.5, macOS Tahoe 26.5, tvOS 26.5, visionOS 26.5, and watchOS 26.5.

This vulnerability only affects Grafana stacks with multiple organizations. A user who is an Org Admin of one organization can call GET /api/access-control/users/permissions/search?actionPrefix=dashboards: and receive permission data from other organizations. Disclosed data is limited to dashboard/folder UIDs and permission mappings, not content or personal data.

Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, and 11.8.x <= 11.8.3 fail to validate WebSocket command field types, allowing an authenticated user to crash the plugin process and deny service to all Boards users via a custom_focalboard_SUBSCRIBE_TEAM message with a non-string teamId.

Pandora is affected by a stored XSS vulnerability in the PDF download functionality. The /task-download/<task_id>/.../pdf endpoint verifies the file is a PDF but returns it without explicit MIME type, allowing it to be served as HTML or another active format. A crafted PDF/polyglot can execute script in the Pandora application context.

OpenViking debug vector scroll and count endpoints apply only account-level scoping without user-level access controls, allowing authenticated users to read all co-tenant records. Attackers can retrieve private memories, resources, skills, and secret material of other users in the same account.

Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can retrieve asset information or trigger wake-on-LAN packets on unauthorized assets.

Hugging Face Transformers fails to validate shard filenames in checkpoint index files, allowing attackers to read arbitrary files outside the model directory. Malicious index files with parent-directory references or absolute paths can lead to file disclosure and filesystem reconnaissance.

vLLM prior to 0.26.0 in the MiMoV2OmniMultiModalProcessor passes attacker-controlled image and audio strings through _fetch_image, requests.get, and Image.open instead of MediaConnector, bypassing allowed_media_domains and allowed_local_media_path protections. This allows server-side requests and reads of arbitrary files accessible to the vLLM process.

hashcat master branch builds after v7.1.2 contain a heap buffer overflow vulnerability in the KeePass AESKDF/KDBX v4 module (module 34301). An oversized ninth hash field token can corrupt adjacent heap memory, potentially leading to heap corruption or memory access violations.