CVE Vulnerability Catalog

An authorization issue in iOS and iPadOS allows an app to read the device's name. The issue was addressed with improved state management and is fixed in iOS 26.7.2, iPadOS 26.7.2, iOS 27.2, and iPadOS 27.2.

Infinite loop in Xpdf 4.06 and earlier, due to incorrect validation of progression order field in JPEG 2000 image.

Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.

A privacy issue was addressed by moving sensitive data to a protected location. The issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, and iOS 27.2 and iPadOS 27.2. An app may be able to identify what other apps a user has installed.

In Asterisk prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unauthenticated attacker may use reflected cross-site scripting in phone provisioning HTTP error pages to retrieve an authorized user's AMI session cookie and impersonate that user when res_phoneprov is enabled. The Asterisk HTTP server, AMI, and AMI access via HTTP must all be enabled (disabled by default), and the attacker must convince the user to click a malicious link.

A vulnerability was found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578 in an unknown function of patientregistration.php. Manipulating the pat_name argument leads to cross-site scripting. The attack can be launched remotely, the exploit has been disclosed publicly and may be used; the project has not responded.

Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a known good TA certificate even if validation fails.

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit_profile of the component Profile. The manipulation of the argument first_name/last_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the OpenAI-compatible server configures Starlette CORSMiddleware with allowed_origins set to a wildcard by default. A malicious web page can use a victim's browser to reach an unauthenticated vLLM server on localhost, an internal network, or a VPN, call endpoints including GET /v1/models and POST /v1/chat/completions, consume GPU resources, and read responses. This issue is fixed in version 0.32.0.

The Photo Reviews for WooCommerce plugin (up to version 1.2.31) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to exploit race conditions for unauthorized actions.

The Espressif AES driver (crypto_esp32_aes.c) advertises a multi-session cipher API, but the AES hardware has a single chip-global set of key and mode registers. The key is programmed only once at session start, outside the mutex, so subsequent operations may run with another session's key, causing data to be encrypted or decrypted under the wrong key without any error being reported.

The vulnerability affects the IPv6 stack in Zephyr RTOS, where the key used to generate stable (RFC 7217) and temporary (RFC 8981) interface identifiers was derived using sys_rand_get(), which is not cryptographically secure. As a result, an observer of network traffic can recover the generator state and reconstruct the key, allowing prediction of the device's IPv6 addresses and tracking across networks.

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API. Mattermost Advisory ID: MMSA-2026-00734.

Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.

Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery endpoint request. This allows a System Administrator to determine whether internal addresses and ports are reachable from the server via an unauthenticated login request that triggers the discovery fetch.

Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and publication paths. This allows an authenticated channel member to publish messages rendering as trusted system events via the scheduled post endpoint.

boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not enforce password complexity. An unauthenticated remote attacker can make unlimited brute-force login attempts, potentially compromising user accounts and gaining unauthorized access to the device.

In Kameleo up to 5.0.1.26, the ListProfiles function in client-engine-application/t.cs of the Profile Controller component leads to information disclosure. The attack can only be performed from a local environment. Upgrading to version 5.2.0 addresses the issue.

MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated members to redeem one recharge card multiple times via the user/buy endpoint. Attackers can send many concurrent flag=card requests that pass the non-locking card read before it is marked used, inflating user_points to buy VIP upgrades and paid content.

In hackney (benoitc) from 2.0.0 before 4.9.0, improper neutralization of CRLF sequences in HTTP headers (HTTP Request/Response Splitting) exists in hackney_http_connect. After a 407 response from an HTTP CONNECT proxy, handle_proxy_auth/11 calls the caller's proxy_auth_fun and writes the returned binary into the Proxy-Authorization line of the CONNECT retry without checking it; a CR, LF, or NUL byte in that value adds header lines to the request sent to the proxy.