CVE Vulnerability Catalog

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. The function filepath.Join of the file server/api/worker/download_cache.go in the Cache Endpoint component is affected. Manipulation of the argument File leads to path traversal. The attack can be launched remotely and the exploit is public.

A weakness has been identified in Appwrite up to 2.3.0. The function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php in the Browser Screenshot Service component is affected. Manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 resolves the issue.

This CVE has been rejected or withdrawn by its CVE Numbering Authority. No further information.

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows buffer overflow via environment variables. Affects version e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. The Markdown Rendering component, file Markdown.tsx, is affected. The manipulation results in denial of service. The attack can be launched remotely and the exploit is public.

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. Affects versions before 11.2.

A vulnerability was identified in zhayujie CowAgent up to 2.2.0 in the json.loads function of the Streaming Tool-Call Argument Handler. Manipulation leads to resource allocation issues. The attack can be initiated remotely and the exploit is publicly available.

Interuse i-Bos version 3.0 has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to manipulate database queries.

A vulnerability in the Zephyr Bluetooth LE stack allows a remote, unauthenticated attacker to trigger a use-after-free in L2CAP CoC channel handling with dynamic PSMs. By sending a data frame followed by a disconnect request, the attacker can cause the system workqueue to process work referencing a freed channel, leading to memory corruption or workqueue corruption.

The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.

A vulnerability in the Bluetooth Link Layer control procedure code (ull_llcp_conn_upd.c) causes a retained RX node not to be released when the Connection Update / Connection Parameter procedure takes the 'invalid PDU, terminate the connection' path. This results in a leak of a node from the controller's RX pool. The issue is remotely triggerable by a peer device in radio range without pairing, bonding, or encryption.

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation leaks a retained RX node (ctx->node_ref.rx). When the invalid PDU paths in ull_llcp_cc.c terminate the connection without releasing that retained node, the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() is broken. A peer device within radio range can trigger this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link.

Vulnerability in the I2S driver for Espressif (ESP32) chips in Zephyr OS. The i2s_esp32_trigger_check() function does not validate stream pointers for RX/TX directions, leading to NULL dereference when only one direction is configured. An unprivileged user-mode thread can call i2s_trigger() with an unsupported direction and cause a kernel panic (denial of service).

The NXP MCUX TRNG entropy driver in Zephyr (drivers/entropy/entropy_mcux_trng.c) passes the caller's byte count directly to the SDK routine TRNG_GetRandomData(), which on i.MX RT5xx/RT6xx parts always copies whole 32-bit words and rounds entropy draws up to a multiple of 128 bytes. A request length not a multiple of four causes an underflow in the SDK's buffer-full check, leading to an overflow of up to 127 bytes past the caller's buffer.

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus an uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure, a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.

A vulnerability in Zephyr's syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() allocates variable-length arrays on the kernel stack sized directly by an unvalidated caller-supplied len argument. Because no bounds check occurs before allocation and copying, a user-mode thread (with CONFIG_USERSPACE) can trigger an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content.

An out-of-bounds read vulnerability was found in the IPv6 subsystem of the Zephyr stack in net_route_ipv6_packet(). The issue stems from missing validation of whether a neighbor cache entry has a link-layer address before using it. An attacker on the same link can force an unresolved neighbor state and trigger an out-of-bounds read past the address array, potentially causing a system panic or data leak.

The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with 0x0F, yielding a value of 0..15. This value is used directly as the loop bound for filling the stack array point_reg[], sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS (Kconfig range 1..5, default 1). A controller reporting more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array on the system workqueue thread's stack.