CVE Vulnerability Catalog

Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information.

A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a null pointer, and then send PUSH_PROMISE for that stream, causing a null pointer dereference in the QNetworkAccessManager class of the Qt Network module that crashes the application.

A security vulnerability has been detected in libimobiledevice up to version 1.4.0. It affects the afc_file_open function in src/afc.c within the AFC File Handler component. Manipulation of the bytes argument leads to an out-of-bounds read, and the attack can be initiated remotely.

In ffxiv-teamcraft FFXIV Teamcraft up to version 11.4.31, the clipboard.readText function in apps/electron/src/preload.ts of the Renderer-Process IPC Bridge component is vulnerable. Manipulation causes cross site scripting, and the attack can be carried out remotely. The exploit has been publicly disclosed, and the fix is in version 11.4.32.

A vulnerability was found in 777genius agent-teams-ai up to 2.17.10. This issue affects the function doStart of the file src/main/services/infrastructure/HttpServer.ts of the Local HTTP Service component. The manipulation results in missing authentication, and the attack is only possible with local access. The exploit has been made public and could be used.

A vulnerability has been found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the Virtual Server Page component. The manipulation leads to cross site scripting, and remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

In NocoDB up to 2026.07.0, the validatePassword function in /auth/user/signup does not adequately restrict excessive authentication attempts. The flaw enables a remote attack of high complexity, and the vendor describes this behavior as intentional. The GitHub issue was deleted without explanation and email contact went unanswered.

In NocoDB up to 2026.07.0, the AuthService.validateUser function in the Sign-in Endpoint component, when the salt argument is manipulated, leads to information disclosure. The attack can be performed remotely, is rated high complexity, and is considered difficult to exploit. The vendor deleted the GitHub issue without explanation and did not respond to email contact.

In NocoDB up to 2026.08.0, unspecified processing in users.service.ts within the Registration component leads to a race condition. The attack can be performed remotely, requires a high level of complexity, and is assessed as difficult to exploit. The vendor deleted the GitHub issue without explanation and did not respond to email contact.

A security vulnerability was detected in the Yoosee GM8135S Camera version 21.00.01.36 in the wpa_supplicantX.conf file of the WiFi Configuration component. Improper initialization can be exploited by an attacker on the local network. The exploit is publicly disclosed and the attack is highly complex.

A weakness was identified in the Yoosee GM8135S Camera version 21.00.01.36 in the /npc/npc file of the Live UDP H.264 Video Stream Handler component. The manipulation causes cleartext transmission of sensitive information. The attack can be initiated remotely, though it is highly complex.

A weakness has been identified in HeyCyan App 1.0.103 on Android, affecting an unknown function of the AndroidManifest.xml file of the Network Security Configuration component. Executing a manipulation can lead to cleartext transmission of sensitive information; the attack can be launched remotely but requires a high level of complexity and exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability was found in gougucms up to 4.08.18 affecting the Add function in app/admin/controller/Level.php (User Level Handler component). Manipulating the Title argument leads to cross-site scripting, and the attack can be carried out remotely. The exploit has been publicly disclosed and the vendor did not respond to the disclosure.

A security vulnerability has been detected in SH3, affecting an unknown function of the Módulo de Gestão/Módulo de Arrecadação component. The manipulation leads to password hashing with insufficient computational effort. The attack is possible remotely but requires high complexity and is reported as difficult to exploit. The exploit has been publicly disclosed and may be used.

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials, CA bundles, or mirror settings intended for the wildcard may be applied to the concrete registry, leaking credentials or pull metadata.

rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx redirects. Attackers who control or influence a cross-host redirect can capture headers such as X-Auth-Token set via --webdav-headers and replay them against the original WebDAV service.

OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events and maps event asset IDs only through the reversible GatewayConnector.mapAssetId transform. An attacker controlling a registered gateway can craft pre-image IDs in AttributeEvent or DELETE AssetEvent messages to overwrite attributes on, or delete, assets in any realm, breaking tenant isolation.

OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate gateways in other realms because GatewayService only checks the gateway ID, not the realm. Attackers with WRITE:ADMIN in one realm can create a service user named after another realm's gateway ID to overwrite its descendant assets and open SSH tunnels into its local network.

Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-factor authentication verification code. An SMS MFA-enrolled user can include extra fields in that request to modify master-key-restricted fields on their own account, such as the email-verification flag or beforeSave-protected values.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation when processing crafted images. Attackers can supply a malicious image that, when a user runs an X11 animate operation on it, overwrites heap memory and can crash the application.