CVE Vulnerability Catalog

A hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices.

Build readers can access another repository's environment properties. A caller with read access to an ordinary repository can select a readable repository parameter while retrieving environment properties for a protected build, exposing build environment secrets (confidentiality impact; no integrity or availability impact demonstrated).

A user with JFrog Artifactory Cargo remote repository read access could make Artifactory request unintended URLs and return the response.

JFrog Artifactory support for Terraform remote repositories was found to be susceptible to Server-Side Request Forgery (SSRF). An authenticated user - or, if anonymous access is enabled on the repository, an unauthenticated user - could cause Artifactory to issue outbound HTTP requests to arbitrary destinations and receive the response content.

A URL validation weakness in JFrog Artifactory Ansible repository handling could allow a user, under specific repository access conditions, to cause unintended server-side requests. The issue primarily affects confidentiality and integrity and has been addressed in fixed Artifactory versions.

Improper URL validation when handling specific URLs, allows an attacker, under certain conditions, to make unauthorized requests from JFrog Artifactory, potentially exposing internal services and cached response data.

In Next.js, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (SSRF). In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.

Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. This issue has been fixed in versions 15.5.21 and 16.2.11.

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 added an INVALID_ATTR_NAME_CHAR guard to addAttribute(), but a second attribute-rendering path, renderHTMLElement(), was not updated and interpolates the attribute name unescaped, allowing XSS. This issue has been fixed in version 7.0.6.

A flaw was found in the file-sgi plugin in GIMP. When processing an RLE-compressed SGI image, the plugin allocates memory for a row table. The image header dimensions (ysize and zsize) are read as 16-bit unsigned integers. If a crafted file sets both dimensions to their maximum value (65535), the multiplication ysize * zsize overflows the standard 32-bit int boundary before being passed to calloc. This integer overflow issue results in undefined behavior, aborting the plugin and causing a denial of service.

Ekushey Project Manager CRM through version 5.0 contains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Reply Ticket field. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Support Ticket detail page.

In Next.js versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. This leads to leakage of confidential POST response data to unauthorized requests. The issue only occurs with request bodies using a charset other than UTF-8.

In Next.js versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Action uses the Edge runtime.

Honeywell S35 Series cameras (3M/5M/8M/PinHole) versions up to HC5.26.1.14.20260207 contain an audit log disclosure vulnerability that allows an attacker to access audit logs without authentication, potentially leading to disclosure of sensitive information.

In Zephyr RTOS versions v3.3.0 through v4.4.1, the userspace verifier function z_vrfy_log_filter_set() performs a signed comparison for the src_id parameter, allowing negative values to be passed. This leads to out-of-bounds read and write in the log_dynamic array, which can be exploited for privilege escalation in supervisor mode.

Ekushey Project Manager CRM version 5.0 and earlier contains a stored cross-site scripting vulnerability. Authenticated client users can inject malicious HTML and JavaScript into the Ticket Title field, which is rendered unsanitized on the Client Support page.

Ekushey Project Manager CRM up to version 5.0 contains a stored XSS vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript via the Name field on the Edit Profile page. Malicious scripts execute in browser sessions of Staff or Administrator users viewing the Manage Clients or Manage Client Projects pages.

Ekushey Project Manager CRM up to version 5.0 contains a missing uniqueness constraint vulnerability that allows authenticated administrators to create duplicate client accounts with identical email and password. Attackers can exploit the lack of email field uniqueness to create conflicting account states, leading to unpredictable authentication and unauthorized account access.

Next.js versions 12.0.0-15.5.20 and 16.0.0-16.2.10 have a vulnerability in rewrites()/redirects() rules with external hostnames from requests. Attackers can point requests to arbitrary hosts, causing SSRF (rewrite) or Open Redirect (redirect).

In Next.js versions 15.5.0 through 15.5.20 and 16.0.0 through 16.2.10, when self-hosting with the default image loader, the Image Optimization API can optimize remotely hosted images if configured (not enabled by default). If those images contain malicious content, they can cause CPU exhaustion in /_next/image endpoints. Only config.images.remotePatterns is affected.