CVE Vulnerability Catalog

Octo STS (github.com/octo-sts/app) before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claim_pattern names and regular expressions in its PermissionDenied errors, which Exchange returned verbatim. Exchange also selected the GitHub App installation before checking the token, so errors from resolving the policy's app or app_pattern pin were returned to callers the policy does not trust.

A vulnerability was identified in the Welcart e-Commerce plugin for WordPress up to 2.12.6, affecting the ESCOTT_MAIN::error_page_message function in classes/paymentESCOTT.main.class.php. Manipulation of the ResponseCd argument leads to cross-site scripting, the attack can be launched remotely, and the exploit is publicly available.

Improper limitation of a pathname to a restricted directory exists in the deployment status component of AWS Serverless MCP Server (aws-serverless-mcp-server) before v0.2.1. Through directory traversal sequences or an absolute path in the project name input, an attacker may read or, if write access is enabled, create/overwrite JSON files outside the intended directory.

A flaw was found in konflux-ci that allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker able to supply arguments to the affected scripts could trigger unintended command substitution, executing commands with the privileges of the deployment runner.

Dell Alienware Command Center (AWCC) versions up to and including 6.14.20.0 contain an Improper Authorization in Handler for Custom URL Scheme vulnerability. An unauthenticated attacker with remote access could exploit this to achieve command execution, launch phishing attacks, and remote execution.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an Improper Verification of Cryptographic Signature vulnerability. A high privileged attacker with local access could exploit this to achieve elevation of privilege and arbitrary code execution.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an Improper Certificate Validation vulnerability. A high privileged attacker with local access could exploit this to achieve arbitrary code execution and denial of service.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain a Least Privilege Violation vulnerability. A low privileged attacker with local access could exploit this to achieve elevation of privilege, arbitrary code execution, and denial of service.

Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 contain an Improper Input Validation vulnerability. A low privileged attacker with local access could exploit this to cause denial of service.

In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed.

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5B__iterate_helper() in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node's level matches the expected level, allowing a crafted HDF5 file to bypass the check and cause unbounded recursion, leading to stack exhaustion and a crash. This can be triggered by calling H5Gget_info() or H5Gget_num_objs() on a group in the crafted file.

Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB, allowing physical attackers to obtain an interactive shell as uid 2000 (system) without credentials. Attackers with physical access and a USB-to-TTL adapter can leverage this shell to reach the pppoe_wrapper vendor daemon, which contains an OS command injection vulnerability executed as root, resulting in full root-level compromise of the device.

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService) on Nexbox A95X TV boxes contains an out-of-bounds write vulnerability in vob_fill_pixel(). A remote attacker can corrupt stack memory by sending a crafted SET_CONTR command with an attacker-controlled alpha value that drives an unbounded array index (change_data) past the end of the fixed four-element PixelDatas array. This can be exploited by sending malicious VobSub data over the unauthenticated tcp/10100 socket or via a malicious .sub file, resulting in silent stack corruption or process crash.

The VobSub subtitle decoder libsub_vob (part of the Amlogic DroidLogic SubTitleService) on Nexbox A95X TV boxes contains an infinite loop vulnerability in get_vob_spu(). An unauthenticated network attacker or local user loading malicious files can trigger an unreachable loop exit condition via mismatched length fields. This can be exploited by sending crafted AMLU data blocks over the unauthenticated tcp/10100 listener or via a malicious VobSub (.sub) file, causing the subtitle decode thread to spin at 100% CPU indefinitely, resulting in denial of service.

Stored cross-site scripting (XSS) in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability report via crafted artifact titles or descriptions. To remediate this issue, users should remove any local copy of the aidlc-traceability CLI obtained before 2026-07-03, or update it to commit 96cf0ea or later. The CLI was removed from the repository on 2026-07-16.

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes past the buffer. A server not trusted under current SSL settings can send such a value. So can any database user who can create a view with its own column named ctid that the application reads with an updatable cursor. Builds with _FORTIFY_SOURCE abort; other builds overwrite adjacent stack memory. Versions before psqlODBC 18.00.0006 are affected.

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data from another user's logs, and can place a symbolic link at the predictable path so that the driver appends log data to a file of the attacker's choosing with the victim's privileges. Versions before psqlODBC 18.00.0006 are affected.

psqlODBC contains a stack buffer overflow when quoting schema or table names into a 128-byte stack buffer. The length check allows writing up to two bytes past the end of the buffer for long names originating from the application's SQL text or from a server-supplied column name. Versions before psqlODBC 18.00.0006 are affected.

psqlODBC trusts server-supplied counts and lengths in three places: SQLBulkOperations can underflow a size subtraction, SQLStatistics iterates index keys without bounding to fixed storage, and bytea octal decoding reads up to two bytes past a truncated escape sequence. A server not trusted under current SSL settings can crash the client or cause out-of-bounds reads. Versions before psqlODBC 18.00.0006 are affected.

In psqlODBC, the server-reported name of an auto-increment int4 column is placed into a printf-style format string and later expanded while building the WHERE clause for an updatable cursor. A column name containing format directives causes reads of unrelated memory, potentially crashing the application or copying client memory into query text sent to the server. Versions before psqlODBC 18.00.0006 are affected.