CVE Brief Security Intelligence

A use-after-free vulnerability in the Views component of Google Chrome on Windows allows for potential memory corruption and arbitrary code execution.

A use-after-free vulnerability in the Network component of Google Chrome allows for potential memory corruption and unauthorized code execution.

The @apostrophecms/seo package fails to sanitize Google Analytics and Tag Manager IDs, leading to stored XSS via JavaScript template literal injection.

A privilege escalation vulnerability in Apache OFBiz allows authenticated users to obtain higher privileges by bypassing authorization checks on specific API operations.

A double free memory corruption vulnerability in the AWS Common Runtime aws-c-http library may lead to arbitrary code execution when processing crafted HTTP/2 HEADERS frames.

A flaw in the Naxclow IoT onboarding workflow allows attackers to replay binding sequences to silently hijack device ownership.

The Aqara IAM/SSO gateway contains an overly permissive Cross-Origin Resource Sharing (CORS) policy, allowing unauthorized cross-origin requests.

The iVEC-IEI Virtualization Edge Computer contains an arbitrary file deletion vulnerability that can be triggered by authenticated remote attackers.

A Vimscript code injection vulnerability exists in the netrw plugin, allowing arbitrary command execution via crafted directory names.

Mattermost fails to enforce role-management authorization on group syncable link and patch endpoints, allowing for unauthorized privilege escalation.

A vulnerability in OpenClaw allows unauthorized users to obtain cached operator.admin authority on WebSocket connections to execute admin-gated Gateway RPCs.

A command injection vulnerability in OpenClaw allows attackers to manipulate command arguments post-approval, enabling the execution of unauthorized shell commands.

An authorization bypass in OpenClaw allows authenticated users to execute restricted, owner-only native commands by circumventing policy enforcement.

OpenClaw is vulnerable to an allowlist bypass in PowerShell command parsing, allowing remote authenticated operators to execute arbitrary commands using abbreviated flag aliases.

A mass-assignment vulnerability in Flowise allows authenticated users to move assistants between workspaces, resulting in cross-workspace takeover.

Netty's DnsResolveContext fails to validate the origin of CNAME records, making applications using the framework vulnerable to DNS Cache Poisoning (Bailiwick Bypass).

The vm2 library contains a sandbox escape vulnerability caused by incomplete overrides of the global Symbol.for function and flaws in proxy-based bridge write-trap handlers.

The WEOLL platform contains an unrestricted file upload vulnerability and fails to properly constrain access to functionality via ACLs.

Netty's DnsResolveContext insufficiently validates NS record bailiwicks, enabling DNS Cache Poisoning attacks.

A vulnerability in the vm2 library's NodeVM component allows attackers to bypass network exclusions and perform SSRF-style attacks via the wildcard '*' option.

The vm2 library is susceptible to a sandbox escape due to a flaw in the BaseHandler.set method which incorrectly ignores the receiver parameter.

The Aqara Board service (op-test) allows unauthenticated remote attackers to send arbitrary MQTT command payloads to the HiveMQ broker.

A high-severity vulnerability exists in OpenClaw, details of which are currently limited.

The Aqara Developer Portal exhibits a permissive cross-origin resource sharing (CORS) policy, allowing unauthorized cross-domain access.

Adobe Dreamweaver Desktop contains an improper access control vulnerability that allows for arbitrary file system read when opening a malicious file.

Keras versions prior to 3.14.0 are susceptible to a path traversal vulnerability during archive extraction, potentially allowing arbitrary file writes.

A security vulnerability has been identified in Perry software products, requiring immediate investigation and remediation.

An authenticated administrator in SolidInvoice can upload an SVG file containing embedded JavaScript, resulting in stored cross-site scripting (XSS).

SolidInvoice stores API tokens in plaintext within the database, risking full credential compromise if the database is exposed or accessed by an unauthorized party.

A high-severity vulnerability has been reported in the Netty network application framework, which is used for developing protocol servers and clients.

Certain devices running UniFi OS contain an improper access control vulnerability that allows a network-adjacent attacker to perform unauthorized changes.