CVE Catalog

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.28. The issue arises because the tool fails to detect calls to the PyTorch function 'torch.fx.experimental.symbolic_shapes.ShapeEnv.evaluate_guards_expression' within pickle files. This oversight allows attackers to embed malicious code that executes when the pickle file is loaded by the victim.

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.28. The issue arises because the tool fails to detect malicious pickle files that exploit the PyTorch function 'torch._dynamo.guards.GuardBuilder.get' within 'reduce' methods. Attackers can craft these pickle files to include embedded code that evades Picklescan's detection, executing arbitrary commands when the files are loaded.

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.33. The issue arises because the tool fails to detect harmful code embedded in pickle files, particularly when the numpy function 'f2py.crackfortran.param_eval' is used in certain methods. This oversight allows attackers to insert undetected code that executes during the deserialization of the pickle file, leading to arbitrary code execution in applications that load untrusted pickle data.

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.30. The issue arises because the tool fails to detect harmful pickle files that call the PyTorch function torch.utils.bottleneck.__main__.run_autograd_prof. This oversight allows attackers to embed malicious code in pickle files, which is executed during deserialization, thereby enabling remote code execution.

A vulnerability in Picklescan versions prior to 0.0.30 allows malicious pickle files to evade detection and execute arbitrary code. This issue arises from the improper handling of pickle files that exploit the 'lib2to3.pgen2.pgen.ParserGenerator.make_label' function within the 'reduce' method. Attackers can craft these pickle files to include embedded code that, while undetected by Picklescan, executes when the pickle file is loaded using 'pickle.load()'.

A remote code execution vulnerability exists in Picklescan versions prior to 0.0.30. The issue arises because the tool fails to detect harmful code embedded in pickle files, specifically when the 'idlelib.run.Executive.runcode' function is used in the 'reduce' method. This undetected code execution occurs during the unpickling process with 'pickle.load', allowing attackers to execute arbitrary code in PyTorch environments. Additionally, this vulnerability poses a supply chain risk, as infected pickle files could be distributed across machine learning models, APIs, or saved Python objects.

A vulnerability allowing elevation of privilege has been identified in Unity Parsec for Windows, affecting versions prior to 150-104a. The issue arises from an incorrect use of privileged APIs, where a user can manipulate the AppData environment variable to create a situation where 'parsecd.exe' runs as 'NT AUTHORITY\SYSTEM'. This vulnerability can be exploited by authenticated users who have Parsec installed using the 'Per User' option.

A vulnerability allowing unauthorized access control bypass has been identified in Microsoft Edge for Android, specifically in version 150.0.4078.48. This flaw enables an attacker to circumvent a security feature over the network, potentially leading to unauthorized access or actions.

A vulnerability exists in NousResearch Hermes-Agent versions through 2026.4.30, specifically within the live streaming filters of the GatewayStreamConsumer component. The issue arises from improper handling of case sensitivity in reasoning tags, allowing mixed-case tags to bypass filters and leak hidden content, such as system prompts and internal logic, to users. This vulnerability can be exploited remotely, with a high complexity and difficulty of exploitation.

A spoofing vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability arises from insufficient user interface warnings about dangerous operations, which allows an unauthorized attacker to perform spoofing over a network. Exploitation of this vulnerability could lead to unauthorized reading of information associated with the vulnerable URL in the victim's browser, potentially allowing the attacker to access sensitive data via malicious JavaScript.

A cross-site scripting vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This issue arises from improper input neutralization during web page generation, allowing an unauthorized attacker to perform spoofing over the network. Exploitation of this vulnerability could lead to the attacker reading information from the victim's browser related to the vulnerable URL, which could then be sent to them.

A relative path traversal vulnerability has been identified in Microsoft Edge for Android, specifically in version 150.0.4078.48. This vulnerability allows an unauthorized attacker to disclose sensitive information locally by exploiting the path traversal issue.

A vulnerability exists in Gitea versions 1.22.0 through 1.26.1, specifically within the Actions Artifacts V4 handling. The issue arises from the HMAC signature of signed upload and download URLs, which can be manipulated to access artifacts across different tasks and repositories. An attacker with permission to run a Gitea Actions job can exploit this by rewriting a signed URL for an artifact they control to read from another task or repository, or to write data into another task's artifact upload staging, including in private repositories.

A vulnerability exists in Gitea's Actions feature, specifically in the handling of fork pull request approvals. When a pull request is made from a fork, Gitea requires approval before the associated workflow can run. However, the approval gate can be permanently bypassed. Once a repository administrator approves a workflow run from a fork PR, Gitea trusts that contributor for all future PRs from the same account on that repository, regardless of the workflow content. This flaw allows an attacker to execute arbitrary code on the repository's CI runner without further consent, exploiting the approval granted to a benign PR.

A vulnerability in Gitea versions 1.23.0 through 1.26.2 allows authenticated SSH users to bypass authentication for Git Large File Storage (LFS) operations. This flaw enables unauthorized read access to LFS objects in private repositories. The issue arises because the application fails to properly validate SSH LFS sub-verbs, allowing users to exploit the oversight and gain access to restricted content.

A vulnerability in Gitea's OAuth2 sign-in callback can improperly reactivate accounts that administrators have disabled. This issue is present in Gitea versions through 1.26.1. When a user authenticates via a linked external identity provider, the callback automatically restores their access, disregarding the administrator's disablement. As a result, the user regains full access to their repositories, organizations, and tokens, undermining administrative controls.

A denial-of-service vulnerability has been identified in Gitea versions prior to 1.26.2, allowing unauthenticated users to cause server hangs through malicious CODEOWNERS files. The issue arises from the CODEOWNERS feature's use of regular expressions for pattern matching, which can be exploited to create catastrophic backtracking scenarios. This vulnerability is triggered by pushing a CODEOWNERS file with a crafted pattern into a repository, then opening a pull request that includes a file named to exploit the regex matching process. The resulting backtracking can significantly delay the processing of the pull request, tying up database resources and causing the Gitea instance to become unresponsive.

A vulnerability in the Gitea Notification API allows users to access private issue and pull request metadata after their access to a private repository has been revoked. This issue is present in Gitea versions prior to 1.26.3. The vulnerability arises because, although the 'repository' field in notification responses is correctly nullified after access revocation, the 'subject' field remains accessible. The 'subject' field can contain private issue or pull request titles, repository-related URLs, issue or pull request states, and comment metadata. This leak not only exposes historical data but also ongoing activity if new comments are added while the notification remains unread.

A server-side request forgery (SSRF) vulnerability has been identified in Gitea versions through 1.25.4, specifically within the repository migration feature. The issue arises when a user migrates a repository from an external URL. Gitea correctly blocks direct imports from internal addresses. However, if the initial URL redirects to an internal service, Gitea follows the redirect without revalidating the destination. This flaw allows a low-privilege user to access internal services via Gitea as a proxy, potentially exfiltrating sensitive data or interacting with internal systems.

A vulnerability allowing absolute path traversal has been identified in Microsoft Edge for Android, specifically in version 150.0.4078.48. This vulnerability allows an unauthorized attacker to locally disclose sensitive information.

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been identified in Microsoft Edge for Android. This vulnerability allows an unauthorized attacker to execute code remotely over a network. The issue arises from a race condition that can be exploited by manipulating the timing of events, leading to unauthorized code execution.

A cross-site scripting vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This issue arises from improper input neutralization during web page generation, allowing an unauthorized attacker to perform spoofing over the network. Exploitation could enable the attacker to host a specially crafted website that, when viewed by a user, could read information from the user's browser related to the vulnerable URL and send it to the attacker.

A vulnerability in Microsoft Edge for Android allows unauthorized attackers to access private personal information over the network. This issue arises from the browser's handling of sensitive data, which can be intercepted by malicious actors.

A vulnerability in Microsoft Edge for Android allows unauthorized attackers to access private personal information over the network. This issue arises from the browser's handling of sensitive data, which can be intercepted by malicious actors.

A type confusion vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to bypass a security feature over the network. The issue arises from the access of resources using incompatible types, which can be exploited to manipulate how the browser handles certain data, potentially leading to unauthorized access or actions.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based), allowing an unauthorized attacker to execute code remotely. This vulnerability requires user interaction, as it involves convincing a user to open a specially crafted file or visit a malicious website.

A remote code execution vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to execute code over a network by external control of file names or paths.

A remote code execution vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability arises from improper input validation, which allows an unauthorized attacker to execute code over a network. Exploitation requires user interaction, such as opening a specially crafted file or visiting an attacker-controlled website.

A vulnerability in Microsoft Edge (Chromium-based) allows unauthorized attackers to disclose sensitive information over the network. This issue arises from operations on a resource after its expiration or release.

A type confusion vulnerability has been identified in Microsoft Edge (Chromium-based), allowing an unauthorized attacker to execute code remotely. This issue arises from the access of a resource using an incompatible type, which could be exploited over the network.

A type confusion vulnerability has been identified in Microsoft Edge (Chromium-based), specifically in version 150.0.4078.48. This vulnerability allows an unauthorized attacker to execute code remotely over the network. The issue arises from improper handling of resources, enabling exploitation by crafting deceptive elements that a user must interact with.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability allows an unauthorized attacker to execute code remotely over the network. Exploitation requires user interaction, such as opening a specially crafted file or visiting an attacker-controlled website.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability allows an unauthorized attacker to execute code remotely over the network. Exploitation requires user interaction, specifically convincing a user to open a specially crafted file or visit a malicious website.

A spoofing vulnerability has been identified in Microsoft Edge (Chromium-based) due to improper access control. This vulnerability allows an unauthorized attacker to manipulate information over a network. Successful exploitation requires crafting deceptive form elements and convincing a user to interact with them, such as by visiting a malicious website or opening an email attachment.

A type confusion vulnerability has been identified in Microsoft Edge (Chromium-based), allowing unauthorized attackers to execute code remotely. This issue arises from accessing a resource using an incompatible type, which could be exploited over the network.

A remote code execution vulnerability has been identified in Microsoft Edge (Chromium-based) due to improper authorization. This issue allows an unauthorized attacker to execute code over a network. The vulnerability affects Microsoft Edge versions through 150.0.4078.48.

A type confusion vulnerability has been identified in Microsoft Edge (Chromium-based), specifically in version 150.0.4078.48. This vulnerability allows an unauthorized attacker to perform spoofing over a network. The issue arises from the access of resources using incompatible types, which could be exploited to deceive users or systems.

A spoofing vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability arises from improper access control, allowing an unauthorized attacker to manipulate network communications. Exploitation involves crafting deceptive form elements that, when interacted with, can mislead users or hijack their actions.

A server-side request forgery (SSRF) vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to perform network spoofing. Exploitation could lead to the attacker reading information from the victim's browser related to the vulnerable URL, potentially allowing for spoofing attacks over the network.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely. This vulnerability requires user interaction, as it involves convincing a user to open a specially crafted file or visit a malicious website.

A server-side request forgery (SSRF) vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to perform network spoofing. Exploitation would require convincing a user to visit a malicious website, where the vulnerability could be triggered through user interaction.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based), allowing an unauthorized attacker to execute code remotely. This vulnerability requires user interaction, as it involves convincing a user to open a specially crafted file or visit a malicious website.

A vulnerability in Microsoft Edge (Chromium-based) allows unauthorized attackers to disclose sensitive information over a network. This issue arises from improper link resolution before file access, commonly known as 'link following'.

A remote code execution vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability arises from relative path traversal, which allows an unauthorized attacker to execute code over a network. Exploitation requires user interaction, such as opening a specially crafted file or visiting an attacker-controlled website.

A server-side request forgery (SSRF) vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to perform spoofing over a network. The issue arises from the way the browser handles certain requests, potentially allowing attackers to manipulate server interactions.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based), allowing an unauthorized attacker to execute code remotely. This vulnerability requires user interaction, as it involves convincing a user to open a specially crafted file or visit a malicious website.

A remote code execution vulnerability has been identified in Microsoft Edge (Chromium-based) versions through 150.0.4078.48. This vulnerability arises from improper input validation, which allows an unauthorized attacker to execute code over a network. Exploitation requires user interaction, such as opening a specially crafted file or visiting an attacker-controlled website.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based) that allows an unauthorized attacker to execute code remotely. This vulnerability requires user interaction, as it involves convincing a user to open a specially crafted file or visit a malicious website.

A vulnerability in Microsoft Edge (Chromium-based) allows unauthorized attackers to bypass security features over the network, exploiting improper authorization. This issue affects Microsoft Edge versions through 150.0.4078.48.

A use-after-free vulnerability has been identified in Microsoft Edge (Chromium-based) version 150.0.4078.48. This vulnerability allows an unauthorized attacker to execute code remotely over the network. The issue arises from improper memory management, where the application continues to use a memory resource after it has been freed, creating an opportunity for exploitation.