rclone serve s3 1.75.0 before 1.75.2 Memory Limit Bypass via Multipart Overflow

rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurrent current-part PUT requests declaring huge lengths to wrap the signed int64 counter and retain out-of-order parts in memory, exhausting the host.

Missing Authorization Check in GROWI Collaborative Editing Allows Unauthorized Draft Modification

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts.

ML-KEM key-pair lookup can bind an unrelated or attacker-planted public key, exposing encapsulated shared secrets

In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions (`FindMLKEMKeyPair`, `FindMLKEMKeyPairs`, `FindMLKEMKeyPairsWithAttributes`) locate the public half of an ML-KEM key pair by `CKA_ID`/`CKA_LABEL` and never verify it against the private key. In addition, the "ID only" fallback search runs even when the private key has no `CKA_ID`, so the search template reduces to the public-key class and the ML-KEM key type and the first ML-KEM public key on the token is returned. `Encapsulate()` on the resulting key pair encrypts the fresh shared secret to that key, so its owner — not the holder of the private key the caller looked up — can recover the secret. An attacker who can open an unauthenticated session on the token and plant a public `CKK_ML_KEM` object carrying the victim's `CKA_ID`/`CKA_LABEL` receives the shared secrets for encapsulations performed through the substituted key pair, compromising the confidentiality of those secrets and of everything protected by keys derived from them. The v1 module paths have no ML-KEM support and are not affected.

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, visionOS 27.2. An attacker in physical proximity may be able to corrupt process memory.

Out‑of‑Bounds Write in Apple 3D Model Parsing Leads to Memory Corruption

An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2, macOS Sequoia 15.8.2, macOS Tahoe 26.7.2, visionOS 27.2. Processing a maliciously crafted 3D model may lead to memory corruption.

@fastify/express vulnerable to path-scoped middleware bypass via absolute-form request targets

@fastify/express is a Fastify plugin that runs Express middleware inside Fastify. In versions 4.0.5 through 4.0.8, when Fastify runs with the non-default ignoreDuplicateSlashes option enabled, the plugin matches path-scoped Express middleware against a URL whose duplicate-slash normalization has also collapsed the separator after an absolute-form request target's scheme, so Fastify's router resolves the request to the scoped path and runs the handler while the Express layer no longer sees that path. As a result, a request using an absolute-form target can reach a handler on a scoped route such as an admin path while the middleware for authentication, authorization, or rate limiting is skipped. An unauthenticated attacker needs only the non-default ignoreDuplicateSlashes option to be enabled. The issue is fixed in @fastify/express 4.0.9, and users should upgrade to 4.0.9 or later. As a workaround, enforce authentication in a Fastify hook such as preHandler that runs after the router resolves the request, or leave ignoreDuplicateSlashes at its default.

Push Endpoint Returns Permissive CORS Headers

The push endpoint of a Vaadin application that uses server push reflects the request Origin into the Access-Control-Allow-Origin response header and allows credentials, because Flow configures Atmosphere with DROP_ACCESS_CONTROL_ALLOW_ORIGIN_HEADER set to false and its CorsInterceptor then echoes whatever Origin the request carries. A page on any origin can therefore make a cross origin request to that endpoint with the user's cookies and read the response, although reading anything useful also requires the push identifier of that session. Applications that do not use @Push are not affected, and neither is the WebSocket transport. The behaviour was introduced in January 2015 and is present in every Flow release and in Vaadin Framework from 7.1.0, which is when push was added. Users of affected versions should apply the following mitigation or upgrade. Releases that have fixed this issue include: Product version Vaadin 14.14.0 - 14.14.7 Vaadin 23.6.0 - 23.6.16 Vaadin 24.4.0 - 24.4.25 Vaadin 24.5.0 - 24.5.15 Vaadin 24.6.0 - 24.6.13 Vaadin 24.7.0 - 24.7.16 Vaadin 24.8.0 - 24.8.17 Vaadin 24.9.0 - 24.9.23 Vaadin 24.10.0 - 24.10.11 Vaadin 25.0.0 - 25.0.13 Vaadin 25.1.0 - 25.1.13 Vaadin 25.2.0 - 25.2.10 Vaadin 25.3.0 - 25.3.2 Vaadin Framework 7.1.0 - 7.7.54 Vaadin Framework 8.0.0 - 8.32.1 Mitigation Upgrade to 14.14.8 Upgrade to 23.6.17 Upgrade to 24.4.26 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.7.17 Upgrade to 24.9.24 Upgrade to 24.9.24 Upgrade to 24.10.12 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.2.11 Upgrade to 25.3.3 Upgrade to 7.7.55 Upgrade to 8.32.2 Please note that Vaadin versions 10-13 and 15-22 are no longer supported and you should update either to the latest 14, 23, 24, 25 version. Artifacts under com.vaadin Maven coordinates / Vulnerable versions / Fixed version vaadin / 14.14.0 - 14.14.7 / >=14.14.8 vaadin / 23.6.0 - 23.6.16 / >=23.6.17 vaadin / 24.4.0 - 24.4.25 / >=24.4.26 vaadin / 24.5.0 - 24.5.15 / >=24.7.17 vaadin / 24.6.0 - 24.6.13 / >=24.7.17 vaadin / 24.7.0 - 24.7.16 / >=24.7.17 vaadin / 24.8.0 - 24.8.17 / >=24.9.24 vaadin / 24.9.0 - 24.9.23 / >=24.9.24 vaadin / 24.10.0 - 24.10.11 / >=24.10.12 vaadin / 25.0.0 - 25.0.13 / >=25.2.11 vaadin / 25.1.0 - 25.1.13 / >=25.2.11 vaadin / 25.2.0 - 25.2.10 / >=25.2.11 vaadin / 25.3.0 - 25.3.2 / >=25.3.3 vaadin-core / 14.14.0 - 14.14.7 / >=14.14.8 vaadin-core / 23.6.0 - 23.6.16 / >=23.6.17 vaadin-core / 24.4.0 - 24.4.25 / >=24.4.26 vaadin-core / 24.5.0 - 24.5.15 / >=24.7.17 vaadin-core / 24.6.0 - 24.6.13 / >=24.7.17 vaadin-core / 24.7.0 - 24.7.16 / >=24.7.17 vaadin-core / 24.8.0 - 24.8.17 / >=24.9.24 vaadin-core / 24.9.0 - 24.9.23 / >=24.9.24 vaadin-core / 24.10.0 - 24.10.11 / >=24.10.12 vaadin-core / 25.0.0 - 25.0.13 / >=25.2.11 vaadin-core / 25.1.0 - 25.1.13 / >=25.2.11 vaadin-core / 25.2.0 - 25.2.10 / >=25.2.11 vaadin-core / 25.3.0 - 25.3.2 / >=25.3.3 flow-server / 2.13.0 - 2.13.7 / >=2.13.8 flow-server / 23.6.0 - 23.6.15 / >=23.6.16 flow-server / 24.4.0 - 24.4.18 / >=24.4.19 flow-server / 24.5.0 - 24.5.17 / >=24.7.17 flow-server / 24.6.0 - 24.6.14 / >=24.7.17 flow-server / 24.7.0 - 24.7.15 / >=24.7.16 flow-server / 24.8.0 - 24.8.16 / >=24.9.24 flow-server / 24.9.0 - 24.9.28 / >=24.9.29 flow-server / 24.10.0 - 24.10.14 / >=24.10.15 flow-server / 25.0.0 - 25.0.15 / >=25.2.11 flow-server / 25.1.0 - 25.1.18 / >=25.1.19 flow-server / 25.2.0 - 25.2.12 / >=25.2.13 flow-server / 25.3.0 - 25.3.3 / >=25.3.4 vaadin-server / 7.1.0 - 7.7.54 / >=7.7.55 vaadin-server / 8.0.0 - 8.32.1 / >=8.32.2 vaadin-server-mpr-jakarta / 7.7.36 - 7.7.54 / >=7.7.55 vaadin-server-mpr-jakarta / 8.18.0 - 8.32.1 / >=8.32.2

TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access services intended to be reachable only from localhost. By leveraging port forwarding, an attacker can interact with locally bound ports and services, resulting in unauthorized access to sensitive functionality and confidential information, and causing availability impact.

Authorization Bypass in GROWI Tag and Page Update APIs Enabling Unauthorized Access and Modification

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and save them to pages that the attacker can edit.

Tanium addressed an insufficient logging vulnerability in Tanium Server.

Tanium addressed an insufficient logging vulnerability in Tanium Server.

Tanium addressed a SQL injection vulnerability in Patch.

Tanium addressed a SQL injection vulnerability in Patch.

Arbitrary File Read in Hitachi Energy TRO600 Firmware

TRO600 contains an arbitrary file read vulnerability. An unauthenticated attacker can exploit this vulnerability to read or download arbitrary files on the affected device, including sensitive configuration files and password data, resulting in the disclosure of sensitive information.

Authorization Bypass in GROWI Page Viewing and Commenting

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission.

Administrator Password Reset Through the Verification-Code Interface in TP-Link RE305

An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3. The verification-code interface allows an unauthenticated attacker on the same local network to trigger generation of an administrator password-reset verification code. Because the interface lacks an effective attempt counter or lockout mechanism and uses a predictable verification-code generation process, an attacker may obtain or brute-force the code and reset the administrator password.  Successful exploitation may allow an unauthenticated attacker on the local network to reset the administrator password and subsequently access privileged device-management functions.

Hardcoded AES-128 Key and Fixed IV in Configuration Backup Encryption in TP-Link RE305 and Archer C7

A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and Archer C7 V5. A fixed AES-128 key and initialization vector are embedded in the firmware configuration-management component. An attacker who obtains an affected configuration backup file may extract the cryptographic material from the firmware and use it to decrypt the backup.  Successful exploitation may disclose sensitive configuration information contained in a backup file, including administrator passwords and Wi-Fi credentials.

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2

Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2 - EditorController::getBlogPosts() reads the order parameter and invokes getBlogPosts() . Unlike other tasks in this controller, it omits the GridboxHelper::checkUserEditLevel() check.

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2

Joomla Extension - balbooa.com - Unauthenticated SQL injection in Gridbox < 2.20.4.2 - On store product list pages, the value of the sort-by URL parameter is retrieved using a string filter and passed directly to GridboxHelper::getBlogPosts(). When the parameter does not match known sorting keys, it is prefixed with a table alias and inserted into the ORDER BY clause without checking against an allowlist

User Enumeration in Rolantis Information Technologies' Agentis

Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis allows Account Footprinting. This issue affects Agentis: before 4.8.

webkit: Processing maliciously crafted web content may lead to memory corruption

A type confusion issue was addressed with improved memory handling. This issue is fixed in Safari 18.2, iOS 18.2 and iPadOS 18.2, iPadOS 17.7.3, macOS Sequoia 15.2, tvOS 18.2, visionOS 2.2, watchOS 11.2. Processing maliciously crafted web content may lead to memory corruption.

A logic issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.2. An app may be able to elevate privileges.