Gbsplay versions up to 0.0.103 contain a heap out-of-bounds read vulnerability in the gbr_open() function within gbs.c. The vulnerability arises because the function does not verify the file length before scanning the GBR ROM title field. An attacker can supply a specially crafted GBR file sized between 0x21 and 0x162 bytes to cause a heap buffer over-read, potentially crashing the application or leaking memory.
gbsplay versions up to 0.0.103 contain an out-of-bounds read vulnerability in the mapper_map() function. This flaw allows crafted game files to cause the player to read beyond the allocated ROM buffer, resulting in a crash. The vulnerability arises from improper validation of ROM bank indexes, leading to an underflowed bank length and heap buffer overread.
The jose library versions before 1.11.13 accept ECDSA JWS signatures with non-canonical lengths due to improper signature length validation. This allows multiple distinct signature byte strings to verify as valid for the same token, causing signature malleability. While this does not enable forging new payloads or impersonation, it undermines security controls relying on signature uniqueness, such as token revocation by hash, replay protection, and deduplication.
A vulnerability in erlang-jose allows an unauthenticated remote attacker to cause a CPU exhaustion denial of service by submitting a crafted RSA JSON Web Key. The issue arises when parsing an RSA private key that omits Chinese Remainder Theorem parameters, triggering a costly factoring attempt of the modulus. This leads to excessive CPU consumption and potential denial of service. The flaw affects versions from 1.7.7 before 1.11.13.
A timing side-channel vulnerability in the pure-Erlang fallback implementation of X25519 in the jose library allows an attacker to recover a long-term private key by measuring decryption timing. The vulnerability arises because the scalar multiplication operation's execution time depends on the secret private key bits. This affects jose versions from 1.10.0 before 1.11.13. Exploitation compromises confidentiality and authenticity of data protected by the key.
The jose_jwk:shared_secret/2 function in the jose library derives an ECDH shared secret from two JSON Web Keys (JWKs). A flaw in its implementation causes an unbounded tail-recursive loop when the two JWKs have differing key types, such as an EC key and an RSA key. This loop consumes 100% CPU on an Erlang scheduler, leading to denial of service when exploited repeatedly. The vulnerability affects jose versions from 1.5.0 before 1.11.13.
A vulnerability in the potatosalad jose (erlang-jose) library allows remote attackers to exhaust a node's memory by sending a crafted JWE token with highly compressed data. The decompression function does not limit output size, enabling data amplification that can crash the BEAM runtime and cause denial of service. This affects versions from 1.0.0 before 1.11.13.
A Bleichenbacher padding oracle vulnerability exists in the pure-Erlang RSAES-PKCS1-v1_5 decryption implementation in the jose_jwa_pkcs1 module. The vulnerability allows an unauthenticated attacker with access to a decryption endpoint using RSA1_5 padding to recover plaintext or forge signatures through adaptive chosen-ciphertext queries. This affects jose versions from 1.3.0 before 1.11.13.
The jose library's pure-Erlang AES-GCM fallback implementation in jose_jwa_aes improperly derives the number of verified authentication tag bits from the attacker-supplied tag without validating its length. This allows an attacker controlling a JWE token to truncate the authentication tag to as few as 8 bits, drastically reducing forgery resistance and enabling reliable forgery within 256 attempts. Supplying an overly long tag causes a crash. This vulnerability affects versions from 1.2.0 before 1.11.13.
Asterisk versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk versions contain a reflected cross-site scripting vulnerability in phone provisioning HTTP error pages. This flaw allows an unauthenticated attacker to potentially steal an authorized user's AMI session cookie and impersonate that user if the res_phoneprov module and related HTTP services are enabled. The HTTP server binds to 127.0.0.1 by default, limiting exposure. The vulnerability is fixed in the specified versions.
A vulnerability in Asterisk's LDAP realtime driver (res_config_ldap) prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases allows unauthenticated attackers to perform LDAP filter injection via crafted SIP usernames. This can lead to arbitrary LDAP queries and information disclosure. The module is not loaded by default and must be configured to access an LDAP server. The issue is fixed in the specified versions.
A heap-use-after-free vulnerability exists in Asterisk's PJSIP TCP/SDP handling when an authenticated attacker sends a SIP INVITE over a connection-oriented transport and disconnects before receiving a 200 OK response. This issue has been observed only when Asterisk is built with Address Sanitizer, a development tool not used in production. The vulnerability is fixed in Asterisk versions 20.20.1, 21.12.3, 22.10.1, 23.4.1, and Certified Asterisk 20.7-cert11 and 22.8-cert3.
A vulnerability in Asterisk's chan_ooh323 addon channel driver allows an unauthenticated attacker to cause an out-of-bounds read, potentially crashing the system. This issue affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. The chan_ooh323 driver is not installed by default and requires explicit compilation and a publicly reachable port. The vulnerability is fixed in the specified versions.
Mem0 provides persistent memory infrastructure for AI agents and applications. Prior to Python SDK 2.0.18 and TypeScript SDK 3.1.6, _build_session_scope() in mem0/memory/main.py and Memory.buildSessionScope() in the TypeScript SDK join caller-controlled user_id, agent_id, and run_id values using unescaped & and = delimiters. A caller can embed another scope component in a controlled identifier so that distinct tenant tuples produce the same session_scope key. Memory.add(), AsyncMemory.add(), and the REST POST /memories flow use that key to read and save recent raw messages, allowing cross-tenant conversation disclosure and eviction or interleaving of another tenant's history. This issue is fixed in Python SDK 2.0.18 and TypeScript SDK 3.1.6.
Consul-k8s versions 0.42.0 and later are vulnerable to a cross-namespace authorization bypass in component ACL binding rules that may allow an attacker to obtain elevated Consul privileges. This vulnerability (CVE-2026-110720) is fixed in consul-k8s 2.1.0 and 1.8.18.
The Espressif AES driver in Zephyr OS incorrectly manages hardware key registers for multiple concurrent AES sessions. This causes operations on one session to potentially use the key and direction of another session, leading to cryptographic failures where data is encrypted or decrypted under an unintended key. The issue arises because key programming occurs outside a mutex lock, allowing race conditions between sessions. Exploitation requires an application to hold multiple concurrent sessions with different keys, which is not currently done by in-tree Zephyr subsystems. The fix involves reprogramming the key and direction inside the lock for each operation.
A vulnerability in Zephyr's Bluetooth Classic Hands-Free Profile Audio Gateway role allows a remote device to cause a crash or hang of the Bluetooth stack. This occurs when an SDP discovery is started but the subsequent RFCOMM connection fails, leading to a use-after-free or null pointer dereference in the SDP client request list. The flaw can be triggered by a remote device advertising an invalid RFCOMM channel or by racing connection attempts. Only builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_AG enabled and using the Audio Gateway role are affected.
A flaw in Zephyr's Bluetooth HFP Hands-Free connection handling can cause a denial of service. When bt_hfp_hf_connect() fails during RFCOMM connection setup, it wipes the connection object while an SDP discovery is still pending. This leads to use-after-free conditions and null pointer dereferences in the Bluetooth host, causing faults or hangs. The issue affects builds with CONFIG_BT_CLASSIC and CONFIG_BT_HFP_HF enabled.
A vulnerability in Zephyr's Bluetooth host affects the handling of connectable advertising sets when multiple extended advertising sets are used. The Bluetooth host pre-allocates connection objects (reservations) for each advertising set, but due to a lookup flaw, a reservation can be misattributed to a different advertising set. This causes the reservation for the undirected advertising set to be stranded and never released, leading to resource exhaustion. An attacker can exploit this by repeatedly triggering connections, eventually preventing new connections and causing advertising failures. The impact is limited to availability; no memory corruption or data disclosure occurs. Configurations with only one advertising set are not affected.