CWE-1395.

Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK

• Broken access control
• CWE-345

>=5.0.0, <5.6.0 · fixed in 5.6.0

Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency

• Broken access control
• CWE-1395

>=7.0.0, <7.20.0 · fixed in 7.20.0

Micro820®, Micro850®, Micro870® – Specialized Fuzzing Vulnerabilities

• Rockwell Automation Micro820®, Micro850®, Micro870®
• CWE-1395

Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up

• Denial of service
• Insecure deserialization

>=13.3.1-canary.0, <14.2.35 || >=15.0.6, <15.0.7 || >=15.1.10, <15.1.11 || >=15.2.7, <15.2.8 || >=15.3.7, <15.3.8 || >=15.4.9, <15.4.10 || >=15.5.8, <15.5.9 || >=15.6.0-canary.59, <15.6.0-canary.60 || >=16.0.9, <16.0.10 || >=16.1.0-canary.17, <16.1.0-canary.19 · fixed in 14.2.35, 15.0.7, 15.1.11, 15.2.8, 15.3.8, 15.4.10, 15.5.9, 15.6.0-canary.60, 16.0.10, 16.1.0-canary.19

Vite Plugin React has a Source Code Exposure Vulnerability in React Server Components

• Information disclosure
• Insecure deserialization

<0.5.7 · fixed in 0.5.7

Vite Plugin React has a Denial of Service Vulnerability in React Server Components

• Denial of service
• Insecure deserialization

<0.5.7 · fixed in 0.5.7

Next Server Actions Source Code Exposure

• Information disclosure
• Insecure deserialization

>=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17 · fixed in 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17

Next Vulnerable to Denial of Service with Server Components

• Denial of service
• Insecure deserialization

>=13.3.0, <14.2.34 || >=15.0.0-canary.0, <15.0.6 || >=15.1.1-canary.0, <15.1.10 || >=15.2.0-canary.0, <15.2.7 || >=15.3.0-canary.0, <15.3.7 || >=15.4.0-canary.0, <15.4.9 || >=15.5.1-canary.0, <15.5.8 || >=15.6.0-canary.0, <15.6.0-canary.59 || >=16.0.0-beta.0, <16.0.9 || >=16.1.0-canary.0, <16.1.0-canary.17 · fixed in 14.2.34, 15.0.6, 15.1.10, 15.2.7, 15.3.7, 15.4.9, 15.5.8, 15.6.0-canary.59, 16.0.9, 16.1.0-canary.17

OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

• CWE-296
• CWE-1395

<1.10.8 · fixed in 1.10.8

SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475

• CWE-1395

<2.21.1 || >=3.0.0, <3.8.1 || >=4.0.0, <4.3.1 · fixed in 2.21.1, 3.8.1, 4.3.1

OpenTofu affected denials of service in "tofu init" with maliciously-crafted module package responses

• CWE-1395

<1.10.7 · fixed in 1.10.7

Busybox 1.31.1 - Multiple Known Vulnerabilities

• Azure Access Technology BLU-IC2
• Azure Access Technology BLU-IC4
• CWE-1395

Vulnerable Components in Azure Access OS

• Azure Access Technology BLU-IC2
• Azure Access Technology BLU-IC4
• CWE-1395

Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS...

• Open redirect
• CWE-1395

<5.13.3 · fixed in 5.13.3

Vasion Print (formerly PrinterLogic) Use of Outdated, End-Of-Life, and Vulnerable Third-Party Components

• Vasion Print Virtual Appliance Host
• Vasion Print Application
• CWE-1395

PostgreSQL Upgrade from v10 to v17.4 in AxxonSoft Axxon One (C-Werk) 2.0.8 and earlier to Address Multiple Vulnerabilities

• AxxonSoft AxxonOne C-Werk
• CWE-1395

Information Disclosure due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Service)

• SAP_SE SAP NetWeaver AS Java (Adobe Document Service)
• CWE-1395

mitmproxy binaries embed a vulnerable python-hyper/h2 dependency

• HTTP request smuggling
• CWE-1395

<12.1.2 · fixed in 12.1.2

Net::Dropbear versions through 0.16 for Perl contains a dependency that may be susceptible to an integer overflow

• ATRODO Net::Dropbear
• CWE-1395

Unauthenticated Path Traversal affecting Avid NEXIS

• Avid NEXIS E-series
• Avid NEXIS F-series
• CWE-1395

Archive::Unzip::Burst from 0.01 through 0.09 for Perl contains a bundled InfoZip library that is affected by several vulnerabilities

• ETJ Archive::Unzip::Burst
• CWE-1395

CryptX for Perl before version 0.065 contains a dependency that may be susceptible to malformed unicode

• MIK CryptX
• CWE-1395

Perl CryptX before version 0.087 contains a dependency that may be susceptible to an integer overflow

• MIK CryptX
• CWE-1395

laravel-auth0 SDK Deserialization of Untrusted Data vulnerability

• Insecure deserialization
• CWE-1395

>=7.0.0-BETA1, <7.2.2 · fixed in 7.2.2

multicast in source builds from vulnerable setuptools dependency

• CWE-1395

<2.0.9a0 · fixed in 2.0.9a0

BSON::XS versions 0.8.4 and earlier for Perl includes a bundled libbson 1.1.7, which has several vulnerabilities

• MONGODB BSON::XS
• Memory corruption
• CWE-1104

FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

• ETHER FCGI
• Memory corruption
• CWE-1395

CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0

• CWE-1395

<0.8.0 · fixed in 0.8.0

Nokogiri updates packaged libxml2 to v2.13.8 to resolve CVE-2025-32414 and CVE-2025-32415

• CWE-1395

<1.18.8 · fixed in 1.18.8

vLLM vulnerable to Denial of Service by abusing xgrammar cache

• Denial of service
• CWE-1395

>=0.6.5, <0.8.4 · fixed in 0.8.4

RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

• HTTP request smuggling
• CWE-1395

<2025.1.0 · fixed in 2025.1.0

Nokogiri updates packaged libxslt to v1.1.43 to resolve multiple CVEs

• Memory corruption
• CWE-1395

<1.18.4 · fixed in 1.18.4

cheqd-node Security patch for upstream vulnerabilities in IBC-Go (ISA-2025-001) and Cosmos SDK (ISA-2025-002)

• CWE-1395

<3.1.8 · fixed in 3.1.8

Duplicate Advisory: Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

• CWE-1395

<1.18.3 · fixed in 1.18.3

Nokogiri updates packaged libxml2 to 2.13.6 to resolve CVE-2025-24928 and CVE-2024-56171

• Memory corruption
• CWE-1395

<1.18.3 · fixed in 1.18.3

Vulnerable OpenSSL included in cryptography wheels

• CWE-392
• CWE-1395

>=42.0.0, <44.0.1 · fixed in 44.0.1

Multiple rtmpdump vulnerabilities

• CWE-1395

<=2.3.1 · no fixed version yet

Dependency on Vulnerable Third-Party Component exposes Vulnerabilities in NI Vision Software

• NI Vision Development Module
• NI FlexRIO
• CWE-1395

The Umbraco Heartcore headless client library uses a vulnerable Refit dependency package

• Other injection
• CWE-1395

<1.5.0 · fixed in 1.5.0

Cross Site Scripting (XSS) vulnerability while uploading content to a new deployment

• Cross-site scripting (XSS)
• CWE-1395

<3.7.7.Final · fixed in 3.7.7.Final

pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

• Code injection
• CWE-25

>=1.2.0, <1.2.3 · fixed in 1.2.3

GFI Archiver Telerik Web UI Remote Code Execution Vulnerability

• GFI Archiver
• CWE-1395

Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify

• Prototype pollution
• CWE-1395

<10.9.3 · fixed in 10.9.3

curl_cffi bundles a version of libcurl affected by High Severity vulnerability

• CWE-1395

<0.7.0b6 · fixed in 0.7.0b6

hermes-management is vulnerable to RCE due to Apache commons-jxpath

• CWE-1395

>=0.8.2, <2.2.9 · fixed in 2.2.9

Kimai has an XXE Leading to Local File Read

• XML external entities (XXE)
• CWE-1395

<2.21.0 · fixed in 2.21.0

Indico has a Cross-Site-Scripting during account creation

• Cross-site scripting (XSS)
• CWE-1395

<3.3.4 · fixed in 3.3.4

pyca/cryptography has a vulnerable OpenSSL included in cryptography wheels

• CWE-1395

>=37.0.0, <43.0.1 · fixed in 43.0.1

NI SystemLink Server Ships Out of Date Redis Version

• NI SystemLink Server
• NI FlexLogger
• CWE-1395

Silverstripe uses TinyMCE which allows svg files linked in object tags

• Cross-site scripting (XSS)
• CWE-1395

<5.2.16 · fixed in 5.2.16

Fiona affected by CVE-2023-45853 related to MiniZip madler-zlib

• Memory corruption
• CWE-1395

<1.10b1 · fixed in 1.10b1

TYCO Illustra Pro Gen 4 - JQuery version

• Johnson Controls TYCO Illustra Pro4 Fixed cameras
• Johnson Controls TYCO Illustra Pro4 PTZ cameras
• CWE-1395

pdoc embeds link to malicious CDN if math mode is enabled

• CWE-1395

<14.5.1 · fixed in 14.5.1

NETGEAR ProSAFE Network Management System Tomcat Remote Code Execution Vulnerability

• NETGEAR ProSAFE Network Management System
• CWE-1395

Pimcore TinyMCE Bundle - tinymce CVE-2024-29203, CVE-2024-29881

• Cross-site scripting (XSS)
• CWE-1395

>=11.0.0-ALPHA1, <11.1.6.5 || >=11.2.0, <11.2.3 · fixed in 11.1.6.5, 11.2.3

Azure SDK Spoofing Vulnerability

• Microsoft Azure SDK
• CWE-1395

SAML authentication bypass due to missing validation on unsigned SAML messages

• CWE-1395

<0.64.3 · fixed in 0.64.3

Intumit inc. SmartRobot - Remote Code Execution

• Intumit inc. SmartRobot
• CWE-1395

Dependency on Vulnerable Third-Party Component in GitLab

• GitLab
• CWE-1395

ntpd has Dependency on Vulnerable Third-Party Component

• CWE-1395

<0.3.7 · fixed in 0.3.7