CVE Vulnerability Catalog

An authenticated user may write data outside the intended Docker cache path under specific remote-repository conditions.

Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain elevated access to sensitive resources. Exploitation of this issue does not require user interaction.

Use-after-free in Windows Ancillary Function Driver for WinSock. An authorized attacker can elevate privileges locally.

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

A vulnerability in the Remote Access SSL VPN service for Cisco Secure Firewall ASA and FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition. The issue is due to insufficient error checking when processing HTTP requests. An attacker could exploit this by sending a crafted HTTP request to the VPN service.

Metabase allows a remote, unauthenticated attacker to inject arbitrary SQL via the '/reset_password' database endpoint and gain administrator access to the connected Metabase instance.

An authentication issue in Apple products was addressed with improved state management. An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Tahoe 26.6.1, and macOS Tahoe 26.7.

The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. An attacker can craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading to unauthorized access.

An incomplete patch for CVE-2026-18556 allows authentication bypass and account takeover in N-central versions up to 2026.3.1.

Authentication bypass using an alternate path or channel vulnerability in N-able N-central through version 2026.1 allows authentication bypass.

VMware vCenter contains a directory traversal vulnerability in the Syslog server. A malicious actor with network access to vCenter may exploit this issue to execute arbitrary code.

The web interface of Cisco Secure Firewall Management Center (FMC) contains static credentials for a low-privileged account, allowing an unauthenticated remote attacker to log in and access sensitive data. This vulnerability can be chained with other flaws for privilege escalation.

JFrog Artifactory (Self Hosted) versions before 7.133.11 are vulnerable to a privilege escalation attack due to a validation check of the token signature/issuer and not the token’s scope.

In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.

VeloCloud Orchestrator (VCO) on-prem has a vulnerability that allows a remote attacker to access privileged internal functionality, impacting the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and managed data. This issue is actively exploited.

Authentication bypass vulnerability in Check Point SmartConsole login. An unauthenticated remote attacker can obtain a login token and authenticate with full administrative privileges. The vulnerability is being actively exploited.

WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with a SQL Injection in WP_Query (CVE-2026-60137), could allow SQL Injection and Remote Code Execution.

WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 fail to properly sanitize the author__not_in parameter of WP_Query. This could allow SQL Injection when a plugin or theme passes untrusted input to this parameter.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to chain the /api/v1/auto_login endpoint (generates SUPERUSER tokens) with /api/v1/validate/code (executes code via exec()), leading to remote code execution (RCE) on default installations.

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.