CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability in the CGI program of Zyxel GS1900-48HPv2 firmware versions through 2.90(ABTQ.1)C0 could allow a LAN-based, unauthenticated attacker to exploit the flaw and potentially execute OS commands via a crafted HTTP request.

A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager allows an authenticated remote attacker to create or overwrite any file on the filesystem. This is due to improper input validation during file upload.

The LiteSpeed cPanel plugin before version 2.4.8 (as distributed in LiteSpeed WHM PlugIn before 5.3.2.0) mishandles symlinks provided by a user with FTP or web shell access on a shared hosting server running CloudLinux/CageFS. This vulnerability was exploited in the wild in May 2026.

SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication flow. Identity tokens submitted during login are accepted without verifying their cryptographic signature, allowing a remote, unauthenticated attacker to obtain a fully authenticated technician session.

A vulnerability in Oracle PeopleSoft Enterprise PeopleTools (component: Updates Environment Management). Affects versions 8.61 and 8.62. Easily exploitable, allows an unauthenticated attacker via HTTP to take over PeopleSoft Enterprise PeopleTools.

In Splunk Enterprise 10.2 before 10.2.4 and 10.x before 10.0.7, an unauthenticated user can create or truncate arbitrary files via a PostgreSQL sidecar service endpoint. The endpoint lacks authentication.

An OS command injection vulnerability in Fortinet FortiSandbox (versions 5.0.0-5.0.5, 4.4.0-4.4.8, 4.2 all, FortiSandbox Cloud 5.0.4-5.0.5, FortiSandbox PaaS 5.0.4-5.0.5). An unauthenticated attacker can execute unauthorized commands via crafted HTTP requests.

An OS Command Injection vulnerability in Ivanti Sentry before versions R10.5.2, R10.6.2 and R10.7.1. A remote unauthenticated user can achieve root-level remote code execution.

An out-of-bounds read and write vulnerability in the V8 engine in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High.

A logic flow weakness in Remote Access and Mobile Access certificate validation in deprecated IKEv1 key exchange. An unauthenticated attacker can bypass user authentication and establish a VPN connection without a valid password.

On affected platforms running Arista EOS, a tunnel decapsulation configuration, such as VXLAN, decap-groups, or a GRE tunnel interface, may lead to incorrect decapsulation and forwarding of other unexpected tunneled packets. This issue arises from the switch's failure to verify the tunnel protocol type.

A vulnerability in the JCE editor extension for Joomla allows unauthenticated users to create new editor profiles, ultimately resulting in PHP code upload and execution.

A vulnerability in the CLI of Cisco Catalyst SD-WAN devices (Controller, Manager, Validator) allows an authenticated local attacker with netadmin privileges to execute arbitrary commands as root by uploading a crafted file. The issue is due to insufficient input validation. Cisco has observed limited exploitation resulting in configuration changes on edge devices.

SolarWinds Serv-U is susceptible to specially crafted POST requests with Content-Encoding: deflate that crash the Serv-U service without authentication.

An OS Command Injection vulnerability in the API of Progress ADC products allows an unauthenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

A vulnerability in Cisco Unified Communications Manager and Unified CM SME allows an unauthenticated remote attacker to perform SSRF attacks. The attacker can write files to the OS, potentially leading to root privilege escalation. WebDialer service must be enabled (disabled by default).

In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This leads to local escalation of privilege with no additional execution privileges needed and no user interaction.

Critical vulnerability in Oracle Payments (Oracle E-Business Suite) versions 12.2.3-12.2.15. An unauthenticated attacker with network access via HTTP can fully compromise the system without any privileges.

Nx Console, the user interface for Nx and Lerna, had a malicious version 18.95.0 available for about 18 minutes in Visual Studio Marketplace and about 36 minutes in OpenVSX. Users should upgrade to version 18.100.0, which is not compromised.

Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP Host request header was not validated before being used to reconstruct request.url. Because the routing algorithm relies on the raw HTTP path while request.url is rebuilt from the Host header, a malformed header could make request.url.path differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on request.url (rather than the raw scope path) could therefore be bypassed.