CVE Vulnerability Catalog

A missing authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs. This issue affects versions from 3.11.0.0 before 3.25.0.

An authorization bypass vulnerability in Vimesoft Inc. Enterprise Video Platform allows accessing functionality not properly constrained by ACLs through a user-controlled key. The issue affects versions from 3.11.0.0 before 3.25.0.

An unverified password change vulnerability in Vimesoft Enterprise Video Platform allows authentication bypass. Affects versions from 3.11.0.0 before 3.25.0.

The Joomla extension Events Booking prior to version 5.8.0 by default allows unauthenticated users to upload media assets. This is an insecure default configuration.

An XML External Entity (XXE) vulnerability was discovered in libpvestorage-perl v9.1.1 and libpve-storage-perl v8.3.7. It allows an attacker to load external XML entities, potentially leading to file disclosure or unauthorized requests.

A business logic vulnerability in HCL Aftermarket EPC allows an unauthorized user to obtain passwords from the server by manipulating server responses. Lack of validation on email requests enables redirecting passwords to the attacker's own email address.

The AI Copilot WordPress plugin before version 1.5.4 does not bind OAuth access tokens to a WordPress user and accepts any valid token as an administrator session. This allows unauthenticated attackers who complete the public OAuth flow to execute privileged MCP tools as an administrator, including arbitrary user creation and role escalation.

The Aimogen Pro WordPress plugin contains a privilege escalation vulnerability. Missing capability checks in the 'aiomatic_call_google_ai_function' function allow unauthenticated attackers to use the 'aimogen_wp_god_mode' tool to clear function blacklists and execute arbitrary PHP functions, including creating administrator accounts.

The clawvet self-hosted API server before version 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as default in .env.example. Additionally, GET /api/v1/scans returns scan records containing userId values without authentication, allowing a remote unauthenticated attacker to harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey.

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form.

Jupyter Enterprise Gateway before version 3.3.0 interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., securityContext), and inject document boundaries (---, ...) to create arbitrary resources, including privileged pods.

Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.3.0 are vulnerable to Server Side Template Injection (SSTI) via KERNEL_XXX environment variables used during Kubernetes manifest rendering. Attackers can execute Python code and OS commands within the Enterprise Gateway service.

In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.

A vulnerability in Zoom Desktop Client for Windows, VDI Client, and Meeting SDK allows an unauthenticated attacker to perform account takeover over the network. The issue stems from improper input validation.

Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.3.0 have a vulnerability that bypasses the UID/GID restriction preventing kernel launches as root. A specially crafted KERNEL_UID or KERNEL_GID value allows running kernels as root, increasing the attack surface and potentially leading to container escapes, compromising worker nodes and the entire Kubernetes cluster.

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.

WireGuard Easy up to version 15.3.0 contains a vulnerability due to cryptographically weak one-time link token generation. The token is computed using CRC32 over a random value constrained to 0-999, allowing an unauthenticated attacker to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidates per client ID.

In the illumos SCTP inbound path, association lookup for INIT ACK chunks is performed without adequate validation of address parameters. A remote attacker can send a crafted SCTP INIT ACK packet, causing out-of-bounds access and kernel heap corruption, potentially leading to remote code execution.

A vulnerability in Argo Workflows before versions 3.7.15 and 4.0.6 allows bypassing the allow-list fix for CVE-2026-31892. Through the ArtifactGC field in WorkflowSpec, a user can inject an arbitrary strategic merge patch into the artifact-GC pod, including dangerous settings like hostPath, privileged mode, or hostNetwork.

In Frogman prior to version 1.6.3, users with PERM_READ access could call sensitive API functions, exposing AMI secrets, outbound dial PINs, Asterisk dialplan contexts, SSH commands, backup paths, CDR history, and raw AMI dumps with SIP fields (passwords, md5_cred, oauth_secret).