CVE Vulnerability Catalog

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the web form description field. Attackers can craft a description with double-brace syntax that reaches the Vue template compiler, executing malicious code for every user viewing the form.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the product name field. Attackers can craft a product name with double-brace syntax that reaches the Vue template compiler, executing malicious code for every user viewing the product record.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the person name field. Attackers can craft a person name with double-brace syntax that reaches the Vue template compiler, executing malicious code for every user viewing the person record.

Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbitrary JavaScript in other users' browsers by injecting Vue.js template expressions into the lead title field. Attackers can craft a lead title with double-brace syntax that reaches the Vue template compiler, executing malicious code for every user viewing the lead record.

A vulnerability was found in ruoyi-vue-pro up to 2026.08 in the getOriginalFilename function of MpMaterialServiceImpl.java in the File Upload component. Manipulation leads to path traversal. The exploit is public and the vendor did not respond.

A vulnerability was found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the File Upload component, specifically in FileController.java. Manipulation of input leads to cross-site scripting (XSS). The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08 in the GoView Data Endpoint component, specifically in the GoViewDataServiceImpl.getDataBySQL function. Manipulation of the sql argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

In YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08, the AiKnowledgeDocumentServiceImpl.readUrl function in AiKnowledgeDocumentServiceImpl.java (AI Knowledge Module component) allows a remote attacker to trigger server-side request forgery by manipulating the url argument. The exploit has been published, and the vendor has decided to retain the existing behavior without a code change.

An integer overflow exists in the BSON document encoding component of the MongoDB Python Driver's bundled native extension when a document is built from an unusually large amount of caller-supplied data. Size arithmetic uses a signed 32-bit type and the overflow guard has undefined behavior under the C standard. Depending on how the native extension was built, this can cause an out-of-bounds write within the application's own process.

PyMongo's connection string parsing decodes percent-encoded characters in the host portion before the host list is separated on its delimiters. When an application places a hostname value supplied by an unauthenticated party into a connection string, that party may cause additional servers of their choosing to be added to the application's database client. The application may then send its authentication exchange and database operations to one of those servers, which can observe limited information and return altered results.

The client-side field level encryption support in the MongoDB Python Driver can treat a key management endpoint value ending in '.sock' as a local Unix domain socket path rather than a remote host. A user with write access to the encryption key metadata stored in the database can cause an application using the driver to open connections to local sockets on the application host. Data sent over these connections is limited to the start of a TLS handshake, so no chosen content is transmitted.

An uncontrolled search path element in InsightVM assessment content in Rapid7 Insight Agent on Windows allows a local, low-privileged user to execute arbitrary code as SYSTEM via a planted executable resolved from the machine PATH. Assessment content at or below version 0.0.261.0 invoked the `code` command without a fully qualified path from a SYSTEM process, resolving it against the machine PATH. The issue was resolved in assessment content version 0.0.269.0, released September 15, 2026, and remediation was deployed automatically.

ServiceNow has remediated a missing authorization vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable an unauthenticated user, in certain circumstances, to extract instance data beyond what was intended, resulting in privilege escalation.

ServiceNow has remediated an authorization bypass issue in the ServiceNow AI Platform. If exploited, it could enable an unauthenticated user to access data within the platform that they are not entitled to access, potentially enabling further unintended access. ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

ServiceNow has remediated an improper access control issue in the ServiceNow AI Platform. This issue could enable an unauthenticated user, in certain circumstances, to create, modify, or delete instance data beyond what was intended. In August 2026, ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

ServiceNow has remediated an authorization bypass issue in the ServiceNow AI Platform. If exploited, it could enable an authenticated user to access data within the platform that they are not entitled to access, potentially enabling further unintended access. ServiceNow deployed the update to hosted instances and provided it to partners and self-hosted customers.

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a transition address embedding a private, loopback, or link-local IPv4 target, and isAlwaysBlocked and isPrivateNetwork classify the address as allowed. In a deployment that routes the applicable transition format, user-facing imports, webhooks, integrations, or plugin egress can reach internal services or cloud metadata and expose returned information. This issue is fixed in version 3.4.0.

Plaintext exposure of sensitive authentication data in Brocade SANnav discovery service log files enables individuals with file read access to retrieve administrative switch credentials and active session tokens. An attacker with access to system logs or support bundles can leverage the exposed authentication details to compromise managed network infrastructure and access active application sessions. This affects Brocade SANnav versions before 3.0.1a.

Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contains an improper certificate validation vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to protection mechanism bypass and unauthorized access.

Dell Rugged Control Center (RCC), versions prior to 5.2.206, contains an improper authorization vulnerability. A low-privileged attacker with local access could potentially exploit this vulnerability, leading to elevation of privileges.