CVE Vulnerability Catalog

ToolJet before v3.16.208 fails to validate organizationId ownership in database write and destroy routes, allowing any builder-role user to create, alter, or drop tables in other organizations' databases. Attackers can exploit missing guards to permanently delete tables, insert arbitrary data, and modify schemas across tenant boundaries on shared instances.

@hulumi/policies before 1.3.2 fail to fully inspect inline and attached IAM policy evidence for the administrator-policy guardrail. Attackers can craft admin-equivalent policy paths that bypass policy evaluation controls.

hulumi before v1.3.2 contain a deployment SCP template that allows tag-on-create bypasses for hulumi:iac-role protections. Attackers can bypass intended IAM boundary restrictions by exploiting the weakened SCP template in downstream deployments.

@hulumi/drift before 1.3.2 accept externally supplied execute plans without sufficient provenance validation, allowing untrusted reconciliation input to be treated as trusted. Attackers can supply malicious execute plans that bypass security checks to perform unsafe reconciliation operations.

A privilege escalation vulnerability in hulumi before v1.3.2 exists in the weekly integration IAM policy, allowing role lifecycle operations on af-e2e-* roles without sufficient boundary restrictions. Attackers with the documented principal can create persistent higher-privilege roles in the sandbox account.

A vulnerability in @hulumi/policies before 1.3.2 fails to properly validate set-qualified AWS IAM condition operators in GitHub OIDC trust policies. Attackers can use ForAnyValue:StringLike operators to hide wildcard GitHub Actions OIDC subject conditions from security guardrails.

A vulnerability in @hulumi/policies before 1.3.2 contains an evidence validation bypass in Cloudflare and deployment-governance validators, allowing attackers to suppress violations by submitting unrelated compliant evidence. Attackers can use evidence from different zones, hostnames, origins, or repositories to bypass security guardrails for unrelated resources in the same stack.

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is concatenated into the SMTP MAIL FROM command (as SIZE=...) without sanitization, allowing injection of arbitrary SMTP commands such as RCPT TO to silently add attacker-controlled recipients.

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

Dell PowerStore contains a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with network access to the restricted management interface could potentially exploit this vulnerability to read internal system information from the appliance filesystem. This is a Critical vulnerability as it could expose sensitive information and credentials which allow full administrative access to the array.

A vulnerability was found in TOTOLINK NR1800X 9.1.0u.6681_B20230703 in the setUploadSetting function of /cgi-bin/cstecgi.cgi. Manipulation of the FileName argument leads to a stack-based buffer overflow. The attack can be executed remotely, and the exploit has been made public.

A flaw was found in D-Link DIR-825M 1.1.8 in the sub_41802C function of /boafrm/formLtefotaUpgradeFibocom, related to LTE module firmware upgrade. Manipulation of the fota_url argument causes a stack-based buffer overflow. The attack can be carried out remotely, and the exploit has been published.

A vulnerability was detected in D-Link DIR-825M 1.1.8. It affects the function sub_46725C in the file /boafrm/formDiskFormat of the Disk Formatting Handler Endpoint. Manipulation of the argument partition results in a stack-based buffer overflow. The attack can be executed remotely, and the exploit is public.

A vulnerability in Tenda HG10 300001138 affects the formIPv6Routing function in the file /boaform/admin/formIPv6Routing of the Boa Web Server component. Manipulation of the destNet argument causes a buffer overflow. The attack can be carried out remotely, and the exploit is publicly available.

A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.

The MyHome Core plugin for WordPress up to version 4.4.5 contains an authentication bypass vulnerability. This is due to missing authorization in the send_link() AJAX handler and improper token validation in the activate() function. This allows unauthenticated attackers to generate an activation token for an unconfirmed user account and obtain a valid authentication cookie for that account, including administrators.

The Custom User Registration Fields for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 2.2.3. This is due to the plugin accepting an attacker-controlled afreg_select_user_role value from the unauthenticated WooCommerce Store API /wc/store/v1/checkout request, persisting it in order meta, and then passing it directly to WP_User::add_role() without validating against the plugin's admin-configured allowed role list. This makes it possible for unauthenticated attackers to elevate their privileges to Administrator by creating an account during checkout with a modified JSON body specifying administrator as the desired role.

Cloud Commander before version 19.20.2 contains a directory traversal vulnerability in REST file-operation and markdown endpoints that fails to properly validate path normalization. Attackers can use path traversal sequences to read, write, move, or copy files outside the configured root directory.

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCD_API_TOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications, request syncs, and modify Argo CD resources.

The Omnivore API (packages/api) before the fix in commit abf53d6 contains an authentication bypass in Apple sign-in token verification. The decodeAppleToken function extracted the 'alg' field from the attacker-supplied JWT header and passed it as the sole allowed algorithm to jwt.verify(). Using jsonwebtoken v8 (which does not validate key/algorithm compatibility), an attacker can set alg=HS256 and sign a forged token using Apple's publicly available RSA public key as the HMAC secret, bypassing signature verification and impersonating any Apple-linked account.