CVE Vulnerability Catalog

Sismics Docs (Teedy) v1.11 has incorrect access control in share-based read endpoints, allowing unauthorized attackers to access sensitive endpoints via a crafted request.

In statping-ng version 0.93.0, incorrect access control allows attackers to escalate privileges to Administrator and access sensitive components.

Version 0.1.1 of the anna-is-cute application has an issue in the /api/v0/pastes endpoint that allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

The impworks Bonsai v6.0 has an incorrect access control issue that allows authenticated attackers with Editor privileges to escalate their privileges to Administrator and make unauthorized changes to accounts, passwords, and configurations.

An issue in the uploadPostHandler component of linx-server v2.3.8 allows attackers to cause a Denial of Service (DoS) via a crafted POST request.

An issue in the attachment handling component of Feuerhamster MailForm v1.1.0 allows attackers to cause a Denial of Service (DoS) via a crafted request.

An issue in Zhoros SuperBin v1.0.0 allows attackers to execute a directory traversal via supplying files with names containing traversal characters.

Incorrect access control in the /{form}/webhooks/{webhook} endpoint of Deck9 Input v2.0.1 allows authenticated attackers to arbitrarily modify or delete another tenant's webhook via a crafted request.

An OS command injection vulnerability in the /manage/features/media component of kanishka-linux Reminiscence v0.3.0 allows attackers to execute arbitrary commands via supplying a crafted input.

CVE-2026-50870 is an information disclosure vulnerability in the configuration endpoint of Ben Busby's whoogle-search v1.2.3, allowing attackers to obtain sensitive information via a crafted GET request.

Discuz! X5.0 versions from 20260320 to 20260610 contain a local file inclusion vulnerability that allows authenticated administrators to execute arbitrary code by importing a specially crafted plugin configuration containing path traversal sequences.

In Spring AI Vector Stores, a vulnerability allows the use of special characters to force the execution of arbitrary queries in Elasticsearch, OpenSearch, and GemFire VectorDB. Affected components include: spring-ai-elasticsearch-store, spring-ai-opensearch-store, spring-ai-gemfire-store.

In OCaml-TLS before version 2.1.0, the server implementation does insufficient checks of the certificate provided by the client during client authentication. This allows impersonation with certificates that are not meant for client authentication.

In Spring Cloud Sleuth, it is possible for a user to provide specially crafted calls that may cause a denial-of-service (DoS) condition. The application is vulnerable when it uses a vulnerable version of org.springframework.cloud:spring-cloud-sleuth-instrumentation and Spring TX instrumentation is not disabled.

An issue in Iru, Inc Kandji Agent before v.4.7.5(5374) allows a local attacker to escalate privileges via a client validation gap to invoke restricted agent functionality.

An issue in Observeinc's Observe v.2026-01-28 and before allows a remote attacker to obtain sensitive information via the CSV Log export component.

A Time-Based Blind SQL Injection vulnerability in the alias_management module of OpenSIPS Control Panel (opensips-cp) prior to version 9.3.3 allows authenticated attackers to execute arbitrary SQL commands via the 'table' GET parameter in alias_management.php.

An issue in Microvirt MEmu Android Emulator version 9.2.7.0 allows a local attacker to escalate privileges via the MemuService.exe component.

A vulnerability was discovered in Rakuten Send Anywhere for Android (version 23.2.9) that allows untrusted applications to force arbitrary file downloads into the app's storage. These files appear in the application's trusted Received interface, creating a vector for arbitrary code execution or denial-of-service through resource exhaustion.

A code injection vulnerability in the wxExecute() function of OpenCPN v5.12.0 allows attackers to execute arbitrary code via embedding shell metacharacters.