CVE Vulnerability Catalog

CVE-2026-47339 in Apache APISIX has an incorrect authorization vulnerability that allows an attacker to authenticate using credentials from a different source. This issue affects versions from 2.14.1 through 3.16.0.

Improper Input Validation vulnerability in Apache APISIX allows an attacker to spoof identity headers by exploiting certain configuration in the forward-auth plugin. This issue affects versions from 2.12.0 through 3.16.0.

Versions of SIMA GmbH Bondix up to 1.25.7.5 on Linux contain an OS command injection vulnerability in the environment and tunnel configuration functionality. This allows an authenticated attacker with configuration write access to execute arbitrary operating-system commands via crafted configuration values passed to server-side scripts.

In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration.

Software running as a non-privileged user may conduct improper GPU system calls, leading to mismanagement of resources and a write use after free scenario.

CVE-2026-34192 vulnerability affects software running as a non-privileged user that may conduct improper GPU system calls, leading to an error path and use-after-free of GPU page tables.

The security fix for CVE-2025-0728 in eclipse-threadx NetX Duo introduced a new vulnerability. The shared cleanup path in the HTTP server PUT process calls fx_file_close() even when the file was never opened, leading to undefined behavior, double-close issues, or memory corruption.

The vulnerability in Dell Server Hardware Manager prior to version 3.2.2 is due to improper access control. It allows a local attacker with low privileges to elevate their privileges in the system.

A DoS vulnerability in the 10G iSCSI interface of the Hitachi Virtual Storage Platform may lead to system availability disruptions. This affects several models, including E990, E1090, E390, G100, and VX7.

The CVE-2026-8806 vulnerability in the FX5-ENET/IP Ethernet module of Mitsubishi Electric's MELSEC iQ-F series allows a remote attacker to cause a denial-of-service (DoS) condition by continuously sending a large number of communication packets in a short period, leading to product processing overload.

CVE-2026-8805 describes an integer overflow vulnerability in the EtherNet/IP function of Mitsubishi Electric MELSEC iQ-F Series FX5-EIP module. This allows a remote attacker to cause a denial-of-service (DoS) condition by rapidly establishing a large number of TCP connections.

SQL injection vulnerability in pgAdmin 4 affects sixteen Jinja templates where user-supplied descriptions are directly interpolated into SQL literals without proper escaping. An authenticated user with permissions to create or alter objects (domains, foreign tables, languages, event triggers) can inject arbitrary SQL commands, potentially leading to OS command execution if the PostgreSQL role has superuser privileges.

PraisonAI before 1.5.115 contains a path traversal vulnerability in MultiAgentMonitor that fails to sanitize agent IDs when building file paths. Attackers can include traversal sequences like ../ in agent IDs to read, write, or overwrite arbitrary files.

PraisonAI before 1.5.128 contains a cross-origin agent execution vulnerability in the AGUI endpoint that allows remote attackers to trigger arbitrary agent execution. The POST /agui endpoint lacks authentication and hardcodes Access-Control-Allow-Origin: * headers, enabling attackers to bypass CORS preflight checks.

PraisonAI before 4.5.128 contains an arbitrary shell command execution vulnerability where the UI modules hardcode approval_mode to auto, overriding administrator configuration from PRAISON_APPROVAL_MODE environment variable. Authenticated attackers can instruct the LLM agent to execute arbitrary shell commands.

A security issue has been identified in Chef 360 that could allow unauthorized access to protected API endpoints under specific conditions. This issue is due to improper handling of URL-encoded paths during request processing.

In versions prior to 0.9.6 of the Open WebUI platform, there is a vulnerability in the terminal-server reverse proxy that allows authenticated users to exploit `../` sequences to escape the intended path scope, potentially leading to unauthorized access to files and endpoints on the terminal server.

A vulnerability in Cost Management Interactive Experiences allows an unauthorized attacker to disclose sensitive information over a network. The flaw is due to exposure of sensitive data to an unauthorized actor.

Improper authentication in Azure Bot Service allows an authorized attacker to elevate privileges over a network.

In versions 15.0.6 and below, the TarUtils.untar() function in OneDev creates symbolic links without validating whether the target is an absolute path. This allows writing to arbitrary server-side locations by authenticated users with CI Job write access.