CVE Vulnerability Catalog

In Eclipse Theia versions prior to 1.69.0, custom task definitions in workspace files could be executed without requiring workspace trust. An attacker could craft a malicious repository that, when cloned and opened in Theia, leads to execution of arbitrary commands with the user's privileges.

In Eclipse Theia versions prior to 1.71.0, the AI chat agent processed workspace file and directory names as part of its prompt context without distinguishing them from system instructions. An attacker could craft a malicious repository with adversarial directory or file names, leading to the execution of attacker-controlled instructions.

In GeoServer, prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator to pass arbitrary file names to the Master Password Dump web page, potentially creating files containing the master password in plaintext.

GeoServer is an open source software that allows users to share and edit geospatial data. In versions prior to 2.27.0 of the DB2 DataStore extension, an administrator could perform a JNDI attack via a specially crafted DB2 jdbc URL, leading to Remote Code Execution (RCE). Version 2.27.0 fixes this issue.

Vulnerability in FFmpeg's libavcodec library, in the MagicYUV decoder, causing an out-of-bounds write. This can lead to denial of service and, in some cases, remote code execution.

CVE-2026-56012 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in the David Lingren Media Library Assistant application.

UBB.threads is vulnerable to Denial of Service (DoS). An authenticated attacker can send multiple concurrent requests to view any user profile, leading to exhaustion of database resources and complete denial of access to the application for other users.

UBB.threads is vulnerable to Path traversal, allowing attackers with privilege to edit templates to read and write any file on the application’s server, resulting in Remote Code Execution.

UBB.threads is vulnerable to Blind SQL Injection, allowing attackers with access to the Members in Control Panel to interact with the underlying database. Due to insufficient input sanitization, an attacker can extract sensitive information, such as user credentials.

uBB.threads is vulnerable to a Cross-Site Request Forgery (CSRF) due to a lack of protective mechanisms. This allows an attacker to trick an authenticated user into executing unintended actions.

In the Woodpecker CI/CD engine, from version 3.0.0 to 3.14.1, a vulnerability in the gRPC layer allowed authenticated agents to impersonate other agents on the same server by injecting a forged `agent_id` value into outgoing gRPC metadata. Version 3.14.1 patches this issue.

In some shadow paging error paths, page tables may be switched without updating the currently running vCPU reference. This can lead to a mismatch between the loaded page tables and the mapcache metadata, potentially resulting in corruption of the mapcache.

Access to HVM guest I/O ports is subject to emulation or at least translation, which requires synchronization with updates. The current implementation lacks synchronization when handling these accesses.

An OS Command Injection vulnerability exists in LMS (LAN Management System) before commit 9fcb4de. The issue arises from an IP address parameter being passed to the 'exec()' function without proper validation, allowing attackers to execute arbitrary operating system commands.

An SQL Injection vulnerability exists in LMS (LAN Management System) before commit 4cb30a7 within the 'tarifflist.php' module due to insufficient sanitization of the POST 'tg[]' parameter. This allows authenticated attackers to perform Error-Based SQL injection and extract sensitive database information.

The vulnerability allows local privilege escalation by loading malicious DLLs from a shared temporary directory in DFIR-ORC versions 10.2.7 and prior. An attacker with access to the system can place a malicious DLL in C:\Windows\Temp, enabling automatic loading when the application is executed with administrative privileges.

An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. An authenticated client with low-privilege tokens can access high-privilege tools by using an older protocol version.

SEPPmail versions before 15.0.5 allow improper handling of attachment filenames during encrypted PDF generation. An attacker can exploit this to create new files outside the intended directory.

Cotonti 1.0.0 is vulnerable to stored Cross-Site Scripting in the Personal File Storage (PFS) module. A folder title (pff_title) is imported with the 'TXT' filter, which does not strip or encode HTML (the tag check in cot_import is disabled), so an authenticated user can store HTML/JavaScript in a folder title.

Cotonti 1.0.0 is vulnerable to Cross-Site Request Forgery in the Personal File Storage (PFS) module. The file upload action ('a=upload') processes uploaded files without calling cot_check_xg to validate the anti-CSRF token, even though sibling actions such as 'delete' do.