CVE Vulnerability Catalog

PickleScan before 0.0.33 fails to include the pty.spawn function in its unsafe globals list, allowing attackers to bypass security checks. Malicious actors can craft pickle payloads using pty.spawn to achieve arbitrary code execution when files are processed by PickleScan.

In version 1.0.0 of the python-pdfkit library by JazzCore, the from_string method allows the execution of JavaScript code within the context of the server application and the exfiltration of local files.

Nexi Payments Nexi XPay has a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

Missing authorization in the server management routes in Azuriom CMS before version 1.2.11 allows an authenticated attacker with admin.access permission to create AzLink server tokens and take over non-admin user accounts by changing their passwords and email addresses.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Information disclosure, Information tampering, and Unauthorized access.

NGINX Open Source has a vulnerability in the ngx_http_v3_module. When configured with the HTTP/3 QUIC module, a remote unauthenticated attacker, under specific conditions, can use a crafted HTTP/3 session to reopen a QPACK encoder stream, causing a Use-after-Free in the NGINX worker process leading to a restart. On systems with ASLR disabled or bypassed, code execution is possible.

Heap-based buffer overflow in NGINX ngx_http_proxy_v2_module and ngx_http_grpc_module. Specific configuration conditions and large headers can cause NGINX worker process crash, and in some cases allow code execution.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Access Control vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to denial of service.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain a Missing Authentication for Critical Function vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Code execution, Denial of service, Information disclosure, Information tampering, Remote execution, Script injection, and Unauthorized access.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Improper Authentication vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, leading to Unauthorized access.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an Inclusion of Functionality from Untrusted Control Sphere vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information disclosure.

In NGINX Gateway Fabric, when NGINX Plus is configured as the data plane, an injection vulnerability exists in the NGINX configuration generator component. User-supplied string values from the serverTokens field of the NginxProxy Custom Resource Definition and the extraAuthArgs field of the AuthenticationFilter Custom Resource Definition are rendered directly into NGINX configuration templates without sanitization or escaping. An authenticated attacker with permission to create or modify these Custom Resource Definitions may inject arbitrary NGINX configuration directives.

Stack-based buffer overflow in raw_to_header function in src/microtar.c in microtar 0.1.0. The function copies name and linkname fields using strcpy without ensuring null termination.

CVE-2026-54818 describes an improper neutralization of special elements used in an SQL command, allowing for Blind SQL Injection in Slimstat Analytics.

CVE-2026-54816 describes an improper control of code generation vulnerability that allows remote code inclusion in Monetizemore Advanced Ads. This issue affects Advanced Ads versions from n/a through 2.0.21.

CVE-2026-54814 describes improper control of filename for include/require statements in PHP, allowing for local file inclusion. This affects the Motors theme from n/a through 1.4.109.

CVE-2026-54813 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in Brainstorm Force SureDash. This issue affects SureDash versions from n/a through 1.8.0.

An integer overflow in the mtar_next function in microtar 0.1.0 allows a remote attacker to cause a denial of service (uncontrolled CPU consumption / infinite loop) via a crafted tar archive. The offset calculation uses 32-bit arithmetic.

In Fusion Builder versions <= 3.15.4, there is a vulnerability that allows arbitrary file deletion by users with appropriate permissions.

Versions of Kastell <= 2.0 are vulnerable to unauthenticated local file inclusion, which may lead to the disclosure of sensitive information.