CVE Vulnerability Catalog

A SQL injection vulnerability was found in Webbeyaz Web Design Mediküm Web due to improper neutralization of special elements in SQL commands. This allows an attacker to execute arbitrary SQL queries on the database.

The vulnerability in the Imager library for Perl before version 1.033 mishandles unsigned EXIF IFD entry counts as signed, potentially leading to an attempt to allocate a huge memory block and process crash. An attacker can exploit this by crafting an image with malicious EXIF data to terminate a worker process.

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino before version 1.2.1.

An Improper Authentication vulnerability in DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

The WP Learn Manager plugin for WordPress up to version 1.1.8 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can exploit this flaw to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.

The Simple Coherent Form plugin for WordPress up to version 2.4.13 is vulnerable to arbitrary file deletion due to insufficient path validation in the removeUploadDir function. The scf_get_id_upload endpoint provides a valid nonce to unauthenticated users, and the secondary hash check relies on a hardcoded salt, making both controls ineffective.

A vulnerability in WebPros Plesk before version 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own. This is due to incorrect authorization in the XML-RPC API, where ownership is enforced only for certain lookup filters and schema validation is bypassed for legacy protocol versions.

The openmemory/api component in mem0 contains an unauthenticated access vulnerability that allows unauthenticated attackers to read, write, and delete arbitrary user memories by accessing API routers registered without authentication middleware. Attackers can supply arbitrary user_id parameters or directly access memory retrieval endpoints to expose private memory content, or invoke pause endpoints with global_pause=true to cause denial-of-service across all users.

Fire-Boltt Smartwatch FB BGS001 with firmware MOY-JS14-2.0.4 has an improper authentication vulnerability. The device accepts GATT Write Request commands without sufficient authentication or strong session validation. Under specific conditions, previously captured BLE packets can be replayed from a nearby device to trigger functionality on the smartwatch.

Trueview Security camera T18161-AF firmware version 4.9.60.0 contains an authentication bypass vulnerability due to improper password validation and hard-coded credentials in the firmware.

A vulnerability in the DBI library for Perl before version 1.650 causes an out-of-bounds read by one byte during processing of an initial SQL comment in the preparse method. The issue occurs when deleting a comment at the beginning of an SQL query.

A heap overflow vulnerability in DBI versions before 1.650 for Perl occurs when preparsing SQL statements with an extreme number of placeholders. The fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2 million placeholders. Version 1.650 sets a hard limit of 99,999 placeholders.

The vulnerability in mem0 exposes unauthenticated config API endpoints that disclose LLM API keys in plaintext and allow server-side request forgery (SSRF) via the attacker-controlled ollama_base_url parameter. Unauthenticated attackers can retrieve stored secrets like OpenAI API keys via GET /api/v1/config/ or trigger SSRF attacks by setting ollama_base_url to internal addresses such as cloud IMDS via PUT /api/v1/config/mem0/llm endpoint.

In Coder prior to versions 2.24.5, 2.29.13, 2.30.8, 2.31.12, 2.32.2, and 2.33.3, the `azureidentity.Validate()` function does not verify the PKCS#7 signature, only checking that the signer certificate chains to a trusted Azure CA. An attacker can embed a legitimate Azure certificate alongside arbitrary content, e.g., `{"vmId":"<target>"}`, and the forged `vmId` will be accepted, returning the victim workspace agent's session token.

Cognee before version 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration by self-registering an account and calling the settings endpoint, which performs no admin or superuser check. Attackers can redirect all LLM operations instance-wide to an attacker-controlled endpoint by exploiting the process-wide singleton configuration cache, enabling exfiltration of prompts, uploaded documents, extracted entities, and knowledge graph content from all users.

9Router before version 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint. The sudoPassword field from the request body is passed to the stdin of a 'sudo -S sh' process, allowing a remote unauthenticated attacker to execute arbitrary OS commands.

A missing authentication for critical function vulnerability in Esri Portal for ArcGIS versions 12.1 and earlier on Windows, Linux and Kubernetes allows a remote, unauthenticated attacker to access an unprotected API.

An improper authentication vulnerability has been discovered in Dell PowerProtect Data Domain. An unauthenticated attacker with remote access could exploit this flaw to gain unauthorized access. This is a critical severity vulnerability as it allows complete system takeover.

A path traversal vulnerability has been discovered in Dell PowerProtect Data Domain. An unauthenticated attacker with remote access could exploit this flaw to gain unauthorized access to the system. This is a critical severity vulnerability as it allows complete system compromise.