CVE Vulnerability Catalog

FrankenPHP is a modern application server for PHP, which in versions from 1.11.2 to before 1.12.3 has an issue in the splitPos() function in cgi.go. This flaw allows an attacker to mislead the server into treating a non-PHP file as a PHP script, potentially leading to remote code execution.

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.3.2512.11, 10.2.2510.15, 10.1.2507.23, and 9.3.2411.132, a low-privileged user can store a malicious script in a classic dashboard HTML panel, leading to unauthorized JavaScript code execution in another user's browser.

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, and Splunk Cloud Platform versions below 10.4.2604.3, 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user can send server-side requests to arbitrary internal destinations through the Dashboard Studio PDF export feature. The vulnerability exists due to improper trusted-domain validation and automatic following of HTTP redirects without re-validating each redirect target.

In Splunk Enterprise versions below 10.2.4, 10.0.7, 9.4.12, and 9.3.13, as well as Splunk Cloud Platform versions below 10.3.2512.12, 10.2.2510.14, 10.1.2507.22, and 9.3.2411.132, a low-privileged user without 'admin' or 'power' roles can perform Remote Code Execution (RCE) through the Splunk Secure Gateway app. This issue arises from unsafe deserialization of App Key Value Store (KV Store) data using the 'jsonpickle' library.

In aws-cdk-lib before version 2.245.0 (2.246.0 on Windows), there is an OS command injection vulnerability in the NodejsFunction local bundling pipeline. An attacker controlling the value of one or more bundling properties can execute arbitrary commands on the host running the CDK toolchain.

An Argument Injection vulnerability was found in NoMachine before versions 9.5.7 and 8.23.2. The flaw is due to improper neutralization of argument delimiters in a command, allowing an attacker to inject malicious arguments.

In Erlang OTP, the erts driver (inet_drv) contains a stack-based buffer overflow in sctp_parse_error_chunk, which writes cause codes into a fixed-size array without bounds checking. An unauthenticated remote attacker with an established SCTP association can send a crafted SCTP ERROR chunk and crash the BEAM VM. Limited leakage of VM memory fragments is also possible.

Plane is an open-source project management tool. Prior to version 1.3.1, there was a cross-workspace asset authorization bypass that allowed any authenticated user to read, copy, delete, and overwrite assets in other Plane workspaces.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is a vulnerability that allows bypassing security checks related to path validation, potentially leading to path traversal attacks.

Roxy-WI, a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers, has an authentication bypass vulnerability in versions 8.2.6.4 and prior. This vulnerability allows bypassing authentication via the 'api' substring in the URL and accessing the unauthenticated /api/gpt.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the central Pydantic validator does not properly block metacharacters, allowing an attacker to inject unauthorized commands.

CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A missing authentication check on the Aix-DB '/llm/process_llm_out' endpoint allows unauthenticated clients to execute arbitrary 'SELECT' SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints.

A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A vulnerability in libnfs through version 6.0.2 before commit 55c18ea fails to validate a string size, leading to an integer overflow when connecting to a crafted NFS server. The issue resides in libnfs_zdr_string in lib/libnfs-zdr.c.

A flaw was found in migration-planner-ui-app that allows an attacker to register a malicious discovery agent using a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link, the embedded malicious code executes within the user's browser session.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the configver parameter in the URL path is interpolated without proper validation, leading to command injection vulnerabilities for authenticated users.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is no role check or group ownership check on the server_ip field, allowing any authenticated user, including guests, to start, stop, or restart the roxy-wi-smon-agent systemd unit on any server.