CVE Vulnerability Catalog

Vulnerability in Oracle Enterprise Manager Base Platform (component: Event Management) affecting versions 13.5 and 24.1. A low privileged attacker with network access via SOAP can easily exploit it, resulting in unauthorized creation, deletion or modification of critical data.

In libp2p-rust, libp2p-quic could panic during an inbound QUIC handshake when a remote peer presented a valid short-lived libp2p TLS certificate and delayed the final TLS 1.3 handshake fragment until after the certificate expired. In the Quinn post-handshake upgrade path, the code called libp2p_tls::certificate::parse a second time and used expect on the result; the repeated wall-clock validity check could reject the now-expired certificate, causing the expect call to terminate any application exposing an affected libp2p-quic listener. Fixed in 0.13.1.

The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml. The vulnerability may allow an attacker to access files outside the intended directory.

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component. The vulnerability can be exploited to inject malicious script.

Netmaker makes networks with WireGuard. Prior to version 1.5.0, the sqliteDeleteRecord function in Netmaker's database layer constructs SQL DELETE statements using direct string concatenation of user-supplied input. This allows an authenticated attacker to perform boolean-based SQL injection.

Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action using only the global access_sitemap task permission and did not check per-page edit permission before updating each page's display order. An authenticated user with sitemap access could change the display order of pages they had no rights to edit. The reorder action also lacked CSRF token validation.

Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery in remote file import due to cross-port reuse of a host's validated DNS pin. A low-privileged authenticated user could supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during download, allowing the server to fetch internal-only resources and save them to the file manager.

Concrete CMS 9.0.0 through 9.5.2 is vulnerable to Insecure Direct Object Reference (IDOR) in the Express saved search preset delete and edit dialogs. An authenticated user with only view permission on a single Express entity could permanently delete or rename saved search presets owned by entities they had no permission for, and a renamed preset name was displayed back to users, enabling defacement or social engineering.

Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend action. An authenticated user with Edit Page Multilingual Settings permission on a single page could bind an arbitrary page in another locale as that source page's translation and delete legitimate translation pairs, altering public-facing language routing.

Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept privileged directory service credentials via a spoofed domain controller certificate. The vulnerability enables a man-in-the-middle attack.

A local privilege escalation vulnerability in the pdfforge PDF Architect activation-service Update Service due to an uncontrolled search path element. The activation-service process loads a library from an unsecured location. An attacker must first obtain the ability to execute low-privileged code on the target system.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to memory corruption during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a memory corruption condition. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds write during PDF file parsing. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated object. User interaction is required: the target must visit a malicious page or open a malicious file.

A remote code execution vulnerability in pdfforge PDF Architect due to an out-of-bounds read during the handling of App objects. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. User interaction is required: the target must visit a malicious page or open a malicious file.

Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged authenticated user to obtain other users' credentials and reach internal or cloud-metadata network endpoints via a crafted connection definition submitted for datacenter discovery. The vulnerability can be exploited for privilege escalation and lateral movement.

Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking the view-password permission to obtain cleartext passwords via a request to the entry listing endpoint with password disclosure parameters. The vulnerability compromises the confidentiality of stored credentials.

Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 and earlier allows a network-positioned attacker to intercept and tamper with outbound TLS connections via a spoofed or self-signed certificate.

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Joomla Extension J2Store in versions 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 reflects unescaped request data into the PayPal notify redirect. A crafted link to the paypal notify endpoint, if followed by a victim's browser, causes the redirect to com_j2store's checkout controller to carry attacker-chosen query parameters.