CVE Vulnerability Catalog

By default, Payara Server does not limit the number of failed login attempts, which can leave it vulnerable to brute force login attacks. To mitigate this, Payara Server includes built-in automatic attack protection.

A vulnerability has been found in OpenBankProject OBP-API up to 1.10.1. This impacts the function KryoInjection.invert of the file obp-api/src/main/scala/code/api/cache/Redis.scala of the component Kryo Handler. Such manipulation leads to deserialization. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A flaw has been found in OpenClaw ClawScan up to 0.1.6 in an unknown function of internal/runner/static_scanner.go in the Static Scanner component. The manipulation causes incomplete comparison with missing factors, and the attack can be launched locally. The exploit has been published and may be used.

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6 in the IsBinaryFile function of internal/runner/static_scanner.go in the File Classifier component. The manipulation results in interpretation conflict, and local access is required. The exploit is now public and may be used.

The MotoPress Hotel Booking plugin for WordPress in all versions up to and including 6.2.4 is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' due to insufficient input sanitization and output escaping. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment.

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen while processing a TLS handshake. This can happen in a non-deterministic manner that is beyond the attacker's control. This may cause a heap buffer overflow in the NGINX worker process leading to a restart and/or limited data corruption.

Denial-of-service vulnerability in the integrated web server of Hirschmann HiOS Switch Platform devices. A remote unauthenticated attacker can send a specially crafted HTTP(S) request to a specific endpoint that is processed incorrectly, causing an unintended reboot and temporary denial of service. The issue is fixed in versions 07.1.12, 08.7.10, 09.0.13, 09.3.03, 10.3.08, and 10.5.00.

1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote attacker to execute arbitrary code.

SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges.

An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTaskServiceImpl.completeTask, CompleteExecuteComponent.process, Warm-Flow TaskService.skip, POST /workflow/task/completeTask components.

Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. This may allow an attacker to decrypt or impersonate communication protected by this key.

An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan internal resources via a crafted POST request.

Kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data validation and without using parameterized statements or stored procedures.

Dell SmartFabric OS10 versions prior to 10.6.1.3 contain a Download of Code Without Integrity Check vulnerability. A high-privileged attacker with remote access could exploit it to achieve code execution.

Dell SmartFabric OS10 versions prior to 10.6.1.3 contain a Session Fixation vulnerability. An unauthenticated attacker with remote access could exploit it to steal sessions.

Woodpecker, a CI/CD engine, from 1.0.0 until 3.16.0 allows any user with Push permission on a connected repository to run pipeline pods under an arbitrary ServiceAccount in the pipeline namespace without administrator authorization. This enables inheriting that account's RBAC permissions and potentially taking over the cluster. The issue is fixed in version 3.16.0.

MySQL MCP Server prior to 0.4.2, when MCP_TRANSPORT=sse is set, constructs SseServerTransport without security settings or DNS rebinding protection, while the /, /sse, and /messages/ routes have no authentication and the service binds to 0.0.0.0 by default. A network attacker can directly reach execute_sql or use DNS rebinding to gain unauthorized access to the database. The issue is fixed in 0.4.2.

Vulnerability in CodeRAG before 1.3.1. The default sync flow invokes _sync_gradle, which prefers a repository-controlled gradlew or gradlew.bat file and passes it directly to asyncio.create_subprocess_exec without validating the file's content. A victim indexing an attacker-controlled repository executes attacker-supplied code with the victim's OS privileges, potentially leading to disclosure, modification, persistence, or DoS.

Outerbase Studio is a lightweight browser-based database GUI supporting PostgreSQL, MySQL, and SQLite. In version 0.10.2 and earlier, TextComponent in src/components/chart/index.tsx renders unsanitized Text Widget content through dangerouslySetInnerHTML, allowing injected markup with script-capable event handlers to execute when the widget is displayed. Outerbase Cloud and its backend services were discontinued in 2025, and the current architecture uses local browser dashboard storage, so the impact is limited to local self-XSS. Authentication token theft, account takeover, and backend database access are not applicable to the current architecture. No fixed release is available as of this review.

In Hydro from 4.10.4 until 5.0.2, the session recreation logic in packages/hydrooj/src/service/layers/base.ts creates a replacement session token without deleting the previous token from the server-side session token store. As a result, an old sid cookie can remain valid after logout or another renewal flow. An attacker who possesses a victim's previously valid stale cookie can replay it without knowing the victim's username or password and without victim interaction, taking over the account.