CVE Vulnerability Catalog

Terrascan v1.18.3 and prior are vulnerable to SSRF via the remote_url parameter in the remote directory scan endpoint in server mode. An unauthenticated attacker can supply an HTTP URL passed to go-getter without validation. Go-getter supports X-Terraform-Get header for redirect to file:// URL, enabling local file read. Additionally, ~/.netrc is read, potentially leaking credentials.

Terrascan v1.18.3 and prior are vulnerable to SSRF via the webhook_url parameter in the file scan endpoint (POST /v1/{iac}/{iacVersion}/{cloud}/local/file/scan) in server mode. An unauthenticated attacker can supply an arbitrary URL, and Terrascan sends scan results with the webhook token to that URL.

A command injection vulnerability in the /cgi-bin/tools/ajax_cmd endpoint of Panabit PAP-XM320 up to v7.7 allows authenticated users to execute arbitrary shell commands with root privileges via the action=runcmd parameter.

An improper authentication vulnerability in the Motorola Factory Test component (com.motorola.motocit) allows third-party apps to open a TCP server via a writable file descriptor, exposing sensitive permissions and data.

BillaBear (all versions prior to Jan 2026) has a SQL Injection vulnerability in EventRepository. Metric filter names and aggregation properties are directly interpolated into SQL queries via sprintf() without sanitization. An authenticated attacker with ROLE_ACCOUNT_MANAGER can execute arbitrary SQL commands.

NGINX JavaScript has a vulnerability when the js_fetch_proxy directive is configured with at least one client-controlled NGINX variable (for example, $http_*, $arg_*, $cookie_*) and a location invoking the ngx.fetch() operation from NGINX JavaScript. An unauthenticated attacker can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR.

Funnel Builder for WooCommerce Checkout prior to 3.15.0.3 contains a missing authorization vulnerability in the public checkout endpoint that allows unauthenticated attackers to invoke internal methods and write arbitrary data to the plugin's External Scripts global setting. Attackers can inject malicious JavaScript through the External Scripts setting that executes in the browsers of all checkout page visitors.

HestiaCP versions 1.2.0 through 1.9.4 have an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass authentication security controls by supplying an arbitrary IP address in the CF-Connecting-IP header without verifying the request originated from Cloudflare.

An issue in gohttp commit 34ea51 allows attackers to perform directory traversal by supplying a crafted request.

An issue was discovered in ModelScope 1.25.0 allowing attackers to execute arbitrary code via a crafted module listed in the configuration file (dey_mini.yaml) under the key ['nnet']['module'].

Memory safety bugs were present in Firefox ESR 115.35, Firefox ESR 140.10 and Firefox 150, which could allow remote code execution. The vulnerability was fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Memory safety bugs present in Firefox ESR 140.10 and Firefox 150 could lead to memory corruption and potentially allow arbitrary code execution. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Memory safety bugs present in Firefox 150 showed evidence of memory corruption and could potentially be exploited to run arbitrary code. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Privilege escalation vulnerability in the WebRTC: Audio/Video component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Privilege escalation vulnerability in the Security component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

In Firefox and Thunderbird 151, a mitigation bypass vulnerability in the DOM: Security component was fixed. An attacker could bypass security measures.

A denial-of-service vulnerability due to an invalid pointer in the Audio/Video: Web Codecs component. Fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Information disclosure vulnerability in the Graphics: WebGPU component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

Information disclosure vulnerability in the IP Protection component in Firefox and Thunderbird. This vulnerability was fixed in Firefox 151 and Thunderbird 151.

An information disclosure vulnerability exists in the DOM: Security component of Firefox and Thunderbird. This flaw was fixed in Firefox 151 and Thunderbird 151.