CVE Vulnerability Catalog

A blind SSRF vulnerability in DataHub v.1.5.0.1 allows a remote attacker to execute arbitrary code by causing the server to retrieve an image from a crafted URL. The server does not return the content or errors directly, making detection difficult.

An issue in GAPTEQ Designer v.3.5 allows a remote attacker to escalate privileges via the Company Manager role. This vulnerability enables unauthorized elevation of access levels.

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend.

Joomla Extension Sourcerer by Regular Labs before version 16.0.0 processes {source} blocks found in Joomla's final rendered HTML without reliably determining where that code originated, allowing unauthenticated remote code execution through unverified reflected user input.

SQL Injection vulnerability in StudIP 6.0.x before 6.0.3 and 5.4.x before 5.4.12 allows a remote attacker to execute arbitrary code and obtain sensitive information via the store() functions.

An issue in Squirro Cognitive Search versions prior to 3.14.2 allows a remote attacker to execute arbitrary code via a crafted payload sent to the password reset function. The vulnerability can be exploited to take control of the application.

An issue in Squirro Cognitive Search before version 3.14.2 allows a remote attacker to escalate privileges via a crafted request. This vulnerability enables unauthorized elevation of access levels.

The CRM+ application from Brainformatik, versions up to and including 2025.6, is vulnerable to time-based SQL Injection. The check conflict endpoint (index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true) used to check user calendar conflicts is vulnerable to SQL injection, allowing an attacker to execute arbitrary code.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature

Prior to version 1.0.0-rc.18 in New API, user-controlled values (e.g., image count, video seconds and duration, max_tokens, max_completion_tokens, maxOutputTokens, audio duration, billing-expression quantities) can overflow conversions in common/quota_math.go and related settlement paths. This allows a low-privileged account with positive balance or an active subscription to turn a negative charge into account credit and potentially drain upstream funds.

Prior to version 1.0.0-rc.7 in New API, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as access_token because User model objects are serialized after queries use Omit("password"). This allows an authenticated administrator to obtain the root user's bearer token and access root-only system configuration APIs.

Prior to versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 in Discourse, an unauthenticated attacker could send a single request with a crafted color_scheme_id (or dark_scheme_id) cookie to inject arbitrary HTML into a Discourse page. Because the cookie value was rendered into a color scheme tag without escaping, the attacker could break out of the attribute and inject a tag that bypassed Discourse's nonce-based Content Security Policy, resulting in arbitrary JavaScript execution in visitors' browsers.

FakeFish handles incoming credentials by passing them down to scripts. This works for real hardware because in the end it's up to the BMC to validate them. However, KubeVirt relies on a KUBECONFIG file mounted to the container and completely ignores the credentials. This allows any user of the cluster to control VMs of the user that created fakefish, power them on and off, and mount arbitrary CD images to them.

In Logsign SIEM, there is an insufficiently protected credentials vulnerability that allows retrieving embedded sensitive data. Affects versions from 6.4.97 before 6.4.114.

In Wavlink WN531P3 and WN535M1 V250922, the strcpy function in the file /etc/lighttpd/www/cgi-bin/export_pingortrace.cgi (Export Pingortrace CGI component) is vulnerable to stack-based buffer overflow via manipulation of the HTTP_COOKIE argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

openssl_encrypt before version 1.4.0 contains an authentication bypass vulnerability in pqc.py where AES-GCM decryption failures trigger fallback to unauthenticated AES-CTR mode. Attackers can modify ciphertext in transit to bypass integrity verification and perform bit-flipping attacks without detection.

openssl_encrypt before version 1.4.0 contains a critical vulnerability in pqc.py where KEM decapsulation failures silently fall back to simulation mode, generating a deterministic shared secret from only 16 bytes of the private key and publicly available encapsulated key data. Attackers who obtain 16 bytes of the private key can compute the shared secret and decrypt all ciphertext, as the fallback triggers on any KEM failure without raising an error.

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in IsolatedPluginExecutor that exposes Python type objects in restricted exec() builtins. Attackers can traverse the Python class hierarchy via __class__.__mro__.__subclasses__() to access system functions and execute arbitrary OS commands.

openssl_encrypt before version 1.4.0 contains a sandbox escape vulnerability in the DangerousPatternVisitor AST analyzer that fails to detect dunder attribute traversal techniques. Attackers can use __class__, __bases__, __subclasses__(), and __globals__ chains to access restricted functions and execute arbitrary system commands from plugin code.

openssl_encrypt before version 1.4.0 fails to apply sandbox restrictions in the default process isolation mode for plugin execution. Attackers can execute malicious plugins with unrestricted access to the filesystem, network, subprocess execution, and all Python modules.