CVE Vulnerability Catalog

A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the component Pull API. The manipulation leads to server-side request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

A vulnerability was found in Zen Cart up to version 2.2.2, affecting the zen_db_perform function in includes/modules/payment/paypaldp.php of the PayPal IPN Handler component. Manipulation of the txn_id argument leads to SQL injection, and the attack can be initiated remotely. The exploit has been made public.

An SQL Injection vulnerability affecting Tuleap Enterprise Edition 17.5 could allow an attacker to gain read access to the Tuleap database.

An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker with tracker administration rights on one tracker to update or delete fields of all the trackers on the instance.

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.

A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in a user's browser session.

An OS Command Injection vulnerability in Tuleap Enterprise Edition from 17.0 through 17.5 allows an attacker to execute arbitrary commands on the server.

An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with low-privilege credentials to obtain the authorization policy of a different account, such as admin, without knowing the password.

An improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc4, DigiDoc Android, and DigiDoc iOS allows an attacker to create forged digital signatures that are displayed as valid by affected software.

A security flaw in agno-agi agno up to 3.0.6/3.1.1 affects the exec function in the Agent Orchestration Layer, allowing remote execution of dynamically-managed code.

A SQL Injection vulnerability in Kong Gateway (Enterprise and Open Source) clustering communication in Hybrid Mode, triggered by specially crafted RPC requests to the Control Plane, leading to unauthorized database access.

A vulnerability in agno-agi agno up to 2.7.3/3.0.6 affects the get_authentication_dependency function in auth.py, where manipulation of the security_key argument leads to missing authentication.

A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths outside the intended directory, potentially allowing deletion of files accessible to the OTRS application process.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/adminregister.php of the Registration Handler component, allowing remote SQL injection.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/authprocessing.php of the Forgot Password Handler component, where manipulation of the fpemail argument leads to SQL injection.

A SQL Injection vulnerability in krupalshah EmployeeRecruitmentSystem (up to a specific commit) affects the mysql_query function in source/loginprocessing.php of the Login Handler component, where manipulation of email/password arguments leads to SQL injection.

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

Improper access control in Samsung Continuity Service for windows prior to version 4.6.1217.0 allows adjacent attackers to manipulate the connected mobile device.

Improper input validation in parsing sheifd in libsimba.heifdec.media.samsung.so prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code.