CVE Vulnerability Catalog

Vulnerability in n8n before versions 2.31.5 and 2.32.1 allows a sandbox escape in expression evaluation. An authenticated user with permission to create or modify workflows can craft expressions using arrow-function bodies to bypass the expression sandbox, triggering system command execution on the host running n8n. The issue is fixed in versions 2.31.5 and 2.32.1.

AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.

Vulnerability in SIMATIC IoT2050 Advanced devices with Node-RED installed. The Node-RED HTTP interface does not enforce authentication, allowing an unauthenticated attacker to create malicious flows and execute code with maximum privileges.

An authenticated attacker can spoof another GUI user's identity by sending a request with the custom header "Grpc-Metadata-USER". This can lead to an account takeover from a low-privileged user to administrator.

An OS command injection vulnerability in wg-easy 15.3.0 allows users with clients.create permission to execute arbitrary commands as root by injecting newline-delimited WireGuard PostUp directives into the client name field. The client name is written to the configuration file without neutralizing newline characters.

An SQL injection vulnerability in e107 2.4.0 allows unauthenticated remote attackers to execute arbitrary SQL via the news item page ID parameter. The parameter is concatenated without escaping into a SQL WHERE clause.

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query, enabling stacked statement injection.

A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Customers should upgrade to the resolved maintenance release.

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Customers should upgrade to the resolved maintenance release.

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.

A flaw was found in Picketlink Federation SAML; the unsolicited response handler would accept forged assertions with no verification or validation, permitting an unauthenticated attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Travel Agency Management System developed by Win Men International has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability.

SAP NetWeaver Application Server ABAP is vulnerable to logical errors in DIAG protocol parsing, allowing an unauthenticated attacker to cause memory corruption. This could potentially disclose sensitive system information or crash the system, leading to high impact on confidentiality, integrity, and availability.

The react18-use library (a React 19 use hook shim) contained malicious commits in the default branch that executed remote attacker-controlled code on developer machines during `npm install`. The code fetched a JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and evaluated it with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations.

ERPNext prior to versions 15.118.0 and 16.29.0 contains a vulnerability in unsafe template rendering in the statement of accounts process. An authenticated user with a common operational role can inject template expressions, execute arbitrary server-side code, and read data across the application.

Firecrawl prior to version 2.11.32 contains a critical arbitrary file read vulnerability in its extraction functionality due to unsafe dereferencing of user-supplied JSON schemas. An authenticated attacker can supply a malicious schema with a $ref, allowing file reads from the extract worker filesystem and SSRF against internal or external HTTP endpoints.