CVE Vulnerability Catalog

Affected versions of Flowintel improperly trust configuration keys supplied to the alerts settings update endpoint. While configuration values were normalized to Python literals, the corresponding keys were used directly when constructing and replacing lines in conf/config_module.py. The vulnerable code used requester-controlled keys in both the regular expression and the generated assignment: f'{key} = {py_val}' and appended an assignment if the key was not already present. The modified Python configuration module was subsequently reloaded using importlib.reload(). This creates a code-generation boundary in which specially crafted configuration keys can alter the Python source structure and result in execution of attacker-controlled Python statements. Version impacted >=3.3.0

A vulnerability in Flowintel allows attacker-controlled note content to be processed by Pandoc and XeLaTeX during PDF export, which can cause local files on the Flowintel server to be read and incorporated into the generated export.

Foreman template revision endpoint lacks object-level authorization. A low-privileged user can retrieve historical template contents from another organization or location.

claude-in-mobile 3.10.2 has an OS command injection vulnerability in execSync in src/adb/client.ts. The attack requires local access.

blackms aistack up to 1.6.1 has a path traversal vulnerability in the Static File Handler in src/web/server.ts. Manipulating req.url allows remote attacks.

Multiple Zbtlink and other devices (including WE1326, WE357, WE5926, WE826-Q, WG108, WG3526, CTN720-W1, LF-1541, MT7620N, WRC1) with specific firmware versions contain an unauthenticated command injection in the infosrvd service (UDP/9992). A remote unauthenticated attacker can send a crafted UDP packet to execute arbitrary commands as root. The service's authentication uses a hardcoded salt and an all-zero wildcard MAC bypass, rendering it ineffective.

Multiple devices (including Zbtlink L3_V2_8, WE826-T2, ZBT-7628, ZBT-ZBT7621, MoreQuick MQAC-7620, AP522, AP7628, HC5661A, APG721B, HK300, MAP-N10) with specific firmware versions ship a backdoor command-and-control implant (yunmgrd) reachable over an unauthenticated cleartext UDP channel to a hardcoded C2 server. A remote unauthenticated attacker on the network path can hijack the channel and execute arbitrary commands as root, modify DNS entries, exfiltrate PPPoE credentials, and open reverse SSH tunnels.

A vulnerability in the si-map component of Element maps-ng (versions V47, V48, V49) does not properly neutralize user-controllable input of the points property used to render tooltip labels of map pins. An attacker could craft a malicious URL that, when loaded by a victim and the map pin is hovered over, executes arbitrary script code within the victim's browser session.

XSS vulnerability in Softtr Informatics E-Commerce Pack due to improper neutralization of script-related HTML tags. Allows Cross-Site Scripting attacks.

Authorization bypass vulnerability in AdisyonPro via user-controlled key. Allows access to functionality not properly constrained by ACLs.

A remote attacker with user privileges may use a malicious or compromised NASL vulnerability test (VT) on the affected products to trigger a stack buffer overflow and gain full access on the compromised system.

Improper validation of memory boundaries in WibuKey64.sys of WibuKey up to 6.70 for Windows can be exploited by an attacker by setting the pointers outside the scope of the program. This usually results in a denial of service, yet we cannot rule out the possibility of exploits that can cause Remote Code Execution and Privilege Escalation (since the driver runs with system privileges).

In WibuKey for Windows before version 6.71, an untrusted pointer dereference in the WibuKey2_64.sys kernel driver for 64-bit Windows allows an attacker to exploit a write-what-where primitive, enabling local privilege escalation. This can be leveraged to execute arbitrary code, run an administrator shell, or gain full control over the system.

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 issues handles per connection and relies on a cryptographically weak SID as sole authenticator. An attacker can brute-force the SID, recover another session's handle number, and read license information belonging to another handle.

If configured as a server, CodeMeter Runtime before versions 8.41a and 9.10 accepts requests with opcode 0x5e, which contain the data length and the data itself. Missing bounds checking on the data length value can lead to out of bounds reads, causing a segmentation fault that ultimately crashes the CodeMeter Runtime.

In CodeMeter Runtime before versions 8.41a and 9.10, the logger does not sanitize input strings in certain cases, allowing an attacker to inject printf-style format specifiers. This can be used to reliably crash CodeMeter and disclose sensitive information such as process memory and stack canaries. The attack works locally, for example by using cmu --set-proxy to set the proxy value, and remotely when combined with CVE-2026-81573 by setting General.ProxyServer and then triggering this vulnerability.

If CodeMeter Runtime before 8.41a or 9.10 is configured as a server, the configuration command handler does not enforce network-origin restrictions. Commands intended only for local or same-network clients can therefore be executed by arbitrary remote peers. An attacker can read potentially sensitive configuration data and overwrite selected values in Server.ini. This does include the hash of the credentials for the CodeMeter WebAdmin, enabling WebAdmin takeover.

In CodeMeter Runtime from version 8.40 to (excluding) 8.41a and 9.00 to (excluding) 9.10, the command `cmu.exe --create-io --file C:` creates a predictable temporary file under C:\CM-Stick. The directory and file paths are not properly checked for NTFS reparse points, such as junctions or symbolic links, before file operations are performed. A local attacker can create a junction at the temporary file that points to an arbitrary system path. Because CodeMeter Runtime runs with System privileges, this could allow arbitrary files to be deleted with System privileges and potentially enable local privilege escalation.

The Push Notification for Post and BuddyPress plugin version 3.20 and earlier has a Subscriber Broken Access Control vulnerability. This means a user with the subscriber role can gain unauthorized access to functions they should not have permissions for.

Contributor SQL Injection in Suggestion Engine for WooCommerce <= 2.0.11 versions.