CVE Vulnerability Catalog

StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. The lack of authorization in the drop process allows any authenticated account to drop a view belonging to any database.

An attacker with network access, low privileges, and under certain conditions can exploit an active debug code vulnerability in devices running UniFi OS to escalate privileges within those devices or instances.

An attacker with network access and low privileges can exploit an improper input validation vulnerability in the UniFi Access Application to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UID Enterprise Agent to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper access control vulnerability in the UniFi Network Application to escalate privileges within the application.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UniFi OS Server to execute a command injection on the host device.

An attacker with network access and high privileges can exploit an improper input validation vulnerability in UniFi OS Server to execute a command injection on the host device.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Connect Application to escalate privileges within the UniFi Connect Application.

An attacker with network access can exploit an improper input validation vulnerability in the UniFi Protect Application to execute a command injection on the host device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in devices running UniFi OS to escalate privileges within such devices or instances.

An attacker with network access and high privileges could exploit an Improper Input Validation vulnerability in UniFi Network Application to execute a Command Injection on an adopted device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in devices running UniFi OS to escalate privileges within such devices or instances.

The OpenRGB network protocol allows writing attacker-controlled strings to arbitrary file system paths (extension of CVE-2026-59682). This can lead to full system compromise from local or remote (if the daemon runs as root) or full account takeover (if the daemon runs in user context).

Arbitrary file overwrite via SAVE_PROFILE message in OpenRGB. This issue affects OpenRGB through 1.0rc3.

The Reviews and Rating – Google Reviews plugin for WordPress up to version 5.10 has a Stored Cross-Site Scripting vulnerability in the wp_display() shortcode handler. Attackers with Contributor-level access can inject arbitrary scripts that execute when a page is accessed.

A command injection vulnerability in TeamViewer Full Client and Host for Linux prior to version 15.81.5 allows a remote attacker to execute arbitrary commands in the context of the current user via a specially crafted URL sent through the out-of-session chat feature. Exploitation requires user interaction by clicking the malicious link.

The OpenRGB network protocol allows attackers to cause memory exhaustion and out-of-bounds memory reads and writes by passing inconsistent data.

Improper neutralization of path traversal sequences in TeamViewer Desktop Clients prior Version 15.81.5 allows an authenticated remote session participant to write files to unintended locations on the local file system via file transfer or virtual file clipboard mechanisms. An attacker can leverage this behavior to achieve arbitrary file write and potentially execute code with the privileges of the affected user.

EFence by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, enabling arbitrary code execution on the server.

Efence by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents.