CVE Vulnerability Catalog

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper authentication vulnerability. This may allow bypassing authentication mechanisms.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper restriction of operations within the bounds of a memory buffer vulnerability. This may lead to buffer overflow and code execution.

Unitronics UniStream Pro (B10/C10) with UniLogic before version 1.41.329 contains an improper neutralization of special elements used in an OS command (OS command injection) vulnerability. This may allow execution of arbitrary commands.

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.

JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a remote code execution vulnerability via a whitelist bypass in the build messages protocol. This may lead to arbitrary code execution on the server.

JetBrains Datalore before version 2026.2.1 contains an unauthenticated path traversal vulnerability via the report blob endpoint, allowing reading of arbitrary files. This may lead to disclosure of sensitive information.

JetBrains Junie CLI before version 26.8.3 contains a code execution vulnerability via an untrusted project's MCP server configuration. This may lead to arbitrary code execution in the user's context.

In Symfony Expression Language versions prior to 5.4.54, 6.4.48, 7.4.21, and 8.1.9, the parser built its node tree with no bound on its depth. An expression made of tens of thousands of nested unary operators, array literals, binary operators or property accesses crashed the PHP process while the tree was being freed.

In kin-openapi prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numeric values to santhosh-tekuri/jsonschema v6.0.2 without applying kin-openapi's existing finite-number guards. A remote unauthenticated client can send an application/yaml or application/x-yaml request body containing .nan, .inf, or -.inf to an operation with a numeric constraint, causing the dependency to create and dereference a nil big.Rat during ValidateRequest.

In kin-openapi from 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc.

In kin-openapi prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schema to decodeValue when an OpenAPI document declares the header with content instead of schema. The document passes validation, but every response validation for the affected operation dereferences the nil schema and panics even when the response does not contain the declared header.

Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only the Viewer role could send POST, PUT and DELETE requests through the proxy to the Loki rules API (/loki/api/v1/rules), allowing them to create, modify and delete Loki alerting rules. Because those rules are stored by Loki rather than by Grafana, the change took effect for every user of that Loki data source.

An issue in lottie-android 6.7.1 and earlier (and master) allows a remote attacker to cause a denial of service via a crafted Lottie animation JSON containing a cyclic precomposition reference graph that triggers uncontrolled recursion in BaseLayer.forModel and CompositionLayer.

A buffer overflow vulnerability in HPE NonStop XABroker may cause memory corruption, resulting in application crash.

A buffer overflow vulnerability in HPE NonStop ODBC/MX Server may cause memory corruption, resulting in application crash.

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.

In EspoCRM from 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation.

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while being lexed, causing the process to crash or the request to end with a fatal error. Any code parsing untrusted YAML is affected, including #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat.

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.