CVE Vulnerability Catalog

ArcadeDB before version 26.7.2 contains an authorization bypass vulnerability in HTTP handlers for time series, batch, Prometheus, and Grafana endpoints. Attackers can access and modify databases without proper permissions by directly calling affected endpoints with arbitrary database parameters.

ArcadeDB before version 26.7.2 fails to enforce scripting authorization checks on the SQL DEFINE FUNCTION statement with LANGUAGE js. Attackers with database access can execute arbitrary JavaScript code by submitting DEFINE FUNCTION statements, bypassing security controls intended to restrict scripting to administrators.

The @better-auth/scim plugin versions >= 1.4.0-beta.27 through <= 1.6.21 and >= 1.7.0-beta.0 through <= 1.7.0-beta.9 contain an authorization bypass. SCIM token issuance did not reject provider IDs already used by existing SSO, SAML, OIDC, generic OAuth, or social account providers, and the same logical provider ID was used for both SCIM provider configuration and account ownership. An authenticated user could mint a SCIM token whose provider ID collided with an existing provider namespace, causing SCIM user routes to resolve account rows the token never provisioned. This allowed listing, reading, updating (including rewriting global profile/email fields without uniqueness checks), and deleting global user accounts and sessions, resulting in account takeover and unauthorized deprovisioning. Fixed in 1.6.22 and 1.7.0-beta.10 (1.7.0-rc.0).

GitPython 3.1.50 fails to recognize joined short-option forms such as -u<value> (the short form of --upload-pack=<value>) when enforcing its default unsafe-option gate. When an application passes attacker-influenced clone options into Repo.clone_from(..., multi_options=..., allow_unsafe_options=False), an attacker can supply -u<helper> to bypass the gate that blocks --upload-pack/-u, causing Git to execute the specified helper command during clone. Fixed in 3.1.51.

Wazuh workflows before commit 44bf114 contain a shell injection vulnerability in GitHub Actions that allows attackers to execute arbitrary commands by submitting pull requests with crafted VERSION.json files. Attackers can inject shell metacharacters into environment variables that are directly interpolated into run steps, enabling command execution and exfiltration of secrets including GITHUB_TOKEN and AWS credentials on self-hosted runners.

FreeRDP before version 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the server-controlled RDP redirection TargetNetAddress field. This value is copied into the client's ServerHostname and, when the client connects through an HTTP proxy, is written directly into the proxy CONNECT request line and Host header by http_proxy_connect() without filtering. A malicious or compromised RDP server can send a crafted redirection PDU containing embedded control characters to inject arbitrary headers/requests into the HTTP proxy CONNECT request.

FreeRDP before version 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in tls_verify_certificate(), tls_match_hostname(), and x509_utils_get_dns_names(). Because FreeRDP performs custom Common Name and DNS SAN string matching instead of using OpenSSL's length-aware identity validation APIs, it (1) truncates DNS SAN values at embedded NUL bytes (accepting e.g. 'victim.example\0.attacker.example' as 'victim.example'), (2) accepts a matching Common Name even when non-matching DNS SAN entries are present, and (3) accepts IP-literal targets via DNS/CN matching without comparing iPAddress SANs. Under a trusted or misissued certificate chain, an attacker positioned to present such a certificate can bypass server identity verification, weakening TLS server authentication.

The Single Sign On For TNG plugin for WordPress is vulnerable to authentication bypass via unauthenticated password reset. The `ssoprocess_ajax()` function accepts an `email` parameter and calls `reset_password()` without any ownership token or email confirmation. The only guard is a nonce that is publicly broadcast on every page, allowing an attacker to capture it and change any account's password, including administrator accounts.

The Participants Database WordPress plugin before version 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query. This allows unauthenticated attackers to perform SQL injection attacks.

The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on a REST API endpoint. Unauthenticated attackers can delete arbitrary files in the formgent uploads directory, and on Linux servers, if the directory does not exist, they can bypass path traversal protection and delete files like wp-config.php.

ComfyUI v0.23.0 contains an unsafe deserialization vulnerability in the LoadTrainingDataset node. An unauthenticated attacker can upload a crafted pickle file via the POST /upload/image endpoint and trigger its deserialization via POST /prompt, leading to arbitrary Python code execution through torch.load.

libiec61850 version 1.6 contains a vulnerability in the parseGoosePayload() function in /goose/goose_receiver.c, allowing attackers to bypass authentication via a captured GOOSE frame.

sentence-transformers contains a security control bypass vulnerability in the import_module_class helper in util/misc.py. The condition 'or os.path.exists(model_name_or_path)' allows code execution from Python files placed in a local model directory even when trust_remote_code=False. An attacker who can influence the model directory contents can place malicious files that execute when the model is loaded.

Hugo Leisink Hiawatha version 12.1 and earlier contains a vulnerability that allows a remote attacker to execute arbitrary code via a crafted request.

Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the ipsec_conn interface. Attackers can execute arbitrary commands as root via crafted input.

Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.setclock interface. Attackers can execute arbitrary commands as root via crafted input.

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in /admin/delete_group.php?id=1. Attackers can manipulate the id parameter to execute unauthorized SQL queries.

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters district_id, division_id, region_id, and ward_id. Attackers can inject malicious SQL queries.

Routers TR1200, TR3000, WR300, WR1200, WR1300, WR1500, WR3000, WR3600, and WR6500 with specific firmware versions contain a command injection vulnerability in the system.upgrade_check interface. Attackers can execute arbitrary commands as root via crafted input.

vault-secrets-webhook versions before 1.23.1 contain a vulnerability that allows sending a ServiceAccount JWT token to an attacker-controlled Vault address. The parseVaultConfig() function accepts the vault.security.banzaicloud.io/vault-addr annotation, and MutateConfigMap and MutateSecret call newVaultClient, which can cause the token to be sent to an unsafe server.