CVE Vulnerability Catalog

Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL injection in /show_price_by_pdtId.php. An attacker can exploit this flaw to execute unauthorized database queries.

Spikster through commit e1cdf8c contains a missing authentication vulnerability that allows unauthenticated remote attackers to access all API routes by exploiting the unattached CipiAuth middleware.

Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS commands by connecting to the exposed H2 database web console using default credentials.

Apache Tika from 4.0.0-alpha-1 to before 4.0.0-beta-1 has an improper protection of alternate path vulnerability. An attacker could exploit this to bypass security controls.

IBM Langflow OSS versions 1.0.0 through 1.10.0 could allow a remote attacker to inject arbitrary code on the system due to improper control of user input code.

Action Pack (Active Storage) prior to versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 does not disable unsafe libvips operations for untrusted content, allowing a crafted upload to read arbitrary files accessible to the Rails process.

In Activepieces before version 0.84.0, an unsanitized path segment in the Code piece sandbox lets an authenticated flow author read and write cached flow and code files belonging to other tenants on the same worker. This can expose embedded data and allow modified code to execute on a victim tenant's next flow run.

In @aws-amplify/codegen-ui-react before version 2.20.6, improper control of code generation might allow a remote authenticated user to execute arbitrary code in end-user browsers, developer machines, CI/CD environments, and server-side rendering contexts via crafted Studio component or theme schema values. This is due to insufficient coverage and effectiveness of input validation introduced for CVE-2025-4318.

SGLang contains a remote code execution (RCE) vulnerability when loading model weights from a HuggingFace repository. In the /update_weights_from_disk endpoint, torch.load with weights_only=False allows pickle deserialization of .bin files.

SGLang contains a remote code execution (RCE) vulnerability in the optional dumper subsystem. When DUMPER_SERVER_PORT is set, a sandbox escape is possible, enabling code execution on inference requests.

SGLang contains an unauthenticated remote code execution (RCE) vulnerability in the /load_lora_adapter_from_tensors endpoint. It bypasses SafeUnpickler's incomplete denylist, allowing arbitrary command execution through crafted base64-encoded pickle payloads.

IBM Langflow OSS versions 1.0.0 through 1.10.1 contain an improper input validation vulnerability in the PythonREPL sandbox implementation.

IBM HMC V10.3.1050.0 through 10.3.1064.0 and IBM HMC V11.1.1110.0 through 11.1.1112.0 Management systems in IBM Power environments (HMC and Novalink) could allow an unauthenticated user to execute arbitrary commands with elevated privileges due to improper validation of user supplied input.

IBM webMethods Integration (on prem) versions 10.15 and 10.11 could allow an unauthenticated remote attacker to execute arbitrary code on the system due to deserialization of untrusted data.

The Windows interactive service in OpenVPN (versions 2.7_alpha1 through 2.7.4) allows remote attackers to cause persistent DNS state pollution or a service crash via a crafted search domain during disconnection.

IBM Langflow OSS versions 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP stdio launcher. The vulnerability is due to an incomplete blocklist of dangerous environment variables (missing SHELLOPTS, BASHOPTS, and PS4) in src/lfx/src/lfx/base/mcp/util.py.

Apache Kyuubi versions 1.7.0 through 1.11.1 are vulnerable to path traversal during REST batch multipart upload handling. An attacker can provide path traversal sequences in the filename, allowing content to be written outside the intended directory.

SQL injection vulnerability in UMAI Vision Traffic Analysis System allows an attacker to manipulate database queries due to improper neutralization of special elements in an SQL command. The issue affects versions from 30 before 34.

Apache JSPWiki up to version 2.12.3 lacks checks in UserManager, allowing impersonation. An attacker can escalate privileges.

SolarWinds Web Help Desk is affected by a SAML authentication bypass vulnerability. This requires the SAML 2.0 authentication method to be enabled.