CVE Vulnerability Catalog

A vulnerability in the vm2 library for Node.js (versions 3.9.6 to 3.10.5) allows attacker-controlled JavaScript running in the sandbox to mutate host prototypes such as Object.prototype, Array.prototype, and Function.prototype. This occurs because the bridge exposes mutable proxies for real host-realm intrinsic prototypes and forwards sandbox writes to host objects using ReflectSet() and ReflectDefineProperty().

A vulnerability in vm2 prior to 3.11.0 allows bypassing the NodeVM builtin allowlist. When the 'builtin' module is allowed (even via '*' wildcard), sandboxed code can use Module._load() to load any module in the host context, bypassing restrictions. This enables loading excluded modules like child_process and achieving remote code execution.

A vulnerability in the vm2 library for Node.js prior to version 3.11.0 allows obtaining the host object. Attackers can use various methods, e.g., HostObject.getOwnPropertySymbols, to obtain Symbol(nodejs.util.inspect.custom) and escape the sandbox.

A buffer overflow vulnerability in the DNS proxy and DNS Server features of Palo Alto Networks PAN-OS Software allows an unauthenticated attacker with network access to cause a denial of service (DoS) condition on all PAN-OS platforms except Cloud NGFW and Prisma Access, and potentially execute arbitrary code on PA-Series hardware by sending specially crafted network traffic.

A buffer overflow vulnerability in the IKEv2 processing of Palo Alto Networks PAN-OS software allows an unauthenticated network-based attacker to execute arbitrary code with elevated privileges on the firewall, or cause a denial of service (DoS) condition.

JupyterLab prior to 4.5.7 allows data-commandlinker-command and data-commandlinker-args attributes on button elements in its HTML sanitizer. CommandLinker executes commands on click without verifying the element's origin, enabling arbitrary command execution via a crafted notebook cell.

A vulnerability exists in iControl REST that allows a highly privileged, authenticated attacker with at least the Manager role to create configuration objects that enable running arbitrary commands.

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key.

ELECOM wireless LAN access point devices contain an OS command injection in processing of the username parameter. If processing a crafted request, an arbitrary OS command may be executed.

ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.

Fleet's Helm deployer did not fully apply ServiceAccount impersonation in two code paths, allowing a tenant with git push access to a Fleet-monitored repository to read secrets from any namespace on every downstream cluster targeted by their GitRepo.

A stack-based buffer overflow vulnerability exists in GUARDIANWALL MailSuite and GUARDIANWALL Mail Security Cloud (SaaS version). A remote attacker can send a specially crafted request to the product's web service, which may lead to arbitrary code execution if the product is configured to run pop3wallpasswd with grdnwww user privilege.

Wszystkie wersje Hitachi Vantara Pentaho Data Integration & Analytics zawierają sterownik JDBC dla baz danych H2, który jest podatny na wykonanie zewnętrznych skryptów podczas tworzenia nowego połączenia przez administratora źródła danych.

ChurchCRM is an open-source church management system. In versions 7.2.0 to 7.2.2, the fix for CVE-2026-4058 is incomplete, allowing for exploitation of this vulnerability.

ChurchCRM is an open-source church management system. In versions prior to 7.3.2, the fix for CVE-2026-39337 is incomplete, allowing for pre-authentication remote code execution via unsanitized DB_PASSWORD.

Thymeleaf, a Java template engine, has a security bypass vulnerability prior to version 3.1.5.RELEASE that allows for the execution of dangerous expressions. If an application developer passes unsanitized variables containing such expressions to the template engine, these expressions can be executed in sandboxed contexts, leading to Server-Side Template Injection (SSTI).

Scramble generates API documentation for Laravel projects. From versions 0.13.2 to before 0.13.22, when documentation endpoints are publicly accessible and validation rules reference user-controlled input, supplied data may be evaluated during documentation generation, leading to execution of arbitrary PHP code in the application context.

In versions prior to 4.08.010, the elfinder_checkRisk function in efw4.X does not validate the dst parameter used by elfinder_paste, allowing an attacker to copy or move files from the home directory to any arbitrary location by setting dst to a base64-encoded traversal path.

In efw4.X prior to version 4.08.010, the efw.file.FileManager.unZip method did not check the canonical path when writing zip entries to disk, allowing for directory traversal. An attacker could exploit this vulnerability to drop a malicious JSP file and execute arbitrary commands as the Tomcat user.

In wger prior to version 2.6, there is a vulnerability that allows a user with gym.manage_gym permissions to reset the password of any user with no gym assignment. By exploiting an object comparison error, an attacker can take over the victim's account, and the victim's original password is invalidated.