CVE Vulnerability Catalog

A denial-of-service vulnerability in 5370/5570 controllers allows a remote user to load an invalid project, causing the device to enter a major non-recoverable fault (MNRF).

An OS Command Injection vulnerability has been found in Apache Kylin. Improper neutralization of special elements in job configuration parameters may allow an attacker to execute arbitrary commands via the backend API. Affects versions 4 through 5.0.3.

An SQL injection vulnerability was found in Apache Kylin's backend API that refreshes the table catalog. An attacker can inject malicious SQL into the generated query.

The 1715-AENTR EtherNet/IP Adapter exposes a debug port without proper privilege controls, allowing unauthenticated remote attackers to execute intrusive CLI commands. This can lead to reading or deleting files, stopping tasks, modifying memory, and changing I/O states.

In JetBrains YouTrack before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, an authentication bypass via direct database access was possible, leading to administrative access.

In Apache Doris, certain FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with network access to the FE HTTP service could perform unauthorized administrative operations, potentially affecting cluster integrity and availability and leading to cluster instability or denial of service.

A vulnerability in Opcenter X (versions prior to V2604) stems from improper validation of the algorithm in the JWT header. An unauthenticated remote attacker can forge arbitrary JWT tokens, bypass authentication, and impersonate any user, including administrative accounts.

A vulnerability in the Management Server API of XProtect allows users with edit permissions to execute arbitrary code in the context of the Management Server Service.

In DBI::SQL::Nano for Perl versions 1.42 through 1.651, the <= and >= SQL operators are inverted for text comparisons. The <= operator is incorrectly evaluated as 'greater than or equal', and >= as 'less than or equal', causing incorrect WHERE clause filtering.

An insufficient technical documentation vulnerability in Apache Tomcat fails to clearly document the requirements for securely configuring the EncryptInterceptor. This affects multiple Tomcat versions from 7.0.100 through 11.0.23.

A vulnerability in Apache Tomcat's rewrite valve allows security constraint bypass due to improper handling of URL hex encoding. Affected versions include 11.0.0-M1 through 11.0.23, 10.1.0-M1 through 10.1.56, 9.0.0-M1 through 9.0.119, and 8.5.0 through 8.5.100.

In Eclipse BaSyx Java Server SDK versions 2.0.0-milestone-05 to 2.0.0-milestone-12, deployments using MongoDB backend are vulnerable to unauthenticated arbitrary file write via the AAS thumbnail API. An attacker can upload a file with a controlled filename and then trigger retrieval, writing the content to any path on the server filesystem.

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) prior to version 3.2.1 allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. Exploitation can occur via crafted OAuth token request URLs, malicious files in ingestion pipelines, SQL injection via staging options in shared Spark environments, or runtime SET commands in shared Spark-SQL sessions.

The Word Count and Social Shares WordPress plugin through version 1.0 does not validate a user-supplied file path before deletion, nor does it have proper authorization or CSRF checks. This allows any authenticated user, such as a Subscriber, to delete arbitrary files on the server, which can lead to a full site takeover (e.g., by deleting wp-config.php).

SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented sample credentials from sample configuration in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data.

An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.

An HTTP Request Smuggling vulnerability in SAP Approuter allows an unauthenticated attacker to send a crafted HTTP request, causing request-response desynchronization. This can expose user responses and make the system unavailable, with high impact on confidentiality and availability.

A vulnerability in the Crypt::OpenSSL::X509 library for Perl before version 2.1.3 allows a heap out-of-bounds read via a long certificate extension OID. Functions like extensions(), extensions_by_long_name(), extensions_by_oid(), and has_extension_oid() incorrectly use the full OID text length as the hash key length, causing a read past the fixed-size 129-byte buffer.

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request to the /api/usage/stats endpoint. Attackers can exploit the missing authentication middleware on the Next.js API route to obtain full API key strings alongside token counts, cost breakdowns, and request metadata.

9Router through version 0.4.41 contains an unauthenticated access vulnerability allowing remote attackers to interact with provider management API endpoints without credentials due to missing authentication middleware in Next.js API routes under src/app/api/providers/*. Attackers can enumerate, create, modify, or delete provider connections.