CVE Vulnerability Catalog

The dataclasses-avroschema library versions 0.38.0 through 0.70.5 does not escape or validate the namespace value of a fixed type, inserting it in quotes into a types.confixed annotation. This allows arbitrary Python code execution when the generated class is defined.

dataclasses-avroschema versions 0.40.0 through 0.70.5 fail to escape quotes or backslashes when copying a schema record's doc value into a generated class docstring. A crafted triple-quote sequence can close the docstring and inject statements into the generated class body, leading to Python code execution during module import.

dataclasses-avroschema versions 0.62.3 through 0.70.5 insert a schema-controlled Avro record name into the quoted Meta.schema_name field of generated Python source without escaping it. A crafted name can terminate the string literal and inject statements into the generated class body that execute when the module is imported.

dataclasses-avroschema versions 0.47.3 through 0.70.5 insert a schema-controlled referenced record name into the callable position of a generated default_factory lambda without validating it as an Avro name. A crafted record name can become an arbitrary Python expression that executes when an instance of the generated model consumes the field default.

dataclasses-avroschema versions 0.38.0 through 0.70.5 insert schema-controlled string, UUID, bytes, and fixed field defaults into quoted literals in generated Python source without escaping them. A crafted default can terminate the literal and inject statements into the generated module that execute when the module is imported.

A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

A Double Free vulnerability [CWE-415] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.7, FortiOS 7.4 all versions, FortiOS 7.2 all versions, FortiProxy 7.6.0 through 7.6.6, FortiProxy 7.4 all versions, FortiProxy 7.2 all versions, FortiSwitch 7.6.0 through 7.6.6, FortiSwitch 7.4 all versions, FortiSwitch 7.2 all versions may allow a local authenticated attacker to crash the newcli daemon via crafted CLI commands.

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.

An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Fortinet FortiManager and FortiManager Cloud may allow an attacker to escalate privileges via specially crafted packets.

An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

The odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Shell metacharacters such as $(id) in a non-.odt filename survive insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), achieving remote code execution as the web-server user during the LibreOffice conversion process.

This CVE ID has been rejected (REJECT) and must not be used. It is a reservation duplicate of CVE-2026-94257; all references and descriptions have been removed to prevent accidental usage.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

Podman from 4.4.0 until 5.8.8 and 6.1.3 treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL. This allows image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

In BusyBox's httpd web server, when configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.