CVE Vulnerability Catalog

Microsoft Azure Kubernetes Service contains an improper authorization vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.

OneUptime is an open-source monitoring platform. Prior to version 10.0.42, the Worker service exposes workflow execution endpoints without authentication. An attacker who knows a workflow ID can execute arbitrary workflows with controlled input, enabling JavaScript code execution, notification abuse, and data manipulation.

Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.

Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.

Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

OneUptime prior to version 10.0.42 allows unauthenticated access to Notification test and Phone Number management endpoints, enabling SMS/Call/Email/WhatsApp abuse and phone number purchase.

Fireshare, a self-hosted media and link sharing tool, prior to version 1.5.3 contains a vulnerability in the unauthenticated /api/uploadChunked/public endpoint. The fix for CVE-2026-33645 was applied only to the authenticated endpoint, not the public one. An unauthenticated attacker can exploit the checkSum parameter to write arbitrary files with attacker-controlled content to any writable path on the server. The issue is patched in version 1.5.3.

OpenProject prior to version 17.2.3 has an SQL injection vulnerability in the =n operator in modules/reporting/lib/report/operator.rb:177. This operator embeds user input directly into SQL WHERE clauses without parameterization.

A vulnerability in Mbed TLS (versions 2.19.0 to 3.6.5 and 4.0.0) is caused by insufficient protection of serialized SSL structures. An attacker can modify these structures, leading to memory corruption and potential arbitrary code execution.

Signal K Server before version 2.24.0-beta.4 has a privilege escalation vulnerability via admin role injection in the /enableSecurity endpoint. An unauthenticated attacker can gain full administrative access.

Percona PMM before version 3.7 has a vulnerability where an internal database user retains excessive superuser privileges. An attacker with pmm-admin rights can abuse the "Add data source" feature to break out of the database context and execute shell commands on the underlying OS.

Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signer via lcobucci/jwt, it only validated time-based claims (exp, nbf, iat) using the StrictValidAt constraint. The SignedWith constraint was not included in the validation step. This means an attacker could forge or tamper with JWT token payloads – such as modifying the user_uuid claim – and the token would be accepted as valid, as long as the time-based claims were satisfied. This directly impacts the SSO authentication flow (LoginController::authorizeToken), allowing an attacker to authenticate as any user by crafting a token with an arbitrary user_uuid. This issue has been patched in version 4.5.1.

Agno versions prior to 2.3.24 contain an arbitrary code execution vulnerability in the model execution component that allows attackers to execute arbitrary Python code by manipulating the field_type parameter passed to eval(). Attackers can influence the field_type value in a FunctionCall to achieve remote code execution.

In FastMCP prior to version 3.2.0, the _build_url() method in the RequestDirector class lacks URL encoding of path parameters. This allows an attacker to inject ../ sequences and perform a path traversal attack, enabling access to arbitrary internal endpoints.

Użytkownik z autoryzacją może przesłać złośliwy plik na serwer i go wykonać, co prowadzi do zdalnego wykonania kodu.

Kontroler Stref Przechowywania ShareFile zarządzany przez klienta (SZC) pozwala nieautoryzowanemu atakującemu na dostęp do zastrzeżonych stron konfiguracyjnych. Może to prowadzić do zmiany konfiguracji systemu oraz potencjalnego zdalnego wykonania kodu.