CVE Vulnerability Catalog

A path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive information via the blobs.yml file. Affected versions are prior to v7.10.4.

A cross-site scripting (XSS) vulnerability in Dynamics 365 Customer Voice allows an unauthorized attacker to perform spoofing over a network due to improper input neutralization during web page generation.

A vulnerability in CoreWCF (a port of WCF to .NET Core) prior to versions 1.8.1 and 1.9.1 causes SAML 1.1 and SAML 2.0 token validation to incorrectly resolve the issuer signing key or fail to require signed tokens when IdentityConfiguration is used with federated bindings. This allows an unauthenticated remote attacker to impersonate any principal the trusted STS could issue.

A Use-After-Free vulnerability in the Autofill feature of Google Chrome on Android prior to version 150.0.7871.115 allows a remote attacker to potentially escape the sandbox via a crafted HTML page.

A vulnerability in HAPI FHIR before version 6.9.10 allows XML External Entity (XXE) injection via the saxonTransform function in XsltUtilities. Missing ACCESS_EXTERNAL_DTD and ACCESS_EXTERNAL_STYLESHEET restrictions enable an attacker to read local files, perform blind XXE, and SSRF to arbitrary URLs.

A vulnerability in the Generic OEM UZ801_v2.1 4G LTE Router V3.4.3 allows a remote attacker to execute arbitrary code via the /ajax web management API endpoint in MifiService.apk.

Fluentd before version 1.19.3 allows dynamically constructing file paths using the ${tag} placeholder. Insufficient validation of ${tag} in file configurations such as the path parameter of the out_file plugin lets attackers send untrusted tags containing path traversal characters to write or overwrite arbitrary files and potentially achieve remote code execution.

An improper authorization vulnerability in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to overwrite the node's configuration and achieve full node takeover via a crafted POST request.

The JupyterLab Git extension before version 0.54.0 contains an XSS vulnerability in the createHeader() method of PlainTextDiff.ts. When rendering renamed files in commit history, filenames are passed directly to innerHTML, allowing a crafted filename to execute JavaScript when a victim views the rename diff in the Git History tab.

IBM API Connect versions 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contain an unauthenticated SQL injection vulnerability in the password reset functionality.

Repomix contains a server-side request forgery (SSRF) vulnerability in the POST /api/pack endpoint that allows unauthenticated attackers to make arbitrary outbound requests. The endpoint fails to properly validate http://, https://, and file:// URLs before passing them to git clone, enabling attackers to access private network addresses, GCP metadata services, or local filesystem paths.

SQL injection vulnerabilities in Snowpark Python SDK prior to version 1.53.0 allow authenticated low-privilege users to execute SQL beyond their authorization scope. Attackers can exploit these via crafted database column names, location parameters, or export paths.

The Blocksy Companion Pro plugin for WordPress before version 2.1.47 contains an unauthenticated arbitrary file upload vulnerability that allows attackers to upload executable files by bypassing extension validation in the save_attachments function exposed through the Advanced Reviews feature. Attackers can exploit the Custom Fonts extension's flawed strpos() substring check by uploading double-extension filenames such as shell.woff2.php, causing the validation to pass on the substring match while the web server executes the file as PHP, achieving remote code execution.

Dgraph Alpha prior to version 25.3.5 exposes unauthenticated RPCs for external snapshot import on the public gRPC port :9080. An unauthenticated network client can open StreamExtSnapshot and send Badger stream data to the target store, causing deletion and replacement of existing DB data.

A SQL injection vulnerability was found in Webbeyaz Web Design Mediküm Web due to improper neutralization of special elements in SQL commands. This allows an attacker to execute arbitrary SQL queries on the database.

The vulnerability in the Imager library for Perl before version 1.033 mishandles unsigned EXIF IFD entry counts as signed, potentially leading to an attempt to allocate a huge memory block and process crash. An attacker can exploit this by crafting an image with malicious EXIF data to terminate a worker process.

Unauthenticated callers can supply a malicious H2 JDBC URL through the testConnection API, which executes arbitrary Java code on the server via H2's INIT parameter. Vulnerability in Apache Gravitino before version 1.2.1.

An Improper Authentication vulnerability in DELMIA Apriso from Release 2020 through Release 2026 could allow an attacker to gain privileged access to the server.

The WP Learn Manager plugin for WordPress up to version 1.1.8 inclusive contains an authorization bypass vulnerability. Unauthenticated attackers can exploit this flaw to install and activate arbitrary plugins from the WordPress.org repository on the vulnerable site.

The Eventer plugin for WordPress up to version 4.4.2 stores the password reset key in plaintext in the `eventer_verification_code` user meta field. Combined with another vulnerability like SQL Injection (CVE-2026-9700), an unauthenticated attacker can extract this key and take over any user account, including administrators.