CVE Vulnerability Catalog

GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered through static analysis of the distributed binary and may also be exposed in process memory during runtime.

In the kernel apsys DVFS driver, there is a possible out-of-bounds read or hardware register corruption due to improper input validation of the frequency index. This could lead to system instability or denial of service with local privileges.

In modem, there is a possible information disclosure due to missing filtering of sensitive data in crash dumps. This could lead to local information disclosure with no additional execution privileges needed.

A vulnerability was determined in deepseek-ai deepseek-harness up to 0.1.1-rc.2, affecting the spawn function of the Sandbox component. Manipulation of the Profile argument can lead to a sandbox issue. The attack can be launched locally and the exploit is publicly disclosed. The vendor did not respond.

A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1, affecting the fetch function in src/utils/crawler.ts of the collect_corpus component. Manipulation of the sitemap_url argument results in server-side request forgery (SSRF). Remote exploitation is possible and the exploit is publicly available. The vendor did not respond.

A vulnerability has been found in houtini-ai seo-crawler-mcp up to 2.1.5, affecting the run_seo_audit function in src/core/CrawlOrchestrator.ts of the Crawler component. Such manipulation leads to server-side request forgery (SSRF). The attack may be launched remotely and the exploit is publicly disclosed. The vendor did not respond.

A flaw has been found in macrozheng mall up to 1.0.3, affecting the JwtTokenUtil.refreshHeadToken function in /admin/refreshToken of the JwtAuthenticationTokenFilter component. Manipulation of the token argument causes session expiration. The attack may be initiated remotely and the exploit is publicly available. Patch name: 9bfc2fd2c4aaa4ac519e9152e65d673a5380de1a.

A vulnerability was detected in macrozheng mall up to 1.0.3, affecting the AlipayServiceImpl.pay function in com/macro/mall/portal/service/impl/AlipayServiceImpl.java of the Payment Endpoint component. Manipulation of the total_amount argument results in business logic errors. The attack can be launched remotely and the exploit is publicly available. Patch dcaa93b3150352e5044708d7211b5bed0af4509f should be applied.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the CommonServiceImpl.getAutoList function of the Autocomplete Handler component. Manipulation of arguments trem/searchField/entityName leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the WmToMoveGoodsController.list function of the PDA Interface component. Manipulation of argument searchstr leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the WmSttInGoodsController.list function. Manipulation of argument searchstr leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the WmInQmIController.list function of the Inbound Quality Check Pda Interface component. Manipulation of argument searchstr leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the WvGiController.list function. Manipulation of argument searchstr leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the WvNoticeController.list function of the Search Endpoint component. Manipulation of argument searchstr leads to SQL injection. Remote attack possible, exploit public.

Vulnerability in JEEWMS up to 2026.09.27-W39 in the getbinall/getbinallagv function. Manipulation of arguments binstore/binid/des/cengshu leads to SQL injection. Remote attack possible, exploit public.

A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. The function docheck of the file WmOmNoticeHController.java is affected. Manipulation of the argument goodscode results in SQL injection. The attack can be initiated remotely and the exploit is public.

A security vulnerability has been detected in bleenco abstruse up to 2.1.0. The function filepath.Join of the file server/api/worker/download_cache.go in the Cache Endpoint component is affected. Manipulation of the argument File leads to path traversal. The attack can be launched remotely and the exploit is public.

A weakness has been identified in Appwrite up to 2.3.0. The function PublicHostname of the file src/Appwrite/Platform/Modules/Avatars/Http/Screenshots/Get.php in the Browser Screenshot Service component is affected. Manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. Upgrading to version 2.4.0 resolves the issue.

Heap-based buffer overflow vulnerability in Samsung Opensource rlottie allows buffer overflow via environment variables. Affects version e57b094f03c39a751a1fded6f7d6c13f1ed95ec9.

A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. The Markdown Rendering component, file Markdown.tsx, is affected. The manipulation results in denial of service. The attack can be launched remotely and the exploit is public.