CVE Vulnerability Catalog

In Duck Site before version 1.0.1, there is a vulnerability related to the deployment process that can be triggered by malicious code in a pull request. An attacker can exploit this flaw to deploy a malicious Docker image to production without merging the code.

Quest Bot is a modern Discord bot that prior to version 1.0.3 had a privileged deployment process. An attacker could exploit a pull request from the main branch, allowing the deployment of malicious code in a privileged context.

Idira Secrets Manager SaaS Edge versions prior to 1.8 exhibit improper access control within its internal authentication components. A remote, unauthenticated attacker could exploit this by submitting a specially crafted request, potentially leading to a bypass of identity verification.

A vulnerability in MariaDB Server allows execution of arbitrary shell commands embedded in the joiner node name when `wsrep_notify_cmd` is enabled. Affected versions: 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1.

The crypton-x509-validation Haskell library fails to enforce X.509 NameConstraints, allowing TLS clients to accept certificates whose Subject Alternative Names fall outside the issuing CA’s permitted subtrees.

A vulnerability in Rotaban by Başarsoft Information Technologies Inc. allows unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.

CVE-2026-38581 is an SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 that allows remote attackers to execute arbitrary SQL commands via the idFormMain and id parameters in the ezform.php file.

The LimRAD NAC system by Limatek System Inc. has a vulnerability allowing unrestricted upload of files with dangerous types, enabling Remote Code Inclusion.

CVE-2026-11561 describes an improper neutralization of special elements used in expression language statements, allowing for code injection in Apinizer software by Soagen Informatics Technologies Software and Consulting Inc.

CVE-2026-4764 describes a Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform. This allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously crafted playbook import.

Vulnerability in Boxlite before version 0.9.0. Users can specify OCI images, and when processing tar entries, symlinks to absolute paths are not checked. An attacker can host a malicious image on DockerHub, allowing arbitrary file writes on the host and remote code execution.

Boxlite prior to version 0.9.0 does not restrict kernel capabilities inside the container, allowing malicious code to remount directories in rw mode and gain write access to read-only directories. Fixed in version 0.9.0.

An improper validation of credentials vulnerability in the Commvault SecurityIQ integration for Cortex XSOAR and Cortex XSIAM allows an unauthenticated attacker to access and modify protected resources.

Metrics::Any::Adapter::DogStatsd versions before 0.04 for Perl does not protect against metric injections. The statsd protocol allows multiple metrics to be sent per packet, creating a risk of injecting malicious data.

Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. In versions prior to 1.24.0, a user with appropriate RBAC permissions could run privileged containers, leading to container-sandbox escape and access to the host's filesystem and network.

Fission is a serverless framework, native to Kubernetes, which prior to version 1.24.0 had a security issue related to the Environment CRD. The pod specs for runtime and builder lacked filtering for critical fields, potentially allowing unauthorized access to system resources.

Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications. In versions prior to 1.24.0, the Container Executor path allowed users to supply pod specifications directly, which could lead to unauthorized access to resources.

Fission is a serverless framework, native to Kubernetes, that simplifies the deployment of functions and applications. Prior to version 1.24.0, the lack of validation in Environment.spec.runtime.podSpec / spec.builder.podSpec led to the propagation of dangerous fields into generated pods.

Fission, a serverless framework for Kubernetes, prior to version 1.23.0 registered internal routes for function objects, allowing them to be invoked without proper permissions. This enabled attackers to call functions by guessing their names and namespaces.