CVE Vulnerability Catalog

Spacelabs Healthcare Sentinel versions 10.5.x and higher, and 11.x.x before 11.6.0, contain an unauthenticated remote code execution vulnerability through a deprecated .NET Remoting HTTP channel on port 8989. Attackers can read/write arbitrary files and deploy ASPX webshells.

OpenMed before 1.5.2 has a remote code execution vulnerability in the PII privacy-filter model loading path. The filter uses broad substring matching on the model_name parameter, allowing an unauthenticated attacker to load a malicious Hugging Face model with trust_remote_code=True, executing arbitrary code.

Progress Sitefinity in multiple versions (14.0.7700-14.4.8152, 15.0.8200-15.0.8234, 15.1.8300-15.1.8335, 15.2.8400-15.2.8441, 15.3.8500-15.3.8531, 15.4.8600-15.4.8630) has a vulnerability due to insufficiently protected credentials. A remote unauthenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service.

Progress Sitefinity 15.4.8623 before version 15.4.8630 has an improper access control vulnerability. A remote unauthenticated attacker can access restricted content, leading to full compromise of confidentiality, integrity, and availability.

MISP contains an authentication bypass vulnerability when LDAP mixed authentication is enabled with OTP enforcement. An authenticated user can bypass the OTP step and access the application without providing a TOTP, HOTP, or email OTP code.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ahmad WP Job Portal allows Blind SQL Injection. This issue affects WP Job Portal from n/a through 2.5.1.

In Wirtualna Uczelnia up to version wu#2016.437.295#0#20260327_105545, a Server-Side Template Injection (SSTI) vulnerability in the redirectToUrl endpoint allows an unauthenticated attacker to achieve remote code execution, including a reverse shell.

Incorrect privilege assignment in Themeisle's Masteriyo LMS PRO allows privilege escalation.

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress versions 6.0.0 to 6.0.6 is vulnerable to privilege escalation via account takeover. The plugin accepts an arbitrary email address when a username is used in the password reset request, allowing unauthenticated attackers to send a password reset link to their own email.

Langroid SQLChatAgent before version 0.63.0 executes SQL generated by an LLM, which is influenceable by prompt injection. An attacker can coerce execution of dangerous operations like COPY ... FROM PROGRAM, leading to remote code execution on the database host.

Cloud Foundry UAA versions v76.12.0 through v78.12.0 inadvertently expose EC private keys through the public /token_keys endpoint. The vulnerability affects only deployments using EC keys for JWT token signing.

Arm Whois 3.11 has a stack-based buffer overflow vulnerability that allows remote attackers to execute arbitrary code by supplying oversized input to the IP address or domain field. Attackers can craft malicious input exceeding 658 bytes with shellcode to overwrite the structured exception handler and gain command execution.

IBM WebSphere Application Server 9.0 and 8.5 are vulnerable to remote code execution due to deserialization of untrusted data via JAX-WS endpoints with WS-Security.

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to remote code execution caused by the bypass of security controls.

IBM WebSphere Application Server 9.0 and 8.5 is vulnerable to identity spoofing.

Vulnerability in Capsule, a multi-tenancy and policy-based framework for Kubernetes. The Capsule Controller runs with cluster-admin privileges. TenantResource RawItems processing incorrectly handles cluster-scoped resources, allowing tenant administrators to create cluster-scoped resources (e.g., ClusterRole, ValidatingWebhookConfiguration) with elevated privileges, leading to cross-tenant privilege escalation and cluster-level attacks. Version 0.13.0 patches this issue.

In CloudPirates Open Source Helm Charts prior to commit fcf9302, a GitHub Actions workflow (generate-schema.yaml) exposes sensitive credentials (Personal Access Token and SSH signing key) to fork-controlled code due to unsafe checkout and credential handling.

In CloudPirates Open Source Helm Charts prior to commit fcf9302, a GitHub Actions workflow (pull-request.yaml) executes attacker-controlled code from forks in a privileged context, exposing repository secrets including Docker Hub credentials.

Cline is an autonomous coding agent available as an SDK, IDE extension, or CLI assistant. In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At the time of publication, no public patches are available.

The WP Directory Kit plugin for WordPress is vulnerable to Blind SQL Injection due to improper neutralization of special elements in SQL commands.