CVE Vulnerability Catalog

SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This could result in a total compromise of the system's confidentiality, integrity, and availability.

SAP Landscape Transformation zawiera podatność, która pozwala atakującemu z uprawnieniami administratora na wykorzystanie luki w module funkcji udostępnionym przez RFC. Luka ta umożliwia wstrzykiwanie dowolnego kodu ABAP/komend systemowych do systemu, omijając istotne kontrole autoryzacji.

OpenCode, an open source AI coding agent, prior to version 1.0.216 automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This vulnerability is fixed in version 1.0.216.

Metabase to platforma analityki danych typu open-source. W wersjach przed 55.13, 56.3 i 57.1, samodzielnie hostowane instancje Metabase, które pozwalają użytkownikom na tworzenie subskrypcji, mogą być narażone, jeśli są współlokalizowane z innymi niezabezpieczonymi zasobami.

Termix, a web-based server management platform, versions 1.7.0 to 1.9.0, has a Stored Cross-Site Scripting (XSS) vulnerability in the File Manager component. The application fails to sanitize SVG file content before rendering, allowing an attacker who has compromised a managed SSH server to plant a malicious file. When previewed by the Termix user, it executes arbitrary JavaScript in the application context. This is fixed in version 1.10.0.

Stack-based buffer overflow in the ethos utility of RIOT OS up to version 2026.01-devel-317. Missing bounds checking in _handle_char() allows writing past the stack buffer when processing serial frames.

RIOT OS versions up to and including 2026.01-devel-317 contain a stack-based buffer overflow vulnerability in the tapslip6 utility. The vulnerability is caused by unsafe string concatenation in the devopen() function, which constructs a device path using unbounded user-controlled input.

A stack-based buffer overflow vulnerability in the mcp2200gpio utility in TinyOS versions up to and including 2.1.2. It is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.

Ollama versions 0.11.5-rc0 through 0.13.5 contain a null pointer dereference vulnerability in the multi-modal model image processing functionality. When processing base64-encoded image data via the /api/chat endpoint, the application fails to validate that the decoded data represents valid media before passing it to the mtmd_helper_bitmap_init_from_buf function. This function can return NULL for malformed input, but the code does not check this return value before dereferencing the pointer in subsequent operations.

A ReDoS vulnerability in LangChain up to version 0.3.1 exists in the MRKLOutputParser.parse() method. An attacker can supply crafted text (e.g., via prompt injection) causing excessive CPU consumption and parsing delays, leading to denial of service.

LlamaIndex versions up to and including 0.12.2 contain an uncontrolled resource consumption vulnerability in the VannaPack VannaQueryEngine implementation. The custom_query() function generates SQL statements from user-supplied prompts and executes them via vn.run_sql() without enforcing query execution limits, allowing an attacker to trigger expensive SQL operations that exhaust CPU or memory resources.

LlamaIndex versions up to and including 0.11.6 contain an unsafe deserialization vulnerability in BGEM3Index.load_from_disk(). The function uses pickle.load() to deserialize multi_embed_store.pkl from a user-supplied persist_dir without validation, allowing an attacker to execute arbitrary code by providing a crafted pickle file.

Emlog, an open source website building system, version 2.6.1 and earlier exposes a REST API endpoint (/index.php?rest-api=upload) for media file uploads. The endpoint fails to implement proper validation of file types, extensions, and content, allowing authenticated attackers (with a valid API key or admin session cookie) to upload arbitrary files (including malicious PHP scripts) to the server. An attacker can obtain the API key either by gaining administrator access or via information disclosure vulnerabilities. Once uploaded, the malicious PHP file can be executed to gain remote code execution (RCE) on the target server, leading to full server compromise.

Vulnerability in Appsmith before 1.93: the server uses the Origin header value as the email link baseUrl without validation. An attacker controlling Origin can cause password reset / email verification links to point to their domain, exposing authentication tokens and potentially leading to account takeover.

WebErpMesv2 prior to version 1.19 exposes multiple sensitive API endpoints without authentication middleware. An unauthenticated remote attacker can read business-critical data including companies, quotes, orders, tasks, and whiteboards. Limited write access allows creation of company records and full manipulation of collaboration whiteboards.

Gin-vue-admin to system zarządzania zaplecza oparty na Vue i Gin. W wersjach do v2.8.7 występuje podatność na przejście ścieżki w funkcjonalności wznowienia przesyłania plików, co pozwala atakującemu na przesyłanie dowolnych plików do dowolnego katalogu.

Multiple SQL Injection vulnerabilities in GYM-MANAGEMENT-SYSTEM 1.0 by AbhishekMali21, in 'name' and 'id' parameters in various scripts. An unauthenticated attacker can inject malicious SQL commands, leading to unauthorized data extraction, authentication bypass, or database modification.

A buffer overflow vulnerability exists in the ippprint (Internet Printing Protocol) service of the Sagemcom F@st 3686 router, version MAGYAR_4.121.0. A remote attacker can execute arbitrary code by sending a crafted HTTP request.

Vulnerability in ServiceNow AI Platform allows an unauthenticated user to impersonate another user and perform operations that the impersonated user is entitled to perform.

W systemie zarządzania siłownią amansuryawanshi Gym-Management-System-PHP 1.0 występuje wiele podatności na ataki SQL Injection poprzez parametry 'name', 'email' i 'comment' w pliku submit_contact.php, 'username' i 'pass_key' w secure_login.php oraz 'login_id', 'pwfield' i 'login_key' w change_s_pwd.php. Atakujący, zarówno nieautoryzowany, jak i autoryzowany, może wykorzystać te luki do ominięcia uwierzytelnienia, wykonania dowolnych poleceń SQL, modyfikacji rekordów w bazie danych, usunięcia danych lub eskalacji uprawnień do poziomu administratora.