CVE Vulnerability Catalog

The temporalio/sqlparser library can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary, causing a Go runtime panic that terminates the process.

A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities, no_new_privs, and seccomp state from the checkpoint instead of enforcing the destination configuration.

A vulnerability in CRI-O related to the container checkpoint and restore feature. When CRI-O is configured to restore containers from checkpoint archives, insufficient validation of restore metadata may allow a user with sufficient privileges to perform unintended operations on the host filesystem.

The CompressionFilter class in Apache MINA uses ZLib to deflate and inflate data, but does not control the resulting buffer size during decompression. Maliciously compressed data with a very high compression ratio can exhaust application memory. The fix introduces limits on the maximum decompressed size and compression ratio.

A vulnerability in BioStar BIOS Update Utility 1.9.7.3 affects the function sub_110BC in BSMEM64_W10.sys (IOCTL Handler component). Manipulation of the PhysicalAddress/Size arguments results in a write-what-where condition. Local access is required, and the exploit has been made public.

A vulnerability in the drogon library (up to version 1.9.13) affects the makeCriteria function in orm_lib/src/Criteria.cc (ORM component). Manipulation of the filter argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

The Canva Mobile App for HarmonyOS before v1.15.1 did not restrict the headers returned to an external origin running in a privileged WebView. A threat actor with control of the WebView could access a user's session.

A vulnerability in the drogon library (up to version 1.9.13) affects the Mapper::orderBy function in Mapper.h (ORM Mapper component). Manipulation of the sort argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. The affected function is sub_1105C in BS_HWMIO64_W10.sys in the IOCTL Handler component, where manipulation of the PhysicalAddress argument leads to a write-what-where condition. The attack requires local access and the exploit is publicly disclosed.

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. The affected file is /send_order.cgi?parameter=loginout in the Cookie Handler component, where manipulation of the session_id argument causes command injection. Remote exploitation is possible and the exploit is publicly available.

A vulnerability was detected in BioStar VALKYRIE AURORA 2.10.2411.0800. The vulnerability affects the function sub_1105C in BS_RVSIO64.sys in the IOCTL Handler component, where manipulation of the PhysicalAddress argument results in a write-what-where condition. The attack requires local access and the exploit is now public.

A vulnerability was detected in BioStar VIVID LED DJ 4.0.2411.1500 in the sub_1105C function of BS_LED64.sys (IOCTL Handler). Manipulation of the AssociatedIrp argument leads to a write-what-where condition. Local access is required and the exploit has been publicly disclosed.

A vulnerability was detected in QCMS up to 6.0.6 in the self_Tmp function of Lib/Config/Controllers.php (Content Detail Page). Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely and the exploit has been publicly disclosed.

A vulnerability was identified in 03-lovepreetSingh MCP up to commit f95d035c5317fad81af9828286631053ccb23546. The issue affects the create_file function in app/api/mcp/route.ts. Manipulating the filePath/content arguments leads to path traversal. The attack can be launched remotely, and the exploit is publicly available. The product does not use versioning, so information about affected and unaffected releases is unavailable.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged SQL injection vulnerability was found. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with ARRAY/STRING filter types, neither of which sanitizes SQL content. Values from category_names[], catOrderIds, and image-ordering fields are concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.

A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.

A server-side request forgery vulnerability was detected in NonceGeek dim-sum-app in the textSearchV2Handler function of deno/main.tsx in the Deno Backend component. Manipulation of the supabase_url argument leads to server-side request forgery, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used, and the patch is named 8389032e5d52c28c4855c6126ca7d0eae8af346a.

A security flaw was discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402 in an unknown function of /ubus in the routerd component. Manipulation of the passwd_set argument results in improper access controls, and the attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function of /drug_recommender/Admin/edit_user.php. Manipulation of the ID argument leads to SQL injection, and the attack may be launched remotely. The exploit is publicly available and might be used.

openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.renderHtml() that allows any authenticated non-guest user to achieve remote code execution by storing a malicious FreeMarker payload through a POST request to the RemotePortletService invoker endpoint. The markup field from stored portlet configuration is passed directly to custFactory.createResult() without a TemplateClassResolver restriction or FreeMarker sandboxing in BasicConfiguration, leaving built-ins such as ?new and freemarker.template.utility.Execute available, causing the payload to execute in the application server process context when any user renders a dashboard containing the affected portlet.