CVE Vulnerability Catalog

Missing invocation of the session ID change method after session binding in Apache Wicket can be exploited for a session fixation attack.

Heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message causing a write of 4 attacker-controlled bytes beyond the end of a heap buffer.

CoreDNS versions prior to 1.14.3 incorrectly handle TSIG authentication in gRPC, QUIC, DoH, and DoH3 transports. For gRPC and QUIC, the server only checks the TSIG key name but does not validate the HMAC, so any request with a matching key name is considered authenticated. For DoH and DoH3, the issue is more severe – the server never inspects the TSIG record at all, so any request with TSIG is treated as authenticated.

Masa CMS versions 7.2.0-7.2.9, 7.3.0-7.3.14, 7.4.0-7.4.9, and 7.5.0-7.5.2 have an SQL injection vulnerability in the unauthenticated JSON API. The altTable parameter is injected directly into the SQL FROM clause, allowing an unauthenticated attacker to read sensitive data from any table.

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.

PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.

A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the function url_rule_asp of the file /url_rule.asp (POST Parameter Handler) allows remote attackers to potentially execute arbitrary code. The exploit has been publicly disclosed.

Kestra version 1.3.3 and earlier is vulnerable to SQL injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization.

In OpenCTI, versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account.

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp. Manipulation of the argument enable/time causes buffer overflow. The attack can be initiated remotely. The exploit has been made public.

ERPNext v15.103.1 and earlier is vulnerable to Server-Side Template Injection (SSTI). Users with permission to create or edit email templates can inject template expressions executed on the server during rendering.

OpenCMS version 20 and before is vulnerable to XML External Entity (XXE) in the Admin Import DB feature due to insecure XML parsing of user-supplied .zip files containing a manifest.xml.

In Eclipse BaSyx Java Server SDK versions prior to 2.0.0-milestone-10, inadequate path normalization in the Submodel HTTP API allows an unauthenticated remote attacker to perform a path traversal attack. An attacker can supply a maliciously crafted fileName parameter during a file upload operation, allowing arbitrary files to be written to any location on the host filesystem.

W jądrze systemu Linux zidentyfikowano podatność związana z odczytem poza granicami (OOB) w dentry_hashtable, gdy użytkownik ustawia 'dhash_entries=1'. Problem ten prowadzi do błędu strony w trybie jądra, co może skutkować nieprzewidzianym dostępem do pamięci.

In the Linux kernel, ext4 could exceed the 32-bit block number range when searching for blocks for indirect block mapped files. This occurs when ac->ac_g_ex.fe_group is greater than or equal to ngroups, potentially allocating blocks outside the supported range. A safety clamp was added in ext4_mb_scan_groups().

A vulnerability has been detected in EFM ipTIME NAS1dual 1.5.24 affecting the function get_csrf_whites in the file /cgi/advanced/misc_main.cgi. Manipulation of this function leads to stack-based buffer overflow.

An unauthenticated OS command injection vulnerability exists in the GoAhead web server on MeiG Smart FORGE_SLT711 devices (firmware MDM9607.LE.1.0-00110-STD.PROD-1). The attack is possible via the /action/SetRemoteAccessCfg endpoint.

An issue was discovered in Gambio version 4.9.2.0 that allows the password reset function to be bypassed, enabling arbitrary passwords to be set for arbitrary accounts if the account ID is known.

OpenClaw versions 2026.4.7 before 2026.4.14 contain a privilege escalation vulnerability where heartbeat owner downgrade logic skips webhook wake events carrying untrusted content. Attackers can exploit this by sending untrusted webhook wake events to preserve owner-like execution context when the run should have been downgraded.