CVE Vulnerability Catalog

A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially crafted packets.

A use of hard-coded cryptographic key vulnerability in Fortinet FortiSandbox (including Cloud versions) may allow an attacker to escalate privileges via specially crafted HTTP requests.

An improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Fortinet FortiManager and FortiManager Cloud may allow an attacker to escalate privileges via specially crafted packets.

An Uncaught Exception vulnerability [CWE-248] in Fortinet FortiSandbox may allow a privileged attacker to persistently deny access to the GUI and CLI via crafted HTTP requests.

An Incorrect Privilege Assignment vulnerability in Docker Hub's account-to-organization conversion feature allowed an authenticated attacker to reassign a personal access token (PAT) they controlled to another Docker Hub user without rotating or revoking the token secret. The unchanged PAT then authenticated to the registry as the recipient and could pull, push, or delete images, within its scopes, in repositories accessible to that user, including organization repositories.

The odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Shell metacharacters such as $(id) in a non-.odt filename survive insufficient sanitization in odt2spip_deplacer_fichier_upload() and LibreOffice::createCommand(), achieving remote code execution as the web-server user during the LibreOffice conversion process.

This CVE ID has been rejected (REJECT) and must not be used. It is a reservation duplicate of CVE-2026-94257; all references and descriptions have been removed to prevent accidental usage.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiMail 7.6.0 through 7.6.3, 7.4.0 through 7.4.5, and 7.2.0 through 7.2.8 allows an authenticated attacker to execute unauthorized code or commands via specifically crafted HTTP or HTTPS requests.

An SQL Injection vulnerability (CWE-89) in Fortinet FortiAnalyzer 7.6.0 through 7.6.4, 7.4.0 through 7.4.7, 7.2 all versions, FortiAnalyzer Cloud 7.6.2 through 7.6.4, 7.4.1 through 7.4.7, and 7.2.1 through 7.2.11 may allow a low privileged user to execute arbitrary commands via crafted requests.

Podman from 4.4.0 until 5.8.8 and 6.1.3 treats an image carrying the io.podman.annotations.checkpoint.runtime.name annotation as a checkpoint and silently ignores user-supplied container creation restrictions such as --cap-drop=ALL. This allows image-controlled checkpoint state to select weaker sandbox settings and capabilities. Rootless containers are not affected because checkpoint and restore are unavailable in that mode. This issue is fixed in versions 5.8.8 and 6.1.3.

A flaw was found in BusyBox's mount utility. A non-root user can bypass mount security restrictions set in /etc/fstab by specifying clearing-mask options on the command line. These options pass the non-root flag filter and are merged with fstab options as strings; when the combined options are re-parsed, clearing options can override nosuid, nodev, and noexec protections the administrator intended to enforce.

In BusyBox's httpd web server, when configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected.

A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an attacker-controlled value from the IP header without re-validating the minimum size. This leads to an integer underflow when subtracting header sizes, causing a subsequent memory copy with a massively oversized length. An attacker on the same network segment can send a specially crafted packet to crash the DHCP client, resulting in denial of service and loss of network connectivity.

Leantime is an open source project management system. Prior to 3.10.0, the JSON-RPC API surfaces lack per-method authorization, allowing a low-privilege authenticated user to create an administrator account and manage plugins without proper permissions.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.

FrankenPHP is a modern application server for PHP. Prior to 1.12.5, in worker mode, when the session extension is loaded as a shared module, PHP session state can be retained between requests, leading to cross-user session exposure and possible session hijacking.

Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition: <= iKuai 8_4.0.304-beta allows a remote attacker to execute arbitrary code.

Argo CD from 2.10.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2 creates PostDelete resource hooks without applying the AppProject destination and resource authorization checks used during ordinary synchronization. A user who can write to an Application's Git repository can commit a delete hook targeting a forbidden namespace, server, group, kind, or resource name, and deletion of the Application causes the application-controller to create that resource with its destination-cluster credentials. This issue is fixed in versions 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2.

A flaw in Portal for ArcGIS allows unauthenticated access to certain Portal Administrator API endpoints under specific conditions. This could enable an attacker to access administrative functionality that should require authentication.

A flaw in Portal for ArcGIS allows unauthenticated users to create new accounts through the sharing endpoint even when self-service account registration is disabled (disableSignup=true). An attacker can bypass the intended restriction by manipulating the signup workflow, resulting in unauthorized account creation.