CVE Vulnerability Catalog

Alerta versions prior to 9.1.0 contain a SQL injection vulnerability in the Query string search API (q=). The query is built by directly interpolating user-supplied search terms into SQL strings via f-strings, allowing manipulation of the query.

The MAVLink communication protocol does not require cryptographic authentication by default. When MAVLink 2.0 message signing is not enabled, any message, including SERIAL_CONTROL providing interactive shell access, can be sent by an unauthenticated party with access to the MAVLink interface. PX4 provides message signing as the cryptographic authentication mechanism, and when enabled, unsigned messages are rejected at the protocol level.

Zora: Post, Trade, Earn Crypto version v2.60.0 contains an arbitrary file overwrite vulnerability during the file import process. An attacker can overwrite critical internal files, potentially leading to arbitrary code execution or information exposure.

The MS27102A Remote Spectrum Monitor is vulnerable to authentication bypass, allowing unauthorized users to access and manipulate its management interface. The device provides no mechanism to enable or configure authentication, making the issue inherent to its design.

Funambol Zefiro Cloud version v32.0.2026011614 contains an arbitrary file overwrite vulnerability during the file import process. An attacker can overwrite critical internal files, potentially leading to arbitrary code execution or information exposure.

The NIS Animal Sounds and Ringtones app version 1.3.0 by PEAKSEL D.O.O. contains an arbitrary file overwrite vulnerability during the file import process. An attacker can overwrite critical internal files of the application.

An arbitrary file overwrite vulnerability in Cast to TV Screen Mirroring v2.2.77 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

In FLY is FUN Aviation Navigation v35.33, an arbitrary file overwrite vulnerability exists during file import. An attacker can overwrite critical internal files, leading to arbitrary code execution or information exposure.

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to version 6.9.4, the FHIR Validator HTTP service exposes an unauthenticated "/loadIG" endpoint that makes outbound HTTP requests to attacker-controlled URLs. Combined with a startsWith() URL prefix matching flaw in the credential provider (ManagedWebAccessUtils.getServer()), an attacker can steal authentication tokens (Bearer, Basic, API keys) configured for legitimate FHIR servers by registering a domain that prefix-matches a configured server URL. This issue has been patched in version 6.9.4.

wenxian versions 0.3.1 and prior contain a command injection vulnerability in a GitHub Actions workflow. Untrusted user input from issue_comment.body is used directly inside a shell command, allowing potential arbitrary code execution on the runner. At the time of publication, no public patches are available.

PJSIP before version 2.17 has a heap out-of-bounds read vulnerability in the VP9 RTP unpacketizer. Insufficient bounds checking on payload descriptor length may cause reads beyond the allocated RTP buffer.

MikroORM prior to versions 6.6.10 and 7.0.6 has a prototype pollution vulnerability in the Utils.merge helper used internally when merging object structures. The function did not prevent special keys such as __proto__, constructor, or prototype, allowing attacker-controlled input to modify the JavaScript object prototype.

MikroORM, a TypeScript ORM for Node.js, has a SQL injection vulnerability in versions before 6.6.10 and 7.0.6. Specially crafted objects are interpreted as raw SQL query fragments.

An arbitrary file overwrite vulnerability in MaruNuri LLC v2.0.23 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

An arbitrary file overwrite vulnerability in DeftPDF Document Translator v54.0 allows attackers to overwrite critical internal files via the file import process, leading to arbitrary code execution or information exposure.

Parse Server prior to versions 8.6.67 and 9.7.0-alpha.11 has a vulnerability where an attacker can bypass Cloud Function validator access controls by appending "prototype.constructor" to the function name in the URL. This causes all access control enforcement to be skipped, allowing unauthenticated callers to invoke protected Cloud Functions.

FastGPT before version 4.14.9.5 exposes the /api/core/app/httpTools/runTool endpoint without authentication. It acts as a full HTTP proxy, allowing attackers to make arbitrary HTTP requests from the server.

OpenClaw before version 2026.3.28 contains a privilege escalation vulnerability in the /pair approve command path that fails to forward caller scopes into the core approval check. A caller with pairing privileges but without admin privileges can approve pending device requests asking for broader scopes including admin access by exploiting the missing scope validation in extensions/device-pair/index.ts and src/infra/device-pairing.ts.

Moduł automatycznej akceptacji poleceń w Ridvay Code zawiera krytyczną podatność na wstrzykiwanie poleceń systemowych, co czyni mechanizm białej listy całkowicie nieskutecznym. Wykorzystuje on słabe wyrażenia regularne do analizy struktur poleceń, co pozwala atakującemu na wstrzyknięcie złośliwego kodu.

Moduł automatycznej akceptacji poleceń DSAI-Cline zawiera krytyczną podatność na wstrzykiwanie poleceń systemowych, która całkowicie unieważnia mechanizm bezpieczeństwa oparty na białej liście. System nieprawidłowo przetwarza znaki nowej linii, co pozwala atakującemu na wstrzyknięcie złośliwego kodu w ramach dozwolonego polecenia.