CVE Vulnerability Catalog

Cloud Commander versions 19.20.2 through 19.21.1 contain a path traversal vulnerability in the GET /api/v1/pack endpoint where the onGET handler calls the unguarded root() function instead of the root.resolve() validation wrapper. Attackers can use percent-encoded directory traversal sequences to read arbitrary files outside the configured --root directory, such as /etc/passwd or SSH private keys, which are archived and streamed back as a downloadable tar.gz file.

The JetEngine plugin by Crocoblock up to version 3.8.16 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Polylang plugin by WP SYNTEX up to version 3.8.9 contains an untrusted data deserialization vulnerability that allows Object Injection.

Radar before version 1.12.2 contains a missing authorization vulnerability in the /api/local-terminal WebSocket endpoint that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a runtime-mode check instead of role-based access control. Attackers can connect to the endpoint to execute /bin/bash -l on the Radar host with Radar's privileges, even when the --disable-local-terminal flag is set.

The JetProductTables plugin by Crocoblock up to version 1.2.4 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

The Paid Videochat Turnkey Site plugin by VideoWhisper.com up to version 7.5.12 contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels.

The Broadcast Live Video plugin by VideoWhisper.com up to version 7.3.2 contains a Session Fixation vulnerability that allows session hijacking.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains an untrusted data deserialization vulnerability that allows Object Injection.

The SureCart plugin by Brainstorm Force up to version 4.9.3 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation.

Google Cloud Application Integration prior to version 2026-08-27 contains an incorrect authorization vulnerability in the AuthConfig validation and integration execution runtime that allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

A security vulnerability in HPE NonStop SNMP Trap Multiplexer may allow remote code execution. Technical details were not provided in the description.

A security vulnerability in HPE NonStop DNS 9.2.3 Non Secure Version could cause a Denial of Service. Technical details were not provided in the description.

Incorrect authentication vulnerability in the TSplus Remote Access multi-factor authentication (MFA) mechanism. A remote attacker authenticated with valid first-factor credentials could bypass the second-factor verification because the authentication flow does not correctly apply the MFA validation result, allowing the attacker to complete the login without a valid second-factor token and gain access to protected applications and resources.

A vulnerability in the TSplus Remote Access web server involves improper access control. An unauthenticated remote attacker can access internal resources by manipulating paths through the /socket.io/JWN/ endpoint, bypassing access restrictions.

A Missing Authorization vulnerability in Crocoblock JetFormBuilder allows exploiting incorrectly configured access control security levels. Affects versions up to 3.6.6.

An SQL Injection vulnerability in Webnus Modern Events Calendar Lite allows blind SQL injection. Affects versions before 7.37.0.

A vulnerability in insights-runtime-extractor allows an unprivileged tenant to take over a node. The scanning process does not sufficiently drop privileges (only seteuid, without changing ruid/suid and without removing capabilities), and then executes a workload-controlled binary with root privileges in the host namespace. An attacker can exploit this to gain full node access through the CRI-O socket.

A vulnerability in JTL-Shop's authentication middleware processes the plugin safe mode toggle on the admin logout route before checking authentication. An unauthenticated attacker can toggle the safe mode, deactivating all plugins and causing a shop-wide denial of service.

A Code Injection vulnerability in VillaTheme Email Template Customizer for WooCommerce allows code injection. Affects versions up to 1.3.4.

A vulnerability in NSD involves text tokens in RDATA (e.g., TXT records) under 32 bytes not being checked to stay within the reserved space, allowing arbitrary sized out-of-bounds stack writes, including overwriting a callback function pointer.