CVE Vulnerability Catalog

An SQL injection vulnerability in Friendica through the 2026.08-dev branch allows unauthenticated remote attackers to execute arbitrary SQL statements via the photo-view order parameter. The parameter is concatenated unescaped into a SHOW COLUMNS query, enabling stacked statement injection.

CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Customers should upgrade to the resolved maintenance release.

CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Customers should upgrade to the resolved maintenance release.

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability.

A flaw was found in Picketlink Federation SAML; the unsolicited response handler would accept forged assertions with no verification or validation, permitting an unauthenticated attacker to authenticate as any principal in any role. This could lead to information disclosure, access to restricted operations, or other flaws.

A caller-supplied X-Grafana-URL request header controls the destination of mcp-grafana's outbound requests, and the grafana_api_request tool lets the caller also choose the HTTP method, path, and body. Because the destination is not restricted to the configured Grafana instance, a caller can direct requests at internal, loopback, and link-local network services (including metadata endpoints) and read the responses, resulting in server-side request forgery. The fix for CVE-2026-15583 prevented the configured service-account token from being sent to unintended destinations but did not restrict the destinations themselves.

Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.

Travel Agency Management System developed by Win Men International has a SQL Injection vulnerability. Unauthenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents.

SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability.

SAP NetWeaver Application Server ABAP is vulnerable to logical errors in DIAG protocol parsing, allowing an unauthenticated attacker to cause memory corruption. This could potentially disclose sensitive system information or crash the system, leading to high impact on confidentiality, integrity, and availability.

The react18-use library (a React 19 use hook shim) contained malicious commits in the default branch that executed remote attacker-controlled code on developer machines during `npm install`. The code fetched a JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and evaluated it with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations.

ERPNext prior to versions 15.118.0 and 16.29.0 contains a vulnerability in unsafe template rendering in the statement of accounts process. An authenticated user with a common operational role can inject template expressions, execute arbitrary server-side code, and read data across the application.

Firecrawl prior to version 2.11.32 contains a critical arbitrary file read vulnerability in its extraction functionality due to unsafe dereferencing of user-supplied JSON schemas. An authenticated attacker can supply a malicious schema with a $ref, allowing file reads from the extract worker filesystem and SSRF against internal or external HTTP endpoints.

The react-tracked library contained malicious commits in the default branch that executed remote attacker-controlled code on developer machines during `npm install`. The code fetched a JavaScript payload from an attacker-controlled HTTPS endpoint, disabled TLS verification, and evaluated it with `require` available. Execution was deliberately skipped on CI and cloud/serverless environments, targeting developer workstations.

A flaw was found in Feast where the system improperly deserializes user-defined functions (UDFs) stored in its registry, serialized using the 'dill' library. This allows a remote attacker to store a malicious UDF, leading to unauthenticated arbitrary code execution on the feature server in default configurations. An authenticated attacker can also achieve arbitrary code execution on the registry server by bypassing authorization checks during deserialization.

A flaw was found in the MaaS API allowing any pod within the cluster to bypass the Kuadrant AuthPolicy gateway by forging HTTP headers `X-MaaS-Username` and `X-MaaS-Group`, which are trusted verbatim. This lack of first-party authentication enables an attacker to gain unauthorized access and escalate privileges, including minting Kubernetes ServiceAccount tokens in other tenants' namespaces, revoking API keys, and exfiltrating sensitive model access configuration.

Dokploy prior to version 0.29.13 allows an authenticated user to execute arbitrary commands on a local or SSH-connected target server because registry.testRegistry and registry.testRegistryById interpolate the password field into an execAsyncRemote shell command instead of using safeDockerLoginCommand.

Dokploy prior to version 0.29.13 allows an authenticated low-privilege member to execute arbitrary commands on the control-plane host because the volumeName field accepted by volumeBackup.create and volumeBackup.runManually is interpolated without quoting in packages/server/src/utils/volume-backups/backup.ts and executed through child_process.exec, with Docker socket access making execution host/root-equivalent.

In Dokploy from version 0.29.2 to 0.29.13, schedule.create and schedule.update in schedule.ts derive serviceId from applicationId or composeId and execute the owner/admin host-schedule gate only in the alternative branch. This allows a member with access to one application to attach its applicationId to a dokploy-server schedule and run a supplied script as root through schedule.runManually. This issue is fixed in version 0.29.13.

In Dokploy version 0.28.8 and earlier, an authenticated user who can create or update file mounts for a service can inject shell metacharacters into filePath, causing Dokploy to execute attacker-controlled commands on the configured remote managed server over SSH. In the default deployment model, this yields direct remote host RCE from the web interface.