CVE Vulnerability Catalog

A Denial of Service (DoS) vulnerability exists in libmodbus 3.1.12 on Windows due to improper timeout management during network read operations in the receive loop.

A vulnerability in MikroTik RouterOS versions 7.21.x before 7.21.4 and 7.22.x before 7.22.2 exists in the unflatten() function of the libumsg.so library. A remote attacker can exploit this flaw to cause a denial of service (DoS).

A vulnerability in the downloadBlob function in Ollama allows a remote attacker to cause a denial-of-service (DoS) condition without authentication. The issue stems from improper validation of user-supplied data, leading to an out-of-bounds memory access.

A vulnerability in Glarysoft Glary Utilities allows local privilege escalation by abusing the Disk Clean functionality. An attacker with low privileges can create a junction to delete arbitrary files in the SYSTEM context.

The vulnerability in the Lorex 2K Indoor Wi-Fi Security Camera is due to improper validation of the certificate presented by the device management server. This allows a network-adjacent attacker to execute arbitrary code in the root context without user interaction.

A format string vulnerability in the Lorex 2K Indoor Wi-Fi Security Camera allows remote code execution via JSON request parsing in the sonia binary. The lack of input validation before using it as a format specifier enables unauthenticated network-adjacent attackers to execute arbitrary code as root.

A SQL injection vulnerability has been discovered in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam2.php. An attacker can remotely manipulate the ID argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.

In ChurchCRM prior to version 7.4.0, an authorization flaw in family-scoped endpoints allowed low-privileged users to read and modify other families' records. An authenticated non-admin user with EditSelf access can supply another family's familyId and access records outside their own family scope. The backend trusts the attacker-controlled familyId and loads the corresponding family entity without verifying that the requested family belongs to the current user.

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by an uncontrolled search path element, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction to open a malicious file. The scope has changed.

A vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier is caused by an uncontrolled search path element, potentially allowing arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file. The scope of the vulnerability has changed.

In CedarJava library versions prior to 2.3.6, 3.4.1, and 4.9.0, a vulnerability allows Cedar-expression injection due to improper input handling. The toCedarExpr() method does not escape special characters, enabling injection of arbitrary policy expressions.

In CedarJava versions prior to 4.9.0, the EntityIdentifier.equals() method has inverted logic for null and self-reference checks, causing incorrect equality comparisons. This does not affect Cedar authorization decisions but may impact integrators performing their own entity identifier comparisons.

CedarJava prior to versions 2.3.6, 3.4.1 and 4.9.0 contains a vulnerability where improper input handling could allow Record-to-Entity type confusion across the Java-Rust FFI boundary. CedarJava sends authorization requests to the Rust cedar-policy evaluator as JSON. The JSON protocol reserves magic single-key object shapes (__entity and __extn) for entity references and extension values. When serializing a CedarMap, there is no validation preventing these reserved keys from being used. If an integrating service builds a CedarMap from caller-supplied key/value data (such as request headers, user-defined metadata, or resource tags), an actor who controls those keys could cause the Rust evaluator to interpret a record as an entity reference. This vulnerability has been fixed in versions 2.3.6, 3.4.1, and 4.9.

A file upload vulnerability in Laravel-Mediable before version 7.0.0 allows unauthenticated attackers to achieve remote code execution by uploading a file with a double extension like shell.php.jpg. The PATHINFO_FILENAME extraction preserves the inner .php extension, and on misconfigured Apache or nginx servers, the file is executed as PHP while MIME and extension validation pass due to the outer .jpg.

A path traversal vulnerability was discovered in the Laravel-Mediable library before version 7.0.0 in the File::sanitizePath() function. It allows attackers to write uploaded files to arbitrary locations by controlling the directory argument passed to MediaUploader::toDestination().

Laravel-Mediable before version 7.0.0 contains a server-side request forgery (SSRF) vulnerability. It allows remote attackers to issue arbitrary HTTP requests from the server by supplying unvalidated caller-controlled URLs to endpoints backed by MediaUploader::fromSource().

OpenBMB XAgent version 1.0.0 and before is vulnerable to path traversal in the file() function in XAgent/XAgentServer/application/routers/workspace.py. The input parameter “filename” is user-controllable and is concatenated into the file path without proper validation, allowing directory traversal that may lead to sensitive information disclosure.

LogicalDOC Enterprise versions up to 9.1.1 are vulnerable to Server-Side Request Forgery (SSRF). An unauthenticated attacker can exploit the ShareFileCallback servlet by manipulating input parameters to trigger a server-side request to an attacker-controlled host.

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token granting full system access.

A path traversal vulnerability was found in the mcp-gitlab library in the job_id parameter of build/index.js. It allows attackers to redirect GitLab API requests to arbitrary endpoints.