CVE Vulnerability Catalog

PraisonAI before version 4.6.78 contains an unauthenticated server-side request forgery vulnerability in the Jobs API /api/v1/runs endpoint. The webhook_url parameter is validated at request time but re-resolved at connection time, allowing attackers to use DNS rebinding to reach internal services with a blind SSRF attack.

In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was discovered via unauthenticated agent registration. An attacker can inject a malicious script that will be executed in other users' browsers.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was found on the cloud profile page. The attack was possible via agent-reported data.

In JetBrains TeamCity before version 2026.1.2, a vulnerability allowed unauthorized arbitrary file access through the Perforce VCS integration.

An authentication bypass vulnerability in Capgo before version 12.128.2 allows attackers to change user passwords without requiring current password confirmation. This flaw can be exploited by attackers with temporary session access.

A vulnerability in Capgo before version 12.128.2 discloses information via the get_orgs_v7(userid) RPC function, which remains publicly invokable despite intended private access controls. Unauthenticated attackers can supply arbitrary user UUIDs to retrieve foreign users' organization membership, roles, management emails, and billing metadata.

Crawl4AI before version 0.8.7 contains a server-side request forgery (SSRF) vulnerability in the Docker API server's /crawl/job and /llm/job endpoints, which accept webhook URLs without destination validation. An attacker can supply webhook URLs pointing to private or internal IP ranges, Docker networks, or cloud metadata endpoints (e.g. 169.254.169.254), causing the server to make requests to internal services and potentially expose cloud metadata.

The vulnerability in @capgo/capacitor-updater before version 12.128.2 distributes the private key to each device downloading the app. This allows an attacker performing a man-in-the-middle attack or compromising the Capgo server to create a validly signed update bundle and force devices to install unauthorized updates.

The iDirect iQ200 exposes the /api/identity and /api/ REST API endpoints without authentication. An unauthenticated attacker with network access can retrieve sensitive device information including serial number, Device ID (DID), Terminal Private Key identifier (TPK), MAC address, and exact firmware version.

The iDirect iQ200 device does not validate CSRF tokens on state-changing API endpoints after authentication. The /api/reboot endpoint accepts POST requests authenticated solely by a session cookie lacking the SameSite attribute. A remote attacker can host a malicious web page that, when visited by an authenticated administrator, automatically submits a cross-site POST request causing an immediate device reboot and satellite link loss.

Lucee CFML Server versions 5.3.x, 6.1.x, 6.2.x, and 7.0.x contain a reflected cross-site scripting vulnerability in URL path parsing. An unauthenticated remote attacker can embed HTML/JavaScript payloads in the request path, which are reflected in the server response without proper output encoding. This allows session hijacking or unauthorized actions against the Lucee administrative interface when a victim visits a crafted link.

FlaskBB through version 2.2.0 contains a logic flaw vulnerability that allows authenticated administrators to delete all built-in authorization groups. The issue is a type mismatch in the bulk AJAX endpoint, where JSON integer group IDs are compared against string literals, causing the protection check to always pass.

FlaskBB through version 2.2.0 contains an authorization bypass vulnerability that allows authenticated moderators to perform unauthorized actions on topics in forums they do not control by submitting crafted topic ID lists. Attackers can include a low-ID topic from a permitted forum as an anchor in a batch request, causing the permission check applied only to the first result to pass, and then execute lock, unlock, delete, or hide actions against topics in unmoderated forums.

Deserialization of untrusted data vulnerability in Dell Unisphere for PowerMax versions 10.3.0.5 and prior. A low-privileged attacker with remote access can exploit this to execute arbitrary commands with root privileges.

Dell PowerFlex Manager versions prior to 5.1.0.1 contain an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. A low-privileged attacker with remote access could exploit this flaw, leading to information disclosure, information exposure, and unauthorized access.

An SQL Injection vulnerability in Dell PowerFlex Manager prior to version 5.1.0.1 allows a low-privileged attacker with remote access to inject malicious SQL code, leading to information exposure.

The vulnerability in R-SOFT DMS stores superadmin credentials using a non-salted nested MD5 hash. This allows an attacker who obtains the password hash to decode superadmin credentials. Critically, this password cannot be changed except by modifying the configuration file.

An IDOR vulnerability in R-SOFT DMS allows unauthorized file access by manipulating IDs in download requests. The system does not verify user permissions for specific files, relying solely on session authentication.

OS Command Injection vulnerability in the konwertujAction() function of R-SOFT DMS allows an authenticated attacker to execute arbitrary system commands with the privileges of the web server user. The issue is fixed in versions v3.19-2752 and v3.17-2580.