CVE Vulnerability Catalog

A missing release of memory after effective lifetime vulnerability has been found in the Custom Reports module of Progress MOVEit Transfer. It affects versions 2025.0.0 before 2025.0.8, 2025.1.0 before 2025.1.4, and 2026.0.0 before 2026.0.1.

A vulnerability in Progress MOVEit Transfer's Custom Reports module involves improper neutralization of special elements in data query logic. This allows an attacker to manipulate queries, potentially leading to unauthorized data access.

A SQL injection vulnerability in n8n before versions 1.123.61, 2.x before 2.27.4, and 2.28.x before 2.28.1 exists in the legacy MySQL v1 node's executeQuery operation. Evaluated {{ ... }} expression values are substituted directly into the raw SQL string without parameterization, allowing an attacker to inject arbitrary SQL through input reaching these expressions when the workflow is connected to an externally reachable trigger (e.g., Webhook).

The Grav API plugin before v1.0.0-rc.16 accepts JWT tokens via the ?token= URL query parameter and responds with Access-Control-Allow-Origin: *, allowing unauthenticated attackers to make fully authenticated cross-origin API requests from any malicious website. Attackers who obtain a leaked JWT token from access logs, proxy logs, browser history, or Referrer headers can create persistent backdoor super-admin accounts and exfiltrate sensitive configuration and user data.

A vulnerability in n8n before versions 1.123.55, 2.25.7, and 2.26.2 allows authorization bypass in the POST /workflows/{workflowId}/test-runs/new endpoint. It uses the workflow:read scope instead of workflow:execute, enabling an authenticated user with read-only access to trigger a real test run of the workflow.

FreeRDP before version 3.22.0 has a use-after-free vulnerability in dvcman_channel_close and dvcman_call_on_receive due to improper synchronization of channel_callback access. A malicious RDP server can trigger a race condition by sending DYNVC_DATA and DYNVC_CLOSE messages concurrently, causing heap-use-after-free in the drdynvc client thread and potentially enabling remote code execution or denial of service.

A vulnerability in Capgo before version 12.128.2 allows upload-scoped API keys to modify the app_versions.r2_path field via PostgREST, enabling retargeting to arbitrary R2 bundle objects. Attackers can patch r2_path to point to victim objects, soft-delete the attacker-controlled version, and trigger the on_version_update cleanup function to delete the victim R2 object, causing denial of service and bundle availability disruption.

A broken access control vulnerability in Capgo before version 12.128.2 allows a scoped API key (limited_to_orgs) to inherit its owner's user permissions, enabling destructive cross-organization actions. A write-mode API key restricted to one organization can still perform operations like DELETE /organization or DELETE /organization/members against another organization.

A vulnerability in Capgo before version 12.128.2 allows unauthenticated attackers to access sensitive organizational data of users via the RPC function public.get_orgs_v6. This function, defined as SECURITY DEFINER and granted to the anon role, does not verify that the user UUID matches the authenticated context.

Dell PowerProtect Data Domain in multiple versions contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized access.

Dell PowerProtect Data Domain in multiple versions contains an integer overflow or wraparound vulnerability. An unauthenticated remote attacker could exploit this flaw, leading to a denial of service (DoS).

In Dgraph prior to version 25.3.4, a DQL injection vulnerability was found in the `checkUserPassword` GraphQL query. User-supplied password values are interpolated directly into a DQL `checkpwd()` query via `fmt.Sprintf` without any escaping or parameterization. An attacker can inject a password containing a double-quote character to break out of the DQL string literal and append arbitrary DQL query blocks.

Dell PowerProtect Data Domain in multiple versions contains a stored cross-site scripting vulnerability. An unauthenticated attacker with remote access could exploit this flaw.

Omnissa Workspace ONE Tunnel for Windows addresses a Local Privilege Escalation Vulnerability. An attacker with local access could exploit this flaw to gain elevated privileges.

A denial of service vulnerability has been addressed in Tanium Server. This flaw could allow an attacker to disrupt server operations.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The LatePoint plugin for WordPress up to version 5.4.0 has an improper input validation vulnerability in the Stripe Connect payment processor. This allows unauthenticated attackers to pay arbitrary amounts by supplying a previously successful PaymentIntent token.

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to time-based blind SQL injection via the 'mc_auth' parameter in versions up to and including 3.7.8. This is due to insufficient escaping and lack of proper SQL query preparation.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'special_requests' parameter in all versions up to and including 1.8.8 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping and lack of proper query preparation.