CVE Vulnerability Catalog

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

In Arcane before 2.5.0, UpdateRegistry and TestRegistry allow the registry URL to change while preserving the stored encrypted token. A user with registries:update and registries:test permissions can repoint the registry URL to an attacker-controlled host, causing the preserved token or password to be sent to that host.

In jackson-core (since 2.16.0), the StreamReadConstraints.maxNameLength limit is not enforced while accumulating a JSON property name in character-input parsers (Reader, String, char[]). The code path reuses the much larger maxStringLength limit (default 100,000,000 characters), allowing roughly 200 MB to be allocated before an exception is thrown. Byte-input parsers (UTF-8) are not affected.

GIMP contains an integer overflow in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. Opening or previewing a specially crafted PowerVR (.pvr) file can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

OpenHuman before 0.56.0 allows cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests this endpoint, switching the user's active local session to the attacker's backend account.

Sunshine from 2026.329.165800 until 2026.906.222525 accepted any client certificate that chained to a stored paired-client certificate, without requiring the presented certificate to be the exact enabled paired identity. Certificate text was compared without canonicalizing equivalent PEM encodings, allowing a previously paired client to bypass the Disable control.

LoopX from 0.0.1 until 0.4.5 in `loopx serve-status` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to status endpoints, exposing control-plane state, goal and run information, local absolute paths, private Markdown files, and dry-run configuration projections.

ERPNext before 15.121.0 and 16.34.0 fails to enforce proper authorization checks on certain status modification endpoints. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks, modifying data beyond the user's permitted role.

Tandoor Recipes before 2.6.12 allows an authenticated user with read and write API scope in the victim's Space to access and modify another same-Space member's private recipe steps. The flaw is because StepViewSet and IngredientViewSet filter only by active Space and use role-level checks instead of the private-recipe owner or sharing predicate.

Tandoor Recipes before 2.6.10 passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks. An authenticated user can create a Space, configure an AI provider with a URL targeting an internal address, and invoke an AI action, enabling scanning of internal hosts and ports.

Tandoor Recipes before 2.6.10 allows an authenticated member of a shared Space to access another member's private recipes by supplying a private recipe identifier to AI import, file, external-link, or share-link endpoints. The flaw is due to missing object-level authorization, potentially leading to reading private recipe files, sending them to the AI provider, or creating public links.

ZoneMinder prior to 1.39.2, 1.38.2, and 1.36.40 interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths. An authenticated user with monitor-create or monitor-edit permission can save a Local monitor whose Device Path contains shell metacharacters, leading to arbitrary command execution as the web server user.

JavaCV prior to 1.5.14 has IPCameraFrameGrabber doubling a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. A malicious MJPEG camera endpoint can return an oversized Content-Length header, trapping the frame-grabbing thread in a CPU-spinning loop and causing denial of service.

ZoneMinder prior to 1.38.3 concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters in exportEvents(). An authenticated user with View Events or View Snapshots permission can submit a crafted export request and execute arbitrary OS commands as the web server user.

IBM i versions 7.3, 7.4, 7.5, and 7.6 is vulnerable to an authenticated attacker elevating their privilege. A bad actor could exploit this vulnerability to perform operations with QSECOFR/Root authority on the system.

Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contains a Least Privilege Violation vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privilege and Denial of Service.

LingGuo-Drama through commit 8a6924a contains a missing authorization vulnerability that allows any registered user to manage all accounts through the /admin/v1/admins API protected only by AuthAdminJWT. Attackers can self-register, read every account's bcrypt hash, reset the bootstrap administrator's password, raise their authority_id, and delete accounts.

LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other users' projects because projects.Get lacks an owner check. Self-registered attackers can iterate numeric IDs via GET, PUT and DELETE /admin/v1/projects/:id to read, overwrite, reassign or delete any user's short-drama projects.