CVE Vulnerability Catalog

MobaXterm Personal Edition (Portable) version 26.3 (Build 5154) allows arbitrary code execution by loading malicious DLLs from a predictable temporary directory that can be modified by the user. The application searches this location for specific DLLs before checking secure system paths.

Quest Bot is an open-source Discord bot that prior to version 1.1.6 allowed moderators with the relevant permissions to moderate users above them in the Discord role hierarchy, as long as the bot itself outranked the target. This bypasses Discord's normal role hierarchy protections.

Quest Bot is an open-source Discord bot. In versions prior to 1.1.6, the automod add command trims user input but does not reject an empty result, leading to the deletion of all non-bot guild messages.

Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, the purge and slowmode commands check only guild-level permissions on the invoking member, allowing users without channel-level moderation permissions to delete messages or change slowmode.

A Missing Required Cryptographic Step vulnerability has been identified in Moxa's embedded Linux firmware for industrial computers. This vulnerability represents an incomplete remediation of CVE-2026-0714, where TPM2 parameter encryption does not provide effective protection due to an omission.

Lack of restriction on the number of attachment headers in Apache CXF during message deserialization can lead to uncontrolled resource consumption or a denial of service attack. Users are recommended to upgrade to versions 4.2.2, 4.1.7, or 3.6.12, which impose a default maximum of 500 attachments per message.

A JNDI Injection vulnerability in Apache CXF's JCA integration module can allow code execution if an attacker can manipulate the JCA deployment descriptor or runtime activation parameters.

A further incomplete fix for CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) in Apache CXF has been identified, which can still allow code execution if untrusted users are allowed to configure JMS.

A race condition in AbstractOAuthDataProvider allows concurrent requests using the same refresh token to bypass single-use semantics and generate multiple valid access tokens when 'recycleRefreshTokens' is set to false. Users are recommended to upgrade to versions 4.2.2, 4.1.7, or 3.6.12.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an Arbitrary File Deletion vulnerability, allowing authenticated remote attackers to exploit this vulnerability to delete arbitrary system files or directories, resulting in data destruction or service disruption.

The iVEC-IEI Virtualization Edge Computer developed by IEI Integration Corp has an OS Command Injection vulnerability, allowing privileged remote attackers to inject arbitrary OS commands and execute them on the device.

The SSH service of CelloOS developed by Cellopoint has an Improper Access Control vulnerability, allowing authenticated remote attackers to bypass the enforced command restrictions and execute operating system commands outside the originally authorized scope.

A vulnerability in Idira Privileged Access Manager (PAM) Self-Hosted Vault versions prior to 15.0.3, 14.6.5, 14.2.7, and 14.0.8 allows unexpected service termination. Under specific circumstances and configurations, processing unexpected input could lead to a localized denial of service (DoS).

Netty, a network application framework, prior to version 4.2.15.Final had a default configuration for `Http3ConnectionHandler` that did not enforce a maximum header size limit. This lack of restriction allows malicious clients or servers to send an enormous number of headers, leading to memory exhaustion and Denial of Service attacks.

Improper state verification in the OAuth implementation could allow an attacker to manipulate the authentication flow, resulting in a victim's account being linked to an attacker-controlled account.

Under certain network configurations, a malicious actor with access to the network could exploit an Improper Access Control vulnerability found in certain devices running UniFi OS to make unauthorized changes to such UniFi OS devices.

A Path Traversal vulnerability has been identified in devices running UniFi OS, which can be exploited by a malicious actor with network access. This allows for data retrieval from such UniFi OS devices or instances.

Improper verification of access permissions when modifying permissions through the Administration Control Panel (ACP) allowed an authenticated administrator to grant permissions beyond the level authorized for their account, resulting in privilege escalation within the administrative interface.

Idira Vendor PAM - Self-Hosted Connector versions prior to 1.1.100504 may not fully enforce TLS certificate validation under specific conditions and configuration scenarios.

A use-after-free vulnerability exists in MongoDB Server's server-side JavaScript engine when converting BSON documents to JavaScript arrays. An authenticated user with read privileges who can run server-side JavaScript may cause the server to access memory that has already been freed.