CVE Vulnerability Catalog

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the central Pydantic validator does not properly block metacharacters, allowing an attacker to inject unauthorized commands.

CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.

During an internal security assessment, a potential vulnerability was discovered in Lenovo Accessories and Display Manager for Enterprise for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A potential uncontrolled search path vulnerability was reported in the LanSchool Classic client application that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A missing authentication check on the Aix-DB '/llm/process_llm_out' endpoint allows unauthenticated clients to execute arbitrary 'SELECT' SQL queries and retrieve database data, as the endpoint lacks the token validation enforced on all other application endpoints.

A potential authentication bypass was reported in Lenovo Smart Connect for Windows that could allow a local authenticated user to execute arbitrary code with elevated privileges.

A vulnerability in libnfs through version 6.0.2 before commit 55c18ea fails to validate a string size, leading to an integer overflow when connecting to a crafted NFS server. The issue resides in libnfs_zdr_string in lib/libnfs-zdr.c.

A flaw was found in migration-planner-ui-app that allows an attacker to register a malicious discovery agent using a specially crafted credentialUrl containing JavaScript code. When an organizational user clicks this link, the embedded malicious code executes within the user's browser session.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, the configver parameter in the URL path is interpolated without proper validation, leading to command injection vulnerabilities for authenticated users.

Roxy-WI is a web interface for managing Haproxy, Nginx, Apache, and Keepalived servers. In versions 8.2.6.4 and prior, there is no role check or group ownership check on the server_ip field, allowing any authenticated user, including guests, to start, stop, or restart the roxy-wi-smon-agent systemd unit on any server.

Improper comparison with the trusted certificates list in S2OPC allows an attacker to have a well-formed untrusted certificate considered trusted.

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.

Ghidra before version 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Ghidra before version 12.0.4 contains a path traversal vulnerability in the theme import functionality, allowing attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

Ghidra before version 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature.

Ghidra before version 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

Ghidra before version 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.

Ghidra before version 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.

Ghidra versions 11.0 through 12.0 contain a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase. The failure to escape double quotes in usernames interpolated into ALTER ROLE statements allows authenticated attackers to inject SQL commands via crafted username parameters in PasswordChange network messages.

CVE-2026-49069 describes an improper neutralization of input during web page generation in WPZOOM Portfolio, leading to a Reflected XSS vulnerability.