CVE Vulnerability Catalog

Vertex, a management tool for PT (Private Tracker) users to manage streaming and watching videos, is vulnerable to path traversal in versions prior to commit fbde301b97986d5913fc4bc95f5445750d282e11. An attacker can exploit this to read or write files outside the intended directory.

A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_payment.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /manage_tenant.php. Manipulating the ID argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in itsourcecode Online House Rental System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in itsourcecode Online Blood Bank Management System 1.0 in the file /admin/campsdetails.php. Manipulating the hospital argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

An SQL injection vulnerability was found in itsourcecode Online Blood Bank Management System 1.0 in the file /admin/viewrequest.php via the ID argument. The attack can be executed remotely and the exploit is publicly available.

Process Experience Studio in DELMIA Service Process Engineer (3DEXPERIENCE R2024x to R2026x) is vulnerable to Stored XSS. An attacker can execute arbitrary script code in the user's browser session.

JVM heap exhaustion vulnerability in Apache Fluss. An unauthenticated remote attacker can send crafted frame headers to exhaust memory on TabletServer and CoordinatorServer.

A bug in Apache Airflow's KubernetesExecutor caused JWT tokens used by worker pods to authenticate against the Execution API to be passed as command-line arguments visible in the pod spec. An authenticated user with read-only Kubernetes access (e.g., `pods/get`) could harvest the JWT from `kubectl describe pod` output and call state-mutating Execution API endpoints.

Incorrect Default Permissions vulnerability in Apache ActiveMQ. The default Jolokia authorization settings granted non-admin (low-privilege) web-login accounts access to Jolokia operations which allowed executing broker management operations meant for admins such as addQueue and removeQueue. This affects versions before 5.19.7 and from 6.0.0 before 6.2.6.

A path traversal vulnerability in Apache MINA SSHD bundle sshd-git. Lack of path validation in git operations allows authenticated SSH users to access git repositories outside the configured git server root directory.

A vulnerability in Apache ActiveMQ allows bypassing the fix for CVE-2026-34197 due to improper validation of discovery wrappers (e.g., `masterslave:vm://...`). An authenticated attacker can exploit the Jolokia JMX-HTTP bridge to invoke MBean operations, leading to remote code execution on the broker.

In Apache Airflow, a vulnerability exists in the scheduler-side deadline-reference decoder (`SerializedCustomReference.deserialize_reference`) that imports and executes arbitrary class paths from DAG-author-controlled serialized state without an allowlist. A DAG author whose code reaches the scheduler can embed a custom `DeadlineReference` pointing to an attacker-controlled module, causing the scheduler to import and instantiate the class with a live SQLAlchemy session.

Apache Solr versions 9.4.0 through 9.10.1 and 10.0.0 contain hardcoded default credentials in the Basic Authentication setup tool (bin/solr auth enable). A remote attacker can gain full administrative access to the cluster using publicly known default passwords.

Apache ActiveMQ before versions 5.19.7 and 6.2.6 has a code injection vulnerability via the Jolokia JMX-HTTP bridge. An authenticated attacker can invoke BrokerService.addNetworkConnector with a crafted URI that loads a Spring XML context, leading to remote code execution on the broker's JVM.

A vulnerability in Apache Airflow's XCom PATCH endpoint allowed authenticated users with XCom write permission to set entries under reserved key names (e.g. return_value), which combined with accepting serialized payloads treated as code by the triggerer's deserializer enabled remote code execution (RCE) on the triggerer. This is a fix-bypass of CVE-2026-33858, which added FORBIDDEN_XCOM_KEYS validation only on the POST path, not the PATCH path.

A bug in Apache Airflow's bulk Task Instances API (PATCH/DELETE /api/v2/dags/{dag_id}/dagRuns/{dag_run_id}/taskInstances) caused authorization to be evaluated against the dag_id from the URL path while operating on dag_id/dag_run_id from request-body entity fields. An authenticated user with edit permission on one Dag could mutate Task Instance state in any other Dag by keeping the authorized Dag's ID in the URL path and naming the target Dag's IDs in the request body. Affects deployments relying on per-Dag edit-scope isolation. Patched in apache-airflow 3.2.2.

A bug in the login redirect route in Apache Airflow allowed authenticated users to craft URLs that bypassed the `is_safe_url` check, enabling redirection from a trusted Airflow domain to an attacker-controlled origin.

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

SOPlanning version 1.55 and below does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file with additional sensitive information.