CVE Vulnerability Catalog

Arcane to interfejs do zarządzania kontenerami Docker, obrazami, sieciami i wolumenami. W wersjach przed 1.19.4, metoda ProjectService.GetProjectFileContent zwracała zawartość dowolnej dyrektywy include z pliku compose projektu przed przeprowadzeniem walidacji ścieżek, co umożliwiało atakującemu odczytanie plików systemowych.

Arcane, an interface for managing Docker containers, before version 1.19.2 contains a vulnerability due to missing admin authorization check on the PUT /api/environments/{id}/templates/variables endpoint. Any authenticated non-admin user can overwrite global environment variables used across all projects.

Arcane to interfejs do zarządzania kontenerami Docker, obrazami, sieciami i wolumenami. W wersjach przed 1.19.0, nieautoryzowany endpoint GET /api/app-images/logo odzwierciedla parametr zapytania koloru dostarczony przez użytkownika w treści dokumentu SVG, co pozwala na wstrzyknięcie złośliwego kodu JavaScript.

Vulnerability in Klever-Go before version 1.7.17. A remote, unauthenticated denial-of-service vulnerability in Batch.Decompress allows any peer participating in a topic served by MultiDataInterceptor to allocate multi-gigabyte heaps on the receiving node from a sub-50 KiB gossip payload. A single packet can OOM-kill a validator.

xiaomusic v0.5.7 contains an unauthenticated path traversal vulnerability in the GET /music/{file_path:path} endpoint. Attackers can read arbitrary files outside the intended music directory by exploiting an incomplete path prefix check.

MoviePilot v2 contains a server-side request forgery (SSRF) vulnerability in the image proxy endpoint. An authenticated attacker can request arbitrary URLs by supplying a resource_token cookie and a URL whose domain matches the configured allowlist.

A SQL injection vulnerability was found in agno library version 2.6.5 in the ClickHouse vector database backend. The flaw exists in the delete_by_metadata() method in clickhousedb.py, which unsafely interpolates metadata keys and values into SQL queries. An attacker can inject arbitrary SQL expressions, allowing deletion of all rows, targeting specific rows, or extracting information through error-based or blind SQL injection.

GitHub CLI (gh) prior to version 2.93.0 incorrectly includes authorization headers in API requests to TUF repository mirrors. A host normalization flaw causes user tokens to be sent to external servers like tuf-repo.github.com, posing a security risk.

In Dokploy version 0.29.0 and earlier, the deleteRegistry function executes docker logout without proper shell escaping of the registryUrl argument, allowing command injection. Unlike the docker login function which uses shEscape(), the lack of sanitization in deleteRegistry creates a vulnerability through a crafted registry URL.

The template upload feature in Emlog Pro v2.6.9 has a path traversal vulnerability, allowing authenticated administrators to execute arbitrary PHP code. By uploading a malicious ZIP archive containing directory traversal sequences in filenames, an attacker can overwrite default template files or directly include malicious code files in the current template.

A scope bypass vulnerability in OpenClaw before 2026.5.18 in the Gateway chat.send route allows scoped clients to execute privileged commands. Attackers with operator.write scope can deliver commands through inherited external routes to bypass operator.approvals and operator.admin scope requirements.

OpenClaw before version 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin approval requests without proper authorization.

An authorization bypass vulnerability in OpenClaw before version 2026.5.4 in the bundled device-pair plugin allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with chat command access can create setup codes to enroll devices with operator/node capabilities.

A vulnerability in Shibby Tomato 1.28 was found in an unknown function of the file usr/sbin/miniupnpd, leading to resource exhaustion. The attack can be launched remotely. This product is no longer supported by the maintainer.

In Shibby Tomato 1.28, the SUBSCRIBE Call Handler component's send function in usr/sbin/miniupnpd allows a Server-Side Request Forgery (SSRF) attack. The vulnerability can be exploited remotely. The project is superseded by FreshTomato and is no longer supported.

A stack-based buffer overflow vulnerability was found in Shibby Tomato 1.28 in the sub_90F0 function of multimon.cgi. The attack can be launched remotely. This project is superseded by FreshTomato and is no longer supported.

A security vulnerability was found in Shibby Tomato up to version 1.28. The issue affects the sub_9068 function in the tomatoups.cgi file of the UPS Service component, leading to a stack-based buffer overflow. The attack can be initiated remotely, and the project is superseded by FreshTomato.

A vulnerability was found in Shibby Tomato 1.28 in the get_ups_field function of tomatodata.cgi. Manipulating the Date argument can cause a stack-based buffer overflow. The attack can be launched remotely.

SQL injection vulnerability in Open ISES Project 3.30A allows unauthenticated attackers to execute arbitrary SQL queries via the ticket_id parameter in GET requests to add_facnote.php. Attackers can extract sensitive database information including version details.

The Open ISES Project 3.30A contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the p1 parameter. Attackers can send GET requests to city_graph.php with crafted SQL payloads to extract sensitive database information including schema names and other data.