CVE Vulnerability Catalog

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.

GitLab EE contains a DoS vulnerability in the SCIM user provisioning feature. An authenticated user can send specially crafted input causing an unbounded loop, leading to denial of service.

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within an unprivileged user namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (e.g., create, import, destroy), pool event log access (zpool events), and fault injection (zinject). Exploitation requires only that the local user can open /dev/zfs and that the kernel permits unprivileged user namespace creation.

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. The bus_load() function reads the number of bus handles from the "bus_handles" attribute without validating an upper bound, and bus_handle_moved() allocates stack arrays based on this count. Excessive values (e.g., 262144) cause stack overflow, SIGSEGV, and potential stack frame corruption.

The vulnerability allows unauthorized generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application's cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.

Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

NLTK before 3.10.3 has a ReDoS vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regex patterns and executes them without validation, potentially causing catastrophic backtracking and blocking the Python process.

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

The Grav API plugin before 1.0.18 does not enforce API-key scope caps in the injectSecurityTab() function of BlueprintController. A caller with a scoped API key may see and potentially edit page permission fields beyond the granted scope.

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

An attacker with network access could exploit an Improper Access Control vulnerability in UniFi Protect AI Key to escalate privileges on the device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Talk Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in UniFi Access Application to escalate privileges on the host device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

An attacker with network access and under certain conditions could exploit an Improper Access Control vulnerability in UniFi Connect Display Cast Pro to escalate privileges on the device.

An attacker with network access could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

An attacker with network access and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Protect Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Access Application to execute a Command Injection on the host device.