CVE Vulnerability Catalog

Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System before version 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs.

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through the enrollment port. Attackers exploit insufficient validation in OS_IsValidName() and unsafe path concatenation in delete_diff() to resolve the traversal to the parent queue directory, causing its subdirectories to be removed and stopping all Wazuh services requiring manual recovery.

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit before version 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection.

Super Productivity prior to 18.13.0 contains a vulnerability in the EXEC IPC handler that accepts a command string from the renderer and executes it with child_process.exec(). The preload.js bridge exposes window.ea.exec() to renderer code, including community plugins, without requiring nodeExecution permission. A confirmation dialog protects only the first execution, and approved commands are stored in ALLOWED_COMMANDS for silent later execution with the desktop account's privileges.

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and org.springframework.util.FileSystemUtils.copyRecursively() components.

Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site.

Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write to LUNs that the host is not authorized to access, bypassing per-initiator LUN access controls.

The sh library before version 2.2.4 incompletely drops privileges when using the _uid option on Linux and Unix systems. A process running with elevated privileges can retain the parent's supplementary groups, allowing the child to access files and resources reserved for privileged groups such as root, docker, disk, shadow, or sudo.

The Apify MCP server before version 0.10.11 does not verify the origin of the URL in getActorMCPServerURL, allowing a malicious actor publisher to redirect the connection to a third-party host. As a result, the victim's Apify API token may be exposed, enabling access to actors, data, and billable compute.

Lemur before version 1.9.1 has the ADMIN_ONLY_AUTHORITY_CREATION and LEMUR_STRICT_ROLE_ENFORCEMENT flags disabled by default, causing the permission check to pass any authenticated user, including the read-only role. A user can create certificate authorities, upload certificates, create notifications, and create domain entries.

Saleor from version 2.10.0rc1 to 3.21.67, 3.22.63, and 3.23.22 treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account. An attacker can create an account with the victim's email address, and after the victim activates it, gain access to their order history and personal data.

Multiple Dell products (AppSync, Metro Node, UCC Edge, VxRail, PowerMax, Unity, PowerFlex Manager, PowerFlex Intelligent Catalog, PowerFlex Rack) contain a UNIX Symbolic Link Following vulnerability. A low privileged attacker with local access could exploit this vulnerability to escalate privileges.

A flaw was found in managed-serviceaccount. A compromised addon-manager pod, due to its ClusterRole granting excessive permissions, can read any secret across all namespaces. Additionally, it can approve arbitrary Certificate Signing Requests (CSRs), which could lead to information disclosure and privilege escalation within the cluster.

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a crafted HTTP request.

Joomla! Core has an improper CORS origin validation. An improper implementation prevented configured CORS origins from being properly validated in CORS requests.

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to command execution and denial of service.

RabbitMQ Java client library before 5.33.1 allows recursive calls to ValueReader.readFieldValue for AMQP types F and A without a nesting-depth limit. A malicious AMQP server or network intermediary can send about 580 nested table levels in the pre-authentication connection.start frame, causing StackOverflowError and terminating the client input processing thread, leading to denial of service.

RabbitMQ Java client library before 5.33.1 uses ValueReader.readBytes to accept a wire-declared contentLength below Integer.MAX_VALUE and allocate a byte array before checking the bytes available in the frame. A malicious AMQP peer can send a LongString field with type tag S and a declared length such as 0x7FFFFFFE, causing an approximately 2 GB allocation and OutOfMemoryError, potentially terminating the JVM and causing denial of service.

RabbitMQ Java client library before 5.33.0 passes a javaReturnType value from an untrusted system.describe response to Class.forName with initialization enabled. An attacker able to answer the JsonRpcClient request can select a class already present in the victim JVM and trigger its static initializer, potentially affecting confidentiality, integrity, and availability in the client process.

authentik before versions 2026.2.6 and 2026.5.5 returns every configured Remote Access Control endpoint to any authenticated user regardless of application access, and the response includes connection settings that may contain stored credentials. Any authenticated user can read all endpoints with host and credentials and open connections to endpoints belonging to other applications, exposing credentials for managed RDP, SSH, and VNC targets and granting interactive access to unauthorized systems.