CVE Vulnerability Catalog

Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.

The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.

The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.

The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.

In Samsung Open Source Escargot (commit 590345cc), an out-of-bounds write vulnerability exists that can lead to buffer overflows.

This affects versions of the package exifreader before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count together with a zero record size. During parsing, ExifReader repeatedly processes the same record and appends entries to an array without sufficient bounds validation, causing excessive memory growth. In applications that parse attacker-supplied images, this may lead to denial of service through memory exhaustion.

In Samsung Open Source Escargot (commit 590345cc), a heap-based buffer overflow vulnerability exists that can lead to buffer overflows.

In Samsung Open Source Escargot (commit 590345cc), a use-after-free vulnerability exists that allows pointer manipulation.

The Fortis for WooCommerce WordPress plugin before version 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information like past orders and PII.

OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.

OpenHarmony v6.0 and prior versions allow a local attacker to cause a denial of service (DoS) that makes the system unavailable and unrecoverable without intervention.

OpenHarmony version 6.0 and earlier allows a remote attacker to execute arbitrary code in pre-installed apps.

AutoGPT versions 0.6.34 through 0.6.51 deserialize Redis cache bytes using pickle.loads without integrity checks. An attacker who poisons a Redis key can achieve remote code execution in the backend container.

AutoGPT versions 0.4.2 through 0.6.51 are vulnerable to a DoS attack via the download_agent_file endpoint, which creates persistent temporary files for each request but fails to delete them. An unauthenticated attacker can repeatedly call this endpoint to exhaust disk space and cause system failure.

Mullvad VPN on macOS versions 2026.1 and below allows local privilege escalation during installation or upgrade. The installer executes binaries from /Applications/Mullvad VPN.app without verifying if the bundle is attacker-controlled.

AutoGPT versions 0.6.36 through 0.6.50 are vulnerable to authenticated session hijacking via IDOR. An attacker can take over another user's session by knowing their session_id.

FacturaScripts versions 2026 and below contain a critical vulnerability in the Plugins::add() function that fails to properly validate file paths within uploaded ZIP archives. This allows a Zip Slip attack, leading to arbitrary file write and remote code execution (RCE) by overwriting sensitive .php files outside the plugins directory.

SOGo versions up to 5.12.7 contain a SQL injection vulnerability in the Access Control List management functionality. An authenticated user can inject malicious SQL subqueries through the uid parameter of the addUserInAcls endpoint, allowing extraction of arbitrary data from the database. Attackers can write extracted data into the sogo_acl table and retrieve it via the /acls API, establishing an out-of-band data exfiltration channel.

In mlflow/mlflow prior to version 3.11.0, functions creating temporary directories set insecure permissions (0o777 and 0o770). This allows a local attacker to tamper with model artifacts, leading to arbitrary code execution upon deserialization via cloudpickle.

In FreePBX before versions 16.0.71 and 17.0.6, the backup module does not properly sanitize data during restore operations, allowing Remote Code Execution (RCE) by restoring a crafted backup containing malicious data. Authentication with sufficient privileges is required. Fixed in versions 16.0.71 and 17.0.6.