CVE Vulnerability Catalog

sqlparse before version 0.6.0 has a performance issue: SQL_REGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split(). This issue is fixed in version 0.6.0.

sqlparse before version 0.6.0 has a performance issue: TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by group_parenthesis and group_case, causing quadratic CPU consumption through sqlparse.parse(), sqlparse.format(), and sqlparse.split() before depth and token limits terminate processing. This issue is fixed in version 0.6.0.

File Upload vulnerability in T-Systems International GmbH ImageMaster Version: 9.14.2.8.1 allows a remote attacker to execute arbitrary code via the add attachments feature in the create new document function.

compliance-trestle before versions 3.12.2 and 4.0.3 has a vulnerability in the `-o/--output` argument in `trestle author jinja` that allows writing files outside the intended workspace. The application does not properly validate `../`, `..\`, or absolute paths, allowing arbitrary file write to attacker-controlled locations. Versions 3.12.3 and 4.0.3 patch the issue.

Stirling-PDF before version 2.0.0 has a stored XSS vulnerability in the Get Info workflow in app/core/src/main/resources/templates/security/get-info-on-pdf.html. Untrusted PDF Title and Author metadata are inserted into the summary-text element with innerHTML, allowing a malicious PDF to execute stored cross-site scripting when a user clicks Get Info and to access browser-session data or modify page content. This issue is fixed in version 2.0.0.

A vulnerability in the flash_copy() system call in Zephyr RTOS (with CONFIG_USERSPACE enabled) allows an unprivileged thread to pass forged pointers to flash device structures. Lack of device object validation (src_dev, dst_dev) before dereferencing enables arbitrary code execution in supervisor mode, leading to privilege escalation outside the userspace sandbox.

Glances before version 4.5.6 has a vulnerability in _sanitize_mustache_dict() in glances/actions.py that sanitizes individual Mustache values before chevron.render(), allowing adjacent unescaped Mustache variables to reconstruct shell operators that secure_popen() executes when attacker-controlled process or container fields are rendered by an administrator-configured action template. This issue is fixed in 4.5.6.

websocket-driver before version 0.8.2 has a vulnerability in WebSocket::Driver.server() that passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when the application does not catch the error from parse(). This issue is fixed in version 0.8.2.

A vulnerability exists in the interaction between a Endpoint Privilege Management (Windows Deployment) support utility and the agent's tamper protection controls. Under certain conditions, the protections applied to the utility process may not be enforced as intended.

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools.

In JetBrains IntelliJ IDEA before 2026.2.1, remote code execution (RCE) was possible via the Markdown export tool.

In JetBrains YouTrack before 2026.2.17917, unauthorized project transfer between organizations was possible.

In JetBrains YouTrack before 2026.1.13901 and 2026.2.17950, a DoS attack was possible via crafted type parameters.

In JetBrains YouTrack before 2026.2.18068, stored XSS via the fenced code-block language label was possible.

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, and 2026.2.18095, missing authorization allowed an authenticated user to delete arbitrary entities via the mailbox endpoint.

In PostCSS before 8.5.18, loadMap() in lib/previous-map.js passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map.

In New API before 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation, allowing an unauthenticated attacker to cause memory pressure, container restarts, or disk exhaustion without forging a successful payment.

A memory-corruption vulnerability exists in a kernel-mode component of BeyondTrust Endpoint Privilege Management (Windows deployments) prior to version 26.1.2, due to insufficient validation of input, potentially leading to out-of-bounds memory access.

In UpTrain version 0.7.1 and prior, the /new_run endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.

In UpTrain version 0.7.1 and prior, the /add_prompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user with access to UpTrain and a valid authentication method may be able to execute arbitrary code in the context of the host running UpTrain, which in most cases will be the docker container.