CVE Vulnerability Catalog

Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.

CVE-2026-44478 vulnerability in hoppscotch allows unauthenticated users to access infrastructure secrets in plaintext via the GET /v1/onboarding/config endpoint when the ONBOARDING_RECOVERY_TOKEN is an empty string. This issue is fixed in version 2026.4.0.

In versions prior to 0.21.1, gitoxide, an implementation of git written in Rust, allows for the construction of a malicious tree that enables writing attacker-controlled symlinks into any directory the user has write access to.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to version 16.9.0, some endpoints were vulnerable to SQL injection, allowing a malicious actor to extract sensitive information.

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to versions 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection, allowing a malicious actor to extract sensitive information.

Prior to version 1.39.6, PlaywrightCapture did not sufficiently restrict navigations and resource requests initiated by rendered pages. An attacker-controlled page could exploit redirection mechanisms to open file:// URLs or request resources from private IP addresses.

CVAT is an interactive video and image annotation tool. In versions from 2.5.0 to 2.63.0, an attacker can add malicious JavaScript code to an annotation guide, which will then run in the browsers of users opening this guide.

SQLBot prior to version 1.8.0 contains a Cross-Workspace IDOR and Authorization Bypass vulnerability in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. An attacker can access and modify database schemas and data sources belonging to other tenants/workspaces.

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

SSL verification is disabled in the DNS Cluster system, which could allow a malicious server to perform a man-in-the-middle attack and capture credentials.

Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.

CubeCart is an ecommerce software solution that prior to version 6.7.3 allowed admins with document edit permissions to save raw PHP code in the Invoice Editor. When any admin clicks Print, the rendered template is saved in a file that can be executed by unauthenticated users.

A mass assignment vulnerability in Quark Drive before version 0.8.5 in the POST /update endpoint allows authenticated attackers to overwrite administrator credentials by posting an arbitrary webui object to the config_data dictionary. Attackers can exploit insufficient deny-list filtering to permanently replace stored login credentials, lock out legitimate administrators, and gain persistent access to all configured tasks, cloud tokens, and notification services.

CubeCart prior to version 6.7.2 has a vulnerability that allows an attacker to take over a user account by manipulating links in emails. An attacker can exploit the Host header to send a malicious link to the victim, leading to account takeover.

EcclesiaCRM versions 8.0.0 and earlier have a vulnerability in the ValidateInput() function that passes user-supplied POST parameters directly into SQL queries without proper sanitization. This allows for SQL injection attacks through query parameters using non-standard validation types.

MISP is a threat intelligence management platform. In versions prior to 2.5.37, there was a vulnerability related to improper access control in the authentication key reset functionality, allowing organization administrators to reset keys for site administrator accounts within the same organization.

Podatność CVE-2026-42602 dotyczy rozszerzenia Azure Authenticator, które w wersjach od 0.124.0 do 0.150.0 ma lukę w autoryzacji po stronie serwera. Umożliwia to każdej osobie posiadającej ważny token dostępu Azure autoryzację do dowolnego odbiornika OpenTelemetry, który używa autoryzacji 'azure_auth'.

Python-Multipart before version 0.0.27 did not limit the number or size of multipart/form-data part headers. An attacker can send a request with many repeated headers or a single very large header, causing excessive CPU load and denial of service.

The twisted.names module in Twisted, prior to version 26.4.0rc2, is vulnerable to a Denial of Service (DoS) attack via resource exhaustion during DNS name decompression. An attacker can exploit this vulnerability by sending a crafted TCP DNS packet containing deeply chained compression pointers.

In CubeCart prior to version 6.6.0, authenticated time-based blind SQL injection vulnerabilities were identified in the sorting parameters (sort[price], sort_activity, sort_admin, and sort_customer) of the Products and Logs endpoints. This allows an attacker to execute arbitrary SQL commands, compromising the confidentiality and integrity of the database.