CVE Vulnerability Catalog

Dell PowerScale InsightIQ versions 6.0.0 through 6.2.0 contains an OS Command Injection vulnerability due to improper neutralization of special elements. A high privileged attacker with local access could exploit this vulnerability to execute commands.

A vulnerability in the safe filter causes all subsequent pipelines on the same string to be incorrectly treated as safe after variable expansion, allowing unsafe data to be unescaped. This can enable SQL or LDAP injection attacks, especially in authentication contexts.

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

A vulnerability exists due to insufficient entropy that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session-management protections.

CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.

The Xpro Elementor Addons plugin has an SQL Injection vulnerability that allows for Blind SQL Injection attacks. This issue affects versions from n/a through 1.5.1.

CVE-2026-45213 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the RealMag777 BEAR woo-bulk-editor. This issue affects BEAR versions from n/a through 1.1.7.1 inclusive.

CVE-2026-45211 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in the APIExperts Square for WooCommerce plugin in versions up to 4.7.1.

CVE-2026-42742 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Aman Views plugin for WPForms. This issue affects Views for WPForms from n/a through 3.4.6.

CVE-2026-42741 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Ninja Forms Views plugin. This issue affects versions from n/a to 3.3.2.

A malicious user could craft input that is stored in conversation memory and later interpreted by the model in an unintended way. Applications using the affected advisor with user-controlled input may be susceptible to manipulation of model behavior across conversation turns.

Spring AI's chat memory component contained a problematic default that, when not explicitly overridden, could result in unintended data exposure between users.

CVE-2026-2465 describes an incorrect authorization vulnerability in Turboard FOR-S software that allows privilege escalation. This issue affects the software versions from 7.01.2026 to 18.02.2026.

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a malformed percent-encoding in the Content-Disposition header, the parser invokes decodeURI without error handling, leading to a process crash.

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to an uncaught exception. By sending a multipart/form-data request with a field name that collides with an Object.prototype property, the parser invokes .push() on the inherited prototype value, leading to a TypeError and crashing the process.

Versions of multiparty up to 4.2.3 are vulnerable to denial of service due to regular expression backtracking in the Content-Disposition filename parameter parser. A crafted multipart upload with a long header value can cause regex matching to take seconds, blocking the event loop.

A vulnerability in BAPSİS by ABIS Technology Ltd. Co. allows authorization bypass through User-Controlled key, enabling exploitation of Trusted Identifiers.

A remote code execution vulnerability exists in Code Runner MCP Server when run with the --transport http option, exposing the /mcp JSON-RPC endpoint without authentication on port 3088. An unauthenticated remote attacker can invoke the run-code MCP tool to supply arbitrary source code and execute it via child_process.exec().

A vulnerability has been identified in Solid Edge SE2026 (All versions < V226.0 Update 5) that involves a stack-based overflow while parsing specially crafted PAR files. This could allow an attacker to execute code in the context of the current process.

A vulnerability in Solid Edge SE2026 before version V226.0 Update 5 involves uninitialized pointer access when parsing specially crafted PAR files. This allows remote code execution in the context of the current process.