CVE Vulnerability Catalog

Wellbia's XIGNCODE3 xhunter1.sys kernel driver, versions 10.0.10011.16384 through 2023.12.7.78, has a privilege escalation vulnerability that provides access to the IRP_MJ_WRITE command interface, allowing any user process to request PROCESS_ALL_ACCESS. The vulnerability was not fully remediated and remains in version 2023.12.7.78.

HireFlow v1.2 is vulnerable to Incorrect Access Control. The application does not enforce object-level authorization on the /candidate/<id> and /interview/<id> endpoints, allowing access to other users' data.

HireFlow v1.2 does not implement CSRF token validation on any state-changing POST endpoint. All forms are vulnerable to CSRF, allowing an attacker to change the victim's password, delete records, or inject arbitrary data.

D-Link DCS-932L version v2.18.01 is vulnerable to Command Injection in the function sub_42EF14 of the file /bin/alphapd. Manipulation of the argument LightSensorControl leads to command injection.

MuuCMF T6 version 1.9.4.20260115 has a SQL Injection vulnerability that allows an unauthenticated attacker to compromise the entire database and gain unauthorized administrative access. The attacker may also potentially achieve remote code execution by writing malicious files to the server's file system via the keyword parameter in the /index/controller/Search.php endpoint.

CVE-2026-30635 in automagik-genie 2.5.27 MCP Server allows attackers to execute arbitrary commands via command injection in the readTranscriptFromCommit function when reading from an external FORGE_BASE_URL.

A Server-Side Request Forgery (SSRF) vulnerability exists in MLflow versions prior to 3.9.0. The `_create_webhook()` function accepts a user-controlled `url` parameter without validation, allowing an attacker to force the MLflow backend to send HTTP requests to internal services or arbitrary external servers.

The extract_name() function in dnsmasq is vulnerable to a heap buffer overflow, allowing an attacker to inject false DNS cache entries. This can result in DNS lookups being redirected to an attacker-controlled IP address or cause a denial of service (DoS).

Grav is a file-based web platform. Prior to version 2.0.0-rc.2, the Twig sandbox allow-list permitted any user with the admin.pages role to call config.toArray() within a page body, dumping the entire merged site configuration, including all plugin secrets.

The form plugin for Grav adds the ability to create and use forms. Prior to 9.1.0, there was an unauthenticated page-content overwrite via file upload.

The Grav API Plugin is a RESTful API for Grav CMS that provides full access to content, media, configuration, and user management. Prior to version 1.0.0-beta.15, there is a vulnerability related to insecure direct object reference and logic flaw, allowing authenticated users to modify their own permissions.

Prior to version 2.1.2, OWASP BLT contained a vulnerability where the .github/workflows/pre-commit-fix.yaml file used pull_request_target, allowing code execution from the attacker's fork, enabling remote code execution (RCE) with write permissions.

Podatność w Clerk JavaScript pozwala na nieautoryzowany dostęp do zastrzeżonych akcji, gdy funkcje has() i auth.protect() zwracają wartość true w sytuacjach, gdzie powinny zwracać false. Problem ten występuje w różnych SDK związanych z autoryzacją i może być obejściem w określonych warunkach.

In Meari IoT SDK embedded in CloudEdge 5.5.0, Arenti 1.8.1, and white-label Android apps <= 1.8.x, multiple security-critical secrets are hardcoded and shared, including API signing material, password-transport keying, and service access keys.

In the Meari IoT SDK, in image handling (libmrplayer.so), a vulnerability exists related to baby monitor '.jpgx3' files that use reversible XOR only on the first 1024 bytes with a predictable key derivation model.

In Meari IoT Cloud, alert images stored on Alibaba OSS can be retrieved without authentication, signed URLs, or expiry enforcement. URLs act as direct object references and remain valid beyond expected operational windows.

In Meari client applications embedding 'com.meari.sdk', there is a vulnerability that allows retrieval of WAN IP data for arbitrary devices. The issue stems from a server-side authorization failure in the 'GET /openapi/device/status' request.

In Meari IoT Cloud MQTT Broker deployments running EMQX 4.x, any authenticated low-privilege account can subscribe to global wildcard topics and receive telemetry from devices the user does not own. The broker enforces publish restrictions but does not enforce equivalent subscribe authorization at per-device scope.

The flash-attention project contains a code injection vulnerability in its training script, allowing arbitrary Python code execution via malicious configuration files.

The flash-attention training framework contains an insecure deserialization vulnerability in its checkpoint loading mechanism. The load_checkpoint() function and the checkpoint loading code in eval.py use torch.load() without enabling the weights_only=True parameter, allowing the deserialization of arbitrary Python objects.