CVE Vulnerability Catalog

A use-after-free vulnerability in Solid Edge SE2025 and SE2026 when parsing specially crafted DFT files. It could allow an attacker to execute code in the context of the current process.

An out-of-bounds write vulnerability in Solid Edge SE2025 and SE2026 when parsing specially crafted DFT files. It could allow an attacker to execute code in the context of the current process.

An out-of-bounds read vulnerability in Solid Edge SE2025 and SE2026 when parsing specially crafted DFT files. It could allow an attacker to execute code in the context of the current process.

An SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the acquisition => order_receive permission to read arbitrary database contents via the orderby parameter in acqui/parcels.pl. The parameter is passed to C4::Acquisition::GetInvoices, which concatenates the direction token raw into the SQL ORDER BY clause without validation. Exploitation is blind (time-based) and allows extraction of patron PII, staff bcrypt password hashes, and two-factor secrets.

A stored SQL injection vulnerability in Koha (through 24.11.17, 25.05.12, 25.11.06, and 26.05.01) allows authenticated staff with the tools => items_batchmod permission to read arbitrary database contents by storing a SQL payload in the agefield value of an automatic item modification rule. The value is stored verbatim and later interpolated without parameterization into a SQL query in C4::Items::ToggleNewStatus when the scheduled cron job executes. The injection allows reading the entire Koha database including patron PII and staff bcrypt password hashes.

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get() without host or IP validation, and ALLOW_NEW_REGISTRATIONS defaults to true enabling anonymous triggering. An attacker can reach internal services or cloud metadata endpoints from the server.

A missing authentication vulnerability in Swing Music 3.0.0 allows unauthenticated remote attackers to create arbitrary user accounts via the POST /auth/profile/create endpoint. The endpoint is allowlisted from JWT verification, permitting unauthenticated account creation. An attacker can register an account and use it to access protected functionality on the server.

A path traversal vulnerability in AsyncFuncAI deepwiki-open through commit 16f35a0 allows unauthenticated remote attackers to obtain directory listings for arbitrary filesystem paths via the local-repository structure endpoint. The endpoint accepts an absolute filesystem path parameter and returns a directory listing without authentication, as WIKI_AUTH_MODE defaults to false. An attacker can enumerate sensitive directory contents on the host system.

A vulnerability in CSZ CMS 1.3.2 allows unauthenticated remote attackers to read all form submissions including PII via the admin form-submission viewer. The endpoint lacks authentication and the auth helper fails open.

A vulnerability in Idurar IDURAR ERP CRM 4.1.0 allows unauthenticated attackers to download invoice PDFs containing customer PII via the /download router. The router is publicly accessible and ObjectIds can be enumerated.

A vulnerability in Ghost Foundation Ghost 5.x allows authenticated Author-role users to delete posts owned by others. The permission check is missing a branch, allowing deletion.

A vulnerability in BadChoice Handesk (as of 2026-07-10) allows any authenticated agent to update tickets belonging to other teams via TicketsController@update. No authorization or team-scoped check is performed.

A vulnerability in BadChoice Handesk (as of 2026-07-10) allows any authenticated agent to overwrite lead records of other teams via LeadsController@update. No authorization check, and the Lead model is mass-assignable.

An SQL injection vulnerability in Pimcore admin-ui-classic-bundle through 2.3 allows authenticated backend users to execute arbitrary SQL via the DataObject grid id filter. The filter value is concatenated into the SQL WHERE clause without parameterization.

A vulnerability in Peppermint Lab Peppermint (through commit ba6e217) allows any authenticated non-admin user to reconfigure global OIDC/SSO settings via an unprotected endpoint. No admin role check is performed.

An SQL injection vulnerability in CiviCRM through 6.18.alpha1 allows authenticated staff to read the entire database via the contact search RLIKE clause. The user-supplied value is concatenated without sanitization.

An unrestricted file upload vulnerability in Cockpit CMS 2.6.0 allows authenticated users to upload files of any extension including PHP scripts via the asset upload endpoint. The allowed_uploads defaults to wildcard and files are stored in a web-accessible directory.

A remote code execution vulnerability in ZoneMinder 1.39.17 allows any authenticated user to execute OS commands by exploiting a broken permission check in the Filter class. canEdit() and canDelete() call nonexistent methods, causing PHP __call() to return truthy and bypass the check.

A broken access control vulnerability in Peppermint through commit ba6e217 exists because the Config.roles_active flag defaults to false, causing all permission checks on ticket, client, and user handlers to behave as no-ops on default installations. All authenticated users bypass ownership and administrative access controls. An attacker with any user account can read, modify, or delete tickets, clients, and users belonging to any other account.

A server-side request forgery vulnerability in Dub as of 2026-07-10 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the metatags edge endpoint. The endpoint fetches any caller-supplied URL without applying a denylist or requiring authentication. An attacker can use this to scan internal services or exfiltrate data from cloud metadata endpoints.