CVE Vulnerability Catalog

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, authenticated users can execute commands on Windows servers via CRLF injection in Pipeline Git connection settings.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, a sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL.

Authorization bypass through user-controlled key vulnerability in Pay with Vipps for WooCommerce allows exploiting incorrectly configured access control security levels. Affects versions from n/a through 6.2.4.

Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape certain values before including them in generated SVG output, which can allow crafted values to be interpreted as SVG markup. Version 0.33.5 contains a patch.

Joomla Extension - JCTables 1.21.1 has unauthenticated SQL injection in read and write queries. The front-end CRUD API controller performs no Joomla token validation and no authentication check on any task. Table names, column names, and values are taken directly from request parameters and concatenated into SQL queries, allowing SQLi for reading and writing queries.

The Business Directory plugin (business-directory-plugin) in WPTasty contains a Blind SQL Injection vulnerability due to improper neutralization of special elements in an SQL command. The issue affects versions from n/a through 6.4.27.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in User Submitted Posts allows Stored XSS. Affects versions from n/a through 20260810.

AJA HELO Plus firmware before version 2.1.7 contains an information disclosure vulnerability that allows unauthenticated attackers to decrypt sensitive diagnostics bundles by exploiting a static AES passphrase embedded in obfuscated form within the firmware.

Trex MES from Trex Digital Smart Manufacturing Systems Inc. contains a missing authentication for critical function vulnerability, allowing authentication bypass. The issue affects versions through 2026-09-29.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Command Line Execution through SQL Injection. This issue affects Trex MES: through 2026-09-29.

OpenSave through version 2.4.0 fails to properly validate save paths supplied by paired peers in the manifest request handler. Attackers can specify arbitrary directories outside configured save locations to read and write files through manifest and sync routes.

OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired devices by spoofing the RelayMessage From field. Attackers who know the room code can join, read paired peer identifiers from announcements, and send forged requests to access protected sync routes including save data, snapshots, and file operations.

bbs-go through 4.4.6 contains a permission bypass vulnerability in the AdminMiddleware authorization logic where the read-only dashboard.user.view permission rule matches the /api/admin/user/synccount endpoint before the intended dashboard.user.update rule. Authenticated users with only view permissions can call the synccount endpoint to trigger expensive full-table user recounts and cache invalidations, causing denial of service through repeated concurrent database operations.

LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-supplied arguments in the remote_infer_images method. Attackers can reach the visual RPyC port and pass objects with __reduce__ methods to execute arbitrary code with service account privileges.

MISP contains a stored XSS vulnerability in the galaxy icon handling path. The icon field is persisted without server-side validation and later concatenated into HTML by correlation graph rendering scripts. A user with perm_galaxy_editor can store arbitrary HTML/JavaScript that executes in another user's browser when viewing the correlation graph.

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink when the value passes FILTER_VALIDATE_URL, which accepts javascript: URIs. A user with galaxy editor privileges can store a javascript: URL, and when another user clicks it, the script executes in their browser.

LightLLM through version 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated attackers can call endpoints like /pause_generation, /abort_request, /flush_cache, and /init_weights_update_group to disrupt inference operations and wedge workers on deployments started with --enable_rl.

LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated SSRF. Attackers can supply arbitrary URLs to fetch internal resources, with vision model processing disclosing content or error responses revealing internal network topology.

GPAC up to 26.07.0 has a buffer overflow vulnerability in the function gf_dash_resolve_url in src/media_tools/dash_client.c of the DASH Client component. The attack can be carried out remotely. Upgrading to version abi-16.26 resolves the issue.

A vulnerability was identified in Artifex Ghostscript up to 10.07.0 in the function type1_callsubr of the file devices/vector/gdevpsfx.c of the Pdfwrite component. The manipulation leads to a stack-based buffer overflow, and remote exploitation is possible. The exploit is publicly available and might be used.