CVE Vulnerability Catalog

Directus contains an authenticated SQL injection vulnerability in the collection creation flow when the instance uses PostgreSQL with PostGIS enabled. An administrator can create a collection with a geometry field whose fields[].type value starts with 'geometry' but contains attacker-controlled SQL syntax after the geometry subtype. This issue affects Directus before 12.1.0.

IBM Langflow OSS 1.0.0 through 1.10.3 allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system.

IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth.

As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to improper link resolution before file access (CWE-1284) were discovered. Hardened software releases addressing these issues have been issued.

As part of an internal security review in Cisco Catalyst SD-WAN, multiple vulnerabilities related to cleartext storage of sensitive information (CWE-312) were discovered. Hardened software releases addressing these issues have been issued.

A vulnerability in the XMCP protocol of Cisco IOS and IOS XE Software allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending a malformed XMCP packet. The attacker does not need the XMCP client username to exploit this vulnerability.

A vulnerability in Cisco IOS XE Software related to improper input validation (CWE-20), discovered during an internal security review. It is addressed in a software hardening release.

A vulnerability in Cisco IOS XE Software related to insufficient control flow management (CWE-691), discovered during an internal security review. It is addressed in software hardening releases.

A vulnerability in Cisco IOS XE Software related to incorrect calculation issues (CWE-682), discovered during an internal security review. It is addressed in software hardening releases.

A vulnerability in Cisco IOS XE Software related to improper control of a resource through its lifetime (CWE-664), discovered during an internal security review. It is addressed in software hardening releases.

A vulnerability in Cisco IOS XE Software related to improper restriction of operations within the bounds of a memory buffer (CWE-119), discovered during an internal security review. It is addressed in software hardening releases.

A vulnerability in the BEEP feature of Cisco IOS XE Software allows an unauthenticated remote attacker to cause a denial of service (DoS) by sending a specific BEEP SOAP request. The issue is due to improper handling during parsing.

A vulnerability in the web-based management interface of Cisco IMC allows an authenticated remote attacker with low privileges to execute arbitrary commands on the underlying operating system and elevate privileges to root. The issue is due to improper validation of user-supplied input.

A vulnerability in the SNMP subsystem of Cisco IOS XE Software allows an authenticated remote attacker to cause a device reload, resulting in a denial of service (DoS). The issue is due to improper error handling when parsing SNMP requests and affects all SNMP versions (1, 2c, 3).

A vulnerability in IBM Langflow OSS versions 1.0.0 through 1.10.3 allows a remote attacker to execute arbitrary code due to improper validation of configuration parameters.

IBM Langflow OSS versions 1.0.0 through 1.10.3 allow an authenticated attacker to read, modify, or expose sensitive host files via Docker-based MCP servers due to incomplete filtering of dangerous Docker volume-mount and device-mapping arguments.

IBM Langflow OSS versions 1.0.0 through 1.10.3 allow a remote authenticated attacker to execute arbitrary commands due to improper validation of the command field in MCP server configurations.

IBM Application Gateway Operator versions 22.2 through 26.06 are vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of URLs specified in custom resources.

A vulnerability in Neo4j's Bolt modern handshake decoder treats an overlong capability bit mask the same as a truncated one. An unauthenticated client can send a selected protocol version with 32 continuation bytes, causing the decoder to reset the reader index and wait for more bytes instead of rejecting the message. The channel remains open, which can be exploited before authentication.

A server-side request forgery vulnerability in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with low-privileged roles to bypass protections for cloud instance metadata endpoints. Successful exploitation can disclose cloud credentials and compromise cloud resources accessible to the host instance.