CVE Vulnerability Catalog

A vulnerability in Veeam Service Provider Console allows an unauthenticated attacker to exhaust host memory and cause a denial of service.

A flaw in Node.js HTTP/2 handling allows `nghttp2_session_mem_send()` to be called re-entrantly while `nghttp2_session_mem_recv()` is executing, resulting in a heap-use-after-free. This affects Node.js 26.x, 24.x, and 22.x.

A command injection vulnerability was identified in GL.iNet AX1800 up to 4.8.3 in the remove_rule function of /usr/share/gl-ngx/oui-rpc.lua (RPC Endpoint component). Manipulation of the args.id argument allows remote command execution. The exploit is publicly available.

The Tapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in handling authenticated HTTP request bodies, which may lead to a buffer overflow and crash of the web service process. Successful exploitation may cause the web service to stop responding or restart, resulting in a denial-of-service condition.

An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster, allowing a file with attacker-chosen name and contents to be written or an outbound network request to be made. This can lead to remote code execution if the file is written to a location later imported by the application.

Flowise before version 3.1.3 has a vulnerability in executeJavaScriptCode() that accepts caller-provided nodeVMOptions and merges them over the default NodeVM security settings. An authenticated attacker can run a custom function that imports utils.js, calls executeJavaScriptCode() with options allowing all built-in modules, and then uses child_process to execute arbitrary system commands as root on the Flowise server.

Flowise before version 3.1.3 has a code injection vulnerability in the AgentAsTool, ChatflowTool, and ExecuteFlow components that run code in the vm2 sandbox. The user-controlled baseURL value is inserted directly into JavaScript code, and the only validation is isValidURL, which does not prevent breaking out of the string. An authenticated user can inject their own JavaScript code, which can escape the sandbox and execute arbitrary code on the Flowise server.

Missing permission check on the /api/v1/files route in Flowise before version 3.1.3, allowing low-privileged API keys to list and delete files across the organization.

Remote code execution vulnerability in LAMP Rapid Development Platform, where GlueFactory executes unsandboxed Groovy scripts from database template fields without compilation restrictions.

Memory corruption when processing untrusted user input in the fastboot command handler for audio framework configuration.

Transient denial of service (DoS) when processing a short target wake time channel usage response frame with insufficient packet size.

Weak configuration in UE (User Equipment) where it does not verify the consistency of its additional security capabilities with replayed capabilities.

Memory corruption occurs while processing IOCTL device driver requests with invalid arguments.

Memory corruption occurs when handling malformed request parameters in the fingerprint TA.

Cryptographic vulnerability when processing registration requests with malformed or missing authentication parameters.

Memory corruption while processing a packet with a size close to the maximum allowed value.

Flowise prior to 3.1.3 allows authenticated users to set arbitrary TypeORM DataSource options through the additionalConfig input in several record manager and agent memory nodes. Options such as entities, subscribers, and migrations can load local JavaScript files, allowing an authenticated user to execute arbitrary code on the server by uploading a JavaScript payload and referencing it from additionalConfig.entities. This issue is fixed in version 3.1.3.

Flowise before 3.1.3 has an unauthenticated OAuth2 token refresh endpoint that performs server-side HTTP requests to attacker-controlled URLs without SSRF protections, exposing responses and credentials.

The fix for CVE-2026-18401 in jackson-core is incomplete and leaves a bypass in the non-blocking parser. An attacker can stream JSON in small chunks without a terminator, causing unbounded buffer growth limited only by maxStringLength (20 MiB) instead of maxNumberLength (1000).

Perspective 5.0.0 contains a path traversal vulnerability allowing unauthenticated attackers to read arbitrary files from the server filesystem by including literal ../ segments in HTTP request URL paths.