CVE Vulnerability Catalog

IBM WebSphere Application Server versions 9.0 and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

IBM Sterling B2B Integrator and IBM Sterling File Gateway in the specified versions are vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify, or delete information in the back-end database.

Artica Proxy before version 4.50.000000 Service Pack 7 (fixed in hotfix 20260724-02) contains a session fixation vulnerability that allows unauthenticated attackers to hijack administrative sessions by setting a known PHPSESSID on a victim's browser prior to authentication. Attackers can pre-set a controlled session identifier and wait for a victim to authenticate through fw.login.php, after which the attacker gains a fully authenticated administrative session on port 9000.

PhpSpreadsheet in multiple versions (4.0.0-5.8.0, 3.3.0-3.10.6, 2.2.0-2.4.6, 2.0.0-2.1.17, and all up to 1.30.5) contains a vulnerability in the Gnumeric reader. The reader reads attacker-supplied .gnumeric files into memory and, when the file starts with gzip magic bytes, calls gzdecode() on the full compressed contents without enforcing a decompressed-size limit. A very small compressed .gnumeric file can expand to data larger than the PHP memory limit and crash the process during Gnumeric::canRead() before the file is rejected or fully parsed. This is reachable through normal file-type detection and Gnumeric loading paths, so applications that accept attacker-controlled spreadsheet uploads can suffer denial of service.

In pglogical, when applying replicated changes for a row with missing columns, the table's default expressions are evaluated on the subscriber. The apply worker runs with PostgreSQL superuser privileges, so functions invoked by default expressions also run with those privileges. A publisher can use this path to escalate to superuser on the subscriber.

The pglogical queue mechanism executes message payloads on the subscriber with PostgreSQL superuser privileges. A publisher can send crafted messages to execute arbitrary SQL as superuser, escalating privileges and breaking tenant isolation.

Nebula Mesh versions 0.3.5 and below do not apply per-operator CA scoping in the web UI, allowing any authenticated non-admin operator to access resources belonging to other operators. This was partially fixed in GHSA-598g-h2vc-h5vg but the web UI was not covered.

Bridge is affected by an Incorrect Authorization vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an out-of-bounds write vulnerability that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (opening a malicious file).

Bridge is affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution in the context of the current user. A low-privileged attacker can exploit it. Requires user interaction (opening a malicious file).

Bridge is affected by an Incorrect Authorization vulnerability that could lead to privilege escalation. An attacker can gain unauthorized read and write access. Requires user interaction (opening a malicious file).

Bridge is affected by a Path Traversal vulnerability that could lead to arbitrary file system read. Requires user interaction (opening a malicious file).

nebula-mesh versions prior to 0.3.2 do not perform admin checks on the audit log endpoint. Any operator with an API key can read the full audit log, including cross-tenant data.

A flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection, allowing it to spoof process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs.

In firmware versions 2.7.7 and earlier, the Arris BGW210-700 gateway fails to enforce any server-side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client-side CSS/JavaScript gating. Unauthenticated attackers on the LAN can read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations.

The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials.

The WP Password Policy plugin for WordPress up to version 3.7.1 is vulnerable to Privilege Escalation due to missing authorization checks and nonce verification in the get_user() function. An authenticated attacker with subscriber-level access can escalate their privileges to Administrator by submitting a crafted POST request.