CVE Vulnerability Catalog

Privilege escalation vulnerability in n8n before versions 1.123.64, 2.29.8, and 2.30.1 in Enterprise SSO. An attacker can obtain the global:owner role, gaining full administrative control.

In n8n before version 2.30.1, the AI Agents feature has an authorization flaw that allows a Project Viewer user to escalate privileges by chatting with an agent that has node tools enabled, enabling execution of arbitrary nodes and access to credential secrets.

Some Hikvision cameras have a stack-based buffer overflow vulnerability that may allow authenticated attackers to cause device malfunction by sending specially crafted packets.

There is a heap buffer overflow vulnerability in some Hikvision cameras, which may allow unauthenticated attackers to cause device malfunction by sending specially crafted packets.

Insufficient validation of input parameters in the firmware of some Hikvision cameras allows unauthenticated attackers to retrieve partial sensitive data.

Improper validation of specified type of input in Magarsus Consulting Ltd. Co. IDM-MFA allows Authentication Bypass. This affects versions from 2025.11.27 before 2026.03.10.

The Ansible Lightspeed extension for Visual Studio Code contains a command injection vulnerability (CWE-78). The `ansible.python.activationScript` setting does not properly validate the file path, allowing a remote attacker to execute unauthorized commands on the user's system when a crafted project is opened.

A command injection vulnerability exists in the Visual Studio Code Ansible Lightspeed extension's AnsiblePlaybookRunProvider. An attacker can craft a malicious playbook filename with special characters that are not properly sanitized, leading to arbitrary code execution with the privileges of the user running VS Code.

Servereye client (sensorhub) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The SE3Recovery service running as SYSTEM monitors a directory for a trigger file; due to insufficient access restrictions, a local standard user can create the file and provide malicious JSON instructions, leading to overwriting a service binary and code execution with SYSTEM privileges.

Joomla Extension Events Booking from joomdonation.com versions 5.0.0-5.8.1 did not properly verify that an actor is allowed to download invoice information, leading to data exfiltration.

The fflate library up to version 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with compressed_size=0xFFFFFFFF (ZIP64 sentinel) without the required ZIP64 extra field causes an infinite loop due to out-of-bounds reads.

Supermicro (SMC) SMASH services on X14DBG-DAP and X14DBI models contain an arbitrary code execution vulnerability. An authorized attacker can exploit SMASH's input capability to compromise data integrity or launch a DoS attack against the BMC.

The Events Manager WordPress plugin before version 7.3.7 unsafely handles booking-registration data on sites using No-User-Account Booking Mode. A booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection. The resulting gadget chain reaches a database query built without parameterization, so an unauthenticated attacker can read arbitrary database data (e.g., user password hashes, secret keys) when the booking is later loaded.

The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that are stored and served inline. An unauthenticated attacker can upload a malicious SVG whose embedded script executes in the session of any user (such as an administrator) who later opens the file.

The WP Foodbakery plugin for WordPress up to version 4.9 contains an arbitrary file deletion vulnerability in the delete_locations_backup_file_callback function. Authenticated attackers with subscriber-level access can delete arbitrary files on the server, potentially leading to remote code execution (e.g., by deleting wp-config.php).

A vulnerability in the Veeam Updater component of the Veeam Software Appliance allows a local user to elevate privileges to root and gain full access to the underlying operating system.

Netty versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final do not validate that the CertificateID in an OCSP response matches the requested CertificateID. This enables a replay attack, allowing bypass of certificate revocation checks.

Netty versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final have a vulnerability where a remote unauthenticated peer can leak one direct ByteBuf per HTTP/2 DATA frame in applications that enable HTTP/2 content decompression via DelegatingDecompressorFrameListener. When a DATA frame is processed for a stream whose decompressor has already been closed, Http2Decompressor.decompress(...) calls decompressor.writeInbound(data.retain()) and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM.

Use-After-Free vulnerability in the UI of Google Chrome prior to version 150.0.7871.182. A remote attacker, after convincing a user to perform specific UI gestures, can potentially exploit heap corruption via a crafted HTML page.

In Google Chrome on Linux prior to version 150.0.7871.182, insufficient validation of untrusted input in Certificate allowed an attacker in a privileged network position to perform domain spoofing via malicious network traffic. (Chromium security severity: High).