CVE Vulnerability Catalog

WordPress versions 6.8.x before 6.8.6, 6.9.x before 6.9.5, and 7.0.x before 7.0.2 fail to properly sanitize the author__not_in parameter of WP_Query. This could allow SQL Injection when a plugin or theme passes untrusted input to this parameter.

IBM Langflow OSS versions 1.0.0 through 1.10.0 allow unauthenticated attackers to chain the /api/v1/auto_login endpoint (generates SUPERUSER tokens) with /api/v1/validate/code (executes code via exec()), leading to remote code execution (RCE) on default installations.

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

An issue was discovered in DD-WRT before version 45724 in router/upnp/src/ssdp.c. An unsafe strcpy in UPnP handling allows an unauthenticated remote attacker to overflow an internal fixed buffer via an M-SEARCH request. Exploitation requires UPnP to be enabled (disabled by default, listening only on internal interfaces).

Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user. This could allow an attacker to gain elevated access or control over the victim's account or session. Exploitation requires user interaction, such as visiting a maliciously crafted URL or interacting with a compromised web page.

A post-authentication improper control of generation of code (Code Injection) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC). Under specific conditions, it could allow a remote authenticated attacker with administrator privileges to execute arbitrary OS commands.

A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacker could potentially cause the appliance to make requests to unintended locations.

A vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over the network due to weak authentication.

A deserialization of untrusted data vulnerability in Microsoft Office SharePoint allows an unauthorized attacker to execute code remotely over a network.

Missing authentication for a critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

Deserialization of untrusted data vulnerability in Microsoft Office SharePoint. An unauthenticated attacker can remotely execute code on the SharePoint server.

The Balbooa Forms extension for Joomla versions below 2.4.1 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).

LiteLLM before version 1.84.0 has a vulnerability in the MCP Streamable HTTP endpoint that allows an unauthenticated attacker to bypass LiteLLM key validation using a crafted Authorization header. The attacker can exploit the OAuth2 passthrough fallback path to replace failed key validation with an empty UserAPIKeyAuth() object, allowing requests to reach MCP tooling without a valid key.

In the Linux kernel's __ip6_append_data() function for IPv6, a bug was found in the buffer size calculation for the paged allocation path. Incorrect accounting of fraggap (extra bytes carried over between packets) causes the linear area of the skb to be undersized, leading to data being copied past its end and overwriting skb_shared_info structures. An unprivileged user can trigger this via a UDPv6 socket with MSG_MORE and MSG_SPLICE_PAGES flags.

A Path Traversal vulnerability in ColdFusion versions 2025.9, 2023.20 and earlier allows a remote attacker to execute arbitrary code in the context of the current user without requiring user interaction. The issue stems from improper limitation of a pathname to a restricted directory.

A memory overflow vulnerability in NetScaler ADC and NetScaler Gateway can lead to unpredictable or erroneous behavior and Denial of Service (DoS) if the appliance is configured as a Gateway (SSL VPN, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

The Page Builder CK extension for Joomla versions below 3.6.0 contains a vulnerability allowing an unauthenticated attacker to upload arbitrary files, including executable files. This leads to full remote code execution (RCE).

In Kestra OSS prior to versions 1.0.45 and 1.3.21, the AuthenticationFilter uses request.getPath().endsWith("/configs") to whitelist the public configuration endpoint from Basic Auth. Because the check is a suffix match rather than an exact path match, any API path whose last segment is configs bypasses authentication entirely. An unauthenticated remote attacker can exploit this to create and execute arbitrary workflows without credentials.

A vulnerability was found in the Linux kernel's netfilter bridge module, specifically in the ebt_snat target. The skb_store_bits() function writing the ARP sender hardware address may operate on nonlinear skb fragments, leading to writes in unintended memory areas. Lack of writeability check before the operation can cause data corruption.