CVE Vulnerability Catalog

Uncontrolled recursion in JSON, CBOR, and XML deserializer functions emitted by Amazon smithy-rs code generation could allow remote attackers to cause a denial of service (process abort via stack exhaustion) via a small request containing deeply nested data for a recursive model shape.

An authenticated non-admin user can exploit a SQL injection flaw in the ticketing REST API to access sensitive data stored in the appliance database.

An authenticated path traversal vulnerability in AOS-CX allows copying arbitrary files to a user-readable location from the CLI of the underlying OS, potentially leading to remote code execution.

Buffer overflow vulnerabilities exist in the command line interface of AOS-CX. Successful exploitation could allow a remote high-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

DHIS2 (versions 2.37-2.44) contains a SQL injection vulnerability in the SqlView API endpoint. An authenticated user with SqlView access can inject arbitrary SQL queries via the filter parameter by abusing a PostgreSQL expression, with output reflected in error messages.

Vulnerability in DHIS2 SQL View data endpoints. Authenticated users with SQL View access can provide crafted filter values that are interpolated into generated SQL, potentially accessing data outside the intended result set.

XSS vulnerability in DHIS2 versions 2.42 and 2.43 before the 2026-06-09 security patches, and in the 2.44 development branch. An attacker can inject active HTML or JavaScript via the scope parameter in the OpenAPI HTML endpoint.

Vulnerability in HumHub (enterprise social network) allows any authenticated user to remove all members from any Space, regardless of their role. Missing access control in the member management controller.

IDOR vulnerability in PraisonAI Platform before 0.1.4. A user who is a member of any workspace can read, modify, or delete agents from another workspace due to missing workspace constraint. Fixed in version 0.1.4.

Vulnerability in PraisonAI Platform before version 0.1.4. An IDOR (Insecure Direct Object Reference) flaw in project CRUD endpoints allows a member of any workspace to read, modify, delete, or read stats of projects belonging to another workspace.

IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) in comment endpoints allows a member of any workspace to read and post comments to issues in other workspaces without verifying issue ownership.

An IDOR vulnerability in PraisonAI Platform allows a member of one workspace to read, modify, or delete issues belonging to another workspace. The issue exists in versions prior to 0.1.4.

IDOR vulnerability in PraisonAI Platform (versions before 0.1.4) allows an authenticated workspace member to manipulate labels and issues belonging to other workspaces. No verification that the label/issue belongs to the workspace.

Vulnerability in PraisonAI Platform before version 0.1.4. Missing authorization on the DELETE /workspaces/{workspace_id} endpoint allows any workspace member to delete the entire workspace along with all associated data (projects, issues, comments, agents, labels, member records).

A buffer overflow vulnerability was found in the command line interface of AOS-CX. Successful exploitation could allow a remote low-privileged user to execute arbitrary code as a privileged user on the underlying operating system.

Information disclosure vulnerability in Confluence Data Center. An unauthenticated attacker can access sensitive information without authentication.

RCE vulnerability in Sourcetree for Mac and Windows version 3.4.11. Requires authentication and user interaction. Attacker can execute arbitrary code with high impact on confidentiality, integrity, and availability.

In ansible-core, the _extract_collection_from_git() function in concrete_artifact_manager.py constructs git clone commands without a '--' separator before user-supplied URLs. An attacker can provide a malicious collection source URI containing git argument injection, leading to arbitrary command execution during collection installation.

In Eclipse OMR versions up to 0.11, the arraycmp SIMD implementation for Z and P does not check if the number of bytes to compare is zero.

A vulnerability in PraisonAI Platform allows any workspace member to remove any other member, including the workspace owner, without role checking. The issue exists in versions prior to 0.1.4.