CVE Vulnerability Catalog

Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unauthorized vaults via a crafted API request. This issue affects Server: from 2026.1.6.0 through 2026.1.14.0, through 2025.3.18.0.

Multiple BinSoft products are vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remote network resource. Alternatively, it is possible to use a previously uploaded file and change its reference. When the application processes the attachment, and a user tries to open it, the referenced resource is executed by the system. Critically, this vulnerability can be exploited by any unauthenticated attacker by chaining it with CVE-2026-40550 and CVE-2026-40551, which allows obtaining database access, and logging onto any account. The described issue affects all published versions. The vendor stated that this issue is a direct result of the architecture model in which the software is distributed, and that it will be mitigated with a corrected installation manual.

Multiple BinSoft products are vulnerable to Privilege Escalation due to excessive database privileges assigned to the user used by the application. An attacker with access to any running application instance connected to the backend server can extract database credentials from the application's memory by inspecting the running process. The exposed credentials grant administrative access to the database, exceeding the privileges required for normal application functionality. This affects all published versions, and the vendor will mitigate it with a corrected installation manual.

A flaw was found in the OpenShift Container Platform build system. A user with the `edit` ClusterRole can inject arbitrary environment variables, such as `LD_PRELOAD` or `http_proxy`, into `docker-build` containers through the `buildconfigs/instantiate` API. This incomplete fix for a previous vulnerability allows for information disclosure, specifically impacting the confidentiality of build traffic.

A vulnerability was detected in creative-ad-agent (creative-ad-agent-server component) up to version 751b9e5146604dc65049bd0f62dcbdad6212f8a3, in an unknown function of server/sdk-server.ts. Manipulation of the req.params argument results in path traversal. Remote exploitation is possible and the exploit is publicly available. The patch is named 3d255865a957f3740b8724dd914502c0f44d4970.

A vulnerability has been found in SourceCodester Pizzafy Ecommerce System 1.0. This impacts the function save_category of the file /admin/ajax.php?action=save_category. Such manipulation of the argument Name leads to SQL injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

In SourceCodester Pizzafy Ecommerce System 1.0, manipulation of the ID argument in /view_prod.php leads to SQL injection. The attack can be carried out remotely, and a public exploit is available and may be used.

In SourceCodester Pizzafy Ecommerce System 1.0, the save_order function in /admin/ajax.php?action=save_order is vulnerable to SQL injection via manipulation of the ID argument. The attack can be executed remotely, and the exploit is publicly available and may be used.

A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to SQL injection. Remote exploitation of the attack is possible, and the exploit has been disclosed publicly and may be used.

AVACAST by eMPIA Technology has an Unquoted Service Path vulnerability, allowing a privileged local attacker to place a malicious executable in a specific directory, resulting in arbitrary code execution with system privileges when the AVACAST service starts.

A weakness has been identified in SourceCodester Pizzafy Ecommerce System 1.0 in the get_cart_items function of /admin/ajax.php?action=get_cart_items, where manipulation of the ID argument leads to SQL injection. The attack may be launched remotely and the exploit has been made public.

An out-of-bounds read vulnerability has been identified in Apache Thrift before version 0.23.0. The issue is fixed in version 0.23.0.

In Apache Thrift before version 0.23.0, an uncontrolled recursion vulnerability was found that could lead to denial of service. The issue is fixed in version 0.23.0.

In Spring AI, a malicious PDF file can be crafted that triggers the allocation of unreasonable amounts of memory when handled by ForkPDFLayoutTextStripper. Affected versions are 1.0.0-1.0.5 (fixed in 1.0.6) and 1.1.0-1.1.4 (fixed in 1.1.5).

In Spring AI, having access to a shared environment can expose the ONNX model used by the application. Affected versions: 1.0.0–1.0.5 (fixed in 1.0.6) and 1.1.0–1.1.4 (fixed in 1.1.5).

In DeskTime Time Tracking App before version 1.3.674, improper TLS certificate validation allows an attacker in the network path to return a malicious executable in response to an update request, leading to user-level remote code execution on the client.

code-projects Online Music Site 1.0 has a vulnerability in /Administrator/PHP/AdminUpdateAlbum.php where manipulation of the txtimage argument leads to unrestricted upload. Remote exploitation is possible, and the exploit has been published and may be used.

A security vulnerability was detected in ErlichLiu claude-agent-sdk-master up to commit b185aa7ff0d864581257008077b4010fca1747bf. An unknown functionality of app/api/agent-output/route.ts allows path traversal via manipulation of the outputFile argument. The attack can be initiated remotely and the exploit has been publicly disclosed.

In KDE KCoreAddons before 6.25, KShell::quoteArgs is intended to safely quote arguments for shell commands but does not adequately handle metacharacters, leading to a shell escape. Applications relying on this method in security-critical paths to handle user input are affected. In particular, because sendInput() sends a string to a terminal, a control character such as \x01 can be used during injection.

KDE Dolphin before 25.12.3 allows applications in a Flatpak (or with AppArmor confinement) to open folders outside of the application sandbox without additional scrutiny. Dolphin's implementation of the FileManager1 protocol allows the path given to be any type of file, including scripts or executables. By default Dolphin prompts the user for consent, but the intended behavior is to block the attempted action rather than present a consent prompt.