CVE Vulnerability Catalog

A buffer overflow vulnerability in HPE NonStop ODBC/MX Services may cause memory corruption, resulting in application crash.

In EspoCRM from 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injection can extract arbitrary database information, including active administrator session tokens, and can enable full privilege escalation.

A local privilege escalation vulnerability in TotalAV allows an unprivileged local user to forge the gRPC IPC authentication token, through loading IPC.dll and abuse the SYSTEM service's within TotalAV to execute arbitrary code as NT AUTHORITY\SYSTEM.

In Symfony YAML prior to versions 5.4.54, 6.4.45, 7.4.18, and 8.1.6, Yaml\Parser::lexInlineStructure() recursed through lexInlineMapping() and lexInlineSequence() for every { and [ of an inline collection, without entering the nesting level that the rest of the parser bounds with maxNestingLevel. A document made of deeply nested inline collections, such as [[[[...]]]], exhausted the stack while being lexed, causing the process to crash or the request to end with a fatal error. Any code parsing untrusted YAML is affected, including #[MapRequestPayload] when the Yaml component is installed and the endpoint does not restrict acceptFormat.

In Progress Kendo UI for jQuery prior to v2026.3.1015, specially crafted filter values in the PivotGrid XMLA transport could alter MDX predicates or inject XML markup into SOAP requests, potentially exposing data accessible through the configured XMLA connection.

In Symfony http-foundation prior to versions 5.4.54, 6.4.46, 7.4.19, and 8.1.7, HeaderUtils::split() parsed header values with a pattern whose token alternative also matched whitespace, followed by a (?<!\s) lookbehind. A run of whitespace before a separator could be divided among iterations in exponentially many ways, causing high CPU usage. HeaderBag calls it for the Cache-Control header whenever a Request is built, so any application handling HTTP requests is reachable without authentication. From 18 spaces on, preg_match_all() gives up at pcre.backtrack_limit and split() returns an empty array, silently dropping every directive of the header.

P4 Search (formerly Helix Search) returns stored credentials in cleartext through its configuration API to users with administrative privileges on the connected P4 Server, allowing privilege escalation. This affects 2026.4.2 and earlier and is fixed in 2026.4.3.

P4 Search (formerly Helix Search) allows an authenticated user holding administrative privileges on the connected P4 Server to supply a crafted logging configuration that causes files to be written or deleted outside the intended logging directory. This could lead to code execution as the P4 Search service account. This issue affects P4 Search 2026.4.2 and earlier; Perforce resolved it in 2026.4.3.

In the Eclipse Adoptium website (adoptium.net), the post-download page /[locale]/download takes a download URL from the "link" query parameter and automatically navigates to it with a meta http-equiv="refresh". The URL is checked against a list of trusted prefixes using String.startsWith() on the raw string, while the browser applies RFC 3986 dot-segment normalisation before navigating, so a value such as https://github.com/adoptium/temurin/../../attacker/malware/releases/download/v1/jdk.exe passes the check but resolves to an attacker-controlled repository. A victim who follows a crafted adoptium.net link is shown the genuine "Thank you for downloading Eclipse Temurin" page while their browser downloads a binary of the attacker's choosing.

Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a DOCTYPE with an external DTD reference, the parser processes external entities, allowing an attacker to read arbitrary files from the victim's filesystem. Because vendor contact attempts were unsuccessful, the vulnerability has only been confirmed in version 17.1 but may also affect other versions.

A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.

In `api-gateway` versions up to `1.7.3`, the default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from the leftmost element of the `X-Forwarded-For` request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

In api-gateway versions till 1.7.3, the default rate-limit key resolver, ClientIpKeyResolver, derives the per-client bucket key from the leftmost element of the X-Forwarded-For request header. That element is supplied by the originating HTTP client and is not validated against any trusted-proxy list. A single attacker can therefore obtain an unlimited number of independent rate-limit buckets — one per unique header value — and completely bypass the gateway's request-rate limiting on every route that uses the shipped default configuration.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS. This issue affects Social Share Buttons: from n/a through 1.31.

Incorrect Privilege Assignment vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Privilege Escalation. This issue affects Fluent CRM: from n/a through 3.2.5.

The User Registration plugin (ThemeGrill) for WordPress in versions up to 5.2.8 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels.

The Link Whisper Free plugin in versions up to 0.9.7 contains a Reflected XSS vulnerability due to improper neutralization of input during web page generation.

The Webba Booking plugin in versions up to 6.5.2 contains an authorization bypass through user-controlled key vulnerability, allowing exploitation of incorrectly configured access control security levels.

A Path Traversal (CWE-22) vulnerability in the execute_obj function of PeaZip's archive object viewer (peach.pas) in versions 11.2.0 and earlier on Windows allows an attacker to execute an arbitrary program already present on the victim's system. The attacker must convince the victim to preview a crafted archive entry via the "Preview with... -> Associated application" action (Shift+Ctrl+O), where the entry name contains "../" sequences that escape the temporary extraction directory and are passed to ShellExecuteW without warning. The flaw stems from missing validation of the tempstring and lack of path-containment check in checkfiledirname.

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.