CVE Vulnerability Catalog

The GoDAM plugin for WordPress up to version 1.12.2 allows unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution due to insufficient file type validation in the save_video_file() function.

A remote code execution (RCE) vulnerability in fastjson versions 1.2.68 through 1.2.83. The vulnerability is exploitable under default configuration, without requiring AutoType enablement or classpath gadgets.

Vulnerability in Oracle Platform Security for Java (Oracle Fusion Middleware) in the Centralized Thirdparty Jars component. Affects versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable by an unauthenticated attacker with network access via HTTP, potentially leading to takeover of Oracle Platform Security for Java. CVSS 9.8.

Vulnerability in Oracle Platform Security for Java (Centralized Thirdparty Jars component) versions 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable, allows a low-privileged attacker via HTTP to take over the system, with impact on other products (scope change).

Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 9.8.

Vulnerability in Oracle Platform Security for Java (component: Centralized Thirdparty Jars) allows unauthenticated attacker via HTTP to compromise the system. CVSS 10.0.

The IP Login extension for Joomla! by regularlabs.com generates persistent URL login keys using a non-cryptographic random generator with insufficient entropy, making them predictable.

The Sourcerer extension for Joomla! by regularlabs.com has multiple code injection vectors: Free version does not require both article creator and last modifier to be Super Users before executing PHP; Pro inconsistently enforces CSS, JavaScript, and PHP permissions; PHP include attributes can escape the configured folder; executable script/style variants can bypass detection.

The Articles Anywhere and Modules Anywhere extensions for Joomla allow content tags to use ignore flags or property overrides to render restricted or unpublished articles or modules. A content author can expose content to visitors lacking required access.

An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe.

Cal.com OSS lacks authorization on webhook teamId creation, allowing any authenticated user to create a webhook on any team via unvalidated teamId injection, then steal booking data, including fields like organizer/attendee emails and custom responses, and conditionally video-call passwords, by triggering webhook delivery.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.

Dell PowerProtect Data Manager versions prior to 20.2.0.0 contain an Improper Input Validation vulnerability in the REST API. A high privileged attacker with remote access could exploit this vulnerability, leading to privilege escalation.

A vulnerability in Fujitsu Software Linux openFT and Fujitsu Software Oracle Solaris openFT before version 12.1D00 allows for unauthenticated remote code execution (pre-auth RCE) on GNU/Linux or Oracle Solaris.

SQL injection vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows an attacker to manipulate database queries due to improper neutralization of special elements in an SQL command. The issue affects versions from 4.1.3 before 4.1.4.

Check Point Security Management and Multi-Domain Security Management contain an authentication bypass vulnerability. An unauthenticated remote attacker can execute administrative commands on the Management Server and on managed Security Gateways. Network access to the Management Server without firewall protection or a configuration that does not restrict Trusted Clients is required.

In Unbound library versions 1.4.22 through 1.25.1, a vulnerability allows DNS cache poisoning attacks. The issue arises from deterministic assignment of UDP port ranges to worker threads when SO_REUSEPORT is enabled, enabling an attacker to predict the source port and reduce DNS transaction entropy.

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based XSS attack. When deployed with a specific configuration, it runs in the same origin as the host application, allowing an attacker full access to its resources.

In n8n before 2.29.8 and 2.30.x before 2.30.1, the @n8n/computer-use package does not enforce shell sandbox restrictions on Linux and Windows (sandboxing was applied only on macOS). Shell commands executed by the tool run without any filesystem or network restrictions, allowing unrestricted access to the host filesystem and network from within the computer-use agent process. This issue only affects deployments where the @n8n/computer-use package is explicitly installed and running; standard n8n installations are not affected.