CVE Vulnerability Catalog

An SQL injection vulnerability has been discovered in Turkmesh Communication Services Inc. Turkhotspot 5651 Loglama due to improper neutralization of special elements in SQL commands. The issue affects versions from 5.1.2 before 5.1.3.

A deserialization of untrusted data vulnerability in Apache Fory allows class-registration checks to be bypassed during Java lambda deserialization. Only the lambda capture class is affected.

An out-of-bounds read vulnerability was found in Apache Fory (formerly Apache Fury) via sun.misc.Unsafe. When out-of-band zero-copy deserialization is used, readAlignedVarUint() can read beyond the bounds of the underlying buffer. This feature is opt-in, so applications not using it are unaffected.

A heap type confusion and out-of-bounds read/write vulnerability has been discovered in the C++ implementation of Apache Fory. During deserialization in compatible mode, field-skip paths fail to properly validate declared field types against actual data, allowing inconsistent schema input to cause type confusion and out-of-bounds memory access.

The Joomla extension Membership Pro (joomdonation.com) prior to version 4.6.2 by default allowed unauthenticated users to upload media assets. This is an insecure default configuration.

The Easy Form Builder by WhiteStudio plugin for WordPress up to version 4.0.11 is vulnerable to unauthenticated privilege escalation to administrator. This is due to the use of a publicly visible session identifier ('sid') as the password reset token and a publicly accessible nonce refresh endpoint, allowing an attacker to reset any WordPress user's password.

Use-after-free vulnerability in the Network component in Google Chrome prior to 150.0.7871.128. A remote attacker can exploit a crafted HTML page to potentially corrupt heap memory (critical severity).

A use-after-free vulnerability in GPU in Google Chrome on Android prior to 150.0.7871.128 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Use after free in CameraCapture in Google Chrome on Mac prior to 150.0.7871.128 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578. execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

In SJCAM AllWinner Tech products (SJ4000-Air V1.4C and earlier, and WhiteLabel versions), a vulnerability allows arbitrary code execution via a crafted FEX file.

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 in the sub_425964 function of the /goform/SetOnlineDevName file. An attacker can remotely exploit this flaw to execute arbitrary code.

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.20 within the sub_424CE0 function of the /goform/setMacFilterCfg file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.

A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EEE0 function of the /goform/SetStaticRouteCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a device crash.

In FreeScout before version 1.8.224, the public endpoint `POST /user-setup/{hash}/{invite_sent_at}` allows an attacker to take over a user account without authentication. The vulnerability is due to trailing space equality in MySQL/MariaDB VARCHAR and improper decryption of the `invite_sent_at` parameter.

A stack overflow vulnerability was discovered in Tenda TX9 firmware version V22.03.02.20 in the sub_42EA38 function of the /goform/SetVirtualServerCfg file. An attacker can remotely exploit this flaw to execute arbitrary code or cause a denial of service.

A stack overflow vulnerability was discovered in the Tenda TX9 firmware version V22.03.02.05 in the sub_4418CC function of the /goform/SetNetControlList file. An attacker can exploit this flaw to execute arbitrary code or cause a denial of service.

ktransformers through version 0.6.3 (fixed in commit def0f93) contains an unauthenticated pickle deserialization vulnerability that allows remote attackers to execute arbitrary commands by sending crafted pickle payloads to the SchedulerServer ZMQ ROUTER socket bound to all interfaces. Attackers can exploit malicious __reduce__ methods embedded in crafted pickle payloads to execute arbitrary shell commands as the server process.

GPT-SoVITS through 20250606v2pro contains an OS command injection vulnerability in webui.py where ASR, slice, denoise, and uvr5 functions interpolate unsanitized Gradio textbox values directly into shell commands executed with shell=True. Attackers can inject shell metacharacters through path parameters to execute arbitrary OS commands as the server process user without authentication.

Vulnerability in RT (Request Tracker) before versions 5.0.10 and 6.0.3 in the REST 2.0 API allows a privileged (non-admin) user to obtain credentials of other users, including admins, and use them to read data via feeds. The request rotates the credentials, invalidating existing feed URLs.