CVE Vulnerability Catalog

The clawvet self-hosted API server before version 0.7.5 hard-codes a fallback JWT secret ('clawvet-dev-secret-change-me') in auth.ts and ships it as default in .env.example. Additionally, GET /api/v1/scans returns scan records containing userId values without authentication, allowing a remote unauthenticated attacker to harvest a victim's userId, forge a valid HS256 cg_session cookie offline using the known secret, and call GET /api/v1/auth/me to obtain the victim's email address, subscription plan, and secret apiKey.

The Bricksforge plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.1.8.6. This is due to improper validation of the fieldIds parameter in the Pro Forms registration action, which allows attacker-supplied field IDs to be added to the trusted form-field whitelist. This makes it possible for unauthenticated attackers to register a new administrator account by submitting a crafted request to a publicly accessible Bricksforge Pro Forms registration form.

Jupyter Enterprise Gateway before version 3.3.0 interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., securityContext), and inject document boundaries (---, ...) to create arbitrary resources, including privileged pods.

Jupyter Enterprise Gateway versions 2.0.0rc2 through 3.3.0 are vulnerable to Server Side Template Injection (SSTI) via KERNEL_XXX environment variables used during Kubernetes manifest rendering. Attackers can execute Python code and OS commands within the Enterprise Gateway service.

In YAML::Syck for Perl before version 1.47, an out-of-bounds read vulnerability exists in the syck_base64dec function. It uses a signed char index to access the b64_xtable array, causing reads before the table when bytes >= 0x80 are encountered. The vulnerability is triggered by default Load or LoadFile calls on untrusted YAML documents containing a !!binary scalar with a high-bit byte.

A vulnerability in Zoom Desktop Client for Windows, VDI Client, and Meeting SDK allows an unauthenticated attacker to perform account takeover over the network. The issue stems from improper input validation.

Jupyter Enterprise Gateway versions 2.0.0rc1 through 3.3.0 have a vulnerability that bypasses the UID/GID restriction preventing kernel launches as root. A specially crafted KERNEL_UID or KERNEL_GID value allows running kernels as root, increasing the attack surface and potentially leading to container escapes, compromising worker nodes and the entire Kubernetes cluster.

A SQL injection vulnerability in the /ureport/datasource/previewData component of ureport v2.2.9 allows attackers to inject malicious SQL queries. This flaw enables unauthorized access to sensitive database information.

WireGuard Easy up to version 15.3.0 contains a vulnerability due to cryptographically weak one-time link token generation. The token is computed using CRC32 over a random value constrained to 0-999, allowing an unauthenticated attacker to recover WireGuard peer credentials by brute-forcing a keyspace of at most 1000 candidates per client ID.

In the illumos SCTP inbound path, association lookup for INIT ACK chunks is performed without adequate validation of address parameters. A remote attacker can send a crafted SCTP INIT ACK packet, causing out-of-bounds access and kernel heap corruption, potentially leading to remote code execution.

A vulnerability in Argo Workflows before versions 3.7.15 and 4.0.6 allows bypassing the allow-list fix for CVE-2026-31892. Through the ArtifactGC field in WorkflowSpec, a user can inject an arbitrary strategic merge patch into the artifact-GC pod, including dangerous settings like hostPath, privileged mode, or hostNetwork.

In Frogman prior to version 1.6.3, users with PERM_READ access could call sensitive API functions, exposing AMI secrets, outbound dial PINs, Asterisk dialplan contexts, SSH commands, backup paths, CDR history, and raw AMI dumps with SIP fields (passwords, md5_cred, oauth_secret).

In Frogman prior to version 1.6.2, the fm_dialplan_apply function accepted template parameters (greeting, dest, url, extension, code, file) without proper sanitization, allowing a PERM_WRITE caller with confirm:true to inject arbitrary Asterisk directives such as System(), Set(SHELL(...)), Goto, or Macro. This issue is fixed in version 1.6.2.

HireFlow versions 1.2 and earlier use a hard-coded Flask secret_key for signing session cookies. Knowing this publicly available value, an unauthenticated attacker can forge cookies with role=admin and arbitrary user_id, bypassing authentication.

Grafana OnCall through version 1.16.11 contains an unauthenticated access vulnerability that allows remote attackers to obtain a valid PluginAuthToken by sending a POST request to the internal plugin install endpoint using hardcoded default stack_id and org_id values present in the public source tree. Attackers can leverage the acquired token to authenticate against all internal API endpoints, create arbitrary Admin users via the user-context header bootstrap path, revoke the legitimate plugin token, and redirect OnCall-to-Grafana API calls to an attacker-controlled host by overwriting the organization's grafana_url and api_token.

The vulnerability in the XML::Bare library for Perl (versions up to 0.53) is due to unbounded character lookahead in the parserc_parse function. This function does not check that offsets are within the buffer, which can cause an out-of-bounds read with truncated strings like "<a/".

A vulnerability in the HTML::Bare library for Perl (versions up to 0.04) is caused by unbounded character lookahead. The parserc_parse function fails to check that offsets are within the buffer when searching for multicharacter strings like "<![CDATA" or element terminators like ">". Truncated strings such as "<a/" can trigger an out-of-bounds read.

A vulnerability in Yamcs before version 5.12.7 allows an authenticated user with ChangeMissionDatabase privilege to achieve remote code execution by overriding Python algorithms in the Jython script engine. Lack of sandboxing enables importing and executing arbitrary Java classes, including java.lang.Runtime.

In Yamcs before version 5.12.7, the Nashorn ScriptEngine used to evaluate user-supplied JavaScript algorithm text was constructed without a ClassFilter, allowing a user with ChangeMissionDatabase privilege to override an algorithm and supply JavaScript that reaches arbitrary Java classes to execute arbitrary OS commands. In the default configuration with no security.yaml, the built-in guest user has superuser=true, making the issue reachable without authentication.

A vulnerability in zrok before version 2.0.3 allows an attacker to pass an absolute URL in the request path to the Flask proxy route of the Python SDK. The urllib.parse.urljoin function enables replacing the configured target host, causing the server to make a request to an attacker-chosen URL.