CVE Vulnerability Catalog

FileBrowser Quantum versions prior to 1.3.2-stable, 1.4.0-beta, and 1.4.1-beta are vulnerable to Path Traversal. The issue occurs in publicPatchHandler, where user-controlled paths can be manipulated, allowing operations on files outside the shared directory.

The device has a webserver that exposes a REST API authenticated with a token on the management network. By exploiting an OS command injection vulnerability, an authenticated attacker can send arbitrary commands to the device that are executed with administrative permissions by the underlying operating system.

In WC-Radio, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed.

A vulnerability in the Perry library before version 0.5.1166 allows remote attackers to bypass JWT token expiration validation. This is caused by the unconditional setting of validate_exp = false in the verify_decode helper within the standard JWT verification path.

An authentication bypass security issue exists within FactoryTalk Historian Site Edition. By continually sending requests to the login endpoint, an attacker may obtain a valid authentication token.

Mitigation bypass in the DOM security component. This vulnerability was fixed in Firefox 152 and Thunderbird 152.

A vulnerability involving a mitigation bypass in the DOM security component. It was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

A vulnerability allowing same-origin policy bypass in the Networking: Cookies component. It was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

A sandbox escape vulnerability exists in the Networking component of Firefox and Thunderbird due to incorrect boundary conditions. This flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

A sandbox escape vulnerability in the Security: Process Sandboxing component. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Thunderbird 152, and Thunderbird 140.12.

A sandbox escape vulnerability exists in the DOM: Navigation component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

A sandbox escape vulnerability exists in the DOM: Workers component of Firefox and Thunderbird. The flaw was fixed in Firefox 152, Firefox ESR 140.12, Firefox ESR 115.37, Thunderbird 152, and Thunderbird 140.12.

A use-after-free vulnerability was found in the WebGPU component of Firefox and Thunderbird. The flaw was fixed in version 152 of both applications.

CVE-2026-40750 vulnerability in themagnifico52 Kids Online Store allows unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.

Versions of GEO my WordPress up to 4.5.5 are vulnerable to unauthenticated SQL Injection.

CVE-2026-49774 describes an improper control of code generation vulnerability that allows remote code inclusion in the RD Station application. This issue affects RD Station versions from n/a through 5.6.0.

CVE-2026-49772 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in The Events Calendar application.

There is an unauthenticated SQL injection vulnerability in InPost Gallery versions up to 2.1.4.6.

The elixir-grpc library (grpc) contains deserialization of untrusted data and allocation of resources without limits or throttling vulnerabilities. An unauthenticated attacker can send a crafted payload with Content-Type: application/grpc+erlpack, causing atom table exhaustion and crashing the BEAM node, and in some cases achieving remote code execution. This affects versions from 0.4.0 before 1.0.0.

Crypt::DSA versions before 1.21 for Perl reused the nonce across signatures, leading to private-key recovery. The first sign() on a Key object picks a nonce, and every later sign() on that same object reuses it, producing an identical 'r'.