CVE Vulnerability Catalog

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, vm2 suffers from a sandbox breakout vulnerability, allowing attackers to execute arbitrary commands on the host system.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins, but the denylist misses process and inspector/promises, allowing sandboxed code to bypass restrictions.

In versions prior to 3.11.4, the vm2 library contained a vulnerability that allowed bypassing security related to the 'nesting: true' and 'require: false' options. The strict equality check in the code did not function correctly, enabling unauthorized requirements.

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining certain calls, it was possible to obtain the host's TypeError constructor, allowing escape from the sandbox and execution of arbitrary code.

The Yarbo Android and iOS applications contain hard-coded MQTT broker credentials that are identical for all users and all devices. These credentials are embedded in the application binary and are readily extractable via APK decompilation.

The iRM-IEI Remote Management developed by IEI Integration Corp has a Hardcoded Credentials vulnerability, allowing unauthenticated remote attackers to exploit hard-coded credentials to gain administrative privileges on the database.

A logic error in OAuthRequestFilter rejects legitimate requests from the bound IP address while blindly allowing requests from any other IP, creating an inverse security check.

The JwtAccessTokenValidator class in Apache CXF fails to validate the 'aud' claims of JWT access tokens, allowing token replay across different resource servers and enabling Token Confusion/Routing attacks.

Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory construct a SAXParserFactory without proper JAXP hardening, enabling out-of-band external entity resolution.

There is an unauthorized access vulnerability in the PcSuite APP. Attackers can exploit this vulnerability to gain unauthorized access to the victim's device.

Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled, leading to unauthorized access in default installations.

Certain devices running UniFi OS are vulnerable to improper input validation, allowing a malicious actor with low privileges to execute a Command Injection attack.

A vulnerability related to improper input validation exists in devices running UniFi OS, which could be exploited by a malicious actor with low privileges to escalate privileges.

An Improper Input Validation vulnerability in UID Enterprise Agent allows a malicious actor with network access and low privileges to exploit it for Command Injection on the host device.

CVE-2026-47365 is an argument injection vulnerability in WordPress Toolkit before version 6.11.0, as used in cPanel and WHM. It allows remote authenticated users to bypass cross-tenant authorization and execute arbitrary wp-toolkit CLI commands as another account.

ClipBucket v5 is an open source video sharing platform that was vulnerable to blind SQL injection in the actions/progress_video.php endpoint prior to version 5.5.3 - #129. Unauthenticated users could exploit the ids parameter to execute SQL queries and exfiltrate sensitive data.

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #140, the Remote Play feature allowed adding videos by importing an external URL, leading to arbitrary command execution due to improper URL handling.

The Hippoo Mobile App for WooCommerce has a vulnerability related to incorrect privilege assignment, allowing privilege escalation.

CVE-2026-42647 describes an improper neutralization of special elements used in SQL commands, leading to the possibility of Blind SQL Injection attacks in the Beardev JoomSport application.

The SQL Injection vulnerability in the Product Filter by WBW allows for Blind SQL Injection attacks. This issue affects versions from n/a through 3.1.2.