CVE Vulnerability Catalog

A critical remote code execution vulnerability in the server-side template rendering mechanism used by the Glassfish gadget handler allows an attacker to inject EL expressions, leading to full host compromise.

An authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the panel can send crafted requests that allow the execution of arbitrary operating system commands with the privileges of the application service user. This issue affects Eclipse GlassFish: from 8.0.0 to 8.0.1, fixed in 8.0.2; 7.1.0, fixed in 7.1.1; from 7.0.0 to 7.0.25, fixed in 7.0.26. Impact on versions from 5.1.0 to 6.2.5 is unknown.

CVE-2026-8959 is a vulnerability due to incorrect boundary conditions in the Widget: Win32 component, allowing for sandbox escape. It has been fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

Integer overflow in the Networking: JAR component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A 'sandbox escape' vulnerability exists due to a use-after-free error in the Disability Access APIs component. It has been fixed in Firefox 151, Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A vulnerability allowing same-origin policy bypass in the Networking: HTTP component. It was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.

A vulnerability in the Networking component of Firefox and Thunderbird allows bypassing the same-origin policy (SOP) in the DOM. The flaw was fixed in version 151 of both products.

Apache Camel vulnerability allows injection of internal headers via untrusted HTTP requests to CXF and Knative endpoints. Missing inbound header filtering lets an attacker override critical Camel headers, potentially leading to remote code execution or arbitrary file writes.

HestiaCP versions 1.9.0 through 1.9.4 contain a deserialization vulnerability in the web terminal component caused by a session format mismatch between PHP and Node.js. This allows unauthenticated remote attackers to achieve root-level code execution by injecting crafted data into HTTP headers.

The Piotnet Forms plugin for WordPress is vulnerable to arbitrary file upload due to missing file type validation in the 'piotnetforms_ajax_form_builder' function in all versions up to and including 2.1.40. The plugin uses an incomplete extension blacklist, allowing dangerous file uploads.

In the Linux kernel, a vulnerability was found in the pcrypt module that incorrectly handles MAY_BACKLOG requests. These requests can return EBUSY, which requires proper checking and filtering of EINPROGRESS notifications.

The extension passes an attacker-controlled cookie directly to PHP's unserialize() without safely processing the input. A remote, unauthenticated attacker can supply a crafted serialized payload to trigger PHP Object Injection, leading to Remote Code Execution on the TYPO3 server.

CVE-2026-45434 in Apache OFBiz has a flaw in password-change logic that can lead to remote code execution. This issue affects versions before 24.09.06.

CVE-2026-41919 describes an improper neutralization of special elements used in LDAP queries, leading to LDAP Injection vulnerability in Apache OFBiz.

Use of hard-coded cryptographic key vulnerability in Apache OFBiz. This issue affects versions before 24.09.06.

In MLflow version 3.9.0, the MLflow Assistant feature introduced improper origin validation in its /ajax-api endpoints. This vulnerability allows a remote attacker to exploit cross-origin requests from a malicious webpage to interact with the MLflow Assistant running on a victim's local machine.

The Piotnet Addons for Elementor Pro plugin for WordPress up to version 7.1.70 has an arbitrary file upload vulnerability due to an incomplete extension blacklist – it only blocks php, phpt, php5, php7, and exe, but allows .phar and .phtml.

In the amazon-redshift-python-driver before version 2.1.14, the vector_in() function uses unsafe eval() on server-received data. This allows a rogue server or man-in-the-middle attacker to execute arbitrary code on the client. To remediate, upgrade to version 2.1.14.

Dokploy version 0.26.6 and below has an OS command injection vulnerability through the appName parameter due to inadequate input sanitization and shell interpolation.

WebdriverIO versions below 9.24.0 contain a command injection vulnerability leading to remote code execution (RCE) in test orchestration. Git permits branch names containing shell metacharacters, and getGitMetadataForAISelection() interpolates these names directly into execSync() calls without sanitization. An attacker can exploit this by supplying a malicious repository whose branch name carries a payload, causing arbitrary code execution on CI/CD servers and developer machines.