CVE Vulnerability Catalog

Electerm, a terminal/ssh/sftp/telnet/serialport/RDP/VNC/Spice/ftp client, is vulnerable to arbitrary local code execution in versions from 3.0.6 to before 3.8.15. Exploiting this vulnerability requires clicking a crafted electerm://... link or opening a crafted shortcut/command.

Electerm is a terminal client that in versions 3.8.15 and prior does not validate protocols for URLs clicked in the terminal. Attackers can exploit this to execute arbitrary code or access local files on the victim's machine if the victim clicks a displayed link.

In the electerm client prior to version 3.3.8, a command injection vulnerability exists that allows an attacker to append malicious version strings into an exec command without validation. This issue has been patched in version 3.3.8.

In the electerm client prior to version 3.3.8, a command injection vulnerability allows an attacker to inject malicious code into the exec command. This issue has been patched in version 3.3.8.

In Argo CD versions 3.2.0 to 3.2.10 and 3.3.0 to 3.3.8, there is a missing authorization and data-masking gap in the ServerSideDiff endpoint. This allows an attacker with read-only access to extract plaintext Kubernetes Secret data from etcd via the Kubernetes API server's Server-Side Apply dry-run mechanism.

A server-side request forgery (SSRF) vulnerability was identified in the GitHub Enterprise Server notebook viewer that allowed an attacker to access internal services by exploiting URL parser confusion between the validation layer and the HTTP request library.

Azure DevOps has a vulnerability that allows an unauthorized attacker to disclose sensitive information over a network.

Improper neutralization of special elements used in a command ('command injection') in Azure Cloud Shell allows an unauthorized attacker to perform spoofing over a network.

Nieprawidłowa kontrola dostępu w Azure Managed Instance dla Apache Cassandra umożliwia autoryzowanemu atakującemu wykonanie kodu przez sieć.

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

Improper access control in Azure Managed Instance for Apache Cassandra allows an authorized attacker to execute code over a network.

FreeScout prior to version 1.8.217 has a vulnerability in the /user-setup/{hash} endpoint that accepts a 60-character random invite_hash to set a new user's password. The lack of expiration check allows for unauthorized account takeover long after the invite was issued.

The CVE-2026-37709 vulnerability involves insecure permissions in grokability snipe-it version 8.4.0 and earlier, fixed after commit 676a9958 on March 10, 2026. This allows a remote attacker to execute arbitrary code via the app/Http/Controllers/Api/UploadedFilesController.php component.

The MQTT broker in Yarbo firmware version 2.3.9 is configured to allow anonymous connections with no topic-level access control. Any host on the same network can subscribe to sensitive telemetry topics or publish control messages without any authentication.

Yarbo firmware v2.3.9 contains hardcoded administrative credentials. These credentials are identical across all devices running this firmware and cannot be changed or removed by end users.

The NPM package query-parser-string version 1.0.0 is vulnerable to Prototype Pollution. The package does not properly sanitize user supplied query parameters and merges them to the newly created object.

The npm package parse-ini version 1.0.6 is vulnerable to Prototype Pollution in the index.js() function.

ChestnutCMS version 1.5.10 has a SQL injection vulnerability. The content parameter of the cms_content tag can be manipulated in the admin backend and injected into a SQL query when the template is rendered.

The NPM package next-npm-version version 1.0.1 is vulnerable to Command injection, which may allow an attacker to execute unauthorized commands on the system.