CVE Vulnerability Catalog

In ThingLinks before 1.4.0, the /groovyScriptTest/registerScript endpoint accepts user-supplied Groovy script content and passes it to an unsandboxed compilation and loading flow. An authenticated attacker can supply code that is compiled and executed on the server, leading to remote server-side code execution. The issue affects the rule engine's Groovy script test/register flow and is fixed in version 1.4.0.

In ThingLinks before 1.4.0, an unauthenticated SQL injection vulnerability exists in the TDengine TDS APIs. JSON field values submitted to /anyUser/tds/insertTableData reach unsafe SQL construction in the TDS mapper, allowing a remote unauthenticated attacker to tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The issue is fixed in version 1.4.0.

The ssl_verify_fun library (deadtrickster) improperly validates certificates with host mismatch because try_match_wildcard/4 in src/ssl_verify_hostname.erl anchors only the text before and after the * in an identifier such as f*.example.net. This causes the wildcard to also consume dots, so the certificate is accepted for f.evil.example.net, and *.168.1.1 matches the IP literal 192.168.1.1. The issue affects versions from 1.0.1 before 1.1.8.

Stack-based buffer overflow and missing authorization in Thales Sentinel Keys Server on Windows. The server does not check the length of the first field in an HTTP request, allowing an attacker to send a crafted request and potentially achieve remote code execution as NT AUTHORITY\SYSTEM.

Kargo versions from 0.6.0 until 1.8.14, 1.9.9, and 1.10.8 contain two authorization flaws in the project-scoped RBAC API. An authenticated user with delegated permission to manage a Project's Roles or ServiceAccounts can confer permissions exceeding their own, enabling escalation to Project-administrator access.

HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications passing user input into the DSL via keyword or symbol can produce SQL strings vulnerable to SQL injection because some formatters do not apply the suspicious-character check to entity names.

PinePods before 0.9.0 allows an authenticated user to subscribe to an attacker-controlled RSS feed whose enclosure URL is stored without host/IP validation. The server performs GET/HEAD requests to internal services, enabling service enumeration, data disclosure, and cloud metadata credential theft.

pgAdmin 4 before 9.19 contains a bypass of the CVE-2026-17566 fix in the Import/Export Data tool. Improper validation of a backslash inside a double-quoted identifier hides a closing parenthesis and executes a TO PROGRAM clause via psql on the pgAdmin host with the OS account privileges.

The LeadSnap WordPress plugin in versions up to 1.25 contains an unauthenticated PHP Object Injection vulnerability.

The WordPress plugin FunnelKit Automations (wp-marketing-automations) up to version 3.8.6.1 contains a deserialization of untrusted data vulnerability that allows object injection. This may let an attacker perform dangerous operations.

The Transliterator WordPress plugin in versions up to 2.5.13 contains an unauthenticated SQL Injection vulnerability.

The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.

The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.

The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.

In JetBrains Toolbox App before 3.9.1 and 3.8.2, and in multiple JetBrains products (IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover) at the listed versions, the jetbrainsd daemon trusted compromised intermediate certificates. This could allow an attacker to impersonate a trusted party in the certificate chain.

Prior to 1.5.7-beta.14, the `api_ns_plex` namespace in `bazarr/api/plex/oauth.py` omits `@authenticate` on its Resource handlers, allowing anonymous callers to perform configuration-mutating operations such as logging out the Plex integration, persisting an attacker-selected API key, binding an attacker-controlled Plex account token, and other `write_config()` operations. Missing OAuth state validation and attacker-controlled server URLs further enable server-side request forgery and credential exposure.

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability. Attackers can send a base64-encoded crafted pickle in serialized_named_tensors to the /update_weights endpoint, which ForkingPickler.loads deserializes without validation, executing commands as the api_server process.

A deserialization of untrusted data vulnerability in the SubWorkflow task in Google Cloud Application Integration versions prior to 2026-09-11 allows an authenticated attacker to execute arbitrary code using a maliciously crafted serialized object. The vulnerability was patched on 11 September 2026.