CVE Vulnerability Catalog

In mlflow/mlflow, the FastAPI job endpoints under `/ajax-api/3.0/jobs/*` are not protected by authentication or authorization when the `basic-auth` app is enabled. Even with basic authentication enabled, any network client can submit, read, search, and cancel jobs without credentials.

The Stackfield Desktop app before version 1.10.2 for macOS and Windows has a path traversal vulnerability in decryption functionality. A malicious export can write arbitrary content to any filesystem path.

Budibase prior to version 3.33.4 allows an unauthenticated attacker to achieve Remote Code Execution (RCE) on the server by triggering an automation that contains a Bash step via the public webhook endpoint. The process executes as root inside the container.

Budibase prior to version 3.33.4 has a Server-Side Request Forgery (SSRF) vulnerability in the REST datasource connector. The SSRF protection mechanism (IP blacklist) is ineffective because the BLACKLIST_IPS environment variable is not set by default in any official deployment configuration. When empty, the blacklist function unconditionally returns false, allowing all requests through.

A heap overflow vulnerability was found in the Linux kernel's NFSD module (NFSv4.0) in the LOCK replay cache. The fixed 112-byte buffer cannot accommodate variable-length lock owner fields (up to 1024 bytes), leading to an out-of-bounds write.

In the Linux kernel, the netfilter nf_conntrack_h323 DecodeQ931() function fails to check for zero length before decrementing, causing an integer wrap and out-of-bounds read.

A vulnerability was found in the Linux kernel's smc_tcp_syn_recv_sock() function in the SMC module. A race condition between closing an SMC socket and TCP connection handling in softirq context leads to NULL pointer dereference or use-after-free (UAF). An attacker could exploit this to cause a system panic.

A use-after-free vulnerability exists in the Linux kernel ksmbd module involving the share_conf object in compound requests. smb2_get_ksmbd_tcon() reuses work->tcon without validating tcon->t_state, so after an earlier SMB2_TREE_DISCONNECT frees share_conf, subsequent commands dereference the freed memory.

W jądrze systemu Linux zidentyfikowano podatność związana z użyciem po zwolnieniu pamięci (use-after-free) w kontekście DURABLE_REQ_V2, co może prowadzić do dereferencji nieaktualnego wskaźnika. Problem występuje w funkcji parse_durable_handle_context(), która niepoprawnie przypisuje połączenie do aktywnych uchwytów plików.

Azure Databricks contains a Server-Side Request Forgery (SSRF) vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Microsoft Azure Kubernetes Service contains an improper authorization vulnerability that allows an unauthorized attacker to elevate privileges over a network.

Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network.

A Server-Side Request Forgery (SSRF) vulnerability in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network.

OneUptime is an open-source monitoring platform. Prior to version 10.0.42, the Worker service exposes workflow execution endpoints without authentication. An attacker who knows a workflow ID can execute arbitrary workflows with controlled input, enabling JavaScript code execution, notification abuse, and data manipulation.

Hoppscotch prior to version 2026.3.0 has a stored XSS vulnerability that can lead to CSRF.

Hoppscotch prior to version 2026.3.0 has an open redirect vulnerability that leads to token exfiltration. With these tokens, the attacker can sign in as the victim to takeover their account.

Group-Office prior to versions 6.8.156, 25.0.90, and 26.0.12 has a vulnerability in the AbstractSettingsCollection model leading to insecure deserialization, allowing arbitrary file write and remote code execution.

Hirschmann HiEOS devices versions prior to 01.1.00 contain an authentication bypass vulnerability in the HTTP(S) management module that allows unauthenticated remote attackers to gain administrative access by sending specially crafted HTTP(S) requests. Attackers can exploit improper authentication handling to obtain elevated privileges and perform unauthorized actions including configuration download or upload and firmware modification.

OneUptime prior to version 10.0.42 allows unauthenticated access to Notification test and Phone Number management endpoints, enabling SMS/Call/Email/WhatsApp abuse and phone number purchase.