CVE Vulnerability Catalog

vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force outbound connections by embedding a decode address in the X-Request-Id header. Attackers can make a P2pNcclConnector prefill worker ZMQ-connect to an attacker host, leaking the NCCL unique_id and KV-cache tensors or blocking the worker.

Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets clients without the master key delete the stored schema of any class. Unauthenticated attackers can send REST API delete requests targeting the internal _SCHEMA collection to remove field definitions, class-level permissions, and protected fields, exposing data to unauthorized reads and modifications.

Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and validateUpdate methods of custom adapters subclassing AuthAdapter are never called, and an inherited default that accepts any authData is used instead. Attackers can supply arbitrary authData to sign up, link identities, log in as existing users, or skip custom additional authentication factors.

ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2 compressed images. Attackers can supply a crafted image using bzip2 compression to overwrite stack memory during decoding, causing crashes or memory corruption.

Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deploy, or stop to overwrite environment variables and build secrets, repoint sources, and disrupt other tenants' applications.

Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the editor file and delete_backups endpoints to read any server-readable file and remove backup files outside the journal or sheets directory.

A SQL Injection vulnerability was found in the Employee Recruitment System (krupalshah) in /source/registerform3.php. Manipulating the pemail argument allows remote attack, and a public exploit is already available. The product is no longer supported by the maintainer, and the vendor did not respond to the disclosure.

A SQL Injection vulnerability was found in EmployeeRecruitmentSystem (krupalshah) in /source/registerform2.php within the mysql_query function. Manipulating the university/institute/branch/degree/status/cpi/semester/experience arguments enables remote attack, and the exploit has been publicly disclosed. The product is no longer supported, and the vendor did not respond to the disclosure.

A SQL injection vulnerability was detected in krupalshah EmployeeRecruitmentSystem within the mysql_query function of /source/registerform1.php. Manipulation of the firstname, middlename, lastname, gender, birthdate, state, statespecify, city, and cityspecify arguments allows SQL injection. The exploit is publicly available and can be launched remotely.

The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install plugins and exposes the routine without authentication. This allows an administrator of a multisite child site who is not a network administrator to install and run arbitrary PHP in the network-wide shared Duplicator directory.

A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. An unknown function in AuthController.java handling SMS code verification improperly processes the mobile/code arguments, resulting in improper authentication. The attack can be launched remotely and the exploit is publicly available.

A security flaw was discovered in Zylon PrivateGPT versions 1.0.0 and 1.0.1. The vulnerability affects the load_file_from_uri function in private_gpt/server/ingest/uri_loader.py (URI Artifact Loader component) and involves manipulation of the Value argument, resulting in server-side request forgery. The attack can be initiated remotely, and a public exploit is available.

A SQL injection vulnerability was found in the Restaurant_IMS project (mansi-k repository) in the mysqli_connect function of the lsmodal.php file. Manipulation of the login_id/epsw arguments allows injection of malicious SQL code. The vulnerability can be exploited remotely, and the project does not provide version details due to its rolling release model.

In FaveoSuite Faveo Helpdesk 2.0.3, the ForgotPasswordController::sendResetLinkEmail/PasswordController::reset function in app/Http/Controllers/Auth/ForgotPasswordController.php leads to weak password recovery. The attack may be initiated remotely.

A vulnerability was found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/system-update/import file in the Import Endpoint component. Manipulation leads to code injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A flaw has been found in Travisun Opptrix 0.4.0 affecting an unknown function of the /api/auth/setup file in the Schedule API component. The manipulation causes command injection, and the attack can be initiated remotely. The exploit has been published and may be used.

The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.

Web::Simple versions before 0.035 for Perl allocate a buffer sized by the Content-Length header for urlencoded body parameters. Web::Dispatch::ParamParser::get_unpacked_body_from reads an application/x-www-form-urlencoded body using a single read call with no cap and ignores the return value, so the declared Content-Length determines the allocation.

The UPI QR Code Payment Gateway for WooCommerce plugin (versions up to 1.6.3) has a missing authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by relocating data-*@ directives with unset-name@ or integer keys. Attackers with page-edit permission can embed crafted fields in Flex form overrides in page frontmatter to call methods like Folder::delete or Utils::download, deleting directories, overwriting files, or reading files outside the page tree.