Reserved but Public CVEs

First seen Aug 20, 2026

First seen Aug 20, 2026

First seen Aug 20, 2026

First seen Aug 20, 2026

First seen Aug 20, 2026

First seen Aug 20, 2026

First seen Aug 20, 2026

CVE-2026-55225 is a privilege escalation vulnerability in the Strimzi cluster-operator related to the Kafka custom resource field Kafka.spec.entityOperator.watchedNamespace. An attacker who can create or modify a Kafka custom resource in a namespace they control can abuse this field to influence the Cluster Operator into creating permissions for the entity operator ServiceAccount in a different namespace. This can result in cross-namespace access beyond the attacker's intended administrative boundary. The flaw effectively allows the operator-managed entity operator to be granted access to Secrets in another namespace, creating an authorization boundary violation across Kubernetes namespaces.

CVE-2026-55225First seen Jun 19, 2026

CVE-2012-4346 is a cross-site scripting vulnerability in the setup.php page of Support Incident Tracker (SiT!). Affected versions include 3.66 and earlier. The flaw can be triggered when attacker-controlled JavaScript is supplied to the vulnerable page through a crafted HTTP GET request, indicating insufficient neutralization of untrusted input before it is returned to the browser. Successful exploitation causes malicious script to execute within the security context of the victim's session in the application.

CVE-2012-4346First seen Aug 20, 2026

CVE-2011-2466 is a cross-site scripting vulnerability in the login process of the ZyXEL ZyWALL 70 firewall. Improper handling of login parameters allows attacker-supplied script content to be reflected into the administrative web interface and executed in a victim's browser as though it originated from the firewall itself. Successful exploitation occurs in the security context of the firewall management interface and can expose authenticated administrative sessions to client-side script execution.

CVE-2011-2466First seen Aug 20, 2026

CVE-2017-5523 is an improper input validation vulnerability in SAP Adaptive Server Enterprise (ASE) involving native library loading from a shared SAP Java Runtime Environment library location. The flaw allows ASE, via Java-related functionality, to load a native library from a shared SAP JRE library path without sufficient validation. In a chained attack scenario, an attacker who has already managed to place a malicious native library in that shared location can cause the ASE process to load it, resulting in execution of attacker-controlled code within the database server process.

CVE-2017-5523First seen Aug 20, 2026

CVE-2021-29232 is an authenticated SQL injection vulnerability in the WordPress Simple Membership plugin affecting versions up to and including 4.0.3. Multiple input parameters are insufficiently sanitized before being incorporated into SQL queries, allowing an authenticated administrator-level user to inject arbitrary SQL into backend database operations. Successful exploitation can alter the logic of intended queries and expose or manipulate application data stored in the WordPress database.

CVE-2021-29232First seen Aug 20, 2026

CVE-2017-18180 is an arbitrary shell command execution vulnerability in the nas_sharing.cgi CGI component of Western Digital My Cloud personal cloud storage devices prior to firmware 2.30.172. The flaw allows an attacker to supply crafted input through the artist parameter and cause shell commands to be executed by the underlying system. Available reporting indicates the commands run with root privileges, making this a direct operating system command injection issue in a network-exposed management component.

CVE-2017-18180First seen Aug 20, 2026

CVE-2014-4680 is an authentication bypass vulnerability in the HTTP server component of Wing FTP Server 4.3.7 and earlier on Windows. The flaw affects the WebLink mechanism used to generate URLs for file downloads. Authenticated users can create WebLink URLs that are intended to permit controlled access to files, but due to insufficient enforcement of the WebLink token, unauthenticated users can access the linked files by using only a truncated portion of the generated hash value. Reported behavior indicates that 8.3 alias handling allows WebLinks to be accessed using only the first six characters of the hash, undermining the intended access control on shared files.

CVE-2014-4680First seen Aug 20, 2026

CVE-2015-1504 is an authenticated reflected cross-site scripting vulnerability in IceWarp Mail Server webmail components affecting version 11.1.1 and earlier. The issue is present in webmail resources including the CSS handling endpoint and the basic webmail interface, where attacker-controlled input is reflected back to the browser without sufficient sanitization or output encoding. A successful exploit causes malicious script to execute in the context of the victim user's browser session within the IceWarp webmail application.

CVE-2015-1504First seen Aug 20, 2026

CVE-2014-4679 is an information disclosure vulnerability in the HTTP server component of Wing FTP Server 4.3.7 and earlier on Windows. The server improperly handles requests for files referenced through their Windows 8.3 short-name alias, allowing retrieval of the underlying source code of web pages instead of only the intended rendered content. The flaw affects the way the application resolves and serves requests for short-name aliases on Windows filesystems.

CVE-2014-4679First seen Aug 20, 2026

CVE-2014-4328 is a protection bypass in KeePass affecting the application's secure desktop feature. The issue arises because the secure desktop implementation allows a process running in another desktop context to interact with user interface objects on the KeePass secure desktop. By using Windows user interface functionality exposed through User32, an attacker with the ability to execute code in the same user session can start or inject a process into the secure desktop context and defeat the intended isolation of the master password entry dialog. This undermines the security boundary KeePass attempts to provide for sensitive input handling.

CVE-2014-4328First seen Aug 20, 2026

CVE-2014-7976 is a cross-site scripting vulnerability in Gizmox WebGUI caused by improper validation and sanitization of user-supplied input in the vwginstance query parameter. An attacker can craft a request in which malicious script is embedded in that parameter, and if the application reflects or otherwise processes the value without adequate output encoding, the script can execute in a victim's browser within the security context of the affected application.

CVE-2014-7976First seen Aug 20, 2026

CVE-2015-3328 is an information exposure and unauthorized file access vulnerability in SAP Adaptive Server Enterprise when the Java subsystem is enabled. The issue affects Java class access within the database server, including java.io.File for file probing and java.io.RandomAccessFile and related java.io classes for filesystem access on UNIX and Linux platforms. An attacker can use these classes to test whether files exist, determine file types, and in affected environments access files without authorization through the Java-enabled ASE context.

CVE-2015-3328First seen Aug 20, 2026

CVE-2015-8518 is a missing authorization check vulnerability in SAP Adaptive Server Enterprise (ASE). The flaw allows an authenticated user who has the CREATE PROCEDURE privilege to invoke restricted system extended stored procedures that should not normally be accessible to that user. Reported abuse includes redefining xp_cmdshell, which can be used to reach privileged functionality otherwise protected by normal security controls. The issue stems from improper enforcement of authorization on invocation of system stored procedures from user-created procedures.

CVE-2015-8518First seen Aug 20, 2026

CVE-2014-6282 is a pre-authentication SQL injection vulnerability in Gerber WebPDM 5.0.58. The flaw affects the ACCOUNT parameter processed by the VerifyLogin.asp page, where unsanitized user-supplied input is incorporated into backend SQL queries. An attacker can submit crafted input to alter query logic and interact with the underlying database without first authenticating to the application.

CVE-2014-6282First seen Aug 20, 2026

CVE-2014-6286 is a SQL injection vulnerability in the dbcc createws command of SAP Adaptive Server Enterprise (ASE). The implementation flow of this command allows a user with CREATE DATABASE privilege to inject SQL statements that are subsequently executed without normal security checks. Because the injected SQL runs in a privileged context, the flaw can be used to bypass intended authorization boundaries and elevate privileges within the database server.

CVE-2014-6286First seen Aug 20, 2026

CVE-2015-3311 is an insecure library loading vulnerability in SAP Adaptive Server Enterprise when the Java subsystem is enabled. The issue arises from the product allowing native libraries to be loaded in an unsafe manner. A valid database user can abuse this behavior to cause attacker-controlled native code to be loaded and executed within the database server process context. Because the vulnerable code executes inside the ASE server process, exploitation can cross the boundary from database-level access into operating-system-level code execution within the privileges of the database service account.

CVE-2015-3311First seen Aug 20, 2026

CVE-2013-2775 is a reflected cross-site scripting vulnerability in the ColdBox debug panel affecting versions prior to 3.6.0. The flaw allows untrusted input to be reflected in a web response without proper sanitization or output encoding, enabling execution of attacker-supplied JavaScript in a victim's browser when a crafted request is processed by the debug panel.

CVE-2013-2775First seen Aug 20, 2026

CVE-2014-6281 is a reflected cross-site scripting vulnerability in Gerber WebPDM Product Data Management 5.0.58. The flaw affects the main login form, where input supplied through the txtUserName parameter is reflected to the client without sufficient sanitization or output encoding. An attacker can craft a malicious request that causes script content to execute in a victim user's browser when the crafted link or request is processed. The issue is present in the application's login workflow and can be triggered without prior authentication.

CVE-2014-6281First seen Aug 20, 2026