NCEAS vulnerabilities
We track 3 vulnerabilities in NCEAS products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on August 14, 2026.
Latest NCEAS vulnerabilities
- 9.8 Critical severity
metacat: Improper Neutralization of Special Elements used in an SQL Command
Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints due to unsa
- 9.3 Critical severity
metacat: Improper Limitation of a Pathname to a Restricted Directory
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` parameter of the `action=read` endpoint that is
- 9.8 Critical severity
metacat: Improper Neutralization of Special Elements used in an SQL Command
Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.0.0 and and above contain an unauthenticated SQL injection in the /harvesterRegistration endpoint. HarvesterRegistration.dbInsert() builds an INSERT again