CVE Vulnerability Catalog

Improper handling of an initialization failure in AWS API MCP Server versions 0.2.13 through 1.3.46 might allow an actor to bypass the user-configured security policy and execute AWS API operations that the policy was set to deny. When initialization of security policy enforcement data fails at server startup, the policy check is skipped for the lifetime of the process. IAM permissions on the configured credentials remain in effect.

Logto omits validation of the SAML <Conditions> element, enabling attackers to strip time and audience restrictions and replay assertions indefinitely.

Logto silently fails to delete IdP-initiated SAML sessions, enabling session replay and reuse within the session’s validity window.

In the swift-crypto library before version 4.5.1, when initializing an RSA public key from DER or PEM bytes fails, a double-free occurs. This can cause a crash on future memory allocations. The issue manifests when BoringSSL cannot decode the key.

In swift-nio-ssl, the NIOSSLCertificate._subjectAlternativeNames method provides access to raw bytes for a cert's SANs. It assumes the buffer is backed by an ASN1_STRING, but not all SANs are backed by ASN1_STRING, leading to potential out-of-bounds memory access.

DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.

Bold Reports Standalone Report Designer before 14.1.12 has a missing filepath validation vulnerability in file upload, allowing authenticated attackers to traverse directories by supplying a crafted filename. Attackers can exploit this to execute arbitrary commands with high privileges. The vulnerability is in the DataHub module introduced in Bold Reports 6.3.

brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales until the process hits a fatal out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000).

In JetBrains PyCharm before versions 2026.1.4 and 2026.2, arbitrary code execution was possible via a malicious Python executable when opening an untrusted project.

In JetBrains TeamCity before versions 2026.1.2 and 2025.11.6, code execution was possible via Kotlin DSL sandbox escape.

Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.

Grav API Plugin before 1.0.10 fails to properly validate the slug field in the POST /pages/{route}/move endpoint. PagesController::move() sanitizes the slug only with ltrim($body['slug'], '.'), which strips leading periods but does not neutralize '/' or '..' segments. An authenticated API caller with api.pages.write permission can supply path traversal sequences (e.g., 01.home/../../../pwned) to move an entire page directory (content and media) to an arbitrary writable location outside user/pages/, including outside the Grav installation.

Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting site-wide to enable credential brute-forcing attacks and reconfigure CORS policies to include attacker-controlled origins with credentials enabled.

Remote code execution (RCE) vulnerability in Grav versions 1.7.0 through 2.0.9. FlexDirectory::dynamicDataField() calls call_user_func_array() on attacker-controlled input without restricting dangerous functions like exec or system. An authenticated user with create or update permissions on any Flex directory can execute arbitrary shell commands on the server.

Unauthenticated Cross-Site Request Forgery (CSRF) in Popup for CF7 with Sweet Alert versions up to 1.6.5.

The Kwayy HTML Sitemap plugin versions up to 4.0 contain an unauthenticated Cross-Site Request Forgery (CSRF) vulnerability. An attacker can trick an administrator into performing unintended actions.

The Persian Woocommerce SMS plugin versions up to 7.2.2 contain an SQL Injection vulnerability exploitable by a shop manager. An attacker with shop manager privileges can manipulate database queries.

The Visualizer WordPress plugin (versions up to and including 4.0.1) has a blind SQL Injection vulnerability due to improper neutralization of special elements in SQL commands.

The PeproDev Ultimate Invoice plugin versions up to 2.2.6 contain an unauthenticated Server-Side Request Forgery (SSRF) vulnerability. An attacker can trick the server into sending requests to internal resources.

The Manual - Documentation, Knowledge Base & Education WordPress Theme versions up to 7.5.4 contain an unauthenticated Cross-Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code.