CVE Vulnerability Catalog

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh prompt. Attackers can embed ANSI/OSC escape sequences in version fields of package manifests to manipulate terminal output, rewrite window titles, or spoof displayed text when victims enter the directory.

onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal escape sequence injection. Attackers can embed ANSI/OSC escape sequences in project manifest version and name fields to manipulate terminal output, rewrite window titles, hide text, or trigger emulator-specific behavior when victims run onefetch.

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.

Joomla Extension - svenbluege.de - Authenticated arbitrary path deletion in 'clear cache' task in Event Gallery extension < 6.5.0 - Using the 'images' parameter of the 'cache.process' task, you can recursively delete any directories that the web server is authorized to write to.

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.

Joomla Extension - svenbluege.de - CSRF in various cart actions in Event Gallery extension < 6.5.0

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.

A vulnerability in wolfSSL causes CRL checking to be skipped for certificates without an OCSP URL when both OCSP and CRL revocation checking are enabled. As a result, a certificate revoked by CRL may be accepted, and a missing OCSP responder is treated as a positive response. The issue affects versions up to 5.9.2 and is reachable over TLS 1.0-1.3 and DTLS.

A (D)TLS 1.2 client can accept a ChangeCipherSpec message before sending its ClientKeyExchange, allowing an attacker to complete the handshake in place of the server and send data the client accepts as authentic. DTLS 1.2 clients are exposed via datagram reads, and TLS 1.2 clients when using wolfSSL_inject() or read ahead.

MatchTrustedPeer ignores the public key used, allowing forged CA clones to pass verification. Affected builds enable WOLFSSL_TRUST_PEER_CERT and load CA certificates via wolfSSL_CTX_trust_peer_cert() or wolfSSL_trust_peer_cert(). The peer must know the loaded certificates to exploit the issue.

When using RPK, the client side of TLS 1.2, 1.3 and DTLS 1.2 connections could accept an unsolicited server_cert_type=RawPublicKey, allowing a malicious or misbehaving server to bypass authentication. RPK is off by default and only enabled in specific builds.

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in all type-blind sibling consumers. Affects wolfSSL versions 5.8.4 through 5.9.2 with specific macros or --enable-opensslextra, when the application calls X509_verify_cert.

A certificate with no dNSName SAN but another SAN type present bypassed the Subject CN dNSName name-constraint check. This incomplete fix from CVE-2026-6731 was introduced in wolfSSL version 5.9.2.

wolfSSL versions 5.9.2 and earlier fail to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepts certificates for hostnames they shouldn't cover due to a chain-walking state-machine bug.

In wolfSSL versions 5.7.2 through 5.9.2, a client-side implementation flaw in RFC 6961 (multiple OCSP response stapling) can lead to certificate forgery. When a client enables OCSP stapling with HAVE_CERTIFICATE_STATUS_REQUEST_V2 and calls wolfSSL_UseOCSPStaplingV2, it accepts any certificate in the peer's chain as a CA without verifying authorization.

In all builds using (D)TLS, including default builds, there is a series of conditional states during TLS shutdown that could lead to a heap-use-after-free. If an application gets a partial wolfSSL_read() result, sometimes caused by a small user buffer, then calls wolfSSL_shutdown for a bidirectional close and attempts wolfSSL_read() again while the peer continues sending data during shutdown, it could lead to a heap-use-after-free.

In wolfSSL versions v5.3.0 through v5.9.2, when NO_SESSION_CACHE_REF is undefined, wolfSSL_get_session() returns a handle into the process-global SessionCache instead of a session object. Because the TLS 1.2 session ID is server-chosen and sent in clear, a malicious server can overwrite the client's cache entry for another server and then be accepted as the original server during session resumption without certificate or domain name verification.

A vulnerability in wolfSSL when WOLFSSL_SMALL_CERT_VERIFY is enabled allows an attacker to bypass certificate signature verification. Due to incorrect result merging, parse errors hide invalid signatures, and date/constraint checks are performed before signature confirmation. An attacker can use a self-signed certificate with arbitrary signature bytes to pass verification if the application uses a callback that overrides date errors.