CVE Vulnerability Catalog

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes. This allows unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

The MAS Videos WordPress plugin through version 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object. This allows any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

The Advanced Twenty Seventeen WordPress plugin through version 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child theme. This allows any authenticated user such as a subscriber to switch the site's active theme site-wide, and allows the same action to be triggered against any logged-in user including an administrator via CSRF.

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard. This allows users with a role as low as Contributor to overwrite the plugin's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store contains recoverable eMudhra intermediate CA certificates. The issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Wasmtime from 46.0.0 until 48.0.7 and 49.0.4, when lowering a host-created component-model stream or future into a guest, can omit a required payload-type check after the value passes through guest code and returns via StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader; a malicious guest can panic the Wasmtime host.

MLflow from 3.12.0rc0 until 3.17.0 in the scorer invoke, register, and GenAI evaluate endpoints (including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke) accepts serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or constructor arguments; with trulens and trulens-providers-litellm installed, an attacker can force an outbound request to a chosen host with controlled headers and body.

In LangGraph CLI from 0.4.15 until 0.4.32, 'langgraph deploy --verbose' passes a temporary registry push token on standard input to 'docker login --password-stdin', but the CLI subprocess helper prints command input in verbose mode. Anyone who can read resulting CI logs or terminal recordings before the token's maximum 12-hour expiration can pull deployment images or push images to that deployment's image repository. Deployments without --verbose and remote image builds are not affected, and the token alone cannot update a deployment to execute a pushed image.

LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-checkpoint-postgres 3.1.3 and langgraph-checkpoint-sqlite 3.1.2, PostgresStore, AsyncPostgresStore, SqliteStore, and AsyncSqliteStore flatten namespace labels with '.'.join(namespace), while BaseStore validates labels only for put and aput. Unvalidated dotted labels passed through get, search, delete, list_namespaces, their asynchronous equivalents, or direct batch and abatch operations can resolve to another tenant's stored namespace, allowing cross-namespace reads, overwrites, or deletion. InMemoryStore is not affected because it compares namespace tuples.

A security flaw has been discovered in Kakao khaiii up to 0.4. The impacted element is the function khaiii::nn::Linear::open of the file src/main/cpp/khaiii/nn/Linear.cpp of the JSON Config File Handler component. The manipulation of the argument hidden_dim/class_num results in out-of-bounds read. The attack requires a local approach. The exploit has been released to the public and may be used for attacks. The vendor explains: 'khaiii treats the resource directory (--rsc-dir) as trusted input, like a binary or a shared library. To use this defect, an attacker must already be able to write to that directory. With that access, an attacker can change the analysis results without this defect.' This vulnerability only affects products that are no longer supported by the maintainer.

In OpenReception versions 2.1.0 and prior, an unauthenticated attacker can store an arbitrary ML-KEM-768 public key under any existing user's identity in any tenant's staff-crypto recipient directory. The product's design guarantees that appointment data is end-to-end encrypted to staff members and that the staff recipient directory is not attacker-writable, so that even administrators and the operator cannot read patient data. This endpoint breaks that guarantee for an unauthenticated remote actor: it allows writing an arbitrary encryption recipient into the recipient directory of any tenant. The injected key receives the tunnel key of every appointment booked afterward in that tenant, because booking clients encrypt to all active staff keys. The attacker holds the corresponding secret key and is a persistent, unauthorized recipient of that key material. At time of publication, there are no publicly available patches.

In OpenReception prior to version 2.2.2, an attacker overbooks an agent, placing multiple appointments into a single time slot that the system is designed to keep exclusive. The number of overlapping appointments equals the number of concurrent requests, and one booking token is enough because the token is consumed after the insert. This results in the integrity of the booking calendar breaking and availability being denied to other clients. This issue has been patched in version 2.2.2.

In Twisted prior to 26.10.0rc1, twisted.web.http.HTTPChannel.headerReceived rejects a NUL byte in an HTTP header value but accepts a bare carriage return or bare line feed. Because Twisted splits header lines only on CRLF, a hidden Content-Length header can remain folded into another value while a lenient front end treats the bare character as a line terminator. The resulting framing disagreement can smuggle a following request past front-end access controls, poison a shared connection or cache, and expose a later client to the wrong response. This issue is an incomplete-fix residual of earlier Twisted request-smuggling protections. This issue is fixed in version 26.10.0rc1.

A vulnerability was identified in UbiquitousLearning mllm up to 2.0.2. The affected element is the function load_model of the file pymllm/mobile/convertor/__init__.py of the Convertor component. The manipulation of the argument shard_file leads to path traversal. The attack needs to be performed locally. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

In Twisted before 26.10.0rc1, twisted.mail.imap4.IMAP4Server reaches parseNestedParens with a negative literal size in an authenticated SEARCH command after the client selects a mailbox. The negative size moves the parser cursor below zero, and Python's negative indexing prevents the synchronous scanning loop from terminating, freezing the single-threaded reactor.

In the DNS stub resolver (subsys/net/lib/dns/resolve.c), the UDP socket is bound only once at resolver context initialisation, so the source port stays constant for the lifetime of the context while only the 16-bit transaction identifier varies. This violates RFC 5452 section 9.2 and lets an attacker with UDP reachability guess just the identifier and inject a forged reply. The fix draws a fresh source port before each query (CONFIG_DNS_RESOLVER_RANDOMIZE_SOURCE_PORT, default y).

The DHCPv4 client in Zephyr RTOS (subsys/net/lib/dhcpv4/dhcpv4.c) maintained its transaction identifier (xid) as a counter rather than a per-transaction random value. It was seeded once with sys_rand32_get() and incremented by one, and RENEWING and REBINDING exchanges reused the unchanged or predictable identifier. Since the xid is the only unpredictable reply-validation token, an attacker can learn or predict it and send a forged DHCP reply that changes the default gateway and DNS resolvers.

A security flaw was discovered in Tenda F6 version 12.02.01.73 affecting an unknown function of the web management interface. Manipulation leads to cross-site request forgery, and the attack can be initiated remotely. A public exploit has been released and may be used in attacks.

An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might allow an authenticated remote user to execute arbitrary code within their own isolated session environment via a crafted script. AWS fixed this issue service-side. No customer action is required.