CVE Vulnerability Catalog

The WordPress plugin 'LiteSpeed Cache' (versions up to 7.9) is vulnerable to insertion of sensitive information into sent data, which may allow retrieval of embedded sensitive data. An attacker could gain access to information that should not be disclosed.

The WordPress plugin 'SureDash' (versions up to 1.12.2) has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker could perform actions they should not be authorized to do.

A vulnerability was found in Scada-LTS 2.8.0 in the HttpServletRequest.getParameter function of AmChartValuesAPI.java within the AmCharts Data API component. Manipulating the ids argument can lead to authorization bypass, and the attack can be executed remotely. The exploit has been published and may be used.

A weakness was identified in InternScience InternAgent 1.5.0 in the train function of tasks/AutoChem/code/experiment.py within the LoRA Loading component. Manipulating the base_model_name_or_path argument causes inclusion of functionality from an untrusted control sphere. The attack may be initiated remotely, and the exploit has been made publicly available.

BigFix Platform uses the Mozilla CA certificate bundle (PEM). Bundle versions dated before 2026/10/20 still trust certificates whose private keys have been compromised. When BigFix Platform validates servers using such a bundle, an on-path attacker can impersonate remote servers and tamper with files downloaded by the application.

The News Kit Addons For Elementor WordPress plugin through 1.4.7 does not perform capability or ownership checks before updating post metadata in one of its authenticated AJAX actions. This allows users with subscriber-level access and above to write arbitrary post meta, under attacker-chosen keys, to any post including those owned by other users.

The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions. This allows authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor plugin from the WordPress.org repository.

The Front End Users WordPress plugin through 3.2.35 does not restrict which account attributes a visitor may set when registering through its front-end forms. This allows unauthenticated users to assign themselves an arbitrary membership level and to mark their own account as approved, confirmed and paid, bypassing the plugin's content restrictions and registration gating.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end. This could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

The GeoDirectory WordPress plugin before 2.8.194 does not perform status, ownership or password checks when loading listings for one of its unauthenticated AJAX handlers. This allows unauthenticated users to disclose the content of non-public (draft, pending and private) listings by supplying their IDs.

The GeoDirectory WordPress plugin before 2.8.194 does not validate a user-supplied image URL before using it as a local file path when saving a front-end listing. This allows users with Subscriber-level access and above to read files from outside the web root and to delete files on the server, limited to file names that carry an allowed media extension; a disclosed file is re-published at a public URL and its original is deleted as a side effect.

The GeoDirectory WordPress plugin before 2.8.194 does not perform any status or ownership check when rendering a listing's map-popup through one of its single-item REST routes. This allows unauthenticated users to read the title, permalink and card fields of non-public (draft, pending, private and trashed) listings by supplying the listing ID.

The GeoDirectory WordPress plugin before version 2.8.194 does not verify that a referenced attachment belongs to the listing being saved. This allows users with Subscriber-level access and above to modify the title, caption, moderation status and featured flag of images belonging to other users' listings, and to claim another user's image as their own featured image.

The MAS Videos WordPress plugin through version 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object. This allows any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

The Advanced Twenty Seventeen WordPress plugin through version 1.3.1 does not perform any capability or nonce check on the action that creates and activates its bundled child theme. This allows any authenticated user such as a subscriber to switch the site's active theme site-wide, and allows the same action to be triggered against any logged-in user including an administrator via CSRF.

The Pixel Tag Manager for WooCommerce WordPress plugin before version 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard. This allows users with a role as low as Contributor to overwrite the plugin's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

MongoDB Compass relies on Electron, a third-party runtime that carries its own TLS root certificate store. This root certificate store contains recoverable eMudhra intermediate CA certificates. The issue is resolved by updating to Compass 1.53.1, which includes Electron 44.9.1.

Wasmtime from 46.0.0 until 48.0.7 and 49.0.4, when lowering a host-created component-model stream or future into a guest, can omit a required payload-type check after the value passes through guest code and returns via StreamAny, FutureAny, Val::Stream, Val::Future, or an equivalent typed reader; a malicious guest can panic the Wasmtime host.

MLflow from 3.12.0rc0 until 3.17.0 in the scorer invoke, register, and GenAI evaluate endpoints (including unauthenticated POST /ajax-api/3.0/mlflow/scorer/invoke) accepts serialized third-party scorer data that Scorer.model_validate_json resolves using a module-path allowlist without constraining the selected class or constructor arguments; with trulens and trulens-providers-litellm installed, an attacker can force an outbound request to a chosen host with controlled headers and body.