CVE Vulnerability Catalog

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post filtering applied to post content on save because it contains no HTML tags and survives intact inside the block comment's JSON attributes, reaching the walker unescaped at render time.

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, enabling stored cross-site scripting attacks.

django-page-cms through version 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access unpublished drafts, page listings, and file paths without proper authorization checks.

A vulnerability was identified in GPAC 26.08-DEV affecting the function gf_rtp_parse_ttxt in src/ietf/rtp_depacketizer.c of the RTP Depacketizer component. Manipulation of the size argument leads to an out-of-bounds read. The attack can be launched remotely.

A vulnerability was found in Freedesktop Poppler 26.07.0 affecting the function FoFiTrueType::mapCodeToGID in fofi/FoFiTrueType.cc. Manipulating the segCnt argument can lead to an integer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed and may be utilized.

A vulnerability was found in Freedesktop Poppler 26.07.0 affecting the function JBIG2Stream::readCodeTableSeg in poppler/JBIG2Stream.cc. Manipulation results in an integer overflow. The attack can be initiated remotely, and the exploit has been made public and could be used.

The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with another user, that user's own folder configuration is used to determine which of the owner's files are searched, allowing them to discover files (name, file ID, and other metadata) in folders the album owner never intended to include in the shared album. This requires the album owner to have shared a filter-based smart album with the attacker.

The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check when the etag parameter was present and non-empty in the request. An attacker able to intercept and modify the approval request could omit the etag field entirely, bypassing the freshness check and approving or rejecting a file version they never reviewed.

Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session user. This enables cross-user manual locks (blocking writes such as PUT/MOVE/DELETE and editor saves) and lock-token disclosure, allowing attackers to remove token-based locks of other users.

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board.

A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to delegate limited administrative privileges for team folder management via API/REST only, restricting access to folders for which the admin has advanced permissions.

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body is never returned, making this a blind SSRF.

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

A flaw was found in Freedesktop Poppler 26.07.0 affecting the function JBIG2Stream::rewind in poppler/JBIG2Stream.cc. Manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in Freedesktop Poppler 26.07.0. The issue affects the SampledFunction::SampledFunction function in poppler/Function.cc, where manipulation of the BitsPerSample argument results in integer overflow. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was identified in O-RAN-SC SMO OAM (2025-06-10) in the VES Collector component. An unknown functionality leads to allocation of resources. Remote exploitation is possible and the exploit is publicly available.

NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Security Association used for SDLS processing solely from the SPI field inside the incoming frame, without verifying that the selected SA is authorized for the frame's GVCID.

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attackers to redirect recovery tokens to attacker-controlled domains. Attackers can submit password recovery requests with a malicious Origin header to have valid password-reset tokens mailed to victim recovery addresses within links pointing to attacker infrastructure, enabling account takeover.