CVE Vulnerability Catalog

Improper comparison with the trusted certificates list in S2OPC allows an attacker to have a well-formed untrusted certificate considered trusted.

In Jenkins 2.567 and earlier, LTS 2.555.2 and earlier, an attacker can deserialize arbitrary types from Jenkins core or plugins via a crafted `config.xml` submission. This allows handling HTTP requests, impersonating any user, executing arbitrary code via the Script Console, or reading arbitrary files from the Jenkins controller.

Ghidra before version 12.1 contains a SQL injection vulnerability in BSim filter types that concatenate user-supplied values directly into SQL queries without escaping or parameterization. Remote attackers can inject arbitrary SQL via the BSim network query protocol to read, modify, or delete data in the PostgreSQL database.

Ghidra before version 12.0.4 contains a path traversal vulnerability in the theme import functionality, allowing attackers to write files outside the intended theme directory. Attackers can craft malicious theme ZIP files with traversal sequences in filenames to execute arbitrary code or modify sensitive files like .bashrc or .ssh/authorized_keys.

Ghidra before version 12.1 contains an authentication bypass vulnerability in PKIAuthenticationModule.authenticate() that allows any user with a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature.

Ghidra before version 12.0.2 contains a path traversal vulnerability in the extension installer that fails to validate ZIP entry names during extraction. Attackers can craft malicious extensions with traversal sequences like ../ in filenames to write arbitrary files outside the intended directory, enabling code execution.

Ghidra before version 12.1 contains an unsafe deserialization vulnerability in client-side Shared-Project RMI connection code that allows unauthenticated remote code execution. Attackers can craft a malicious project file with a ghidra:// URL that, when opened via File → Open Project, deserializes untrusted objects using a Jython 2.7.4 gadget chain to execute arbitrary commands.

Ghidra before version 12.1 contains a command injection vulnerability in URL annotation handling on Windows where cmd.exe metacharacters are not properly escaped. Attackers can execute arbitrary commands under the Ghidra user's privileges by embedding malicious URLs in program comments that victims click.

Ghidra versions 11.0 through 12.0 contain a SQL injection vulnerability in the changePassword() method of PostgresFunctionDatabase. The failure to escape double quotes in usernames interpolated into ALTER ROLE statements allows authenticated attackers to inject SQL commands via crafted username parameters in PasswordChange network messages.

CVE-2026-49069 describes an improper neutralization of input during web page generation in WPZOOM Portfolio, leading to a Reflected XSS vulnerability.

Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field, triggering an infinite loop in the ICNS parser.

Version 2.0.2 of the image-size library contains a denial of service vulnerability that allows remote attackers to block the Node.js event loop. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by supplying a specially crafted image with a zero-valued size field.

Slate Digital Connect version 1.37.0 for macOS installs a privileged helper tool that exposes the XPC service to race conditions related to process identifiers. A local attacker can exploit PID reuse, leading to unauthorized access to privileged helper functionality.

Slate Digital Connect version 1.37.0 for macOS installs a privileged helper tool that exposes the XPC service. The helper only validates connecting XPC clients based on the subject.OU value of the client's signing certificate, allowing a local attacker to gain access to privileged functionality.

The Newsletters plugin for WordPress up to version 4.13 is vulnerable to time-based SQL injection via the 'wpmlsubscriber_id' parameter. Insufficient escaping and lack of proper SQL query preparation allow unauthenticated attackers to append additional SQL queries, potentially extracting sensitive information from the database.

Vulnerability in Concrete CMS below version 9.5.2 allows an unauthenticated attacker to perform PHP object injection via unserialize() calls in Permission, Cache, and Search components. The attack requires a malicious payload to be placed in the database.

Vulnerability in the Anti-Spam by CleanTalk WordPress plugin before version 6.79: improper content sanitization in a custom shortcode used in email encoding. Unauthenticated attackers can inject arbitrary web scripts into approved comments.

The Xstore WordPress theme before 9.7.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.

Some Dahua products have a vulnerability allowing an unauthenticated remote attacker to send a crafted packet, triggering an exception causing unexpected system reboot, leading to denial of service.

A vulnerability in the ldns library (versions 1.2.0 to 1.9.0) used as a UDP resolver lacks verification of the response source address and port, as well as the query ID and question. This enables off-path DNS cache poisoning attacks.