CVE Vulnerability Catalog

The Avada theme for WordPress up to version 7.16 is vulnerable to Arbitrary File Write when the Fusion Builder plugin is installed and active in versions up to 3.16. A chain of authorization and input validation weaknesses allows unauthenticated attackers to write attacker-controlled files to the server, leading to remote code execution and complete site compromise. Successful exploitation requires both Avada and Fusion Builder installed and active, as well as certain administrator-authored content.

Improper access control in debug and engineering interfaces in Danfoss iC7-Automation SP, iC7-Marine, and iC7-Hybrid GR3 allows attackers to gain read/write access to internal values, upload and execute unsigned applications, and upload unsigned EEPROM data and firmware via exposed service interfaces and software update mechanisms.

The TranslatePress plugin for WordPress up to version 3.3.1 is vulnerable to Sensitive Information Exposure via the 'trp_get_translations_regular' AJAX action. Unauthenticated attackers can extract the raw administrator password-reset URL, enabling full administrator account takeover. Exploitation requires automatic string saving enabled (default) and the target administrator's profile locale set to a published secondary language.

ClipBucket V5's web installer fails to properly validate or escape the php_cli_filepath parameter before passing it to shell execution. Unauthenticated attackers can submit a crafted POST request to the installer with a malicious php_cli_filepath value to execute arbitrary commands as the web server user.

TOTOLINK N600R 4.3.0cu.7647_B20210106 has a stack-based buffer overflow vulnerability in the setSystemConfig function of /cgi-bin/cstecgi.cgi. Manipulation of the Hostname argument leads to buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.

Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects versions from 0.0.0 to 3.2.0.

Incorrect Authorization vulnerability in Drupal Webform REST allows Forceful Browsing. This issue affects versions from 0.0.0 to 4.1.0.

Vulnerability in Drupal Commerce Elavon. This issue affects all versions.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Internationalization Single Sign-On allows Authentication Bypass. This issue affects versions from 0.0.0 to 1.8.0.

Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the session.

Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numerically.

Incorrect Authorization vulnerability in Apache Tomcat's FORM authentication process allows the bypassing of a security constraint that limits user has access to a resource POST but not GET.

Authentication Bypass by Capture-replay vulnerability in Apache Tomcat's DIGEST authenticator. If, before windowSize requests have been made, a client makes a DIGEST authenticated request with a nonceCount on the upper boundary of the replay window then that request is replayable once only while the associated nonceCount remains within the replay window.

Improper input validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. Affects versions 11.0.20-11.0.24, 10.1.53-10.1.57, and 9.0.115-9.0.120.

Improper access control and incorrect authorization vulnerability in Apache Tomcat leads to security constraint bypass if a constraint for a longer path is specified before a more restrictive constraint for a shorter sub-path. Affects a wide range of versions from 7.0.0 through 11.0.24.

Typebot up to version 3.17.1 (self-hosted) has a brute-force vulnerability in the default passwordless email magic-link authentication. The code is generated using Math.random() and has only 900,000 possible combinations, with no attempt limits or lockouts, allowing account takeover. An attacker knowing the victim's email address can gain full access without victim interaction.

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. The skill_upload function does not canonicalize the path or check that it remains under the upload root, allowing writes outside it. The endpoint is reachable without authentication, enabling a remote attacker to write arbitrary files and achieve code execution.

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in ANGLE in Google Chrome on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)