CVE Vulnerability Catalog

NVIDIA TRT-LLM for any platform contains a vulnerability in the MPI server that could allow an attacker to cause unsafe deserialization. A successful exploit might lead to code execution, denial of service, data tampering, and information disclosure.

The Read More & Accordion plugin for WordPress up to version 3.5.7 contains a privilege escalation vulnerability. The RadMoreAjax::importData function does not restrict which database tables can be written to during import and does not properly validate imported data. An authenticated attacker with appropriate permissions can insert arbitrary rows into the wp_users and wp_usermeta tables, including the wp_capabilities field, creating a new administrator account.

The Account Switcher plugin for WordPress versions up to and including 1.0.2 contains a privilege escalation vulnerability. This is due to the `rememberLogin` REST API endpoint using a loose comparison (`!=` instead of `!==`) for secret validation, combined with no validation that the secret is non-empty. When a target user has never used the "Remember me" feature, their `asSecret` user meta does not exist, causing `get_user_meta()` to return an empty string. An attacker can send an empty `secret` parameter, which passes the comparison (`'' != ''` is `false`), and the endpoint then calls `wp_set_auth_cookie()` for the target user. Additionally, all REST routes use `permission_callback => '__return_true'` with no capability checks. This makes it possible for authenticated attackers with Subscriber-level access and above to switch to any user account including Administrator, ultimately granting themselves full administrative privileges.

Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checked for overflow. A malicious sender can trigger an overflow that causes the receiver process to read and return data from outside the intended buffer bounds. Attackers can disclose process memory contents including environment variables, passwords, heap and stack data, and library memory pointers, significantly reducing ASLR effectiveness.

The Creative Mail – Easier WordPress & WooCommerce Email Marketing plugin for WordPress versions up to 1.6.9 contains an SQL injection vulnerability via the 'checkout_uuid' parameter. This is due to insufficient escaping and lack of proper query preparation in the has_checkout_consent() method.

MantisBT versions up to 2.28.1 contain a stored XSS vulnerability. When cloning an issue from another project, the source project name is displayed without proper escaping, allowing an attacker with manager or administrator privileges to inject HTML.

CtrlPanel 1.1.1 and prior contains a broken access control vulnerability where admin controllers enforce permission checks on form display methods but omit them on corresponding write methods (store/update), allowing any authenticated user to bypass RBAC via direct POST/PATCH requests.

Stored XSS vulnerability in CtrlPanel billing software (versions 1.1.1 and earlier) exists in ticket reply notifications. Unsanitized reply content is stored in the database and rendered unescaped via Blade's {!! !!} syntax, allowing arbitrary JavaScript execution in the victim's session context. Affects both admin and user notifications.

Innoshop 0.6.0 has an authorization vulnerability. After logging into the frontend, an attacker can directly access backend application interfaces, leading to further dangerous operations.

In libheif versions up to 1.21.2, a heap buffer over-read exists in HeifPixelImage::overlay(). When compositing an overlay image whose child image has a different bit depth for the alpha channel than for the color channels, the function indexes into the alpha plane using the color channel stride instead of the alpha stride, causing reads past the end of the alpha buffer.

libheif versions 1.21.2 and below have a heap buffer overflow in MaskImageCodec::decode_mask_image(). When decoding a HEIF file with a mask image, the copy length is attacker-controlled and may exceed the destination buffer size.

libheif is a library for decoding and encoding HEIF and AVIF formats. Versions 1.21.2 and prior contain a heap-buffer-overflow (write) vulnerability in grid tile compositing. An attacker can supply a HEIF/AVIF file with a 1×4 grid of odd-height tiles, causing a write of 64 attacker-controlled bytes past the end of allocated memory.

JWT tokens that were used by workers in Kubernetes Executors have been exposed to users who had read only access to Kubernetes Pods. This could allow users with just read-only access to perform actions that were only available to running tasks via Task SDK and potentially allow to modify state of Airflow Database for tasks.

Execution with unnecessary privileges vulnerability in Broadcom Automic Automation Agent Unix on Linux x64, Linux Power 64 BE, Linux Power 64 LE, zLinux (zSeries), AIX, Solaris x64, Solaris Sparc 64 allows Privilege Escalation and Target Programs with Elevated Privileges. This issue affects Automic Automation versions prior to 24.4.4 HF1.

The Kirki plugin for WordPress up to version 6.0.6 is vulnerable to arbitrary file deletion due to insufficient file path validation and missing capability check in the 'downloadZIP' function. Unauthenticated attackers can read and delete arbitrary files in the WordPress uploads directory.

A CSRF vulnerability in ScadaBR version 1.2.0 allows an attacker to lure a logged-in user to a malicious webpage, triggering any authenticated action in the victim's session.

A Java deserialization vulnerability in Jaspersoft Reports Library leads to Remote Code Execution (RCE). An attacker can supply crafted data that, upon deserialization, executes arbitrary code on the target system.

Windmill prior to version 1.703.2 has an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions. This allows authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes.

Kitty terminal versions 0.46.2 and below have a heap buffer overflow in load_image_data(). Any process that can write to the terminal's stdin can send a crafted APC command with a PNG declaration exceeding twice the initial buffer capacity, causing an immediate crash and potentially remote code execution.

Terrascan v1.18.3 and prior are vulnerable to SSRF via external URL resolution in uploaded IaC templates when running in server mode. An unauthenticated attacker can upload a template with a field pointing to a controlled URL, causing server-side fetch. Local file read via file:// scheme is also possible.