CVE Vulnerability Catalog

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in mtrudel bandit allows unauthenticated remote denial of service via worker process exhaustion. 'Elixir.Bandit.HTTP1.Socket':do_read_chunked_data!/5 terminates only when the last-chunk line is followed immediately by the empty trailer line, but RFC 9112 permits trailer fields between them. When trailers are present, the worker process is pinned for the lifetime of the TCP connection, and a handful of concurrent connections can exhaust the Bandit worker pool. This issue affects bandit from 1.6.1 before 1.11.1.

Allocation of Resources Without Limits or Throttling vulnerability in mtrudel bandit allows unauthenticated remote denial of service via memory exhaustion. The chunked clause of 'Elixir.Bandit.HTTP1.Socket':read_data/2 ignores the caller-supplied :length option when reading HTTP/1 chunked request bodies, buffering every received chunk unconditionally and materializing the entire body as a single binary. A single Transfer-Encoding: chunked POST request with an arbitrarily large body to any path causes the BEAM process to exhaust available memory and be terminated by the OS OOM killer. This issue affects bandit from 1.4.0 before 1.11.1.

An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms allows attackers to execute arbitrary code via uploading a crafted file.

The Custom Twitter Feeds plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 2.5.4. The issue is due to insufficient output escaping in the CTF_Display_Elements::get_post_text() function, allowing unauthenticated users to execute malicious HTML/JavaScript.

The RTMKit Addons for Elementor plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 2.0.2 via the 'path' parameter of the 'get_content' AJAX action. This allows authenticated attackers with Author-level access and above to include and execute arbitrary PHP files on the server.

ELECOM wireless LAN access point devices contain an OS command injection vulnerability in processing of ping_ip_addr parameter. If processing a crafted request sent by a logged-in user, an arbitrary OS command may be executed.

In libcurl, when a custom `Host:` header is first set for an HTTP request and a second request is subsequently made using the same *easy handle* without the custom `Host:` header set, the second request uses stale information and passes on cookies meant for the first host.

libcurl might in some circumstances reuse the wrong connection for SMB(S) transfers. Due to a logical error in the code, a network transfer operation could wrongfully reuse an existing SMB connection to the same server that was using a different share than the new transfer should. This could lead to downloading the wrong file or uploading a file to the wrong place, using the same credentials and server name.

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to and including 3.15.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The new privileged D-Bus helper, plasmaloginauthhelper, has multiple issues, including the ability for a compromised plasmalogin service account to chown() arbitrary files in the system.

CVE-2024-47091 is a privilege escalation vulnerability in the mk_mysql agent plugin on Windows in Checkmk versions <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL). It allows a local unprivileged user to create a Windows service named 'MySQL' or 'MariaDB', enabling arbitrary code execution in the context of the Checkmk agent service, which typically runs as SYSTEM.

A vulnerability has been identified in Rancher's Extensions that allows malicious code injection through a path traversal in the `compressedEndpoint` field inside a `UIPlugin` deployment. A malicious UI extension could exploit this to overwrite Rancher binaries or configuration.

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in all versions up to and including 5.7.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The Bytello Share (Windows Edition) installer insecurely loads Dynamic Link Libraries. If a crafted malicious DLL is present in the same directory as the installer, arbitrary code may be executed with the privileges of the user invoking the installer.

Improper export of android application components in OmaCP prior to SMR May-2026 Release 1 allows local attackers to trigger privileged functions.

Improper input validation in FacAtFunction in Galaxy Watch prior to SMR May-2026 Release 1 allows local attacker to execute arbitrary code with system privilege.

The coreActivity: Activity Logging plugin for WordPress is vulnerable to PHP Object Injection in all versions up to and including 3.0. This is due to the plugin failing to validate or strip PHP serialization syntax from the User-Agent HTTP header before storing it in the logmeta table.

CVE-2026-8336 allows an authenticated user to crash the mongod server by improperly using server-side JavaScript functions. The issue affects MongoDB Server v8.2 versions prior to 8.2.9 and v8.3 versions prior to 8.3.2.

An issue in MongoDB Server's time-series collection implementation allows an authenticated user with database write privileges to trigger an out-of-bounds memory write in the mongod process. The issue results from an inconsistency in the internal field-name-to-index mapping within the time-series bucket catalog.

Exploitation of the SQL injection vulnerability could allow a remote authenticated attacker to execute arbitrary commands via a specific interface, potentially enabling access, modification, or deletion of sensitive information within the database.