CVE Vulnerability Catalog

Pocket ID, as an OIDC provider, prior to version 2.6.0, did not re-validate the user's current authorization state when issuing new tokens. The createTokenFromRefreshToken function allowed indefinite token refreshing after authorization revocation.

YetAnotherForum.NET (YAF.NET) prior to versions 4.0.5 and 3.2.12 has a vulnerability that allows for the injection of unsafe HTML code by users in posts and replies. This content is stored server-side and rendered back into the thread page without adequate HTML sanitization.

In YetAnotherForum.NET prior to versions 4.0.5 and 3.2.12, there is a vulnerability related to improper handling of the User-Agent header. The application logs this header in the event log and then interpolates it directly into HTML without proper encoding, which may lead to XSS attacks.

In YetAnotherForum.NET (YAF.NET) prior to version 4.0.5, there is a vulnerability that allows arbitrary SQL execution by low-privileged users. The issue is related to the OnPost… handler in the admin panel, where there are insufficient checks for SQL queries.

Open-WebSearch prior to version 2.1.7 has a vulnerability that does not recognize bracketed IPv6 literals and does not resolve DNS, allowing non-blind SSRF with the response body returned to the caller.

An SQL injection vulnerability in the Elixir.Postgrex.Notifications module of the postgrex library for Elixir. The channel argument passed to listen/3 and unlisten/3 is interpolated directly into LISTEN/UNLISTEN SQL statements without escaping the double-quote character. An attacker who can influence the channel name can inject arbitrary SQL commands, including DDL and DML, using the PostgreSQL simple query protocol. This affects versions from 0.16.0 before 0.22.2.

A use-after-free vulnerability was found in the JavaScript: WebAssembly component of Firefox. This flaw was fixed in Firefox 150.0.3.

A JIT miscompilation vulnerability exists in the JavaScript Engine of Firefox, which could lead to unexpected behavior. This issue was fixed in Firefox 150.0.3.

CVE-2026-6865 is a vulnerability related to improper limitation of a pathname to a restricted directory, which may lead to unauthorized access to sensitive files. The issue arises when user-supplied input is improperly handled during server-side file path processing.

The PAM session module pam_authnft, which binds nftables firewall rules to authenticated sessions, had a vulnerability related to heap buffer over-reads in versions prior to 0.2.0-alpha. This allowed a crafted NETLINK_SOCK_DIAG reply to bypass the message-size check, leading to dereferencing past the end of the allocation.

Dell PowerScale InsightIQ versions 6.0.0 through 6.2.0 contains an OS Command Injection vulnerability due to improper neutralization of special elements. A high privileged attacker with local access could exploit this vulnerability to execute commands.

A vulnerability in the safe filter causes all subsequent pipelines on the same string to be incorrectly treated as safe after variable expansion, allowing unsafe data to be unescaped. This can enable SQL or LDAP injection attacks, especially in authentication contexts.

Siemens Simcenter Femap contains a memory corruption vulnerability while parsing specially crafted IPT files. This could allow an attacker to execute code in the context of the current process.

A vulnerability exists due to insufficient entropy that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session-management protections.

CVE-2026-45218 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the WP Travel plugin. This issue affects WP Travel versions from n/a to 11.4.0.

The Xpro Elementor Addons plugin has an SQL Injection vulnerability that allows for Blind SQL Injection attacks. This issue affects versions from n/a through 1.5.1.

CVE-2026-45213 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the RealMag777 BEAR woo-bulk-editor. This issue affects BEAR versions from n/a through 1.1.7.1 inclusive.

CVE-2026-45211 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection attacks in the APIExperts Square for WooCommerce plugin in versions up to 4.7.1.

CVE-2026-42742 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Aman Views plugin for WPForms. This issue affects Views for WPForms from n/a through 3.4.6.

CVE-2026-42741 describes an improper neutralization of special elements used in SQL commands, leading to a Blind SQL Injection vulnerability in the Ninja Forms Views plugin. This issue affects versions from n/a to 3.3.2.