CVE Vulnerability Catalog

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer overflow. The attack may be launched remotely. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1 affecting the function processFrameContinuousAndNonFin in Draft_6455.java of the Fragmentation Handler component. The manipulation can lead to resource allocation. The attack may be performed remotely and the exploit is publicly available.

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment.

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post identified in a request to their playlist entry removal, allowing unauthenticated attackers to destroy arbitrary posts, pages and media attachments, bypassing the trash.

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting arbitrary files on the server, overwriting the payment gateway configuration and recovering stored wallet credentials in cleartext.

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every front-end page.

This CVE ID has been rejected and should not be used. Reason: the candidate was withdrawn by its CNA, and further investigation showed that it was not a security issue.

TinyEXIF before 1.1.0 has a heap-based buffer over-read in EntryParser::Fetch methods reachable via a crafted SubjectArea length. This can lead to reading beyond the bounds of a heap buffer.

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLL(None) loads the C library without relying in any import statements. In other words, a within-process sandbox cannot merely account for the import system and instead must account for the complete runtime of the Python interpreter.

A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. The vulnerability allows injection of malicious SQL code.

Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables.

A security flaw has been discovered in kagisearch smallweb up to commit 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf affecting the function index in app/sw.py of the Query String Rendering component. Manipulation of the qs argument results in cross site scripting. The attack can be carried out remotely and the patch is named 00b68144e583f20a6b67e29cf01bc07f57979ffb.

A vulnerability was identified in evanchiu serverless-todo 1.0.3/2.0.0 affecting the function saveTodos in src/index.js of the API Todo Endpoint component. Manipulation of the event.body argument leads to resource consumption. The attack can be executed remotely and the exploit is publicly available.

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2 affecting the function MainController.autoUpdate in /adminPage/main/autoUpdate. Manipulation of the url argument causes code injection. Remote exploitation is possible and the exploit has been publicly disclosed.

A vulnerability was found in FlowiseAI Flowise up to 3.0.2 affecting the function axios.post in packages/server/src/controllers/evaluations/index.ts of the Evaluations Endpoint component. Manipulation of the Host/X-Forwarded-Proto argument results in server-side request forgery. The attack may be launched remotely and the exploit is public. Upgrading to version 3.1.3 (patch 700137738bcaebefd4709021f6d6b0abcd7df0ac) resolves the issue.

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. The lack of logging makes it difficult to detect unauthorized changes.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. This may lead to incorrect function behavior.