CVE Vulnerability Catalog

The Eventin WordPress plugin before version 4.1.20 does not perform an authorization check on its waiting-list registration handler, allowing unauthenticated users to create WordPress user accounts for arbitrary email addresses and inject order records.

Velociraptor allows scheduling new collections via VQL queries in notebooks. The COLLECT_CLIENT permission is required, but it is not enforced when the user can run a VQL query that resets the authorization provider. A user with the analyst role can launch new collections, which usually require the investigator role, leading to privilege escalation.

The userspace syscall verifiers z_vrfy_zsock_sendmsg() and z_vrfy_zsock_recvmsg() in subsys/net/lib/sockets/sockets.c snapshot the caller-supplied struct net_msghdr into a kernel-side copy, but then re-read the still-live user struct for subsequent decisions. A double-fetch/TOCTOU allows a cooperating thread to inflate msg->msg_iovlen, leading to out-of-bounds writes in the kernel heap. This can result in local privilege escalation or kernel denial of service.

The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authentication Bypass via Unverified Provider Email in all versions up to and including 1.4.3. The plugin trusts the unverified email field from Spotify's /v1/me endpoint, allowing unauthenticated attackers to log in as any existing WordPress user, including administrators, and gain full administrative access.

A flaw was found in the multicloud-operators-channel component of Red Hat Advanced Cluster Management (RHACM). This vulnerability allows a compromised agent from a managed cluster to gain unauthorized access to sensitive information, reading all Secrets and ConfigMaps within any Channel namespace on the hub, potentially exposing credentials for other tenants' Git and Helm repositories.

A flaw was found in multicloud-operators-subscription. A privileged user (namespace administrator) can manipulate the Channel.Spec.SecretRef.Namespace field, causing the system to copy sensitive Secret contents from other namespaces into their own, leading to information disclosure.

In UEFI firmware, lack of verified boot for certain firmware volumes (FV) may allow arbitrary code execution.

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the CRIU control stack checkpoint copy is not bounded to the allocated BO size. The copy uses the hardware value cp_hqd_cntl_stack_size, which may be larger than the allocated region, leading to out-of-bounds read and kernel data leak to userspace. The fix clamps the copy size to the buffer size.

In the Linux kernel, the drm/vmwgfx driver has a vulnerability due to lack of validation of the array_size field in the vmw_surface_metadata structure. This field comes from userspace and should be validated against specific limits depending on the available Shader Model.

In the Linux kernel's drm/vc4 driver, vc4_gem_object_mmap() rejects writable mappings of validated shader BOs but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then make it writable with mprotect().

In the Linux kernel's btrfs filesystem, when splitting extent maps, the new maps inherit the EXTENT_FLAG_LOGGING flag, which is never cleared. This can lead to a WARN_ON and use-after-free when the map is freed.

In the Linux kernel's txgbe network driver, txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which is allocated with exactly 'length' bytes. A non-4-aligned length causes an out-of-bounds write (heap overflow).

In the Linux kernel's libceph library, there is a bug in handle_get_version_reply() which uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. Since this is the buffer size, not the actual received bytes, a truncated reply can cause an uninitialized memory read from stale tail bytes.

In the Linux kernel's VXLAN driver, there is a missing CAP_NET_ADMIN requirement in the device network namespace during changelink operations. A caller privileged in the device namespace but not in the underlay namespace can modify VXLAN tunnel configuration, potentially leading to unauthorized changes.

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

Kestra before version 2.0.0 passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Kestra before version 2.0.0-rc6 serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.