CVE Vulnerability Catalog

The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 continues after MD5File() or SHA256_File() failure and compares an expected checksum with stale data in the hash buffer instead of a newly computed digest. An attacker able to influence an installed file or hashing failure conditions can obtain a misleading integrity result or hide a checksum failure. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 in the audit command computes adjusted local_argv and local_argc values but passes the original argument entry to audit_package(). When an operator uses an option such as -r before a package name, stale optind state can cause auditing of the option token instead of the requested package, yielding a false-negative result. The issue is fixed in version 2.7.8.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.

MariaDB Connector/J in versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 does not enforce allowLocalInfile=false when processing a LOCAL INFILE packet. A rogue or man-in-the-middle server can cause the connector to transmit a file selected by the application despite the disabled option. The issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler, allowing a malicious or compromised Mattermost server (or a user with script access to a connected server view) to disconnect an active call belonging to a different connected server via the desktopAPI.leaveCall IPC message. Advisory ID: MMSA-2026-00699.

Dell SmartFabric Manager versions prior to 2.2.1 contain an improper handling of insufficient permissions or privileges vulnerability. A low-privileged attacker with remote access could exploit this vulnerability, leading to information disclosure.

vm2, a sandbox for running untrusted JavaScript, in versions up to and including 3.11.3 uses prototype-walking index assignment in defaultSandboxPrepareStackTrace, allowing sandbox code to intercept error stack lines. The impact is low (information side channel) and the issue is fixed in version 3.11.4.

Use of a one-way hash with a predictable salt in team-alembic AshAuthentication allows readers of the audit store to recover client IP addresses that the :hash privacy mode is supposed to pseudonymise. The hash_ip/1 function uses a single unkeyed SHA-256 hash with a salt that defaults to a constant published in the source code, allowing full precomputation of the hash table for the IPv4 address space. Truncation to 16 hex characters does not prevent recovery, and even a properly configured salt can be brute-forced once leaked.

A vulnerability in the AshAuthentication library (audit_log add-on) causes the full user record, including the hashed_password attribute, to be stored in the audit log when an audited action is invoked with an actor set. Marking the attribute as sensitive does not help because redaction only applies to inspect/1 output, not JSON encoding or raw-term storage. The issue affects versions from 4.12.0 before 4.15.0 and from 5.0.0-rc.0 before 5.0.0-rc.2.

An insufficient session expiration flaw in AshAuthentication allows an attacker who obtains a victim's OAuth2 state value to replay the callback and sign the victim into an attacker-controlled account. The session entry is never removed on failed authentication paths due to improper Elixir scoping, so the CSRF-protection value persists across cancelled or failed attempts until the next request or session expiry.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains Use of a Broken or Risky Cryptographic Algorithm vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure.

The NeuVector JWT verifier accepts noncanonical Base64URL encodings of the same RSA signature field. An attacker holding a valid JWT that has not expired, but was logged out of NeuVector, can continue using the non-expired token with equivalent spelling of the RSA signature field until the token validity expires.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The WebSocket handshake process does not properly require authentication before allowing connections to the service. Under certain circumstances, unauthorized access to service functionality may be possible.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. A WebSocket service was configured to listen on all network interfaces, which may expose the service to unintended network access.

A vulnerability has been identified in the Acer System Monitoring component included with NitroSense and PredatorSense. The vulnerability is caused by the use of a hard-coded AES encryption key within the software. Under certain circumstances, a local attacker may be able to use the embedded key to access protected information or perform unauthorized actions.

The Robokassa payment gateway for WooCommerce WordPress plugin before 1.8.9 does not verify the authenticity of incoming payment notifications when its non-default deferred-payment feature is enabled. This allows unauthenticated attackers to forge a notification and mark arbitrary WooCommerce orders as paid or on-hold without payment or a valid signature.

The Event Booking Manager for WooCommerce WordPress plugin before 5.3.8 does not perform an ownership or authorization check before rendering booking confirmation details. This allows unauthenticated attackers to retrieve registered attendees' personal information (full name, email address, phone number, and custom registration fields) by supplying an enumerable booking reference. Exploitation is limited to sites configured to use the plugin's native (non-WooCommerce) checkout, which is not the default.

The Comments Import & Export WordPress plugin before 2.5.4 does not restrict its comment export to users able to moderate comments, nor scope the export to content owned by the requesting user. This allows users with the Author role and above to retrieve every comment on the site, including commenter email addresses, IP addresses, unapproved comment content and comment meta.