CVE Vulnerability Catalog

In ZAC prior to version 5.2.0, by-id read endpoints in ZaakRestService.kt omit assertPolicy authorization. An authenticated low-privileged municipal user who knows a case or decision UUID can read decisions, audit history, and BPMN workflow state across unauthorized case types. The advisory also identifies the afzender endpoint as exposing mailbox configuration without a policy check.

In SecureDrop from version 2.5.0 until 2.16.0, the Journalist Interface can accept an API session token against the web UI because its SessionInterface keeps a mutable session key prefix that changes with each request. An attacker who already has access to the Journalist Interface onion address, the required authentication, and a recent nonexpired API session token can reuse that token against the web UI until its natural expiry (at most eight hours).

In Frappe Learning Management System (LMS) prior to version 2.52.0, an authenticated user with a course editing role can inject malicious JavaScript through meta tag fields in the Course Management module. The values are stored without adequate HTML sanitization and are not safely escaped when rendered, allowing stored cross-site scripting.

A Cross Site Scripting (XSS) vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality and chat messaging component. The provided description lacks details on the attack vector.

The APIExperts Square for WooCommerce (woosquare) plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. The issue affects versions from n/a through 4.7.5. This may allow an attacker to force an authenticated user to perform unwanted actions.

The Events Calendar (the-events-calendar) plugin contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 6.18.2. This may enable unauthorized access to features or data.

The Media Player Addons for Elementor (media-player-addons-for-elementor) plugin contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 1.1.10. This may allow stored XSS.

Wekan, an open source kanban built with Meteor, prior to 11.11 passes authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. In MongoDB-backed deployments the resulting patterns are evaluated with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users. The searchUsers method additionally requires board membership or site-admin status.

gopacket, a Go packet processing library, prior to 1.7.2 passes attacker-controlled declared lengths and counts in layers/sctp.go to the SCTP sub-decoders (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, decodeSCTPParameter) without checking that each chunk contains the required fields. A crafted SCTP segment can cause out-of-bounds or inverted slice panics. The panic can terminate applications using SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic; default recovery-enabled APIs convert it to a per-packet decode error.

croc, a tool for securely transferring files and folders between computers, prior to 11.5.2 treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact in the receive-side file-readiness loop (src/croc/croc.go), even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite, truncate, or replace a matching file without confirmation.

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.

The Fluent CRM WordPress plugin through version 3.2.6 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured access controls.

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks, causing heap over-reads that lead to crashes or heap memory disclosure.

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that triggers the out-of-bounds read and crashes Blender when opened.

NocoDB before 2026.08.0 contains a clickjacking vulnerability because no X-Frame-Options or CSP frame-ancestors headers are sent, allowing any origin to frame the authenticated interface. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.

The My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows unauthenticated attackers to execute registered shortcodes via the mcs search parameter. The mcs value reaches mc_search_results() without bracket encoding before do_shortcode runs, so a GET request triggers shortcodes on any page or post, enabling content injection and spoofing.

PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that allows attackers to make the indexing service fetch internal addresses by embedding image URLs in documents. Attackers can supply Markdown or HTML via uploads, synced mailboxes, or web connectors to reach loopback, private-network, or cloud metadata endpoints, with image responses embedded into indexed content.

PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated attackers to evade per-IP throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can rotate header values to obtain fresh rate-limit buckets on authentication endpoints, enabling password spraying and OTP or password-reset email flooding.

Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata POST handler that passes user-supplied URLs to getMetadata() without authentication checks. Attackers can submit URLs targeting loopback, internal-network, or cloud metadata endpoints and read the parsed title, description, and page content returned.