CVE Vulnerability Catalog

An authentication bypass exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, associated FIDO registration data is not removed, so a new account with the same username may be linked to the previously registered FIDO device. This may allow a deleted user to authenticate and impersonate the new account.

The SureForms WordPress plugin before 1.9.1 does not sanitise and escape some parameters when outputing them in the page, which could allow admin and above users to perform Cross-Site Scripting attacks.

A security vulnerability has been detected in code-projects Simple Food Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /ordersimple/order.php. The manipulation of the argument ID leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

A vulnerability was found in axboe fio up to 3.41. This affects the function str_buffer_pattern_cb of the file options.c. Performing manipulation results in null pointer dereference. The attack must be initiated from a local position. The exploit has been made public and could be used.

Mailgen, a Node.js package for generating responsive HTML emails, before version 2.0.30 has an HTML injection vulnerability in plaintext emails generated by the Mailgen.generatePlaintext(email) method. Projects are affected if this method is used with user-generated content. The vulnerability has been patched in version 2.0.30.

In Smartstore up to version 6.2.0, an unknown function in /checkout/confirm/ of the Gift Voucher Handler component is affected by a race condition. The attack may be initiated remotely, but its complexity is rated as high and exploitability as difficult.

In Harness 3.3.0, the login endpoint /api/v1/login does not properly restrict excessive authentication attempts. The attack can be performed remotely, is of high complexity and difficult exploitability, and the exploit has been publicly disclosed.

A cross-site scripting (XSS) vulnerability was detected in htmly up to version 3.1.0 in the /htmly/admin/field/post file of the Custom Field Handler component. Manipulating the label argument leads to malicious script execution. The exploit has been publicly disclosed, and the vendor did not respond to the report.

Mattermost versions 10.5.x <= 10.5.8 and 9.11.x <= 9.11.17 fail to properly validate access controls, allowing any authenticated user to download sensitive files via the board file download endpoint using UUID enumeration.

PureVPN client applications on Linux through September 2025 mishandle firewalling: they flush existing iptables rules and apply default ACCEPT policies when connecting to a VPN server. This removes firewall rules configured manually or by other software (e.g., UFW, container engines, system security policies). Upon VPN disconnect, the original firewall state is not restored, potentially exposing the system to network traffic that was previously blocked. Affects CLI 2.0.1 and GUI 2.10.0.

PureVPN client applications on Linux through September 2025 allow IPv6 traffic to leak outside the VPN tunnel upon network events such as Wi-Fi reconnect or system resume. In the CLI client, the VPN auto-reconnects and claims to be connected, but IPv6 traffic is no longer routed or blocked; in the GUI client, IPv6 remains functional after disconnect until the user clicks Reconnect. The real IPv6 address is exposed to external services, violating privacy and defeating advertised IPv6 leak protection. Affects CLI 2.0.1 and GUI 2.10.0.

SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds.

A vulnerability has been found in youth-is-as-pale-as-poetry e-learning 1.0. The function encryptSecret in JwtUtils.java of the JWT Token Handler component leads to insufficiently random values. The attack can be initiated remotely but is difficult to exploit.

In Tor up to 0.4.7.16/0.4.8.17, the Onion Service Descriptor Handler causes resource consumption. The attack can be initiated remotely, is of high complexity and difficult exploitability; upgrading to 0.4.8.18 or 0.4.9.3-alpha is recommended.

A cross-site scripting vulnerability was identified in Portabilis i-Educar up to version 2.10, affecting the file /intranet/educar_funcao_cad.php (Editar Função Page component). Manipulation of the abreviatura/tipoacao arguments allows remote exploitation. The exploit has been publicly disclosed and could be used.

A vulnerability was identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educar_calendario_anotacao_cad.php. Such manipulation of the argument nm_anotacao/descricao leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

Element Web and Element Desktop before version 1.11.112 have insufficient validation of room predecessor links, allowing a remote attacker to attempt to impermanently replace a room's entry in the room list with an unrelated attacker-supplied room. While the effect is temporary, it may confuse users into acting on incorrect assumptions. The issue has been patched and users should upgrade to 1.11.112.

Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section.

An issue in Apple systems involving disclosure of sensitive information was addressed with improved redaction of sensitive information. The vulnerability was fixed in iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, and macOS Tahoe 26. An app may be able to fingerprint the user.

An out-of-bounds write issue exists in Apple systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) and was addressed with improved input validation. Processing a maliciously crafted video file may lead to unexpected app termination. The issue is fixed in iOS 18.7, iPadOS 18.7, iOS 26, iPadOS 26, macOS Sequoia 15.7, macOS Sonoma 14.8, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26.