CVE Vulnerability Catalog

The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and unconditionally registers the SVG MIME type in the WordPress media library. This allows authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.

The ActiveTrail for WooCommerce WordPress plugin through 1.2.6 does not perform any authorization check before creating WooCommerce coupons. This allows unauthenticated attackers to create arbitrary coupons, including 100%-off and free-shipping coupons.

The Gateway for Vantiv on WC WordPress plugin through 1.0.1 does not verify the authenticity of the payment notification received on its hosted-payment return handler. This allows unauthenticated attackers to mark orders as paid without actually paying.

A vulnerability was found in LlamaChinese Llama-Chinese in the get_class_from_dynamic_module function of examples/chat_gradio_no_merge.py. Manipulating the base_model_name_or_path argument results in code injection, and the attack can be performed remotely. The exploit has been made public and could be used.

A vulnerability has been found in hankcs HanLP in the load_word2vec_as_vocab_tensor function of hanlp/utils/torch_util.py. Manipulating the vectors.vocab argument leads to deserialization, and the attack is possible remotely. The exploit has been disclosed to the public and may be used.

A flaw has been found in RVC-Project Retrieval-based-Voice-Conversion-WebUI in the change_info_ function of webui.py. Manipulating the ckpt_path argument can lead to code injection, and the attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in radareorg radare2 in the r_core_cmd_str_pipe function of libr/core/rtr_http.inc.c, related to the HTTP sandbox policy handler. Manipulation results in a protection mechanism failure, and remote exploitation is possible though highly complex. The issue is fixed in version 6.2.4 (commit 18fd12efa98a7d1977de7bdd379d8a848777b90f).

A vulnerability was detected in alexta69 MeTube in the DownloadQueue.__write_feed_metadata_sync function of app/ytdl.py, related to feed-metadata thumbnail fetching. Manipulation leads to server-side request forgery, and the attack may be launched remotely though it is highly complex. The issue is fixed in version 2026.09.29 (commit a3896604540223ecbb8258b41b1d745d62647d16).

A weakness was identified in unslothai unsloth in the FastSentenceTransformer._is_transformer_module_ref function of unsloth/models/sentence_transformer.py. Manipulating the Type argument causes externally-controlled input to select classes or code, and the attack may be initiated remotely. The issue is fixed in version 0.1.902-beta (commit de801746386a53a0cb26216e715a0af863b76ad9).

A flaw was found in Tencent ncnn in the ncnn::yuv420sp2rgb function (src/mat_pixel.cpp) within the Conversion API component. The manipulation results in an integer overflow. The exploit is publicly available and can be launched remotely.

A vulnerability was identified in Tencent ncnn in the matmul_transb function (src/layer/matmul.cpp) within the MatMul component. The manipulation leads to an out-of-bounds read. The exploit is publicly available and can be initiated remotely.

A vulnerability was detected in donetick in the CanDeleteHistory function (internal/chore/model/model.go) within the History Deletion Handler component. Manipulation of the AssignedTo argument results in improper authorization. The exploit is public and can be launched remotely.

A weakness was identified in calcom cal.com and cal.diy in the createWebhookProcedure function (packages/trpc/server/routers/viewer/webhook/util.ts) within the Webhook Handler component. Manipulation of the ID argument can lead to an authorization bypass. The attack can be launched remotely; the fixing pull request awaits acceptance.

A vulnerability was determined in diem-project diem in an unknown part of dmCorePlugin/plugins/dmUserPlugin/modules/dmUser/lib/BasedmUserActions.class.php within the Sign-In component. Manipulation of the Referer argument causes an open redirect. The exploit is publicly disclosed and can be carried out remotely.

A vulnerability was detected in Artifex MuPDF in the free_char_list function (source/pdf/pdf-xref.c) within the Signature Locking component. The manipulation results in a double free. The exploit is public and can be initiated remotely; a patch named 3984925b660afb8a781ddf504021e91be1bc671e is available.

A security vulnerability was detected in aircheng-org iWebShop-5 in the send_message_mobile function (controllers/simple.php). Manipulation of the user_id argument leads to weak password recovery. The exploit is publicly disclosed and can be launched remotely.

A weakness was identified in aircheng-org iWebShop-5 in the IController::redirect function (plugins/_userInfo/_userInfo.php) within the Login Redirect component. Manipulation of the callback argument causes an open redirect. The exploit is publicly available and can be initiated remotely.

A security flaw was discovered in aircheng-org iWebShop-5 in the admin_repwd/admin_repwd_act function (controllers/system.php) within the Password Change component. Manipulation of the password/repassword arguments results in cross-site request forgery. The exploit is publicly released and can be launched remotely.

A vulnerability was identified in aircheng-org iWebShop-5 in the Util::search function (classes/util.php). The manipulation leads to SQL injection. The exploit is publicly available and can be initiated remotely.

A vulnerability was found in diem-project diem up to 5.1.3 affecting the file dmCorePlugin/lib/data/dmDataLoad.php. Manipulation leads to use of default password, and the attack can be carried out remotely. The exploit has been made public and could be used.