CVE Vulnerability Catalog

libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.

libtta through 2.3 contains a stack out-of-bounds read and write vulnerability in tta_decoder_process_stream() and tta_decoder_process_frame() because header checks never reject a zero channel count. Attackers can supply a crafted .tta file declaring zero channels so decorrelation accesses cache[-1] with stream-derived values, corrupting stack memory in decoding applications.

libtta through 2.3 contains an integer overflow vulnerability in tta_decoder_init_get_info() that allows attackers to cause a heap buffer overflow on 32-bit builds via unvalidated header fields. Attackers can supply a crafted .tta file with a sample rate of 1 and large samples value, wrapping the seek table allocation and crashing applications.

smpeg through 2.0.0 contains an integer underflow vulnerability in stream_header() in MPEGsystem.cpp. By supplying a crafted MPEG file with an undersized packet length, packet_size can be wrapped, leading to a reachable assertion or out-of-bounds copy and application crash.

smpeg through 2.0.0 contains a heap out-of-bounds read vulnerability in MPEGsystem::FillBuffer(). A crafted system header stream table whose bytes all set the high bit can cause reads past the 16384-byte buffer, crashing applications that open it via SMPEG_new, SMPEG_new_rwops, or SMPEG_new_data.

libmng through 2.0.3 contains a heap-based buffer overflow vulnerability in mng_read_ordr(). ORDR entry buffers are sized by 5-byte on-wire records instead of 8-byte in-memory entries, allowing heap memory corruption via a crafted MNG file with MHDR, DHDR, and a multi-record ORDR chunk.

Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c. The one-byte sample count is not clamped to MAX_SAMPLES, allowing a crafted .ult module to overwrite the instruments pointer array and cause csf_destroy() to free attacker-chosen pointers, crashing the application.

OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation vulnerability that disables TLS verification when OTEL_EXPORTER_OTLP_CERTIFICATE variables are empty strings. Man-in-the-middle attackers can impersonate the collector to read or alter exported traces, metrics, and logs, including authentication headers from OTEL_EXPORTER_OTLP_HEADERS.

ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permission to treat tracked files as orphans. Attackers can submit ./ path aliases to the orphans import or delete endpoints, deleting or adopting other owners' files while bypassing delete_others_files.

ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update() that lets sessions of Social-provisioned accounts set local passwords without the current password. Attackers holding a stolen session cookie can send PUT /settings/password to create a durable local password, enroll their own second factor, and persistently take over the account.

A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It impacts read_metadata_from_safetensors in modules/sd_models.py of the Metadata Extraction component. Manipulating the header length field results in resource allocation, the attack can be launched remotely, and the exploit has been made public. The project was informed but has not responded yet.

A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. It affects create_item_html in modules/ui_extra_networks.py of the Card Builder component. Manipulating the filename argument leads to cross site scripting, the attack can be initiated remotely, and the exploit has been disclosed publicly. The project was informed but has not responded yet.

The HivePress plugin for WordPress (up to version 1.7.32) has a Code Injection vulnerability due to improper control of code generation. An attacker can inject and execute arbitrary code in the application context.

The 2Way VideoCalls and Random Chat plugin (up to version 6.1.5) contains an Authentication Bypass by Primary Weakness vulnerability, allowing Authentication Abuse. An attacker can gain access to functions restricted to logged-in users.

The Kit (formerly ConvertKit) plugin for WordPress (up to version 3.4.6) has a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. An attacker can perform operations they are not authorized to do.

The Advanced File Manager plugin for WordPress (up to version 5.4.14) has a Missing Authorization vulnerability, enabling exploitation of incorrectly configured access control security levels. An attacker can access file management functions without proper permissions.

The PickPlugins Product Designer for WooCommerce WordPress plugin through 1.0.40 does not perform any capability check and its nonce verification is inverted, accepting requests with an invalid or absent nonce while rejecting valid ones. It also does not validate the post the data is written to, allowing unauthenticated users to insert design template data into the metadata of any post on the site.

The Blood_Bank_Management_System version 1.0.0 has a Cross-Site Scripting vulnerability in the /abs.php file due to manipulation of the Search argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

The Books4Cash application (up to commit a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571) has a Cross-Site Scripting vulnerability in the search.php file due to manipulation of the Search argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

The AI Engine WordPress plugin before 3.7.9 does not verify that the user performing certain AI media management actions owns or is otherwise allowed to edit the targeted object. This allows users with the Editor role or above to modify, or change the type of, arbitrary posts on the site, including content they are not permitted to edit.