CVE Vulnerability Catalog

The Gallery for Google Photos WordPress plugin before version 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account. This exposes persistent access and refresh tokens to unauthenticated users, allowing long-term compromise of the linked account.

The SMS Alert WordPress plugin before version 3.9.8 does not bind its 'mobile verified' session flag to the phone number that was actually verified. After an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.

The Five Star Restaurant Reservations WordPress plugin before version 2.7.23 does not perform a capability check on one of its AJAX actions. This allows users with the lowest booking-management role (which by default cannot access the plugin's settings) to reset the site's configured booking notification rules.

The description of CVE-2026-14920 contains only the word '## Summary', which prevents detailed analysis. Based on available information, the nature of the vulnerability cannot be determined.

The Lenxel WP WordPress theme through version 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce. This allows unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.3.15 via the 'uamgetfile' parameter. Unauthenticated attackers can read the contents of arbitrary files on the server, which can contain sensitive information. This occurs because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.1.30 via the 'cubewp_get_svg_content' function. Unauthenticated attackers can read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.

Improper Verification of Cryptographic Signature in guardian (versions from 1.0.0 before 2.4.1) allows an unauthenticated attacker to revoke a victim's session with a forged JWT token.

A vulnerability in the Guardian library (Guardian.Permissions module) allows a denial of service attack via BEAM atom-table exhaustion. The encode_permissions!/1 function converts map keys to atoms without validation, and atoms are never garbage collected, exhausting the fixed-size atom table.

A vulnerability in the Guardian library (Elixir) allows DoS via unbounded atom creation from attacker-controlled binary input. The encode/3 function in Guardian.Permissions.AtomEncoding calls String.to_atom/1 without validation, exhausting the BEAM atom table and crashing the node.

Allocation of Resources Without Limits or Throttling in guardian (versions from 0.1.0 before 2.4.1) allows denial of service via unbounded atom creation from attacker-influenced binary input.

A stored XSS vulnerability in luci-app-https-dns-proxy allows authenticated users to inject active HTML via the resolver_url parameter. When an administrator views the HTTPS DNS Proxy status page, the resolver URL is rendered as raw HTML and executes JavaScript in the administrator's browser origin.

ArcadeDB before version 26.7.2 fails to properly redact the cluster token in the GET /api/v1/server endpoint, allowing authenticated users to retrieve the arcadedb.ha.clusterToken value in cleartext. Attackers can use the leaked token with X-ArcadeDB-Cluster-Token and X-ArcadeDB-Forwarded-User headers to impersonate root and execute administrative actions including user creation, database operations, and server shutdown.

ArcadeDB before version 26.7.2 (arcadedb-engine) allows trigger scripts to look up host classes in java.lang.* (via Java.type) because ScriptTriggerExecutor adds java.lang.* to the allowed packages. An authenticated user with UPDATE_SCHEMA permission can create a JavaScript trigger that invokes java.lang.Runtime.getRuntime().exec() (or ProcessBuilder), achieving OS command execution when the trigger fires.

better-auth before version 1.6.11 contains insecure cryptographic defaults in the oidcProvider and mcp plugins that advertise the none algorithm and accept plain PKCE by default. Attackers can exploit algorithm negotiation to accept unsigned tokens or intercept authorization codes when PKCE plain is used instead of the required S256 method.

better-auth before version 1.6.13 (and pre-release builds 1.7.0-beta.0 through 1.7.0-beta.3) fail to validate the scheme of redirect_uris registered via the deprecated oidc-provider plugin and the mcp plugin. An attacker can register an OAuth client with a javascript: redirect_uri, which the authorization server later returns unchanged in the consent response. If the deployment's consent page navigates the browser to the returned redirectURI, the attacker's JavaScript executes in the authorization-server origin, exposing the victim's session and enabling account takeover.

better-auth SCIM versions from 1.5.0 before 1.7.0-beta.4 fail to bind non-organization SCIM providers to their creator by default, allowing authenticated users to manage other users' providers. Attackers can regenerate SCIM bearer tokens, invalidate legitimate tokens, and authenticate to SCIM API routes with the attacker-controlled token.

@better-auth/stripe versions >= 1.4.11 and < 1.6.21, and >= 1.7.0-beta.0 and < 1.7.0-beta.10, contain an authorization bypass in organization subscription actions. The middleware validates the organization ID taken from the request query string against the authorizeReference callback, but the handler reads the organization ID only from the request body and falls back to the caller's active organization from their session. When these differ, an authenticated member of multiple organizations can perform subscription actions against an organization they belong to but should not manage, and can access another organization's billing details including payment methods, invoices, and subscription state.

@better-auth/sso versions before 1.6.21 contain multiple authentication bypass vulnerabilities in SSO provider handling that allow attackers to sign in as arbitrary users. Attackers can exploit domain verification parsing mismatches, orphaned provider accounts, unbound SAML assertions, or reflected XSS on logout endpoints to gain unauthorized session access and account takeover.