CVE Vulnerability Catalog

The fast-uri library before versions 4.1.2, 3.1.5, and 2.4.4 incorrectly parses URIs when a backslash is used instead of a double forward slash. Node.js treats backslash as interchangeable with forward slash, leading to differences in host parsing. Applications using fast-uri for host-based policy enforcement can be steered to an unintended host.

In the Zephyr Bluetooth GATT client, in the gatt_write_ccc_rsp() function, a use-after-free vulnerability exists. Upon receiving an ATT Error Response from a GATT server, the function calls the notify(NULL) callback signaling subscription termination, then calls the subscribe() callback on the already freed structure, leading to use-after-free.

In gnome-remote-desktop as shipped in Red Hat Enterprise Linux, when the daemon runs in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler. This allows an unauthenticated remote attacker to open many parallel pre-authentication connections, exhausting resources and preventing legitimate users from establishing RDP sessions.

A SQL injection vulnerability has been identified in PHP Jabbers - PHP Poll Script in the pjAdminPolls.controller.php endpoint. An authenticated attacker can manipulate input data, leading to unauthorized SQL queries. This issue was fixed in version 4.1.

An authenticated SQL injection vulnerability has been identified in multiple PHP Jabbers scripts. An authenticated user can manipulate parameters responsible for sorting functions, leading to unauthorized SQL queries. This issue was fixed in the versions specified in the affected products list.

The security fix for CVE-2025-66518 in Apache Kyuubi is incomplete. Any client with access to the Kyuubi server via frontend protocols can bypass the server-side config kyuubi.session.local.dir.allowlist using unprefixed Spark config aliases. This affects versions from 1.6.0 before 1.12.0.

Some Hikvision networking products are vulnerable to authenticated command execution due to insufficient input validation. Attackers with valid credentials can send crafted packets containing malicious commands, leading to arbitrary command execution.

A stack buffer overflow flaw was found in 389 Directory Server (389-ds-base) in the get_ruvelement_from_berval() function. A remote unauthenticated attacker can send a crafted StartNSDS50ReplicationRequest with a replica ID field containing more than 16 digit characters, causing a crash of the LDAP server.

A flaw was found in 389 Directory Server where an unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV operation. Because the query runs with elevated privileges, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information.

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS) where processing Kubernetes Deployments replaces identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name, labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment.

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration, exposes its data and configuration endpoint without any authentication and permissive CORS. An unauthenticated attacker with network access can read live process values and server configuration.

ANDRITZ HIPASE-250 stores and transmits user passwords in a reversible format instead of a one-way hash. This allows an attacker to recover all stored passwords by reading the credential store or capturing network traffic.

The Realtyna Organic IDX plugin for WordPress up to version 5.3.0 is vulnerable to arbitrary file upload due to missing file validation and insufficient authorization. Authenticated attackers with subscriber-level access can upload arbitrary files, potentially leading to remote code execution.

The Product Feed Manager For WooCommerce WordPress plugin before version 7.6.1 does not properly sanitize and escape product-feed custom filter rules before using them in a SQL query, allowing users with the Contributor role and above to perform SQL injection attacks.

The Geeky Bot WordPress plugin before version 1.2.8 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to retrieve chat-history session metadata including WordPress usernames, user IDs, and timestamps.

The JS Help Desk WordPress plugin before version 3.1.4 lacks authorization and ownership checks in file upload requests. Unauthenticated users can upload files (with allowed extensions) and attach them to any user's support tickets.

The FlxWoo WordPress plugin before version 3.1.1 does not verify with the payment processor that a checkout session was actually paid before marking the associated order as paid. This allows unauthenticated attackers to complete WooCommerce orders without paying.

The Demi WordPress plugin before version 0.0.7 stores its full-site backup archives in a publicly accessible location under a predictable filename and without access protection. This allows unauthenticated attackers to download complete backups including the site database and its user password hashes.

The GiveWP WordPress plugin before version 4.16.3 does not properly restrict access to a REST API endpoint that returns recurring-donation records. This allows unauthenticated users to retrieve information about anonymous recurring donors, including their name and subscription details.