CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others versions up to 3.36.

Editor PHP Object Injection in Page Builder by SiteOrigin versions up to 2.36.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS. This issue affects CURCY: 2.2.18.

Tugtainer prior to version 1.31.3 has a vulnerability where the OIDC login flow decodes the id_token without verifying signature, audience, issuer, and expiry. Extracted claims are used directly as the user_id for the session.

MineAdmin prior to version 3.2.0-alpha.2 has a vulnerability in the app-store plugin service where unsanitized identifiers are concatenated into file paths. An attacker can use path traversal sequences to read, install, or uninstall plugins from arbitrary directories, and potentially execute arbitrary composer commands.

Taskcluster prior to version 100.3.0 is vulnerable to unauthenticated RCE on deployments with an anonymous role that exposes the GraphQL endpoint and parses filter arguments using the sift library.

Reachy Mini ISO for Wireless prior to version 0.2.4 ships with an overly broad sudoers entry granting the pollen daemon user passwordless sudo access to /usr/bin/systemctl with no restrictions. This allows local privilege escalation to full root.

yii2-starter-kit through 4.2.0 fails to validate file types in backend storage upload actions, allowing authenticated managers to upload PHP files. Attackers with manager role can upload PHP scripts to the web-accessible storage directory and execute arbitrary code on the server.

Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escaped for the wrong shell type. Attackers can inject OS commands by passing untrusted arguments with the shell option, allowing arbitrary command execution with Deno process privileges.

restbed through 5.0.0 accepts WebSocket frames with declared payload lengths up to 2^63 bytes and buffers the payload without size limits in an unbounded stream buffer. Remote unauthenticated attackers can declare large frame sizes and stream payload data to exhaust server memory, causing denial of service through process crash.

restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit. A remote unauthenticated attacker can open a TCP connection and stream bytes indefinitely without sending the header delimiter, forcing the server to allocate unbounded heap memory until the process is killed.

Authorization bypass through a user-controlled key vulnerability in The Wikimedia Foundation MediaWiki WikiLambda extension allows authentication bypass. This issue affects MediaWiki WikiLambda extension version 1.46.

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields versions <= 3.3.8.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder versions <= 3.6.5.4.

Contributor PHP Object Injection in Photo Gallery by 10Web versions <= 1.8.46.

Subscriber Cross Site Scripting (XSS) in Branda versions <= 3.4.32.

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid versions <= 1.27.14.

CloudTAK versions prior to 13.10.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the ESRI route family (api/routes/esri.ts). These routes accept an attacker-controlled URL and fetch it without any validation against private, loopback, or link-local ranges. Any authenticated user can force the CloudTAK server to make requests to internal resources, and the responses are returned to the attacker.

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.