CVE Vulnerability Catalog

The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.

The Wholesale for WooCommerce plugin for WordPress up to version 2.0.5 allows privilege escalation. The `save_requests_meta()` function only applies `sanitize_text_field()` to the `user_role_set` parameter before passing it to `WP_User::add_role()`, without validating allowed roles. Authenticated attackers with author access can escalate their privileges to administrator.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that forwards the `SslHandshakeCompletionEvent` before asynchronous OCSP validation completes. This allows the client to send sensitive data to a revoked server before the channel is closed.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that marks an outdated OCSP response as valid even if expired. This allows an attacker to replay a stale GOOD response to bypass certificate revocation.

In goshs before version 2.1.1, the bulkDownload handler for ZIP downloads did not check ACLs or custom authentication, allowing unauthenticated reads of files protected by .goshs folder ACLs and block lists. This is an incomplete fix for CVE-2026-40189.

In openhole 0.1.1 and earlier, the server forwarded r.URL.Path instead of the original request target, allowing percent-encoded dot segments and separators to perform path traversal in tunneled local services.

In gotd/td before version 0.145.1, the Decode function read attacker-controlled dataLen from an unauthenticated MTProto packet and allocated memory before checking the remaining buffer, allowing remote denial of service via excessive memory allocation and CPU or garbage collection pressure.

In find-my-way before version 9.7.0, the lookup() function passes req.method to find(), which indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor can resolve inherited properties, causing a crash when accessing currentNode.prefix.length.

In datamodel-code-generator from 0.11.6 to 0.64.0, attacker-controlled x-python-import or customTypePath schema extensions can reach the JSON Schema parser and generate imports that allow newline injection into import statements, executing Python code when the generated model is imported.

In datamodel-code-generator before version 0.63.0, URL host validation checks the host once but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_private_network=False and reach internal services.

In datamodel-code-generator from 0.59.0 to 0.62.0, XML Schema parsing resolves schemaLocation values in xs:include, xs:import, xs:redefine, and xs:override outside the input base path, allowing arbitrary local files to be read and reflected into generated models.

The datamodel-code-generator tool before version 0.62.0 improperly handles JSON Schema $ref references, allowing arbitrary local file reads. The vulnerability is in jsonschema.py, which does not block file:// or ../ paths outside the input directory.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 does not validate hosts/IPs in URL targets and redirects, enabling SSRF attacks against internal resources. The vulnerability is in the http.get_body function.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 automatically dereferences JSON Schema $ref references from HTTP/HTTPS without proper blocking, enabling SSRF attacks. The --allow-remote-refs flag only warns instead of blocking.

The datamodel-code-generator tool from version 0.52.1 to 0.60.2 interpolates validators from --extra-template-data without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported.

The datamodel-code-generator tool from version 0.51.0 to 0.60.2 inserts x-python-type values into field annotations without sufficient validation, allowing Python code execution when the generated module is imported.