CVE Vulnerability Catalog

A flaw was found in libcap. A local unprivileged user can exploit a TOCTOU race condition in the `cap_set_file()` function, allowing an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file.

A stored cross-site scripting (XSS) vulnerability exists in Kiamo before version 8.4 due to improper output encoding of user-supplied input in administrative interfaces. An authenticated administrative user can inject arbitrary JavaScript code that is executed in the browser of users viewing the affected pages.

A vulnerability was found in GitLab EE due to incorrect authorization, which under certain circumstances allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects.

Występujący wyścig w WebCodecs w Google Chrome przed wersją 147.0.7727.55 umożliwiał zdalnemu atakującemu uzyskanie potencjalnie wrażliwych informacji z pamięci procesu za pomocą spreparowanej strony HTML.

A cryptographic flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack.

Podatność CVE-2026-4837 dotyczy wstrzyknięcia eval() w logice beaconingu agenta Rapid7 Insight dla systemów Linux, co teoretycznie może umożliwić atakującemu zdalne wykonanie kodu jako root poprzez spreparowaną odpowiedź beacon. Mimo to, ze względu na użycie mutual TLS (mTLS) do weryfikacji poleceń z platformy Rapid7, wykorzystanie tej funkcji zdalnie jest mało prawdopodobne bez wcześniejszego, wysoko uprzywilejowanego dostępu do platformy backendowej.

A Server-Side Request Forgery (SSRF) vulnerability was found in Red Hat Quay and mirror registry for Red Hat OpenShift in the log export feature. An authenticated user can specify an arbitrary callback URL, and a backend process makes server-side HTTP requests to that URL. An attacker could use this to send requests from the application's internal network, potentially leading to disclosure of sensitive information.

Urządzenia Siklu EtherHaul 8010 z oprogramowaniem siklu-uimage-nxp-enc-10_6_2-18707-ea552dc00b mają statyczne hasło dla konta root.

In CI4MS before version 0.31.4.0, the ban note parameter in UserController::ajax_blackList_post() is stored unsanitized and rendered into an HTML data-note attribute without escaping. An admin with blacklist privileges can inject arbitrary JavaScript that executes in the browser of another admin viewing the user management page.

W wersjach Wimi Teamwork On-Premises przed 8.2.0 występuje podatność na nieautoryzowany dostęp do obiektów w punkcie końcowym preview.php, gdzie parametr item_id nie jest odpowiednio zabezpieczony. Atakujący mogą enumerować sekwencyjne wartości item_id, aby uzyskać dostęp do podglądów obrazów z prywatnych lub grupowych rozmów innych użytkowników.

A vulnerability in the Linux kernel's ATM driver (sigd_send path) allows an unvalidated vcc pointer from userspace to be dereferenced, causing a crash. A malicious process can forge the pointer via sendmsg(), leading to memory corruption.

A container privilege escalation flaw was found in certain Ansible Automation Platform images. The issue arises from the /etc/passwd file being created with group-writable permissions during the build process. An attacker with command execution access, even as a non-root user, can leverage membership in the root group to modify the file and add a user with arbitrary UID, including UID 0.

The BEAR – Bulk Editor and Products Manager Professional for WooCommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.1.5. This is due to missing nonce validation on the woobe_redraw_table_row() function, allowing unauthenticated attackers to update WooCommerce product data including prices, descriptions, and other product fields via a forged request, provided they trick a site administrator or shop manager into performing an action such as clicking a link.

The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wsm_showDayStatsGraph' shortcode in all versions up to and including 8.4 due to insufficient input sanitization and output escaping on user-supplied attributes. This allows authenticated attackers with contributor-level access or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Download Manager plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 3.3.52.

The Panda Pods Repeater Field WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.5.12.

The Grand Magazine WordPress plugin contains a CSRF vulnerability that allows an attacker to perform unauthorized actions in the context of a logged-in administrator. The flaw affects all versions up to and including 3.5.5.

The Grand Photography WordPress plugin contains a Cross-Site Request Forgery (CSRF) vulnerability. This flaw allows an attacker to perform unauthorized actions on behalf of an authenticated administrator.

The WpTravelly tour booking manager plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.1.7.

The CartFlows WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects versions up to and including 2.2.3.