CVE Vulnerability Catalog

CVE-2026-23558 describes a race condition that occurs during the grant table version change from v2 to v1 in HVM or PVH guests. This issue may lead to some status pages being freed while their mappings are still being inserted into the guest's page tables.

The Contest Gallery plugin for WordPress is vulnerable to SQL Injection via the 'form_input' parameter in versions up to and including 28.1.6. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query inside the unauthenticated 'post_cg_gallery_form_upload' AJAX action.

W Keycloak znaleziono lukę, która pozwala użytkownikowi o niskich uprawnieniach, znającemu dane logowania i identyfikator klienta, na obejście zabezpieczenia mającego na celu wyłączenie domyślnego przepływu w klientach OpenID Connect (OIDC). Manipulując danymi klienta podczas ponownego uruchamiania sesji, atakujący może uzyskać dostęp do tokena, który nie powinien być dostępny.

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker can pre-create an authentication session and trick a victim into clicking a malicious link, allowing the attacker to hijack the required-action form without the victim's credentials. Successful exploitation could lead to complete account takeover, including highly privileged administrative accounts.

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further attacks. This vulnerability specifically affects Keycloak clients configured with a wildcard (*) in the "Valid Redirect URIs" field and requires user interaction to be successfully exploited.

A flaw was found in Keycloak where a remote, unauthenticated attacker can send a specially crafted XML input to the SAML endpoint, causing high CPU usage and worker thread starvation, leading to a Denial of Service (DoS) and server unavailability.

The AddressRepository::getSqlQuery() method constructs a database query without properly sanitizing user input, leading to SQL Injection. The method is not invoked anywhere within the extension itself and therefore poses no direct risk in a default installation.

The Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server.

The extension fails to properly sanitize user input before using it in a database query. As a result, an unauthenticated attacker can inject arbitrary SQL through a URL parameter on pages using the 'Date Menu of news articles' plugin.

Apache OFBiz has a vulnerability related to improper control of code generation and improper neutralization of directives in dynamically evaluated code. This issue affects versions before 24.09.06.

The Server-Side Request Forgery (SSRF) vulnerability in Apache OFBiz before version 24.09.06 allows an attacker to use the server to send requests to internal or external resources.

The CVE-2026-31909 vulnerability in Apache OFBiz involves exposure of sensitive information to unauthorized actors. This issue affects versions before 24.09.06.

The SSRF vulnerability in Apache OFBiz, occurring in Content component operations, allows an attacker to send malicious requests to the server. This issue affects versions of Apache OFBiz before 24.09.06.

Podatność typu out-of-bounds write w Samsung Open Source Escargot pozwala na przepełnienie buforów. Problem ten dotyczy wersji Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

The vulnerability affects versions of the exifreader package before 4.39.0. A crafted image containing an ICC mluc tag can set an attacker-controlled record count along with a zero record size, leading to excessive memory growth during parsing.

W podatności CVE-2026-47311 występuje przepełnienie bufora oparte na stercie w Samsung Open Source Escargot, co pozwala na przepełnienie buforów. Problem ten dotyczy wersji Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

W podatności typu use after free w Samsung Open Source Escargot występuje możliwość manipulacji wskaźnikami. Problem ten dotyczy wersji Escargot: 590345cc6258317c5da850d846ce6baaf2afc2d3.

The Fortis for WooCommerce plugin before version 1.3.1 may leak sensitive API keys to unauthenticated attackers, allowing them to query Fortis' API and retrieve sensitive customer information, such as past orders and PII.

OpenHarmony v6.0 and prior versions have a vulnerability that allows a remote attacker to execute arbitrary code in pre-installed apps.

OpenHarmony v6.0 and prior versions have a vulnerability that allows a local attacker to cause a DoS attack, from which the system cannot recover.