CVE Vulnerability Catalog

ProcessMaker before version 2026.14.3 is vulnerable to SQL injection in the `GET /api/1.0/tasks` endpoint via the `order_by` parameter. The `applyColumnOrdering()` method concatenates a user-controlled `process_requests` column name into a SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account.

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates SHA-512, the key is 64 bytes instead of the required 32 bytes. The agent does not validate the size, causing failures in tunnel updates and configuration writes. For peers without a previously negotiated 32-byte key, the tunnel may have no preshared key, allowing an attacker with a quantum computer to decrypt traffic.

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

The Affinity by Canva application for macOS before version 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

The WPFunnels plugin for WordPress up to version 3.13.3 contains a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation.

The Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

Envira Gallery Lite before version 1.16.2 has a missing authorization vulnerability in its gallery conversion REST endpoint, allowing lower-privileged authenticated users to create and publish galleries without required capabilities. Attackers can also supply arbitrary image IDs without ownership verification to publish unauthorized content.

Affinity by Canva before version 3.3.1 did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and dereference of an untrusted pointer. A crafted document could cause memory corruption or application crash.

The Testimonials by BestWebSoft WordPress plugin through version 1.0.8 does not sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.

The Shipping for Nova Poshta WordPress plugin through version 1.19.8 does not perform any authorization, nonce, or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request using the store's own stored API credentials.

The Livees Checkout WordPress plugin through version 7.0.2 does not perform any capability, nonce, or order-key check before acting on request parameters on the order confirmation page, allowing unauthenticated users to change the status of arbitrary orders, store arbitrary data and notes on them, and recover their order keys.

The GDPR Data Request Form WordPress plugin through version 1.7.1 does not have CSRF protection when updating one of its settings, allowing attackers to change that setting via a forged request, provided they can trick a site administrator into performing an action such as clicking on a link.

The Scripts n Styles plugin by unFocus Projects through version 3.5.8 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Scripts n Styles from n/a through 3.5.8.

The WP Event Manager plugin by Ashok Dudhat through version 3.4.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects WP Event Manager from n/a through 3.4.1.

The Restrict User Access – Membership Plugin with Force by DEV Institute through version 2.8.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects Restrict User Access – Membership Plugin with Force from n/a through 2.8.1.

The Html5 Audio Player plugin by bPlugins through version 2.8.8 has a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation. This issue affects Html5 Audio Player from n/a through 2.8.8.

The All Bootstrap Blocks WordPress plugin up to version 1.3.31 exposes sensitive system information to unauthorized control spheres. Attackers can exploit this to retrieve embedded sensitive data.