CVE Vulnerability Catalog

Perforce P4 Search prior to 2026.4.2 trusts a client-supplied address when validating certain authentication requests. An attacker holding a stolen P4 Server ticket can bypass host-based ticket restrictions and trusted-address controls, gaining access to P4 Search as the ticket's owner.

Perforce P4 Search prior to 2026.4.2 does not validate file names supplied to its extension installation feature. An attacker with super-user or service-token privileges can write files with arbitrary content to the P4 Search installation directory.

The Taxi Booking Manager for WooCommerce WordPress plugin contains an improper validation of specified quantity in input vulnerability, allowing input data manipulation. The issue affects versions up to and including 2.1.1.

The Video Conferencing with Zoom WordPress plugin contains an insertion of sensitive information into sent data vulnerability, allowing retrieval of embedded sensitive data. The issue affects versions up to and including 4.6.10.

The Premium Addons for Elementor WordPress plugin contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 4.11.109.

The JS Help Desk WordPress plugin contains an authorization bypass through user-controlled key vulnerability, allowing exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.0.0.

The JS Help Desk plugin (js-support-ticket) up to version 4.0.0 has an authorization bypass vulnerability through a user-controlled key. An attacker can exploit incorrectly configured access control security levels.

The Presto Player plugin (presto-player) up to version 4.5.2 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

The Starter Templates plugin (astra-sites) up to version 4.7.7 has a stored Cross-site Scripting (XSS) vulnerability due to improper input neutralization during web page generation.

In the vgmstream library up to revision r2117, a vulnerability was found in the decode_ms_ima function in src/coding/ima_decoder.c (Microsoft IMA Decoder component). Manipulation leads to a divide by zero, and the attack can be executed remotely.

In the vgmstream library up to revision r2117, a weakness was found in the make_group_random function in src/meta/txtp_process.c (TXTP File Handler component). This manipulation causes a use-after-free, and the attack needs to be launched locally. Patch name: ae37662ad626254ddd96ad69ac263792d7a92024.

In the vgmstream library up to revision r2117, a vulnerability was found in the parse_params/txtp_parse functions in src/meta/txtp_parser.c (TXTP File Handler component). The manipulation results in an out-of-bounds write, and the attack may be launched remotely. The patch is identified as 4669d37a6af94866f6f0628678f9f90d46954e8b.

The pwhois tool in Net::Whois::Raw before version 2.99044 for Perl queries WHOIS for the wrong domain for unicode domain names. The punycode encoding skips IDNA mapping and normalization steps, leading to incorrect A-labels for certain characters.

An improper access control vulnerability exists in GROWI, which allows an unauthenticated attacker to read files contained in non-public pages of the affected product when the file upload setting is configured as "Local".

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenticated attackers to mark an arbitrary order as paid without making any payment.

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated attackers who know or guess a file's name to download other customers' uploaded files.

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffective, so an unauthenticated attacker who knows or guesses a file's name can retrieve customer-uploaded files directly, bypassing the plugin's authenticated download mechanism.

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can register a client that bypasses audience checks during token introspection, allowing them to view sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm.

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity providers. This allows a delegated client administrator to leak a user's upstream bearer tokens into the tokens issued to their managed application.

A flaw was found in the X.509 client-certificate authenticator of Keycloak. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate that points to a malicious server, causing Keycloak to make unauthorized outbound requests to internal or external endpoints before the certificate is fully validated.