CVE Vulnerability Catalog

A buffer overflow vulnerability was found in Tenda CH22 version 1.0.0.1 in the formCertListInfo function of the /goform/CertListInfo file. An attacker can remotely manipulate the Name argument, causing a buffer overflow. The exploit has been made public and could be used.

A vulnerability was found in the Isaiah library up to version 1.36.9 in the WebSocket connection authentication component. An unknown function in app/main.go allows improper authentication, exploitable remotely. A fix is pending in a pull request.

A missing authorization vulnerability was found in will-moss Isaiah up to version 1.36.9 in the Server.Handle function of app/server/server/server.go within the Master Websocket Handler component. Manipulation of the Agent argument allows remote exploitation without proper authorization.

The CVE-2026-14165 vulnerability in Tuleap Enterprise Edition allows authorization bypass through a user-controlled key. An attacker can access other users' data without proper authorization.

A SQL injection vulnerability has been discovered in SourceCodester Online Book Store System 1.0 in the file admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been publicly released.

The Library Management System WordPress plugin before version 3.5.8 does not sanitize or escape a user-supplied parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection and extract arbitrary data from the database, including user password hashes.

The Tutor LMS WordPress plugin before version 3.9.13 fails to enforce enrollment, purchase, and private-course capability checks in its Droip and Kirki page-builder integration. This allows authenticated users with subscriber-level access to enroll in paid or private courses, read private course content, and mark arbitrary courses as completed.

The User Registration & Membership WordPress plugin before version 5.2.2 lacks authorization checks on a membership-upgrade action and derives the user to modify from a caller-supplied identifier instead of the current user. This allows any authenticated user, such as a subscriber, to change another user's WordPress role and membership tier.

The MBStorage DRAM lighting control module in Gigabyte Control Center (GCC) has an Improper Access Control vulnerability. An authenticated local attacker can send specific IOCTL commands via the MyPortIO_x64.sys driver, allowing arbitrary read/write of physical memory and kernel-level privilege escalation.

An integer overflow vulnerability in an unspecified component allows an attacker to achieve system-level access to the affected software.

A SQL injection vulnerability has been discovered in Jinher OA 1.0 in the file PlanGiveOut.aspx. An attacker can remotely manipulate the httpOID argument, leading to SQL injection. The exploit has been published and may be used.

A vulnerability was found in the QMUDisk driver (qmudisk64.sys) of Tencent PC Manager 18.1.30242.301, involving an uncontrolled search path. The attack requires local access and is considered difficult due to high complexity. The exploit has been publicly disclosed.

A SQL injection vulnerability has been identified in Metasoft MetaCRM up to version 6.4.0 Beta06 within the PHPRPC Remote Call Interface component. The flaw exists in the file /customizemt/xkq/rpc.jsp, where the RPCService.query function improperly handles the phprpc_args argument. The attack can be executed remotely, and a public exploit is available.

A heap-based buffer overflow vulnerability has been found in the saappctl.sys library of the SecureAge CatchPulse driver up to version 10.9.3. The attack requires local access and the exploit has been publicly disclosed.

A use-after-free vulnerability was found in Zephyr's dynamic kernel-object tracking mechanism. In SMP configurations with userspace and dynamic objects enabled, unsynchronized operations on a doubly-linked list can lead to kernel memory corruption.

A stack buffer overflow vulnerability exists in the parse_ipv4() function in Zephyr OS. An attacker can craft an IP address with a long suffix after the colon, causing data to be copied beyond the allocated 17-byte buffer. The issue has been present since v1.9.0 through v4.4.0 and can lead to system crashes or potential control-flow hijack.

In Zephyr's WireGuard subsystem, wg_process_data_message() linearizes an inbound transport-data payload into a fixed pool buffer of CONFIG_WIREGUARD_BUF_LEN bytes before decryption. The net_buf_linearize() call passes the attacker-derived data_len as both destination capacity and copy length, bypassing the function's internal bound. When data_len exceeds CONFIG_WIREGUARD_BUF_LEN, an out-of-bounds write (CWE-787) occurs.

A vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network via untrusted pointer dereference.

The vulnerability in LuCI is due to improper encoding of DHCPv6 lease hostnames before rendering in status tables. This allows adjacent network attackers to inject HTML markup by sending a DHCPv6 Client FQDN containing script tags.

A stored cross-site scripting (XSS) vulnerability in luci-app-upnp allows unauthenticated LAN clients to inject malicious JavaScript via UPnP IGD AddPortMapping SOAP requests. Attackers can send malicious HTML in the NewPortMappingDescription field, which is stored by miniupnpd and rendered without output encoding by luci-app-upnp, executing the payload when administrators view the UPnP or Status pages.