CVE Vulnerability Catalog

The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping.

The WP Grid Builder plugin for WordPress up to version 2.3.3 contains a privilege escalation vulnerability. Missing authorization and meta key validation in the `/wp-json/wpgb/v2/metadata` REST endpoint allow authenticated users with Subscriber-level access or higher to escalate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.

Spinnaker prior to versions 2026.1.1, 2026.0.3, 2025.4.4, and 2025.3.4 contains a vulnerability in Kustomize bake operations that allows unsafe YAML tag processing in rosco manifests. This can lead to remote code execution on rosco pods when performing Kustomize bakes.

Multiple connections to the backend using the same charging station ID are allowed, which could allow an attacker to deploy multiple instances of malicious OCPP clients to overwhelm the backend.

The charging station backend lacked throttling on repeated authentication attempts, allowing an attacker to perform a denial-of-service attack.

A vulnerability in Phalcon before version 5.15.0 causes the default MVC router to use a compiled PCRE pattern with a nested quantifier, allowing an attacker to trigger catastrophic backtracking via a crafted request URI containing repeated slashes and newline characters. This leads to CPU exhaustion or route-matching failure.

A vulnerability in Tilt from version 0.24.0 to 0.37.3 allows an attacker to access the HUD view stream via WebSocket despite CSRF protection. The CSRF token is served by an unauthenticated endpoint, and the server accepts connections without an Origin header, enabling theft of session data, Tiltfile contents, and resource statuses.

Tilt HUD server mounts unauthorized pprof handlers under /debug, allowing an unauthenticated attacker to read process memory (including session and API tokens) and degrade performance. The vulnerability affects versions 0.19.5 through 0.37.3.

In the Frappe framework prior to versions 16.23.0 and 15.112.0, a TarSlip RCE vulnerability was found in Package Import. Insufficient validation of tarfile members before extraction allowed remote code execution.

The Plotly.js Graphing plugin for Drupal contains an object injection vulnerability due to improperly controlled modification of dynamically-determined object attributes. Affected versions range from 0.0.0 to 3.0.2.

A vulnerability in the Flag attendance field module for Drupal allows improperly controlled modification of dynamically-determined object attributes, leading to object injection. Affected versions range from 0.0.0 to 1.2.

A vulnerability in Phalcon before version 5.14.1 allows an attacker to exploit a timing side-channel in the Phalcon\Encryption\Crypt::decrypt function, where the HMAC comparison is performed byte-by-byte and returns early on the first mismatch. This enables the attacker to recover a valid HMAC tag byte-by-byte and attach it to a chosen IV and ciphertext, causing decrypt() to accept tampered encrypted content as authentic.

ModSecurity before version 3.0.16 has a vulnerability in the multipart/form-data parser that silently removes line breaks from non-file form-field values. This occurs because the code overwrites reserved bytes instead of appending the current buffer, causing a parser differential between ModSecurity and backend applications.

In Frappe prior to version 16.19.0, an authorization bypass vulnerability was found in the update_page endpoint in Workspace. Public workspaces did not undergo the required Workspace Manager edit check.

An SSRF vulnerability in TypeBot prior to 3.17.2 allows bypassing the URL validator by using the IPv6 unspecified address ::. A workspace editor or creator can configure a server-side HTTP Request block or script fetch to connect to local HTTP services.

A vulnerability in Spinnaker allows remote code execution through unsafe YAML processing when using CloudFormation or CloudFoundry. The use of a non-safe constructor enables arbitrary Java class loading, leading to remote code execution.

In Frappe framework prior to version 16.18.3, a path traversal and local file inclusion vulnerability was possible through secure local resource access in the Chrome PDF Generator.

The Location Selector plugin for Drupal contains an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This affects all versions from 0.0.0 to 1.3.0.

A vulnerability in the Drupal Tealium iQ Tag Management module allows improperly controlled modification of dynamically-determined object attributes, leading to object injection. This affects versions from 0.0.0 to 2.4.0.

A vulnerability in the GPU driver allows a non-privileged user to execute a sequence of improper GPU system calls, leading to use-after-free. This facilitates unauthorized memory access from shader code.