CVE Vulnerability Catalog

An out-of-bounds read and improper input validation vulnerability in the Apache IoTDB C++ client causes crashes during TsBlock deserialization when processing malformed server data.

A vulnerability in Apache IoTDB allows unauthorized but authenticated users to access last-value data via the /rest/v2/fastLastQuery endpoint. The issue is caused by incorrect authorization and improper access control.

An uncontrolled recursion and resource consumption vulnerability exists in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the AirGap receiver's readLength method recursively calls itself without depth limit upon recognizing the E-language prefix in socket data. An unauthenticated attacker can send a stream of repeated E-language prefixes, causing a JVM stack overflow and StackOverflowError.

In Apache IoTDB with AirGap mode enabled (pipe_air_gap_receiver_enabled=true), the pipe receiver accepts unauthenticated TCP connections on port 9780. An attacker can send a controlled 32-bit integer used as memory allocation size without an upper bound, causing JVM heap exhaustion and crashing the DataNode process.

The Hide My WP Lite plugin for WordPress up to version 1.3 is vulnerable to Arbitrary File Read. Attackers can exploit the he_wrapper_js and he_wrapper_css parameters processed by the elementor_assets_filter() function without path validation, allowing reading of files like wp-config.php.

The EscortWP WordPress theme (up to version 3.6.2) contained a hard-coded, obfuscated backdoor that allows an unauthenticated attacker to permanently delete all site content by supplying a pre-defined key. The backdoor covertly transmits the site URL, administrator email address, and license key to a third-party server.

The vulnerability in Bixby prior to version 4.0.70.8 is caused by improper export of Android application components. A local attacker can exploit this to execute arbitrary commands with Bixby privileges.

An out-of-bounds write vulnerability in the libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.

An out-of-bounds write vulnerability in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory while parsing DNG format.

A time-of-check time-of-use (TOCTOU) race condition exists in the fabricKeymaster trustlet prior to SMR Jul-2026 Release 1. This allows local privileged attackers to execute arbitrary code.

A vulnerability in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows out-of-bounds write when parsing TIFF format. Remote attackers can exploit this to write out-of-bounds memory.

An out-of-bounds write vulnerability in libsavsac.so prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code.

A server-side request forgery (SSRF) vulnerability was found in the Vision Tool of zhayujie CowAgent up to version 2.1.1. The issue exists in the _build_image_content/_download_to_data_url functions in agent/tools/vision/vision.py, where manipulation of the image argument allows remote attackers to make requests to internal resources. The exploit has been publicly disclosed and may be used.

The TelSender plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting in all versions up to and including 1.14.14. This is due to insufficient input sanitization when processing Telegram API responses containing attacker-controlled chat titles.

The WP Business Intelligence Lite plugin for WordPress up to version 3.2.0 contains an authorization bypass vulnerability, allowing authenticated attackers with Subscriber-level access or higher to modify stored SQL queries. This can lead to privilege escalation via arbitrary SQL execution when the modified query is viewed by an administrator.

The Chat Help – Click to Chat Button & Form plugin for WordPress up to version 3.1.3 exposes sensitive information via REST API endpoints /wp-json/chat-help/v1/leads and /wp-json/chat-help/v1/leads/{id}. Due to missing authentication and authorization checks, unauthenticated attackers can extract customer names, email addresses, phone numbers, WhatsApp messages, geolocation data, device fingerprinting information, and WordPress account credentials of logged-in users.

The Ultimate Member plugin for WordPress is vulnerable to blind SQL injection via the search parameter in all versions up to and including 2.10.1 due to insufficient escaping and lack of query preparation. This allows unauthenticated attackers to append additional SQL queries and extract sensitive information from the database.

The SureForms plugin for WordPress up to version 2.2.1 has an improper input validation vulnerability. The 'create_payment_intent' and 'create_subscription_intent' functions accept payment amounts directly from POST data without validating against the form's configured price, allowing unauthenticated attackers to modify the payment amount.

In OpenStack Ironic before version 37.0.1, a user with the ability to deploy nodes via the IPMI management interface can maliciously use the send_raw step to send arbitrary IPMI commands to a node, bypassing Ironic's access control.

The Salon Booking System – Free Version plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 10.30.32. Missing nonce validation in the setCustomText function allows unauthenticated attackers to inject arbitrary PHP code into the translate-constants.php file, leading to remote code execution on the server by tricking an administrator into clicking a link.