CVE Vulnerability Catalog

Cesanta Mongoose before version 7.22 has an out-of-bounds read vulnerability in the mg_tls_server_recv_hello() function. An attacker can send a crafted ClientHello with an oversized session ID length, causing a read past the buffer and crashing HTTPS, MQTTS, or WSS services.

A null pointer dereference vulnerability exists in Zeek before 8.0.9 in its Kerberos protocol analyzer. An unauthenticated remote attacker can crash the sensor by sending a crafted KRB_ERROR message with error code 25 (KDC_ERR_PREAUTH_REQUIRED) containing a PA-DATA element with padata-type 2, 3, 11, or 19.

A vulnerability in the FTP analyzer of Zeek before version 8.0.9 allows unauthenticated remote attackers to cause process termination by sending a crafted FTP control session negotiating AUTH GSSAPI followed by a large ADAT control line. The NVT_Analyzer component lacks a maximum line length check, causing uncontrolled memory consumption during base64 decoding of an attacker-controlled ADAT token, resulting in denial of service of the Zeek sensor.

A SQL Injection vulnerability in the AcyMailing extension for Joomla versions below 10.11.1 allows unauthorized database access and data leakage.

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by insufficient validation of authentication credentials during administrative account modifications via the web API. This allows an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

An LDAP injection vulnerability in PEAKUP Technology Inc.'s PassGate allows attackers to manipulate LDAP queries due to improper neutralization of special elements. This issue affects all PassGate versions up to April 30, 2026.

An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping.

A stack buffer overflow vulnerability exists in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is copied into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN, causing a stack buffer overflow and process crash.

A heap buffer overflow vulnerability exists in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker with parameters_all rights can inject SQL commands into the audit configuration form which is then saved. Execution is triggered when the audit functionality is accessed by the attacker or another user.

The Divi Torque Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, bypassing WordPress's built-in nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the lack of nonce verification allows a forged request from a logged-in administrator's browser to pass the capability check via session cookies.

The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.

The EventPrime plugin for WordPress up to version 4.3.4.2 is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts that execute when users access the affected page.

An authorization bypass vulnerability in PAVO Pay allows exploitation of trusted identifiers via a user-controlled key. The issue affects versions up to 09072026. The vendor did not respond to the disclosure.

The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.

A permissive CORS policy in the REST API (helix-rest) of Apache Helix through version 2.0.0 allows a remote attacker controlling a web page visited by an authorized user to read responses and issue cross-origin requests to administrative endpoints. The CORSFilter unconditionally returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true and reflects arbitrary request headers.

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

A vulnerability in the Remote Collector allows man-in-the-middle attacks because the configuration generated by n2os-tui disables TLS certificate verification for connections to the Guardian or CMC, with no option to enable it.

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.