CVE Vulnerability Catalog

A vulnerability was detected in Kamailio up to versions 6.0.7/6.1.3 in the isup_get_calling_party function of the file src/modules/sipt/ss7_parser.c in the sipt module. Manipulation of the length argument results in buffer overflow. The attack may be performed remotely.

A security vulnerability was detected in Tencent WeKnora up to version 0.8.1 in the validateSubquery function of the file internal/utils/inject.go in the SQL Validator component. The manipulation leads to SQL injection. The attack can be carried out remotely and the exploit has been publicly disclosed.

A weakness was identified in agno-agi agno up to versions 3.0.6/3.1.1 in the member_agent.run function in the library libs/agno/agno/team/_default_tools.py in the Delegation Feature component. Executing a manipulation can lead to execution with unnecessary privileges. The attack can be executed remotely and the exploit has been made public.

A security flaw in agno-agi agno up to 3.0.6/3.1.1 affects the exec function in the Agent Orchestration Layer, allowing remote execution of dynamically-managed code.

A SQL Injection vulnerability in Kong Gateway (Enterprise and Open Source) clustering communication in Hybrid Mode, triggered by specially crafted RPC requests to the Control Plane, leading to unauthorized database access.

A vulnerability in agno-agi agno up to 2.7.3/3.0.6 affects the get_authentication_dependency function in auth.py, where manipulation of the security_key argument leads to missing authentication.

A vulnerability was determined in agno-agi agno up to version 3.0.9 in the agno.CodingTools.run_shell function in the library libs/agno/agno/tools/coding.py in the CodingTools component. Manipulation of the command argument causes OS command injection. The attack may be initiated remotely and the exploit has been publicly disclosed.

A vulnerability was found in agno-agi agno up to version 3.0.6 in the run_python_code function of the file python.py in the PythonTools component. Manipulation of the code argument results in code injection. The attack can be launched remotely and the exploit has been made public.

A vulnerability has been found in idcCMS 1.70. It affects an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

The Custom Query Blocks plugin for WordPress up to version 5.6.0 contains a stored XSS vulnerability in the post-type-archive-mapping function. The vulnerability is due to improper neutralization of input during web page generation.

The Flexible Subscriptions plugin for WordPress up to version 1.8.4 contains a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects the flexible-subscriptions function.

The JetElements For Elementor plugin for WordPress up to version 2.9.2.3 contains a stored XSS vulnerability in the jet-elements function. The vulnerability is due to improper neutralization of input during web page generation.

Stored XSS vulnerability in the JetMenu plugin by Crocoblock. Improper input neutralization during web page generation allows persistent injection of malicious script.

Stored XSS vulnerability in the Ad Inserter plugin by Igor Funa. Improper input neutralization during page generation allows persistent script injection.

Missing authorization in the Products Restricted Users for WooCommerce plugin by Codection. Incorrectly configured access control security levels can be exploited by unauthorized users.

Missing authorization in the WP User Manager plugin. Incorrectly configured access control security levels can be exploited by unauthorized users.

This CVE number has been rejected because it is a duplicate of CVE-2026-71364, which was publicly disclosed and fixed in Red Hat Ansible Automation Platform on 2026-08-24. No separate identifier is required.

Vulnerability involving insertion of sensitive information into sent data in the Booster Elite for WooCommerce plugin. Allows retrieval of embedded sensitive data.

SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Banner.php. Manipulation of input can lead to SQL injection, remotely exploitable.

SQL injection vulnerability in SEMCMS (up to 5.0) in SEMCMS_Download.php. Manipulation of input leads to SQL injection, remotely exploitable.