CVE Vulnerability Catalog

A stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without bounds checks; copying into a fixed-size 17-byte stack buffer via memcpy with a length byte greater than 16 writes past the stack boundary, leading to firmware crash, DoS, or potentially arbitrary code execution.

A stack-based buffer overflow in the Bosch Sensortec BHI360 SensorAPI (C library) in versions up to and including commit d6b200416a. The vulnerability is in the FIFO parsing and debug logging subsystem within bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875); the parser trusts the first payload byte as the message length and copies that many bytes into a fixed-size 17-byte stack buffer via memcpy without bounds checking. A locally or physically positioned attacker can inject a crafted debug frame with a length byte exceeding 16, corrupting adjacent stack data including the saved return address; because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (DoS).

A vulnerability in Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The plugin's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.

The miniOrange 2FA WordPress plugin before 6.3.1 and before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to a client-supplied identifier that can be changed at will. An attacker who already knows a victim's password can make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic. This issue affects Nintendo Switch: before 23.0.0.

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. Panorama is also impacted.

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages.

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site, not that the requested file path belongs to that product.

The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is due to the plugin not properly validating a user's identity prior to updating their details, including arbitrary user passwords, to a known plugin-configured custom value. This makes it possible for authenticated attackers with subscriber-level access and above to change arbitrary users' email addresses, including administrators, and reset their passwords.

Velociraptor creates notebook backups in its default enabled daily backup feature. When Velociraptor restores the backup, the notebook cell content is interpolated into a template with no ACL checks. This allows a malicious user with NOTEBOOK_EDITOR permission to plant a VQL query that will be evaluated at elevated permissions if the notebook's backup is subsequently restored.

A vulnerability was found in DaveGamble cJSON up to 1.7.19. The affected element is the function cJSONUtils_MergePatch of the file cJSON_Utils.c. The manipulation results in use after free, and the attack may be launched remotely. The exploit has been made public and could be used, and the pull request to fix this issue awaits acceptance.

A vulnerability was detected in Rizwan17 inventory-management-system in the storeCustomerOrderInvoice function of includes/manage.php. Manipulation of the pro_name[] argument leads to SQL injection. The attack can be initiated remotely and the exploit is publicly available.

In Siam Ordering (siam-server) version 1.0.0, there is an authentication bypass vulnerability via a hardcoded master verification code. Remote unauthenticated attackers can log in as any user, merchant, or administrator.