CVE Vulnerability Catalog

Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. The public, unauthenticated endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/ reach this code path, allowing any unauthenticated user to force the server to issue a GET request to an internal address. The response body is never returned, making this a blind SSRF.

A flaw was found in Freedesktop Poppler 26.07.0 affecting the function JBIG2Stream::rewind in poppler/JBIG2Stream.cc. Manipulation causes a null pointer dereference. The attack can be initiated remotely, and the exploit has been published and may be used.

A vulnerability was detected in Freedesktop Poppler 26.07.0. The issue affects the SampledFunction::SampledFunction function in poppler/Function.cc, where manipulation of the BitsPerSample argument results in integer overflow. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was identified in O-RAN-SC SMO OAM (2025-06-10) in the VES Collector component. An unknown functionality leads to allocation of resources. Remote exploitation is possible and the exploit is publicly available.

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browsers of all users viewing that Payment Term record.

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned length values to write past array bounds with attacker-controlled bytes, corrupting heap memory.

A vulnerability was determined in O-RAN-SC SMO OAM (2025-06-10) in the VES Collector component. An unknown functionality leads to allocation of resources. The attack may be launched remotely and the exploit is publicly disclosed.

A vulnerability was found in O-RAN-SC SMO OAM (2025-06-10) in the VES Collector component. An unknown functionality leads to allocation of resources. The attack may be initiated remotely and the exploit has been made public.

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rootAttributes' parameter in all versions up to and including 2.8.14 due to insufficient input sanitization and output escaping. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts that execute whenever a user accesses an injected page.

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to and including 5.6.9 via the set_customer_object due to missing validation on a user controlled key. This allows unauthenticated attackers to enumerate arbitrary customer records and disclose personally identifiable information - including first name, last name, email address, and phone number - by iterating the customer[id] parameter. This issue is exploitable only when the site is configured with customer authentication disabled (guest checkout enabled).

Ai command injection in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

A vulnerability in the VES Collector component of O-RAN-SC SMO OAM allows uncontrolled memory allocation via manipulation of the additionalFields.padding argument. The attack can be launched remotely and the exploit has been publicly disclosed.

Imager versions from 0.45_02 before 1.035 for Perl read outside the EXIF block via unchecked start offsets in tiff_load_ifd. tiff_load_ifd() validates an IFD entry's data by checking that entry->offset + entry->size stays within the EXIF block, and never checks the start offset itself. Where that sum is not the real end of the data, the check passes with the entry starting outside the block. Through 1.032 entry->offset is a plain int, so on the usual two's-complement implementations an offset with the high bit set converts to negative and the sum can land back inside the block. From 1.033 the field is a size_t and the addition wraps only where size_t is 32 bits. The IFD's own start offset is checked the same way and wraps where unsigned long is 32 bits, which includes 64-bit Windows. Any caller of Imager->read() on an attacker-supplied image may receive EXIF tags holding bytes from outside the block, or crash the process.

In CubeCart prior to 6.7.5, the GDPR tools rely on page-level CC_PERM_READ access and do not require CC_PERM_DELETE for purge, no_order_purge, or delete_guests commands. An authenticated administrator with read-only customer privileges can invoke these backend actions directly to bypass interface restrictions and irreversibly delete customer records, accounts without orders, or guest accounts.

In CubeCart prior to 6.7.5, admin/sources/products.index.inc.php reads rich-text fields from $GLOBALS['RAW']['POST'] and removes only script elements before storing and rendering through Smarty templates. An administrator with product-editing rights can store event-handler attributes, SVG content, or javascript: URIs that bypass this filter, causing persistent JavaScript execution when a storefront visitor or another administrator views the product content.

In CubeCart prior to 6.7.5, the _errorMessage method uses strip_tags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data that reaches a GUI message can carry a javascript: URI or event handler through the filter, and viewing or interacting with the rendered anchor executes JavaScript in the victim's browser session.

In CubeCart prior to 6.7.5, the delete-note handler verifies only the presence of order_id and delete-note parameters before deleting records from CubeCart_order_notes, without requiring CC_PERM_DELETE for orders. An authenticated administrator lacking order modification privileges can directly invoke the handler with valid identifiers and delete order-history notes, removing operational records and audit-trail data.

In CubeCart prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action use state-changing GET requests and are omitted from the protection map in csrf.inc.php. A remote attacker can induce an authenticated administrator to issue one of these requests without a validated session token, causing unintended resets of electronic download usage counters or deletion of stored customer payment-card tokens.

In PoDoFo from version 1.0.0 to 1.1.1, processing a crafted PDF with an Indexed color-space image can cause a heap out-of-bounds read in PdfColorSpaceFilterIndexed::FetchScanLine. PODOFO_INVARIANT does not perform a runtime check, so a pixel index greater than or equal to m_MapSize can address beyond m_lookup. Additionally, validation of hival uses an incorrect conjunction and no upper bound, allowing malformed Indexed color-space metadata outside the expected range.

In Vvveb prior to 1.0.8.5, getThemeFolder() returns the attacker-controlled theme parameter without sanitization, and backupFolder() concatenates it beneath DIR_THEMES before editor/revisions/load or editor/revisions/delete operates on a named .html file. sanitizeBackupFileName() strips traversal characters only from the separate file parameter and does not protect the theme directory component. An authenticated user with the default Editor role and editor/* permission can submit traversal sequences that redirect file_get_contents() or unlink() to a reachable backup subdirectory outside the web root.