CVE Vulnerability Catalog

The ColorFolio WordPress theme (colorit) by BuddhaThemes contains a Deserialization of Untrusted Data vulnerability, allowing Object Injection. This issue affects ColorFolio versions up to and including 1.3.

The Neo | Barber Shop WordPress theme (neocut) by BuddhaThemes contains a Deserialization of Untrusted Data vulnerability, allowing Object Injection. This issue affects Neo | Barber Shop versions up to and including 3.5.

The Education Center WordPress theme (education) by ThemeREX contains an Improper Neutralization of Input During Web Page Generation vulnerability, allowing Reflected XSS. This issue affects Education Center versions up to and including 3.6.12.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.

The Dashboard Notes WordPress plugin (dashboard-notes) by MIGHTYminnow contains a Cross-Site Request Forgery (CSRF) vulnerability. This issue affects Dashboard Notes versions up to and including 1.0.3.

In the libhangul library, when parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. Providing a specially crafted dictionary file to an application that queries it can trigger an unexpected application crash, resulting in a Denial of Service (DoS).

ProcessMaker before version 2026.14.3 is vulnerable to SQL injection in the `GET /api/1.0/tasks` endpoint via the `order_by` parameter. The `applyColumnOrdering()` method concatenates a user-controlled `process_requests` column name into a SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account.

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates SHA-512, the key is 64 bytes instead of the required 32 bytes. The agent does not validate the size, causing failures in tunnel updates and configuration writes. For peers without a previously negotiated 32-byte key, the tunnel may have no preshared key, allowing an attacker with a quantum computer to decrypt traffic.

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

The internal data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and retrieve the complete device and measurement topology of the system.

A component loading mechanism in openPDC and openHistorian will construct and run any specified type, which may be an invalid component to load. An attacker with an authenticated user account and the ability to place a file on the host filesystem can use this to run arbitrary constructor code, and this code runs with the privileges of the affected service account.

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authentication, an attacker must already be authenticated to reach this function; on systems without Windows Authentication, this is reachable by an unauthenticated network attacker. This allows an attacker to trigger deserialization of an arbitrary object graph, which could allow remote code execution under the privileges of the affected service account.

The Affinity by Canva application for macOS before version 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

The Affinity by Canva app for macOS before version 3.3.1 did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.

The Affinity by Canva application for macOS before 3.3.1 did not validate image dimensions against the size of the pixel data when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A crafted Affinity document, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory in the rendered thumbnail or preview image, or cause the thumbnail or preview extension to crash.

The Affinity by Canva app before 3.3.1 did not perform adequate bounds checking when parsing Affinity document files, leading to an out-of-bounds pointer dereference. A crafted Affinity document, when opened by a user in Affinity, could result in an application crash.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion. This issue affects Werkstatt: from n/a through 4.8.3.