CVE Vulnerability Catalog

In the Linux kernel, a vulnerability exists in the SysV IPC ID allocation mechanism. The `ipc_idr_alloc()` function in the checkpoint/restore path can allocate an ID beyond the valid range (`ipc_mni`), causing incorrect IDR mapping and dangling pointers. This can lead to memory corruption and potential code execution via freed memory dereference.

In the Linux kernel, the batman-adv module (Distributed ARP Table) fails to check the return value of pskb_copy_for_clone(). A failed memory allocation leads to a NULL pointer dereference in batadv_send_skb_prepare_unicast_4addr(), causing a system crash.

A vulnerability was found in the Linux kernel's netfilter xt_policy module, affecting strict mode inbound policy matching. The match_policy_in() function processes sec_path entries in reverse order, causing inconsistent matching of multi-element inbound rules.

In the Linux kernel, the batman-adv module's tp_meter counter underflows during shutdown due to multiple callers of batadv_tp_sender_shutdown(). This causes a use-after-free when the interface is removed while a zombie sender thread loops indefinitely.

A vulnerability was found in the Linux kernel's Bluetooth stack due to unsynchronized access to the accept_q queue. The bt_sock_poll() function walks the queue without locking, while child socket teardown can concurrently unlink and release the last reference, causing a race condition. This issue has existed since the initial Bluetooth implementation.

In the Linux kernel, a vulnerability in the SCTP sock_diag mechanism allows the dump_one function to process stale associations. After blocking on lock_sock() and sctp_association_free() completes, the association is marked dead and its bind address list is freed, leading to an out-of-bounds memory read.

In the Linux kernel, the netfilter ip6t_hbh module lacks validation of the Hop-by-Hop options list size. Userspace can supply an optsnr value larger than allowed (IP6T_OPTS_OPTSNR = 16), causing an out-of-bounds access on the opts array. The issue was reported by UBSAN as an array-index-out-of-bounds error.

A use-after-free vulnerability was found in the Linux kernel's netfilter queue (NFQUEUE) for bridged packets. br_pass_frame_up() changes skb->dev to the bridge master before queuing, but NFQUEUE does not hold a reference to this device, leading to a use-after-free when the packet is reinjected after the bridge is removed.

The Cornerstone WordPress plugin before version 7.8.8 does not enforce capability checks on one of its CSS-preview request handlers, allowing any authenticated user to evaluate dynamic content tokens against arbitrary users and disclose their sensitive metadata, including raw password hashes.

The Cornerstone WordPress plugin before 7.8.9 does not enforce capability checks on one of its REST API routes, allowing any authenticated user to disclose the metadata of any other user, including roles, session token previews and stored billing/shipping fields.

The WP Meta SEO plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting via the REQUEST_URI server variable in all versions up to and including 4.5.18. The plugin directly inserts unsanitized HTTP_HOST and REQUEST_URI data into the database, allowing arbitrary script injection.

The WP Forms Connector plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the /wp-json/wp/v3/post/list REST endpoint in versions up to and including 1.8. This is due to insufficient escaping on the user-supplied 'order' parameter and lack of proper preparation on the existing SQL query.

The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.8. The plugin registers the REST route wp/v3/user/list/<id> with permission_callback set to '__return_true', allowing access to sensitive information without proper authorization.

The ClearSale Total plugin for WordPress is vulnerable to SQL Injection via the `pagseguro[metodo]` POST parameter of the `clearsale_total_push` AJAX action in all versions up to and including 3.4.2. Although a `wp_verify_nonce()` check exists, the failing branch's `die()` is commented out, allowing the vulnerability to be exploited.

The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. The missing capability check in the nc_setOption() function allows authenticated attackers with Subscriber-level access and above to update arbitrary WordPress options via XML-RPC requests.

ACE vulnerability in logback-core up to version 1.5.36 allows arbitrary code execution by bypassing protections for CVE-2025-11226. The attack requires Janino library on the classpath and write access to a configuration file or injection of an environment variable.

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 1.0 via the 'url' parameter. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application.

The Kargo Takip plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 1.2 via the 'api_url' parameter. This allows unauthenticated attackers to make web requests to arbitrary locations originating from the web application.

The Post Duplicator WordPress plugin before version 3.0.15 does not safely handle custom meta-data during post duplication, allowing attacker-supplied serialized values to be stored without the WordPress meta API's double-serialization protection.

WordPress plugins such as Shapedsmart-post-show-pro, Real Testimonials Pro, and Product Slider for WooCommerce before specified versions contained malicious code. They were distributed through the vendor's compromised update server, allowing unauthenticated attackers to deploy a second-stage attack.