CVE Vulnerability Catalog

Stack-based buffer overflow in the diagnostic execution utility of Brocade Fabric OS before version 10.0.1. When processing command arguments, the utility tokenizes input without enforcing array boundary checks. An authenticated administrator can supply excessive arguments, leading to memory overwrite and process crash.

Stack-based buffer overflow in the IKEv2 protocol handler on Brocade Fabric OS before version 10.0.1. When processing initial key exchange requests on extension switches with FCIP, an unauthenticated remote attacker can send a single UDP packet with an oversized Nonce field, causing a data-plane process crash.

A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1. A compromised switch connected to the fabric can transmit crafted inband Fibre Channel vendor-unique CT (Common Transport) management requests to bypass administrative authentication. Successful exploitation allows an unauthorized peer switch to execute administrative actions on the target device, including resetting administrative passwords, initiating system reboots, and triggering firmware downloads.

Out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation in NXP MQX Classic before version 5.0. Improper enforcement of the receive buffer length may allow a crafted UDP packet to overflow the buffer, leading to memory corruption or denial of service.

Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an untrusted third party to access unintended memory regions, potentially leading to limited loss of confidentiality, integrity, and availability. All software versions from 07.18.00 onwards have fixed this problem.

Multiple stack-based buffer overflow vulnerabilities exist in the REST API management component of Brocade Fabric OS versions prior to 10.0.1. When processing API request payloads (such as device configuration attributes or port mapping requests) the REST API service fails to properly validate incoming array counts and string lengths against internal buffer capacities. An authenticated attacker with REST API access can transmit crafted, oversized request parameters to induce memory corruption on the execution stack. This may result in a denial-of-service condition (daemon crash) or potential arbitrary code execution within the management process context.

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.

Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted. This affects versions with the flawed permission evaluation logic.

An access control bypass vulnerability exists in the RBAC validation engine of Brocade Fabric OS before 10.0.1. The RBAC engine incorrectly categorizes non-standard action opcodes during permission checks, allowing authenticated read-only users to execute restricted administrative operations.

A command injection vulnerability in the REST API management interface of Brocade Fabric OS before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

A heap overflow vulnerability exists in Brocade Fabric OS before 10.0.1 when processing trunk configuration operations. The application parses user-supplied list strings into dynamically allocated heap arrays without boundary checks, allowing an authenticated administrator to cause heap corruption via crafted REST API requests.

WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in MFA. Unused OTPs remain valid indefinitely, allowing attackers to conduct brute force attacks by repeatedly guessing the code. A successful attack can lead to MFA bypass and unauthorized account takeover.

The Aurora Heatmap plugin for WordPress up to version 1.7.2 is vulnerable to Stored Cross-Site Scripting via the 'url' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an admin user clicks the injected heatmap link.

The LatePoint plugin for WordPress up to version 5.6.9 is vulnerable to Insecure Direct Object Reference. The process_step_customer() function uses only is_user_logged_in() as a gate before merging POSTed customer data into an existing LatePoint customer, without ownership checks. This allows authenticated attackers with Subscriber-level access or above to modify personal information of arbitrary LatePoint customers, and when contact_merge is 'phone', overwrite the victim's email and take over the account via password reset.

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 through 42.7.13 pads a value shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. These bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes with GSS encryption. The padding occurs when an application declares a length larger than the data it supplies through certain APIs. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data are not affected. Versions 42.7.3 and earlier pad with zeros.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

In pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11 through 42.7.13, the requireAuth property does not enforce restrictions when it excludes all known authentication methods (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none). The driver then accepts any method the server asks for, including cleartext password authentication. An attacker in a man-in-the-middle position can capture the database password. Version 42.7.14 fixes the issue.

In the AsyncHttpClient (AHC) library prior to versions 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.