CVE Vulnerability Catalog

Multiple OS Command Injection vulnerabilities exist in the management interface and session processing routines of Brocade Fabric OS versions before 10.0.1. Input processing flaws during remote management connection validation and session verification for directory-based user accounts allow untrusted input containing shell metacharacters to reach internal system execution wrappers. An authenticated user or a compromised directory service account can exploit these vulnerabilities to execute arbitrary operating system commands with elevated privileges on the target device.

The Uncanny Automator – AI + Automation for WordPress | AI Agent, AI Page Builder, Free AI Usage Included plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.6.1.1 via deserialization of untrusted input. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject a PHP Object when a third-party integration plugin (such as PeepSo, MailPoet, WPForms, etc) is installed and a recipe is configured that stores attacker-controlled data as trigger meta. The additional presence of a POP chain within Uncanny Automator allows attackers to delete arbitrary files on the server.

Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obtain deployment permissions beyond those actually granted. This affects versions with the flawed permission evaluation logic.

An access control bypass vulnerability exists in the RBAC validation engine of Brocade Fabric OS before 10.0.1. The RBAC engine incorrectly categorizes non-standard action opcodes during permission checks, allowing authenticated read-only users to execute restricted administrative operations.

A command injection vulnerability in the REST API management interface of Brocade Fabric OS before 10.0.1 allows an authenticated user to execute arbitrary system commands via crafted input parameters.

A heap overflow vulnerability exists in Brocade Fabric OS before 10.0.1 when processing trunk configuration operations. The application parses user-supplied list strings into dynamically allocated heap arrays without boundary checks, allowing an authenticated administrator to cause heap corruption via crafted REST API requests.

WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in MFA. Unused OTPs remain valid indefinitely, allowing attackers to conduct brute force attacks by repeatedly guessing the code. A successful attack can lead to MFA bypass and unauthorized account takeover.

The Aurora Heatmap plugin for WordPress up to version 1.7.2 is vulnerable to Stored Cross-Site Scripting via the 'url' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute when an admin user clicks the injected heatmap link.

The LatePoint plugin for WordPress up to version 5.6.9 is vulnerable to Insecure Direct Object Reference. The process_step_customer() function uses only is_user_logged_in() as a gate before merging POSTed customer data into an existing LatePoint customer, without ownership checks. This allows authenticated attackers with Subscriber-level access or above to modify personal information of arbitrary LatePoint customers, and when contact_merge is 'phone', overwrite the victim's email and take over the account via password reset.

The PostgreSQL JDBC Driver (pgjdbc) versions 42.7.4 through 42.7.13 pads a value shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. These bytes are messages the driver sent earlier on the same connection: SQL text and parameter values of recent statements, which on a pooled connection can come from other requests. Each padded value can carry up to 8192 bytes of this traffic, or 16320 bytes with GSS encryption. The padding occurs when an application declares a length larger than the data it supplies through certain APIs. An attacker who can make the application store such a value and read it back can collect earlier traffic. Applications whose declared lengths always match their data are not affected. Versions 42.7.3 and earlier pad with zeros.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

Vault and Vault Enterprise did not consistently evaluate ACL policies against the canonical form of resource and policy names. This may allow an authenticated user with delegated permissions to bypass an explicit deny restriction and access a protected resource or assign a denied policy, potentially leading to privilege escalation. This vulnerability (CVE-2026-89322) is fixed in Vault Community Edition 2.1.2, and Vault Enterprise 2.1.2, 1.21.12, 1.20.17, and 1.19.23.

In pgjdbc (PostgreSQL JDBC Driver) versions 42.7.11 through 42.7.13, the requireAuth property does not enforce restrictions when it excludes all known authentication methods (e.g., requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none). The driver then accepts any method the server asks for, including cleartext password authentication. An attacker in a man-in-the-middle position can capture the database password. Version 42.7.14 fixes the issue.

In the AsyncHttpClient (AHC) library prior to versions 3.0.12 and 2.16.1, a proxied ws request is carried through CONNECT, but NettyRequestFactory.newNettyRequest and requestUri decide whether to attach proxy authentication and an absolute-form target only from whether the URI is secure. Because ws is not marked secure, the tunneled WebSocket upgrade sent to the origin includes the proxy's Proxy-Authorization value. Basic credentials are directly recoverable and Digest responses can be replayed or cracked offline. This issue is fixed in versions 3.0.12 and 2.16.1.

The AsyncHttpClient (AHC) library prior to 3.0.12 and 2.16.1 has a vulnerability in WebSocketHandler.upgrade that aborts a handshake with missing or invalid Sec-WebSocket-Accept but continues into pipeline installation and onOpen delivery. Frames coalesced with the invalid 101 response can be decoded and delivered from a peer that did not prove the handshake, although the request future fails and the channel closes. This issue is fixed in versions 3.0.12 and 2.16.1.

The AsyncHttpClient (AHC) library before versions 3.0.12 and 2.16.1 generates the HTTP Digest client nonce using ThreadLocalRandom instead of a cryptographically secure random source. This makes the authentication mechanism vulnerable to chosen-plaintext and credential precomputation attacks.

Vulnerability in AsyncHttpClient (AHC) library before versions 3.0.13 and 2.16.1 allows cross-host request replay that updates the current request but leaves the target request and proxy context pointing to the original origin. This can send the original host's path, Host header, Authorization credentials, or plaintext request to the replay destination.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. Prior to 3.0.13 and 2.16.1, the HTTP/1.1 connection-pool key excludes the authenticated principal for connection-oriented NTLM and Negotiate authentication. A pooled socket authenticated for one request can be reused by a request carrying another principal, and the server executes that later request as the first identity. Basic and Digest are not affected because they authenticate each request. This issue is fixed in versions 3.0.13 and 2.16.1.

In the AsyncHttpClient (AHC) library prior to versions 3.0.13 and 2.16.1, ThreadSafeCookieStore validates Domain attributes with domain matching but does not reject public suffixes. A host beneath a suffix such as co.uk can set a cookie for that suffix, after which the shared cookie store sends it to unrelated hosts under the suffix. This can inject or overwrite session-relevant cookie values across origins. This issue is fixed in versions 3.0.13 and 2.16.1.

The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. In 3.0.12, a peer offering only Digest qop=auth-int causes mutual-authentication verification to be skipped. AuthenticatorUtils.computeExpectedRspAuth returns no expected value for auth-int, and Interceptors treats that result as unverifiable but nonfatal, so a response with an invalid rspauth value is accepted. A peer that does not know the shared secret can therefore be accepted as the authenticated server. This issue is fixed in version 3.0.13.