CVE Vulnerability Catalog

HCL iControl is affected by missing access control. The application failed to enforce proper granular access controls, allowing users to access administrator-level functionalities without appropriate authorization.

Sharp and Toshiba Tec MFPs cache print data internally and leave it uncleared. It may be accessed later by other users.

A vulnerability was identified in Meesho Online Shopping App up to 20260607 on Android. The component com.meesho.supply stores user_id, phone number, email address, and name in cleartext. The attack requires physical access to the device.

The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allowing users with contributor-level access and above to read daily revenue figures normally restricted to administrators and report managers.

The 'Classified Listing' WordPress plugin before version 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowing users with contributor-level access and above to read the content of any post, page, or custom post type on the site — including drafts, pending, and private posts owned by other users — regardless of ownership.

The Tag, Category, and Taxonomy Manager WordPress plugin before version 3.51.0 does not verify that a user is authorized to access a referenced post before processing it and returning derived data. This allows users with contributor privileges to disclose data from private or draft posts they do not own.

In ggml-org llama.cpp (commit e15efe0), a vulnerability in the Jinja Minja Template Parser (parser.cpp) allows a reachable assertion via input {{9|9|{. Local access is required.

In Zephyr's Bluetooth Mesh subnet key management, one PSA Crypto key slot leaks on every subnet-key teardown. net_keys_create() imports the Private Beacon Key into a PSA key slot, but subnet_keys_destroy() guarded psa_destroy_key() with CONFIG_BT_MESH_V1d1, which was removed, so the slot is never freed. With the default 16 slots, after roughly 12 add/delete or key-refresh cycles the slot pool is exhausted, preventing new subnet creation and causing errors for other PSA Crypto consumers.

The Simple Restrict WordPress plugin before version 1.2.9 does not enforce its content-restriction permission check on the REST API the way it does on the front end. Instead, it relies on a generic capability check, allowing users with contributor-level access or above to read the content of restricted posts and pages they were never granted access to.

better-auth versions before 1.6.11 fail to delete cached sessions when removing users via admin, anonymous, or SCIM endpoints when secondaryStorage is configured and storeSessionInDatabase is false. Attackers can reuse deleted user session tokens to maintain authentication for up to seven days after account deletion.

Axios before version 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option objects when the JavaScript process's Object.prototype has already been polluted by another component. While the top-level merged config uses a null prototype, nested plain objects such as auth and paramsSerializer are cloned into ordinary objects and read without own-property checks. When an application passes placeholder nested objects such as auth: {} or paramsSerializer: {}, inherited username/password values can cause silent injection of an Authorization: Basic header, and inherited encode/serialize values can alter query-string serialization (full serializer replacement requires a function-valued pollution primitive). This is exploitable only in the presence of pre-existing prototype pollution.

FreeRDP before 3.29.0 contains an out-of-bounds heap read vulnerability in the UVC H.264 extension-unit parser that fails to validate descriptor length before accessing the GUID field. A local attacker with a malicious USB video camera can trigger a heap read beyond allocated bounds during camera stream setup, causing denial of service.

better-auth versions greater than 1.3.34 and before 1.4.0 contain a vulnerability in the multi-session plugin's /sign-out after-hook, which trusts raw multi-session cookies and forwards extracted values to internalAdapter.deleteSessions without verifying the cookie signature. An attacker can supply a forged _multi-* cookie to trigger deletion of arbitrary session tokens.

The Event Tickets and Registration WordPress plugin before version 5.29.0.1 does not properly verify authorization on some of its seating actions, allowing users with contributor-level access and above to overwrite the seating layout, ticket inventory, and attendee seat assignments of events they do not own.

The Booking for Appointments and Events Calendar WordPress plugin before version 2.4.4 does not restrict which fields can be written during customer import. A user with the Amelia Manager role can modify arbitrary columns of any stored user record by supplying them in the import request.

The Fluent Support WordPress plugin before version 2.3.1 does not perform a per-ticket access check before reassigning a ticket's customer. A restricted support agent can change the assigned customer of any ticket in the system, including tickets outside their granted scope.

The Brizy WordPress plugin before version 2.8.18 does not properly verify authorization on a request handler before returning post content. Users with the Contributor role or higher can read the content of arbitrary posts, including other users' private, pending, and draft posts.

The Builderall for WordPress plugin before 3.0.2 does not bind the state value of its public OAuth authentication routes to the initiating user session, allowing unauthenticated attackers to complete the connection flow and overwrite the stored third-party integration access token.

The Spectra Legacy WordPress plugin before 2.20.0 does not validate or escape several block style attributes before using them to build the CSS it outputs on the front end, allowing users with the Contributor role and above to inject arbitrary CSS into the pages that render the affected block.

In the sigstore-go library prior to version 1.2.1, a bundle signing timestamp is not checked against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate. This allows an attacker holding expired key material to sign accepted bundles.