CVE Vulnerability Catalog

node-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.

Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arbitrary maintenance windows to silence alerts, modify notification channels, and delete monitor check history to erase incident evidence.

Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated users to inject arbitrary PostgreSQL expressions into ORDER BY clauses. Attackers can use time-based and boolean-based blind SQL injection techniques to extract sensitive database content including password hashes from other tenants. This is an incomplete fix for CVE-2026-25947.

Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Development Kit (aws-fpga) before 2.3.4 might allow local users to execute arbitrary code with root privileges via crafted shell content placed at a predictable path in a world-writable temporary directory, which the installation step reads after elevating its own privileges. To remediate this issue, users should upgrade to version 2.3.4.

Incorrect Authorization in Kibana can lead to unauthorized configuration modification via exploiting incorrectly configured access control security levels.

Incorrect Authorization in Kibana can lead to privilege escalation via input data manipulation. Elasticsearch cluster privilege declarations from integration packages were not validated before being used to mint credentials for enrolled Elastic Agents.

c-ares is an asynchronous resolver library. From version 1.32.3 until 1.34.7, a use-after-free / double-free vulnerability exists in query-completion handling. The same flaw is present at multiple points in the resend/finish path.

A potential security vulnerability in HP Support Assistant for versions prior to 9.53.2.0 could allow a local attacker to escalate privileges due to insufficient access controls.

A security vulnerability has been detected in itsourcecode Online Medicine Delivery System 1.0. The function Order::pupdate in the file /rider/orders/controller.php?action=edit&actions=confirm is affected by SQL injection via manipulation of the ID argument.

Improper neutralization of special elements in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services codecatalyst-blueprints before 0.3.156 might allow a user with commit permission to execute arbitrary commands via shell metacharacters in the owner field of a [local] merge strategy entry.

Substance3D - Sampler is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction – the victim must open a malicious file.

GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server.

Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager versions up to 9.17.

Unauthenticated Broken Access Control in Quick Event Manager versions up to 9.17.

Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping versions up to 1.22.3.

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages versions up to 2.15.27.

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents versions up to 1.51.0.

Unauthenticated Denial of Service Attack in Migrate Guru – Site Migration & Cloning versions up to 6.65.

Unauthenticated Broken Authentication in Really Simple SSL versions up to 9.8.0.

Unauthenticated Denial of Service (DoS) attack in MalCare Security versions up to 6.69. An attacker can cause service unavailability without an account.