CVE Vulnerability Catalog

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer versions up to 8.7.6. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT versions up to 7.5.1. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in RTMKit versions up to 2.1.5. An attacker can inject malicious script without authentication.

Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache versions up to 7.9. An attacker can send requests from the server to internal resources without authentication.

Unauthenticated Settings Change in WP Compress versions up to 7.21.28. An attacker can change plugin configuration without authentication.

Subscriber Privilege Escalation in WCFM Membership versions up to 2.11.11. A user with subscriber role can gain higher privileges.

Contributor PHP Object Injection in RTMKit versions up to 2.1.5. A user with contributor role can inject malicious PHP objects.

In the current development version of Eclipse aeriOS, for which no official release has yet been published, the Federator component disables TLS certificate validation for outbound HTTPS connections by default. When the TLS_CERTIFICATE_VALIDATION environment variable is unset or set to false, the component configures its HTTP transport to skip TLS certificate verification. As a result, an attacker able to intercept network communications between the Federator and external services could impersonate those services and intercept sensitive information transmitted over HTTPS, including OAuth client credentials and bearer tokens. The issue has been addressed by enabling TLS certificate validation by default. The TLS_CERTIFICATE_VALIDATION environment variable is now set to true in the default configuration provided by the Helm chart and Docker Compose deployment.

Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX versions up to 3.8.8. An attacker can inject malicious script without authentication.

Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension versions up to 3.3.26.

Unauthenticated Cross Site Scripting (XSS) in Calculation For Contact Form 7 versions up to 1.0.

Unauthenticated Cross Site Scripting (XSS) in Under Construction versions up to 5.82.

Unauthenticated Cross Site Scripting (XSS) in Simple Payment versions up to 2.5.1.

A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of OTP verification attempts. The email_otp() endpoint did not apply brute-force protection, enabling repeated guessing of OTP and potential bypass of the additional authentication factor.

A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and irreversible operation while accepting HTTP GET requests. An attacker could cause an authenticated user with sufficient privileges to invoke the endpoint, leading to deletion of published empty events.

A vulnerability was detected in SeaCMS up to 13.6. The function addslashes in the file weixin/index.php of the WeChat Module is affected. Manipulation of the argument Content results in SQL injection, which can be launched remotely.

A security vulnerability has been detected in SeaCMS up to 13.6. The function parseIf in the file seacms_locoy_news.php of the Locoy Collector component is affected. Manipulation of the argument pwd leads to code injection, and the attack can be initiated remotely.

ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage this vulnerability to gain limited read and write access. The vulnerable component is restricted to an administrative network zone by default. Exploitation does not require user interaction. Scope is changed.

A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v1 Token store dropped its internal owner filter instead of returning an empty result. Any authenticated user could therefore list and watch every other user's tokens, disclosing token metadata and the stored salted hash of the bearer token. This issue affects Rancher before 2.15.1.

A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed assertion IDs in a per-process cache, so each replica only detected replays that reached the same pod. In a high-availability deployment, an attacker holding a captured assertion could replay it once against every other replica to obtain additional authenticated sessions as the victim. This issue affects Rancher before 2.15.1.