CVE Vulnerability Catalog

The Firebase Authentication WordPress plugin before 1.7.1 does not require the email address in an authentication token to be verified before matching it to a WordPress account and issuing a session, allowing unauthenticated attackers to log in as any user, including administrators.

The Slider Hero with Video Background, Animation WordPress plugin before 9.1.3 does not have authorisation and nonce checks on two of its request handlers, and does not escape a stored setting before outputting it, allowing unauthenticated users to store malicious JavaScript which will be executed in the context of an administrator viewing the plugin's admin area, as well as any visitor of a page embedding a slider.

The Forminator Forms WordPress plugin before version 1.57.0.5 does not restrict a network-wide setting to network administrators. An administrator of any single site on a multisite network can execute arbitrary code across the entire network.

The ManageWP Worker WordPress plugin before version 4.9.37 does not bind the account being logged in to the signature authorizing the login, nor prevent an already used login link from being replayed. Attackers who obtain such a link can gain a session as any user on the site, including an administrator.

The WPeMatico RSS Feed Fetcher plugin for WordPress up to version 2.8.24 is vulnerable to unauthorized data modification due to a missing capability check in the wpematico_import_settings function. Authenticated attackers with subscriber-level access or above can update arbitrary options on the WordPress site, potentially leading to privilege escalation.

The Tie::Hash::Regex module for Perl before version 2.0.0 throws an exception on unparseable lookup keys. The FETCH, EXISTS, and DELETE methods throw an exception when the key is an invalid regular expression, potentially causing application termination.

WeeChat versions 0.3.1 through 4.9.0 use non-constant-time string comparison functions (weechat_strcasecmp and strcmp) to verify password hashes and plaintext passwords in relay authentication. An attacker can exploit timing differences to extract the server-computed hash character by character, then authenticate without knowing the password. Version 4.9.1 fixes the issue.

FORT Validator versions through 1.6.7 contain an origin-validation error in RRDP processing: a delegated CA under the same TAL can reference a victim CA's public RRDP notification and snapshot URLs, causing FORT's URL-based download cache to report success after deleting the victim's local snapshot. This can silently remove the victim's VRPs and other signed objects from FORT's output, potentially enabling route hijacking or loss of reachability. Version 1.6.8 contains a patch that rejects cross-origin RRDP snapshot and delta URLs.

Recce before version 1.50.0, in OSS server deployments exposed to an untrusted network without authentication, is vulnerable to unauthenticated SQL execution through the query run API. When Recce is configured with a DuckDB-backed project, an attacker can use DuckDB filesystem primitives to read and write files accessible to the Recce server process.

Arc Enterprise prior to version 26.06.1 validates only the wire-format envelope (length, opcode) of inbound messages in the cluster replication receiver. The MsgReplicateSync payload is accepted without any application-layer authentication (no HMAC, signature, or per-message nonce). Transport-layer TLS/mTLS does not protect against application-layer tampering or replay. Fixed in 2026.06.1.

Arc Enterprise prior to version 26.06.1 accepts attacker-chosen file paths in manifest-registration proposals in the Raft FSM without validating them against the configured storage backend. The only check is that the path is non-empty; there is no parent-traversal rejection, allowlist, scheme restriction, or length bound. Fixed in 2026.06.1.

Arc versions prior to 26.06.1 register Go's net/http/pprof handlers at /debug/pprof/* and add /debug/pprof to PublicPrefixes, making these endpoints reachable without authentication. Version 26.06.1 contains a patch. Workarounds include blocking /debug/pprof* at a reverse proxy or restricting the API port to trusted networks.

Arc prior to version 26.06.1 blocked only read_parquet( and arc_partition_agg( via regex denylist in the user-SQL validator. Other DuckDB I/O functions (read_csv, read_json, glob, etc.) were not blocked. RBAC table-reference extraction only inspected FROM/JOIN clauses, so scalar table functions in SELECT slipped past. Fixed in 26.06.1 via a structural sandbox at the DuckDB layer.

Combodo iTop prior to 3.2.3 only protects classes present in the SELECT clause with the silos access check in OQL. This issue has been fixed in version 3.2.3.

RaTeX prior to version 0.1.11 panics on the 9-byte input \verbéxé because the parser slices the verbatim argument with byte indices, and index 1 lands inside a multibyte UTF-8 character. Since the release profile sets panic = "abort", the panic aborts the entire process, causing a hard denial of service. Version 0.1.11 fixes the issue.

LeafWiki versions 0.3.0 through 0.10.0 have a path traversal vulnerability in the asset rename functionality. An authenticated user with editor permissions could move files accessible to the LeafWiki server process into a page's asset directory, potentially allowing sensitive local files, such as the application database, to become downloadable. Users should update to version 0.10.1 or greater.

LeafWiki versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user can change their own role from e.g. 'viewer' to 'admin'. This requires a valid LeafWiki account.

Combodo iTop before version 3.2.3 has an authentication bypass vulnerability. An unauthenticated remote attacker can execute arbitrary PHP files from the env-production directory on a new iTop instance in the production environment.

Combodo iTop before version 3.2.3 has a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. An attacker can inject malicious script into query parameters.

Combodo iTop before version 3.2.3 allows users to access unauthorized object information through the search operation. A user can read data they are not permitted to see.