CVE Vulnerability Catalog

The Email JavaScript Cloak plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'email' shortcode in all versions up to and including 1.03 due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the `value` parameter of the `arf_save_incomplete_form_data` AJAX action in all versions up to and including 7.1.3 due to insufficient input sanitization and output escaping.

In a vulnerability in Google go-attestation, the parseEfiSignatureList() function improperly validates indices, allowing attacker-controlled vendor header bytes to be appended to the trusted SHA256 hash list. This could lead to a remote attestation verifier accepting a compromised boot state.

Style Dictionary, a build system for creating cross-platform styles, has a prototype pollution vulnerability from version 4.3.0 to 5.4.4. Users are at risk with direct or indirect usage of the API, especially in NodeJS server applications.

The vulnerability in Anthropic Claude Desktop (versions v1.1348.0 through v1.2278.0) involves missing integrity verification of the Cowork VM root filesystem image. A local attacker with unprivileged access to the macOS user account can modify the rootfs.img image, which will be trusted on subsequent VM boots, enabling persistent arbitrary code execution in the VM and access to host-mounted directories.

Incorrect check of function return value in Caliptra Core Runtime Firmware allows bypass of MCU FW verification during hitless updates.

FlatPress contains a stored cross-site scripting vulnerability in comment and contact forms where name, URL, and email fields are rendered without proper output encoding in Smarty templates. Attackers can inject arbitrary HTML and JavaScript through these fields.

A vulnerability in Python's 'tarfile' module occurs when opening an archive in streaming mode (mode='r|'). The module improperly handles EOF, causing archive parsing to take exponentially longer.

A vulnerability in jackson-databind allows bypassing the allowlist in BasicPolymorphicTypeValidator. The allowIfSubTypeIsArray() method permits any array type without validating the component type, enabling deserialization of dangerous types like EvilType[] even if EvilType is not allowlisted.

Vulnerability in jackson-databind allows bypassing the PolymorphicTypeValidator (PTV) during polymorphic deserialization. When a type contains generic parameters (e.g., ArrayList<Gadget>), validation only checks the container name, not nested types, enabling loading a denied class as a generic parameter.

A vulnerability in jackson-databind from version 2.13.0 to 2.14.0 allows a DoS attack by sending deeply nested JSON (thousands of levels) read as JsonNode and written via toString(). Even small requests (1000 nested arrays is 2kB) can significantly consume system resources.

NocoDB prior to version 2026.05.1 has a vulnerability that allows users with editor role to inject malicious JavaScript code through the form's redirect_url field. When an authenticated user opens the shared link, this code can be executed in the context of NocoDB.

NocoDB prior to version 2026.05.1 allowed authenticated commenters to store HTML in row comments, resulting in script execution when other users hovered over the comment in expanded view. Lack of server-side sanitization enabled the injection of malicious code.

Spring Statemachine has a vulnerability in Kryo-based backends that deserialize state-machine contexts without enforcing a class allowlist. This can lead to remote code execution within the application JVM.

In FOSSBilling versions 0.7.2 and prior, a query-construction flaw in client list endpoints allowed authenticated clients to bypass tenant scoping and retrieve other clients’ data. The issue stemmed from improper grouping of filters in queries, allowing OR clauses to be evaluated independently of the enforced client_id constraint.

A session management vulnerability was found in the foreman-mcp-server. Unauthenticated attackers can hijack active administrative sessions due to improper caching of authenticated client connections, trusting a non-secret session ID without re-validating authentication tokens, and logging all newly created session IDs to standard logs.

In Traefik versions from 3.7.0-ea.1 to 3.7.5, a medium severity vulnerability was found in the Kubernetes Ingress NGINX provider. When an Ingress explicitly enables BasicAuth or DigestAuth via auth-type and auth-secret annotations, but the referenced Secret cannot be resolved or parsed, Traefik logs the error, skips installing the authentication middleware, and still emits a router to the backend. This results in a protected route being published without access control, allowing unauthorized access.

Vulnerability in Traefik (versions prior to 3.6.21 and 3.7.5) in the Kubernetes Gateway provider affects the crossProviderNamespaces allowlist. For HTTPRoute rules with multiple backendRefs (WRR), Traefik incorrectly evaluates the allowlist against the target backendRef.namespace instead of the route's own namespace. This allows an HTTPRoute from a non-allowlisted namespace to reference internal Traefik services (e.g., api@internal) by pointing backendRef.namespace at an allowlisted namespace covered by a ReferenceGrant.

A vulnerability in rtk (versions before 0.42.2) allowed bypassing the permission control mechanism by hiding a second command within Bash shell constructs that were not properly split or rejected. A command starting with an allowed prefix (e.g., 'git') could contain a hidden command that executed without required user authorization.

Pi is a minimal terminal coding harness. From versions 0.74.0 to 0.78.1, temporary npm or git extension package installs used predictable paths under the operating system's temporary directory, allowing a local attacker to inject malicious code.