CVE Vulnerability Catalog

An issue in Nodemailer smtp_server before v.3.18.3 allows a remote attacker to cause a denial of service via the SMTPStream._write and lib/smtp-stream.js components.

A buffer underflow vulnerability has been identified in the ogg123 utility from the vorbis-tools 1.4.3 package in function remotethread in remote.c. This vulnerability occurs in the remote control functionality when processing malformed input, leading to a stack buffer underflow that can cause application crashes and potentially allow code execution.

A vulnerability was found in the Linux kernel's ptrace mechanism related to the 'get_dumpable()' logic. This function, used for access permission checks, behaved incorrectly for threads without a memory descriptor (mm), potentially allowing unauthorized access to kernel thread details.

The PDF Export Module used in DHTMLX's products Gantt and Scheduler is vulnerable to Path Traversal due to lack of HTML sanitization. An unauthenticated user could craft the HTML payload which could include local files from the server and display them in the generated PDF.

CVE-2026-41964 describes a permission control vulnerability in a web application. Exploitation of this vulnerability may impact system availability.

The Quick Playground plugin for WordPress is vulnerable to Path Traversal in versions up to and including 1.3.3. This is due to insufficient path validation in the qckply_zip_theme() function, allowing a user-controlled 'stylesheet' parameter to be appended directly to the theme root directory path without sanitizing directory traversal sequences.

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 3.28.36. This is due to insufficient authorization checks in the role field update mechanism combined with overly permissive capabilities for the admin_form post type.

SzafirHost verifies the signature of the downloaded JAR file, but loads classes in a way that can lead to remote code execution. An attacker can combine a genuine, signed JAR file with a malicious ZIP file, allowing the malicious class to be loaded despite successful verification.

Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands on the staging or target host.

The FOX – Currency Switcher Professional plugin for WooCommerce in WordPress is vulnerable to unauthorized data loss due to a missing capability check on the 'admin_head' function in all versions up to and including 1.4.5. This allows authenticated attackers with Contributor-level access and above to delete the entire multi-currency configuration.

VMware Fusion contains a TOCTOU (Time-of-check Time-of-use) vulnerability that occurs during an operation performed by a SETUID binary. A malicious actor with local non-administrative user privileges may exploit this vulnerability to escalate privileges to root on the system where Fusion is installed.

In the Linux kernel, the ksmbd filesystem has a vulnerability due to missing validation of SID length in inherited ACE entries. A malformed ACE can advertise more subauthorities than present, leading to out-of-bounds read by compare_sids() and potential buffer overflow when computing inherited ACE size.

A cross-site request forgery vulnerability exists in Musetheque V4 for IPKNOWLEDGE V4L1 rev2203.0 and earlier. If a user views a malicious page while logged in, unexpected operations may occur.

A vulnerability in Zen 2-based processors arises from improper isolation of shared resources within the CPU operation cache. This allows an attacker to corrupt instructions executed at a different privilege level, potentially leading to privilege escalation.

Improper verification of cryptographic signature in the Radeon RGB tool could allow a malicious file placed in the installation directory to be run with elevated privileges potentially leading to arbitrary code execution.

A DLL hijacking vulnerability in the AMD Cleanup Utility could allow an attacker to achieve privilege escalation potentially resulting in arbitrary code execution.

Improper isolation of VCN-JPEG HW register space could allow a malicious Guest Virtual Machine (VM) or a process to perform unauthorized access to the register space of the JPEG cores assigned a victim VM/process, potentially gaining arbitrary read/write access to the victim VM/process data.

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. An attacker can exploit an OpenSSL configuration file to trick the high-privilege service into executing arbitrary commands.

A vulnerability in mlflow/mlflow versions 3.9.0 and earlier allows unauthenticated access to certain FastAPI routes when the server is started with authentication enabled. Issues with the authentication mechanisms lead to a bypass of protections on routes such as the Job API and the OpenTelemetry trace ingestion API.

An out of bounds write in the AMDGV_CMD_GET_DIAG_DATA ioctl handler could allow a local user to escalate privileges via remote code execution.