CVE Vulnerability Catalog

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 2.1.45 due to insufficient input sanitization and output escaping.

The BetterDocs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of the Gutenberg block in versions up to 4.5.3. This is due to insufficient input sanitization and output escaping in the CategorySlateLayout::render() method.

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to and including 2.8.7. This allows unauthenticated attackers to make web requests to arbitrary locations, enabling access to internal services.

A vulnerability has been identified in armeria-xds versions 1.38.0 through 1.39.0, where DataSourceStream in the xDS module can resolve control-plane-supplied filenames and environment variables without restriction.

The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 5.4.2. This is due to a missing capability/ownership check on the gallery_image_update_as_feature AJAX handler, allowing authenticated attackers to change the featured image of arbitrary listings they do not own.

Canonical MicroCeph versions from the squid and tentacle track are vulnerable to a path traversal issue in the remote-import API. Holders of a trusted cluster mTLS certificate or join token can manipulate files in an imported remote cluster.

The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 3.1.39. This is due to the plugin not properly verifying that a user is authorized to perform an action, allowing unauthenticated attackers to process SAR requests using any victim email address.

The User Admin Simplifier plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 3.0.0. This is due to missing or incorrect nonce validation on the useradminsimplifier_options_page function, allowing unauthenticated attackers to reset and permanently delete users' menu and admin-bar configurations.

An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection.

An attacker within BLE communication range can passively intercept wireless traffic and obtain sensitive health-related information, including glucose measurement values.

SQL injection vulnerability in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated directly into the SQL string with str.format() instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected PostgreSQL session to inject additional statements through that endpoint.

Open redirect vulnerability in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honored the user-supplied 'next' parameter without confirming the target points back to pgAdmin, allowing an authenticated user to be redirected to an external attacker-controlled host.

PraisonAI before 1.5.115 contains an information disclosure vulnerability in the MultiAgentLedger component that allows attackers to access sensitive data by registering agents with duplicate IDs. The lack of agent ID uniqueness enforcement enables sharing ledger instances and exposing system prompts and conversation history between agents.

PraisonAI versions before 1.5.128 cache tool approval decisions based only on tool name, not invocation arguments, allowing subsequent execute_command calls to bypass approval prompts.

phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController, allowing unauthorized operations on four API endpoints.

Hashgraph Guardian up to version 3.6.0 contains a stored cross-site scripting vulnerability. Authenticated users with the STANDARD_REGISTRY role can inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attackers exploit unsanitized innerHTML assignment in the branding service to execute arbitrary JavaScript in every authenticated user's browser on every page load.

In OpenEXR versions 3.4.0 through 3.4.11, the HTJ2K decoder function ht_undo_impl() is vulnerable to a heap-buffer-overflow READ. It fails to validate that the tile/line dimensions from the codestream match the EXR header, leading to out-of-bounds reads from the OpenJPH line buffer. A crafted EXR file can cause a deterministic crash (DoS) or leak adjacent heap data.

In OpenEXR versions 3.4.0 through 3.4.11, an integer overflow in ht_undo_impl() in internal_ht.cpp leads to a heap-buffer overflow when decoding a crafted HTJ2K-compressed EXR file. The multiplication of channel width (int32_t) by bytes_per_element in 32-bit signed arithmetic can overflow, causing an out-of-bounds write. The same pattern appears in two other HTJ2K paths.

A vulnerability in libssh2 up to version 1.11.1 (fixed in commit 2dae302) causes an out-of-bounds heap read in the sftp_symlink() function in src/sftp.c. A malicious SSH server or man-in-the-middle attacker can send a crafted SSH_FXP_NAME response, leading to disclosure of heap memory contents or a crash.

A vulnerability in OpenBSD before commit 6a23123 (2026-06-18) in the mpls_do_error function within sys/netmpls/mpls_input.c allows remote attackers to read kernel stack memory by sending crafted MPLS frames with 16 labels and no Bottom-of-Stack bit set.