CVE Vulnerability Catalog

A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request.

The Ultimate Maps plugin by Supsystic in versions up to 1.5.5 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can exploit this flaw to gain unauthorized access.

Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields versions <= 3.3.8.

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder versions <= 3.6.5.4.

Contributor PHP Object Injection in Photo Gallery by 10Web versions <= 1.8.46.

Subscriber Cross Site Scripting (XSS) in Branda versions <= 3.4.32.

The Optimole WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.2.14.

PHP Object Injection vulnerability in Nested Pages plugin up to version 3.3.2. Allows an attacker to inject malicious PHP objects.

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid versions <= 1.27.14.

A missing authentication vulnerability in the firmware update mechanism of PTZOptics cameras and the Firmware Upgrade Tool allows an unauthenticated user to install modified firmware without administrator credentials. This affects many camera models and all versions of the Upgrade Tool.

In Tugtainer prior to version 1.30.6, an authenticated user can make the backend server send outbound HTTP requests to arbitrary user-supplied URLs through the notification test endpoint. The /settings/test_notification endpoint accepts a urls field and passes it directly to Apprise without restricting protocols, hostnames, localhost, private IP ranges, or cloud metadata addresses. This can be abused as an authenticated blind SSRF.

In Tugtainer Agent prior to version 1.30.4, when AGENT_SECRET is not configured, Docker management APIs are accessible without authentication. The signature verification function in agent/auth.py returns success if Config.AGENT_SECRET is empty, making protected APIs accessible without authentication.

In Tugtainer prior to version 1.30.3, OIDC authentication can still be initiated even when OIDC_ENABLED=false. The /auth/oidc/enabled endpoint correctly reports that OIDC is disabled, but a direct request to /auth/oidc/login still starts the OIDC login flow, returns HTTP 302, sets an oidc_state cookie, and redirects to the OIDC authorization endpoint. This bypasses the intended OIDC disable switch.

CloudTAK versions prior to 13.10.0 contain a Server-Side Request Forgery (SSRF) vulnerability in the ESRI route family (api/routes/esri.ts). These routes accept an attacker-controlled URL and fetch it without any validation against private, loopback, or link-local ranges. Any authenticated user can force the CloudTAK server to make requests to internal resources, and the responses are returned to the attacker.

In Soft Machine versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth() and authenticateWorkspaceHttp() — accept the global CONTAINER_SHARED_SECRET as a bearer token without verifying which workspace the caller belongs to. Because that secret is set identically on every container in the Fly app and is reachable from the user-facing process environment, any tenant can use it to authenticate to any other tenant's workspace API. This results in cross-workspace read, write, and destructive-restore primitives.

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP service that listens on 0.0.0.0:8080 inside each sm-ws-* Fly Machine exposes endpoints (/health, /file/<path>, /archive/<dir>) without any authentication or origin check. Any host that can reach TCP/8080 on a workspace can read arbitrary files under that workspace's /workspace root and download whole project trees as tar archives. Because every workspace shares the same Fly private 6PN and resolves all peer addresses via the unauthenticated _instances.internal TXT record, every other sm-ws-* machine on the same Fly app/org is a reachable, unauthenticated attacker — the trust boundary (workspace owner ↔ everyone-else) is missing. At time of publication, there are no publicly known patches.

ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a missing parameter check in SSLObject, if the server_hostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to programs where certificate hostname verification *appeared* to be succeeding with SSLContext.check_hostname = True and no ValueError being raised due to misconfiguration.

A remote, unauthenticated TLS client can crash a server or trigger a use-after-free if its sni_callback assigns a different context to SSLSocket.context (the documented way to select a certificate per server name) and nothing else keeps the original ssl.SSLContext alive. Typical cases are servers that create an SSLContext per connection or replace it while connections are open; servers that wrap their listening socket with it are not affected. Mitigation: keep a reference to every SSLContext that sets sni_callback for the lifetime of the server. TLS clients are not affected.

Stored XSS vulnerability in the WikiForum extension for MediaWiki. Improper neutralization of script-related HTML tags allows persistent script injection. Affects master version.

XSS vulnerability in the Collection (Book) extension for MediaWiki. Improper neutralization of HTML tags allows XSS targeting non-script elements. Affects versions 1.46, 1.45, and 1.43.