CVE Vulnerability Catalog

Blosc C-Blosc2 up to 3.3.2 has an integer overflow vulnerability in the function blosclz_decompress in blosc/blosclz.c of the blosclz Decompression component. The attack can be launched remotely but is difficult to exploit. Upgrading to version 3.3.3 fixes the issue.

Astro is a web framework for content-driven websites. Prior to version 11.1.3, the @astrojs/node adapter builds a request URL from the Host header, and a malformed port can make that URL invalid. The recovery path reuses the same malformed host and throws an uncaught TypeError: Invalid URL before routing begins. In the default standalone configuration, the request returns an HTTP 500 response and the server continues running, but when staticHeaders is enabled the synchronous handler does not catch the exception and the Node process terminates. Proxies and CDNs that reject malformed Host headers prevent this path from reaching the origin. The issue affects availability only and does not expose data or permit code execution. This issue is fixed in version 11.1.3.

Astro from 5.2.0 to 8.2.4 has a vulnerability in the @astrojs/netlify adapter that generates regexes for Netlify Image CDN remote-image allowlists without anchoring them to the URL start. This allows an attacker to control the actual host while an allowed origin appears only in the path or query. An unauthenticated request to /.netlify/images can cause the Image CDN to request attacker-selected URLs, potentially probing internal services. Fixed in version 8.2.4.

MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash.

Path traversal / arbitrary file write vulnerability in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layers without validating that file paths resolve within the intended destination directory.

LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain 'corner case.'

A missing authorization check in the Vaadin Spreadsheet component allows an authenticated user of an application that renders a spreadsheet to add or replace cell comments on a sheet that has protection enabled, including on cells that are locked. Writing a comment to a cell that does not exist yet also creates the row and the cell.

A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the application does not control into a chart configuration or into a component's i18n property writes onto Object.prototype, making the injected properties visible to every object in the running application.

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG allows SQL Injection. This issue affects SOPLOG: before Soplog 2026.9.4.1.

GraphicsMagick up to 1.3.47 has an uncontrolled recursion vulnerability in the function ExtractPostscript in coders/wpg.c of the WPG File Handler component. The attack can be initiated remotely. The patch is named 627b5b1b2fc2.

The MPG plugin in versions up to and including 4.2.3 allows an unauthenticated user to access sensitive data. The lack of required authentication enables exposure of confidential information.

The Cool Formkit Lite plugin in versions up to and including 2.7.8 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This allows injection of a malicious script into the site.

The Razorpay Payment Links for WooCommerce plugin in versions up to and including 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF) without requiring authentication. An unauthenticated attacker can force a victim to perform unwanted actions.

The King Addons for Elementor plugin in versions up to and including 51.1.86 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

Contributor SQL Injection vulnerability in Media Library Assistant versions up to 3.41.

The YITH WooCommerce Tab Manager plugin in versions up to and including 2.15.0 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Author privileges. This allows injection of a malicious script into the site.

The Quiz And Survey Master (quiz-master-next) WordPress plugin contains a DOM-Based Cross-site Scripting vulnerability due to improper neutralization of input during web page generation. The issue affects versions up to and including 11.2.6.

The OAuth Server plugin in versions up to and including 4.5.1 contains a Cross Site Scripting (XSS) vulnerability exploitable by a user with Contributor privileges. This enables injection of a malicious script into the site.

The Event Tickets plugin (Liquid Web / StellarWP) is vulnerable to SQL Injection (Blind SQL Injection) due to improper neutralization of special elements in SQL commands. This issue affects Event Tickets from n/a through 5.29.5.

The Strong Testimonials plugin (up to version 3.3.11) has a Stored XSS vulnerability due to improper input neutralization during web page generation. An attacker can inject malicious scripts that execute in other users' browsers.