CVE Vulnerability Catalog

The GeoDirectory WordPress plugin before version 2.8.169 does not perform any authorization check when returning map marker data for a single requested listing, allowing unauthenticated users to disclose the title and exact geographic coordinates of non-public (pending or draft) listings.

A path traversal vulnerability exists in parisneo/lollms version 2.1.0, in the SPA catch-all route in `backend/routers/ui.py`. Improper handling of user-controlled path input, which is directly joined into a filesystem path without sanitization, allows an unauthenticated attacker to read arbitrary files on the server. This issue has been resolved in version 3.

In the Crypt::OpenSSL::PKCS12 library for Perl before version 1.98, there is a NULL pointer dereference vulnerability in the print_attribute function when handling a zero-length BMPSTRING attribute. The zero length causes the buffer to be freed and return NULL, and a subsequent strlen call on that pointer crashes the process.

Flowise through 3.1.4 contains a server-side request forgery vulnerability in the SSRF guard implemented in httpSecurity.ts, where the DEFAULT_DENY_LIST omits the Oracle Cloud Infrastructure metadata endpoint 192.0.0.192 and the Alibaba Cloud metadata endpoint 100.100.100.200, allowing authenticated attackers to force the server to issue arbitrary GET requests to cloud instance metadata services. Attackers can send requests to the fetch-links API endpoint with a crafted URL parameter, bypassing deny-list validation including redirect-based bypasses, to reach instance metadata services and expose instance identity data and role credentials on Oracle Cloud Infrastructure or Alibaba Cloud deployments, with unauthenticated access possible when URL-fetching nodes exist in public chatflows.

A heap-based buffer overflow vulnerability exists in the GIMP DDS (DirectDraw Surface) file parser. When a crafted DDS file declares a D3D9 pixel format but sets a lower bits-per-pixel (bpp) value in the header, the loader allocates an undersized heap buffer. Subsequent pixel data consumption at the real format's stride causes a write past the heap buffer boundary, leading to heap metadata corruption and potential code execution.

In the INQUIRELAB mcp-bridge-api project up to commit b30a82aa1d1d1139e0de846c41c8aadee6e06114, a command injection vulnerability was found in an unknown function in mcp-bridge.js of the Servers Endpoint component. Manipulating the command/args arguments allows remote command execution. The project uses rolling releases, so no version details are available.

The Solace Extra WordPress plugin before version 1.6.1 does not perform capability checks in several AJAX actions and exposes the nonce protecting them on admin pages accessible to low-privileged users. This allows users with roles as low as Subscriber to modify site-wide presentation settings and delete imported site-builder content.

The WP Directory Kit WordPress plugin before version 1.5.5 does not perform authorization or nonce checks on one of its authenticated AJAX actions, allowing any authenticated user such as a Subscriber to disclose the plugin settings including sensitive API keys and secrets.

The WP Directory Kit WordPress plugin before version 1.5.5 does not sanitize and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, which lacks authorization and nonce checks. This allows any authenticated user such as a Subscriber to perform SQL injection attacks.

The Admin Safety Guard — Login Security, Limit Logins, 2FA & Brute Force Protection WordPress plugin before version 1.4.0 does not perform any capability check on one of its REST API endpoints, allowing unauthenticated attackers to retrieve the full list of registered users including their usernames, email addresses, roles, and two-factor authentication enrollment status.

The Newsletters WordPress plugin before version 4.16 does not restrict the classes allowed when unserialising a value taken from a public form submission, allowing unauthenticated attackers to inject arbitrary PHP objects.

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7, 2.0.2 and 2.1.3, sensitive key material held by the AES and DESede engines, the SP 800-90A DRBGs, SymmetricSecretKey and the PBKD and scrypt parameter classes was zeroised on garbage collection by overriding Object.finalize. Finalization runs at an unspecified time and order and is serviced by a single finalizer thread, so where objects carrying a finalizer are allocated faster than that thread retires them the pending-finalization queue grows without bound: disposal falls arbitrarily far behind, which can contribute to an OutOfMemoryError under load, and the key material those objects hold stays resident in the heap for as long as they are queued, defeating the purpose of the zeroisation. The behaviour was not a problem on Java 8 or Java 11; it is later JVMs, on which finalization has been deprecated and progressively de-emphasised, where it becomes one. Disposal of these classes now runs from a java.lang.ref.Cleaner registered in the multi-release jdk1.9 overlay, so on Java 9 and later it no longer depends on the finalizer being scheduled. Bouncy Castle for Java (bcprov) and Bouncy Castle for Java LTS are not affected, as neither implements the finalizer-based zeroisation scheme.

In Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long as that flag stayed clear, so a persistent failure of the on-chip entropy source left the calling thread looping indefinitely inside the JNI call, where it could be neither interrupted nor timed out. Any operation drawing from the native entropy source could therefore hang, denying service to the application. The retry loops are now bounded (200 attempts for RDSEED and 20 for RDRAND), pausing between attempts and, on exhaustion, clearing any partially written buffer and throwing rather than continuing to spin. The clear is performed by an un-elidable memzero, which uses a volatile pointer and an assembly memory barrier. Bouncy Castle for Java (bcprov) is not affected, as it has no native entropy source; the 1.0.X and 2.0.X FIPS series are not affected.

Klever-Go, the Go implementation of the Klever blockchain protocol, versions 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. REST APIs are started with the default Go HTTP server without ReadHeaderTimeout, ReadTimeout, or MaxHeaderBytes configured, allowing connections to be held open indefinitely, exhausting file descriptors.

Klever-Go versions 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service via unbounded goroutine creation. The direct-message ingress handler spawns a goroutine for every message before antiflood checks, allowing a single peer to send a stream of messages and overload the node.

Klever-Go versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction with omitted RawData sub-message. The lack of nil check before dereferencing tx.RawData.Version in txVersionChecker.CheckTxVersion causes a crash of the entire node process, potentially leading to a chain halt.

Kakoune, a code editor, prior to version 2026.05.21 includes the bundled, enabled by default, autorestore.kak script that can be exploited by malicious backup files leading to arbitrary kakoune and shell commands being executed by simply opening a file.

lakeFS, an open-source tool for object storage management, prior to version 1.81.1 (open source) and 1.84.0 (enterprise) renders Markdown files from repository objects without sanitizing the resulting HTML. A user with write access can commit a .md object containing arbitrary HTML/JavaScript, which executes in another user's session.

Klever-Go prior to version 1.7.18 is vulnerable to hash-array amplification in the P2P resolver request handling logic. A small compressed request (442 bytes) can expand into 200,000 decoded hash entries, causing remote memory and CPU amplification.

Klever-Go prior to version 1.7.20 has a vulnerability in header signature verification where unused padding bits of PubKeysBitmap are counted toward the two-thirds validator quorum. A malicious block producer can set these bits to reach the required quorum without genuine signatures, weakening consensus safety.