CVE Vulnerability Catalog

W podatności CVE-2025-10466 występuje niewłaściwe neutralizowanie danych wejściowych podczas generowania stron internetowych w Safe Access w Synology Safe Access przed wersją 1.3.1-0329. Umożliwia to zdalnym użytkownikom z uprawnieniami administratora odczyt lub zapis określonych plików zawierających niesensytywne informacje oraz przeprowadzenie ograniczonego ataku typu denial-of-service w SRM.

W podatności CVE-2024-11399 w komponencie redis-server w Synology BeeDrive dla systemu desktop przed wersją 1.3.2-13814, lokalni użytkownicy mogą uzyskać dostęp do plików lub katalogów, co umożliwia przeprowadzenie ataków typu denial-of-service za pomocą nieokreślonych wektorów.

CVE-2026-41704 affects BOSH Director, where the AgentClient#handle_method processes NATS replies, leading to unauthorized access to resources in the blobstore. The lack of proper checks, such as UUID format validation, ownership verification, and namespace prefix checks, allows unauthorized deletion of resources.

CVE-2026-41009 affects BOSH Director, where the agent's response to long-running requests may lead to unauthorized access to system files. Due to the lack of normalization of the blob identifier, it is possible to reference files outside the blobstore root.

The CM Ad Changer plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 2.0.7. Missing nonce validation in the cmac_campaigns_action function allows unauthenticated attackers to permanently delete arbitrary advertising campaigns, including their associated banner records and uploaded files.

The ShopLentor plugin for WordPress up to version 3.3.8 is vulnerable to stored XSS via the 'blockUniqId' attribute in Product Grid blocks. Authenticated attackers with contributor-level access can inject arbitrary scripts.

The Yoast SEO plugin for WordPress up to version 26.5 is vulnerable to Insecure Direct Object References (IDOR) in the Meta Search REST API endpoint. It lacks proper authorization checks to verify post ownership, allowing authenticated attackers with Contributor-level access or higher to read sensitive SEO metadata from any post on the site, including other users' posts, private posts, and drafts.

The Splide Carousel Block plugin for WordPress up to version 1.7.1 is vulnerable to stored XSS via the 'url' attribute in blocks. Authenticated attackers with contributor-level access can inject scripts, but require approval from an editor or administrator.

Attackers inject malicious scripts (e.g., JavaScript) into the target system. When other users visit infected pages, the scripts execute in their browsers, enabling cookie theft, session hijacking, and content tampering.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0 (including 9.3.x and 8.3.x) expose Hadoop cluster credentials in plain text through the Cluster Test API. Users can leverage these credentials to submit jobs via the backend API.

Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6 and 11.0.0.0, including 9.3.x and 8.3.x, do not apply ACLs on certain API endpoints related to platform mail notifications.

Vulnerability in IO::Uncompress::Unzip for Perl before version 2.215. An uncaught exception when parsing a ZIP header with a malformed DOS date causes a crash.

In QianFox FoxCMS up to version 1.2.6, a vulnerability was found in the Edit function of Admin.php, allowing manipulation of the password recovery process. The attack can be performed remotely, and the exploit is publicly available.

Tanium addressed a denial of service vulnerability in Tanium Server. The issue could lead to server disruption.

The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin for WordPress up to version 1.6.11.5 is vulnerable to DoS. A publicly accessible REST API endpoint (/wp-json/ssa/v1/async) calls PHP's sleep() with a user-supplied delay parameter without rate limiting, allowing unauthenticated attackers to exhaust PHP worker processes.

The Style Kits plugin for WordPress up to version 2.5.0 has a Stored XSS vulnerability via the kit title parameter in the '/wp-json/agwp/v1/tokens/save' endpoint. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever a user visits an infected page.

In OpenStack Swift before 2.36.2 and 2.37.2, the s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

In itsourcecode Courier Management System 1.0, an unknown function in the file /parcel_list.php is vulnerable to SQL Injection via manipulation of the argument s. The attack can be performed remotely, and the exploit has been made public.

GitHub Enterprise Server before versions 3.20.3, 3.19.7, 3.18.10, 3.17.16, and 3.16.19 has an SSRF vulnerability in the security advisories package lookup feature. An attacker can direct requests to internal services and infer sensitive environment variables, including signing secrets and private keys, via response timing.

In JeecgBoot up to version 3.9.1, a vulnerability in the AiragModelController component allows improper access controls via manipulation of list/queryById arguments. The attack can be executed remotely, and the exploit is public. Fixed in version 3.9.2.