CVE Vulnerability Catalog

ArcadeDB before 26.7.3 leaks the cluster token (arcadedb.ha.clusterToken) in cleartext via the MCP get_server_settings tool. Attackers with MCP access can use it to impersonate root.

ArcadeDB before 26.7.3 binds the real LocalDatabase object into JavaScript trigger contexts with HostAccess.ALL, allowing schema-admins to call getSecurity().createUser() without permission checks.

better-auth passkey before version 1.4.0 has an insecure direct object reference vulnerability in the passkey deletion endpoint. Authenticated users can delete arbitrary passkeys of other users.

Better Auth relies on the rou3 router library, which normalizes URL paths by removing empty segments. In Better Auth versions prior to 1.4.5, an attacker can bypass disabledPaths configuration and path-based rate limits by submitting requests with extra slashes in the URL path. The issue does not apply when the proxy or platform normalizes URLs by collapsing multiple slashes.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.6 does not restrict a bulk appointment operation to the requester's own records. Unauthenticated users can retrieve personal data of all appointments and, on premium editions, permanently delete them.

The Product Attachment for WooCommerce WordPress plugin before version 2.3.3 does not perform any authorization check before streaming media library files. This allows unauthenticated users to download any attachment, including private or unlinked uploads, by enumerating its numeric ID.

The login-social WordPress plugin through version 1.0.4 does not validate password-reset requests against a reset key or the requester's identity, and it issues authentication sessions from unverified third-party sign-in data. This allows unauthenticated attackers to reset any user's password or log in as any existing account, including administrators, and take over the site.

The AI ChatBot for WooCommerce WordPress plugin before version 4.8.4 does not perform any authorization or nonce check on one of its AJAX actions. This allows unauthenticated users to abuse the site owner's stored third-party API key, send requests billed to the owner's account, and, when an optional feature is enabled, retrieve indexed knowledge-base content.

The Gallery for Google Photos WordPress plugin before version 1.2.1 does not properly restrict access to the stored third-party OAuth credentials of the connected account. This exposes persistent access and refresh tokens to unauthenticated users, allowing long-term compromise of the linked account.

The SMS Alert WordPress plugin before version 3.9.8 does not bind its 'mobile verified' session flag to the phone number that was actually verified. After an attacker verifies an OTP sent to their own phone, the signup/login handler reads a fresh, attacker-supplied phone number to select the account and logs them in. An unauthenticated attacker can therefore log in as any user, including an administrator, who has a billing phone on file.

The Five Star Restaurant Reservations WordPress plugin before version 2.7.23 does not perform a capability check on one of its AJAX actions. This allows users with the lowest booking-management role (which by default cannot access the plugin's settings) to reset the site's configured booking notification rules.

The description of CVE-2026-14920 contains only the word '## Summary', which prevents detailed analysis. Based on available information, the nature of the vulnerability cannot be determined.

The Lenxel WP WordPress theme through version 1.0.31 does not perform any authorization or ownership check on its password-reset action, validating only a CSRF nonce. This allows unauthenticated attackers to reset the password of any user (including an administrator) and take over the account.

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.3.15 via the 'uamgetfile' parameter. Unauthenticated attackers can read the contents of arbitrary files on the server, which can contain sensitive information. This occurs because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

The CubeWP Framework plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 1.1.30 via the 'cubewp_get_svg_content' function. Unauthenticated attackers can read the contents of arbitrary files on the server, which can contain sensitive information. This is exploitable because the required nonce is publicly emitted into the markup of any page rendering the CubeWP posts shortcode or widget with AJAX loading enabled, making it harvestable by any guest visitor before submitting the AJAX request.

Improper Verification of Cryptographic Signature in guardian (versions from 1.0.0 before 2.4.1) allows an unauthenticated attacker to revoke a victim's session with a forged JWT token.

A vulnerability in the Guardian library (Guardian.Permissions module) allows a denial of service attack via BEAM atom-table exhaustion. The encode_permissions!/1 function converts map keys to atoms without validation, and atoms are never garbage collected, exhausting the fixed-size atom table.

A vulnerability in the Guardian library (Elixir) allows DoS via unbounded atom creation from attacker-controlled binary input. The encode/3 function in Guardian.Permissions.AtomEncoding calls String.to_atom/1 without validation, exhausting the BEAM atom table and crashing the node.

Allocation of Resources Without Limits or Throttling in guardian (versions from 0.1.0 before 2.4.1) allows denial of service via unbounded atom creation from attacker-influenced binary input.