CVE Vulnerability Catalog

The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.

The Wholesale for WooCommerce plugin for WordPress up to version 2.0.5 allows privilege escalation. The `save_requests_meta()` function only applies `sanitize_text_field()` to the `user_role_set` parameter before passing it to `WP_User::add_role()`, without validating allowed roles. Authenticated attackers with author access can escalate their privileges to administrator.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that forwards the `SslHandshakeCompletionEvent` before asynchronous OCSP validation completes. This allows the client to send sensitive data to a revoked server before the channel is closed.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that marks an outdated OCSP response as valid even if expired. This allows an attacker to replay a stale GOOD response to bypass certificate revocation.

In goshs before version 2.1.1, the bulkDownload handler for ZIP downloads did not check ACLs or custom authentication, allowing unauthenticated reads of files protected by .goshs folder ACLs and block lists. This is an incomplete fix for CVE-2026-40189.

In openhole 0.1.1 and earlier, the server forwarded r.URL.Path instead of the original request target, allowing percent-encoded dot segments and separators to perform path traversal in tunneled local services.

In gotd/td before version 0.145.1, the Decode function read attacker-controlled dataLen from an unauthenticated MTProto packet and allocated memory before checking the remaining buffer, allowing remote denial of service via excessive memory allocation and CPU or garbage collection pressure.

In find-my-way before version 9.7.0, the lookup() function passes req.method to find(), which indexes this.trees[method]. Since this.trees is a normal object, HTTP/2 method values like constructor can resolve inherited properties, causing a crash when accessing currentNode.prefix.length.

In datamodel-code-generator from 0.11.6 to 0.64.0, attacker-controlled x-python-import or customTypePath schema extensions can reach the JSON Schema parser and generate imports that allow newline injection into import statements, executing Python code when the generated model is imported.

In datamodel-code-generator before version 0.63.0, URL host validation checks the host once but then allows httpx to resolve the host again for the connection, enabling DNS rebinding to bypass allow_private_network=False and reach internal services.

In datamodel-code-generator from 0.59.0 to 0.62.0, XML Schema parsing resolves schemaLocation values in xs:include, xs:import, xs:redefine, and xs:override outside the input base path, allowing arbitrary local files to be read and reflected into generated models.

The datamodel-code-generator tool before version 0.62.0 improperly handles JSON Schema $ref references, allowing arbitrary local file reads. The vulnerability is in jsonschema.py, which does not block file:// or ../ paths outside the input directory.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 does not validate hosts/IPs in URL targets and redirects, enabling SSRF attacks against internal resources. The vulnerability is in the http.get_body function.

The datamodel-code-generator tool from version 0.9.1 to 0.61.0 automatically dereferences JSON Schema $ref references from HTTP/HTTPS without proper blocking, enabling SSRF attacks. The --allow-remote-refs flag only warns instead of blocking.

The datamodel-code-generator tool from version 0.52.1 to 0.60.2 interpolates validators from --extra-template-data without safe validation, allowing Python code execution when the generated Pydantic v2 model is imported.

The datamodel-code-generator tool from version 0.51.0 to 0.60.2 inserts x-python-type values into field annotations without sufficient validation, allowing Python code execution when the generated module is imported.

The datamodel-code-generator tool from version 0.14.1 to 0.60.2 renders the comment field from --extra-template-data into Python comments without neutralizing carriage returns, allowing Python code injection into generated models.

The datamodel-code-generator tool from version 0.17.0 to 0.60.2 preserves attacker-controlled default_factory values and emits them into Field(default_factory=...), allowing Python expression execution when the model is imported.

The datamodel-code-generator tool before version 0.60.1 renders GraphQL Union description values into Python comments without neutralizing carriage returns, allowing Python code injection into generated models.

In Dompdf versions 3.15 and prior, there is a Denial of Service (DoS) vulnerability via resource exhaustion. An attacker can submit a specially crafted HTML document with a single image of massive dimensions (e.g., 30,000x30,000 pixels), causing large memory and CPU allocation. This issue is fixed in version 3.16.