CVE Vulnerability Catalog

Addressing certain issues related to long-running operations has proven overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for use at own risk. Memory-wise small guests may still be okay to run.

Xenstore uses a new XEN_DOMCTL_get_domain_state to track domains. The bitmap management is tied to the binding of VIRQ_DOM_EXC. Unfortunately, an error path can tear down the bitmap even when it wasn't set up. Unprivileged domains can trigger that error path.

Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.

The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.

The StoreGrowth plugin for WordPress up to version 2.1.0 is vulnerable to stored XSS via the 'message_popup' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page. The 'ajd_protected' nonce is exposed to all visitors.

In Quick.CMS, the admin UI restricts deletion of the primary language, but the API endpoint lacks server-side authorization. An authenticated admin can send a direct HTTP request to delete the primary language, causing Denial of Service (DoS). Combined with a CSRF vulnerability (CVE-2026-1468), an unauthenticated attacker can trick an admin into clicking a malicious link, triggering DoS.

A vulnerability in the cowlib library allows an unauthenticated remote attacker to exhaust memory on a vulnerable server or client by sending specially crafted HTTP/2 or HTTP/3 frames. The issue stems from missing limits in the HPACK and QPACK decoder, which processes arbitrarily long prefixed integers, causing large bignum allocations and heavy garbage collection churn.

The Web Directory Free plugin for WordPress up to version 1.7.13 is vulnerable to generic SQL Injection via the 'levels' parameter. Insufficient input sanitization and lack of prepared statements allow unauthenticated attackers to append additional SQL queries, potentially leading to extraction of sensitive database information.

The Eazy Plugin Manager plugin for WordPress up to version 4.4.1 is vulnerable to privilege escalation. The AJAX handler `wp_ajax_pos_get_option` lacks capability checks, and the REST endpoint `admin/login` is publicly accessible, authenticating based on a hash of values stored in options. An authenticated attacker with Subscriber-level access can read the `eazywp_connecting_info` and `eazywp_connection` options, compute the auth key, and obtain administrator cookies, taking over the site. This requires the remote connection feature to be configured.

The PickPlugins Question Answer plugin for WordPress up to version 1.2.73 is vulnerable to SQL Injection via the 'id' GET parameter in the user profile template. The qa_user_profile_card() function uses wp_unslash(), which removes magic quotes protection, and then directly concatenates input into a SQL query without proper sanitization. This allows unauthenticated attackers to append additional SQL queries and extract sensitive database information.

ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the Restore Settings function. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.

ELECOM wireless LAN routers and access points contain an OS Command Injection vulnerability in the WebUI. An attacker who can log in to the device can exploit this to execute arbitrary OS commands.

The Bookly plugin for WordPress (up to version 27.5) is vulnerable to time-based SQL injection via the 'staff_ids' parameter. An unauthenticated attacker can append additional SQL queries to existing ones, allowing extraction of sensitive database information. A two-request chain is required, and lack of CSRF/nonce validation enables cross-site attacks.

Due to incorrect behavior order, a low-privileged remote attacker can trigger an inconsistent account state via crafted input and overwrite existing user passwords, potentially resulting in complete administrative unavailability of the device.

A low-privileged remote attacker can gain administrator privileges due to missing authorization in the configuration table insert path, resulting in full system access.

A low-privileged remote attacker can perform privileged configuration changes reserved for the administrator, including permission management, due to incorrect authorization.

The TrueBooker plugin for WordPress (up to version 1.2.2) is vulnerable to generic SQL injection via the 'alldata[truebooker_user]' parameter. An unauthenticated attacker can append additional SQL queries to extract sensitive database information. The nonce is exposed to unauthenticated users, and exploitation requires specific booking fields to be present.

The Premium Packages plugin for WordPress (up to version 6.2.0) is vulnerable to SQL injection via the 'code' parameter in the REST API endpoint /wp-json/wpdmpp/v1/cart/coupon. An unauthenticated attacker can append additional SQL queries to extract sensitive database information due to lack of proper query preparation.

The WP Fast Total Search plugin for WordPress (up to version 1.80.280) is vulnerable to generic SQL injection via the 'form_data[s]' parameter. An unauthenticated attacker can append additional SQL queries to extract sensitive database information.

The Better Messages plugin for WordPress up to version 2.15.19 has an arbitrary file deletion vulnerability in the delete_sticker function. An authenticated attacker with administrator privileges can delete any file on the server, potentially leading to remote code execution.