CVE Vulnerability Catalog

An improper authorization check in MISP's attribute creation endpoint allowed an authenticated user with permission to add attributes to submit a sharing_group_id without triggering the corresponding sharing group authorization check, as long as the attribute distribution value was not explicitly set to 4 — 'sharing group'.

In n8n prior to versions 2.27.4 and 2.28.1, when configured with more than one trusted token-exchange issuer, external identities were resolved to local accounts using only the JWT sub claim, ignoring the iss claim. This allowed an attacker with a valid token from one trusted issuer and a sub matching a victim under another issuer to authenticate as that victim.

In n8n prior to versions 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL. This allowed a member-level user with use-only access to a shared credential to send its secret to an external server they control.

A security vulnerability was detected in the aerostackdev aerostack-mcp project up to version 6315dfde7df0a15aaf743f88d91347115e09ba23. The upload_media function in the mcp-whatsapp component allows manipulation of the media_url argument, leading to server-side request forgery (SSRF). The attack can be launched remotely.

A vulnerability has been found in manjurulhoque django-job-portal up to commit dfa352f305bba44445ac5dc12e9b2a98c9dcd71f. The EditEmployeeProfileAPIView function in accounts/api/views.py of the Employee Dashboard endpoint is affected. Manipulation of the role argument leads to improper access controls, allowing remote attacks.

A security flaw in enquirer up to version 2.4.1 allows improper control of object prototype attributes via the Enquirer.set function in the Public Package API. The attack can be launched remotely, and the exploit has been made public.

A stored cross-site scripting (XSS) vulnerability has been found in OKRs & Goals by Twiser Informatics Technology Consulting, Trade and Education Inc. The issue is caused by improper input neutralization during web page generation.

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by a default configuration that disables all OPC UA security mechanisms. This allows an attacker to gain unauthorized access and control over critical system functions.

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) affects the firmware update signature validation. This flaw allows an attacker to install malicious firmware, leading to persistent code execution and system compromise.

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) allows an authenticated attacker to exploit a debugging interface accessible via HTTP to crash the web process, causing denial of service (DoS).

A stack buffer overflow vulnerability in the agentlink_server service of Vinchin Backup & Recovery through version 9.0.0.86562. An unauthenticated remote attacker can overwrite the saved return address by sending a crafted request with an oversized _listen_uuid field, which is copied without bounds checking into a fixed-length stack buffer using strcpy().

Vinchin Backup & Recovery through version 9.0.0.86562 contains a heap buffer overflow vulnerability that allows unauthenticated remote attackers to cause a process crash or memory corruption by sending a malformed TCP packet with an unchecked body_len field to the agentlink_server service. Attackers can craft a malicious packet that passes an attacker-controlled length directly to recv(), triggering a heap overflow of up to approximately 4 GiB, resulting in process crash or potential memory corruption.

A vulnerability was found in macrozheng mall up to version 1.0.3 in the file /returnApply/create of the Portal Endpoint component. Manipulation of the orderId argument leads to improper control of resource identifiers. The attack can be initiated remotely and the exploit is publicly available.

An Improper Input Validation vulnerability in the BigQuery DAO component of Google Cloud Apigee (versions prior to 2026-06-12) allows an authenticated attacker to exfiltrate cross-tenant data. The vulnerability was patched on June 12, 2026 on the Apigee servers.

A vulnerability was found in GNU LibreDWG up to version 0.13.4 in the dwg_bmp function of src/dwg.c, part of the BMP Image Handler component. Manipulation leads to a heap-based buffer overflow. The attack requires local access and the exploit is publicly available.

The Colissimo Officiel plugin for WooCommerce up to version 2.9.0 lacks a capability check and nonce verification in the updateShippingMethod() function, allowing authenticated attackers with Subscriber-level access or higher to modify shipping method, pickup point meta, and shipping address of arbitrary WooCommerce orders.

The Crew HRM plugin for WordPress up to version 1.2.2 suffers from an authorization bypass vulnerability. Authenticated attackers with subscriber-level access can delete, archive, unarchive, and duplicate arbitrary job listings along with associated data due to improper permission verification and an exposed nonce.

The DHL eCommerce (Benelux) for WooCommerce plugin up to version 2.2.3 lacks capability checks and nonce verification in the create_label() and delete_label() functions. This allows authenticated attackers with Subscriber-level access or higher to create or delete DHL shipping labels for any WooCommerce order.

The CorvusPay WooCommerce Payment Gateway plugin for WordPress, up to version 2.7.4, contains an authorization bypass vulnerability that allows unauthenticated attackers to cancel any WooCommerce order placed via the CorvusPay payment method. The attack is performed by supplying an arbitrary order number to the /wp-json/corvuspay/cancel/ REST endpoint.

The CorvusPay WooCommerce Payment Gateway plugin for WordPress up to version 2.7.4 contains a payment bypass vulnerability. The `corvuspay_success_handler` function registers a REST endpoint `POST /wp-json/corvuspay/success/` without authentication, and the cryptographic signature validation result is never evaluated conditionally, allowing any pending order to be marked as paid.