CVE Vulnerability Catalog

The Jupiter X Core plugin for WordPress (up to and including 4.61.0) is vulnerable to authentication bypass in its Twitter/X social login handler. The verify_twitter_callback function fails to reassign the returned credentials to the TwitterOAuth client, so the subsequent API call remains signed with the site operator's stored token, and the plugin authenticates a WordPress account based solely on the X app owner's email address.

A vulnerability in jackson-databind allows bypassing generic-argument validation: only the outer class of a type ID is checked, while attacker-selected classes inside generic arguments are accepted. This enables deserialization of dangerous classes (e.g., HashMap<FileSystemXmlApplicationContext,String>) even with a validator enabled, potentially leading to remote code execution. Affects versions 2.10.0+ and 3.0.0+; it is an incomplete fix for CVE-2026-54512.

In GRR prior to version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and enabling remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page.

Improper input validation in the Command component in Google Chrome prior to 156.0.8078.73. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Out-of-bounds write vulnerability in the Editing component of Google Chrome prior to 156.0.8078.73. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Memory corruption in Skia in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper access control in Forms in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Missing authorization in Video in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Improper input validation in Compositing in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in the Core component of Google Chrome on Android prior to version 156.0.8078.73. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Memory corruption in Paint in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in Views in Google Chrome on Windows prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in UI in Google Chrome on Android prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in SVG in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Memory corruption in the FileSystem component of Google Chrome prior to 156.0.8078.73. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Memory corruption in the Turbolev component of Google Chrome prior to 156.0.8078.73. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

In MLflow from 3.12.0rc0 until 3.17.0, third-party scorer deserialization in mlflow/genai/scorers/base.py accepts request-selected descendants of allowed modules rather than requiring an exact allowed module. An attacker can place a Python module under a writable allowed package and invoke it via /ajax-api/3.0/mlflow/scorer/invoke, leading to code execution. Version 3.17.0 fixes the issue.

Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote attacker to impersonate any user with an active web session by forging a session cookie containing only a cleartext username with no random identifier or integrity protection. Attackers can guess default account names such as Admin or sftp_user and submit a forged username cookie to satisfy the login check in checkLogin (libwebcmn.so) and networkDiag.cgi, chaining into root command execution.

Adobe Connect is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation requires user interaction, as a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.