CVE Vulnerability Catalog

A vulnerability in jupyter/nbconvert versions up to 7.17.0 allows Cross-site Scripting (XSS) via unsanitized `text/vnd.mermaid` output in HTML exports. The `data_mermaid` block in `share/templates/lab/base.html.j2` renders `text/vnd.mermaid` cell output directly into HTML without escaping, enabling attackers to inject arbitrary HTML/JavaScript by breaking out of the `<pre>` tag.

The User Registration & Membership plugin for WordPress up to version 5.2.0 contains a vulnerability due to missing validation in the confirm_payment() function. This allows unauthenticated attackers to bypass payment processing and activate paid memberships.

The Frontend File Manager Plugin WordPress plugin through 23.6 does not properly verify ownership of every targeted post before permanent deletion, allowing authenticated users with author-level access and above to permanently delete arbitrary posts and pages. When the 'Allow guest uploads' setting is enabled by an administrator, the same deletion primitive becomes reachable by unauthenticated users.

The Printcart Web to Print Product Designer for WooCommerce WordPress plugin through version 2.4.8 contains a path traversal vulnerability, allowing an attacker to retrieve directory listings for arbitrary directories on the server.

The Markdown plugin for Rapid7 InsightConnect on Linux before version 4.0.2 is vulnerable to Server-Side Request Forgery (SSRF). An attacker can make arbitrary HTTP requests via unsanitized HTML elements in Markdown, such as `img/src`, `CSS url()`, or `@import`.

A missing sanitisation vulnerability exists with user input in the stats-video.php script. The way URLs to this script were constructed did not follow best practices, and the output of the Smarty custom helper function url was neither properly encoded nor sanitised, allowing user‑supplied input to be reflected without escaping.

A bypass to the admin-only restriction of the XML-RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated, allowing the leaked session ID to be used for subsequent unrestricted API calls.

A stored XSS vulnerability exists in the maintenance-acl-check.php and maintenance-banners-check.php tools of Revive Adserver 6.0.7. Entity names are displayed without proper escaping when inconsistencies are detected.

In Revive Adserver 6.0.7 and earlier, missing sanitization of user input in the zone-include.php script allows XSS attacks. A low-privileged user can exploit the refresh parameter of the iFrame invocation tag to perform reflected XSS attacks.

A bypass for CVE-2026-34913 exists in Revive Adserver 6.0.7 and earlier due to missing ownership validation in the reverse operation of linking campaigns and trackers via the `tracker-campaigns.php` script. A low-privileged user can link their trackers to campaigns owned by other managers on the same instance, causing inconsistent ownership relationships.

A flaw in Node.js TLS host verification allows an attacker to bypass certificate validation. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

An inconsistency in Node.js hostname matching can cause a trust-policy bypass in multi-context mTLS setups. This vulnerability affects all supported release lines: Node.js 22, Node.js 24, and Node.js 26.

A flaw in Node.js TLS hostname handling causes a mismatch in Unicode dot separator normalization between the resolver and verifier, leading to a wildcard-depth authentication bypass. This can result in confidentiality impact or bypass of the intended security boundary.

The Groundhogg plugin for WordPress (versions up to and including 4.5.4) is vulnerable to generic SQL injection via the 'after' parameter. Authenticated attackers with Sales Manager-level access or above can append additional SQL queries to existing ones, enabling extraction of sensitive data from the database. Additionally, the AJAX handler wp_ajax_groundhogg_get_contacts_table has its capability check commented out and performs no nonce verification, allowing any authenticated user to reach the vulnerable code path.

The Setracker2 Android Companion App (com.tgelec.setracker) versions 3.1.5 and prior generate a predictable registration ID derived from IMEI. The enrollment system lacks additional authentication before assignment, allowing an attacker who obtains the registration ID to arbitrarily enroll watches belonging to other users.

A vulnerability in FOSSBilling versions 0.5.4 through 0.7.2 allows an unauthenticated remote attacker to trigger the /run-patcher maintenance endpoint, which executes critical operations such as configuration file modifications, database schema changes, filesystem mutations, and cache clearing. The lack of authentication and CSRF validation enables denial-of-service attacks via a simple HTTP GET request.

A server-side request forgery (SSRF) flaw was found in KubeVirt's virt-api port-forward handler. When processing a port-forward request to a VirtualMachineInstance (VMI), virt-api reads the target IP from vmi.Status.Interfaces[0].IP and passes it directly to net.Dial() without validation. For VMIs using non-masquerade network bindings (bridge or secondary-only), this IP is reported by the QEMU guest agent running inside the VM and is fully controllable by the VM owner.

A flaw in KubeVirt's virt-handler network cache handling allows a user with access to the virt-launcher container to overwrite arbitrary host files with JSON content and change their ownership by planting a symlink at the cache file path.

A flaw was found in the Pen Drive report generator where cluster-sourced data is rendered into HTML reports without proper escaping or sanitization. An attacker with cluster administrator privileges can inject a stored XSS payload into cluster objects (such as ClusterVersion spec.channel) that executes in the browser of any user who opens the generated HTML report.

A vulnerability in Apicurio Registry occurs because DocumentBuilderAccessor does not disable DOCTYPE declarations or enable FEATURE_SECURE_PROCESSING, although it blocks external DTD and schema access. An attacker with artifact-write permission can upload XML documents with internal entity-expansion payloads (billion-laughs variant), causing CPU and heap exhaustion, partially mitigated by the JAXP default 64,000 entity-expansion limit.