CVE Vulnerability Catalog

A vulnerability in CPCI85 Central Processing/Communication and SICORE Base systems (versions before V26.20/V26.20.0) is caused by insufficient validation of authentication credentials during administrative account modifications via the web API. This allows an authenticated attacker to bypass security controls and gain unauthorized elevated privileges.

An LDAP injection vulnerability in PEAKUP Technology Inc.'s PassGate allows attackers to manipulate LDAP queries due to improper neutralization of special elements. This issue affects all PassGate versions up to April 30, 2026.

An internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) failed to enforce sufficient permissions when creating an API token for another user. An attacker knowing the login name of a privileged internal user and authenticated via OAuth/OIDC could forge a token creation request on their behalf.

The WP Cost Estimation & Payment Forms Builder (E&P Forms) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customerInfos' parameter in all versions up to, and including, 10.5.97 due to insufficient input sanitization and output escaping.

A stack buffer overflow vulnerability exists in GStreamer's DTLS plugin. During a DTLS handshake, the peer certificate Subject Distinguished Name is copied into a fixed-size 2048-byte stack buffer without bounds checking. A remote unauthenticated attacker can send a certificate with an oversized Subject DN, causing a stack buffer overflow and process crash.

A heap buffer overflow vulnerability exists in GStreamer's rfbsrc plugin. When a client connects to a malicious RFB/VNC server that advertises a 16bpp framebuffer and sends Hextile-encoded updates, the Hextile background fill path writes 32-bit pixel values into a buffer allocated for 16-bit pixels. This type mismatch causes an out-of-bounds heap write that can lead to denial of service (process crash) and potential memory corruption.

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker with parameters_all rights can inject SQL commands into the audit configuration form which is then saved. Execution is triggered when the audit functionality is accessed by the attacker or another user.

The Divi Torque Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 4.2.3. This is due to the use of '__return_true' as the permission_callback for the /install_plugin and /activate_plugin REST API endpoints, bypassing WordPress's built-in nonce verification. Although the endpoint callbacks contain internal current_user_can() checks, the lack of nonce verification allows a forged request from a logged-in administrator's browser to pass the capability check via session cookies.

The Bit Form plugin for WordPress up to version 3.1.1 is vulnerable to arbitrary file deletion due to insufficient file path validation in the deleteFiles function. This allows authenticated attackers with subscriber-level access or higher to delete arbitrary files on the server.

The EventPrime plugin for WordPress up to version 4.3.4.2 is vulnerable to Stored Cross-Site Scripting via the 'new_event_type_background_color' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with custom-level access or higher can inject arbitrary web scripts that execute when users access the affected page.

An authorization bypass vulnerability in PAVO Pay allows exploitation of trusted identifiers via a user-controlled key. The issue affects versions up to 09072026. The vendor did not respond to the disclosure.

The Popup Maker plugin for WordPress up to version 1.22.0 contains an authorization bypass vulnerability. It allows authenticated attackers with editor-level access or higher to install and activate arbitrary plugins from an external URL, leading to remote code execution.

A permissive CORS policy in the REST API (helix-rest) of Apache Helix through version 2.0.0 allows a remote attacker controlling a web page visited by an authorized user to read responses and issue cross-origin requests to administrative endpoints. The CORSFilter unconditionally returns Access-Control-Allow-Origin: * with Access-Control-Allow-Credentials: true and reflects arbitrary request headers.

An Incorrect Privilege Assignment vulnerability was discovered in the synchronization functionality due to Arc sensors receiving CLI permissions. An authenticated user with limited privileges can push administrative CLI commands through the sync, altering the device configuration, and/or affecting its availability.

A vulnerability in the Remote Collector allows man-in-the-middle attacks because the configuration generated by n2os-tui disables TLS certificate verification for connections to the Guardian or CMC, with no option to enable it.

A denial-of-service vulnerability caused by unbounded resource allocation was discovered in the audit logging functionality, due to a missing size limit on input recorded into audit entries. An unauthenticated attacker can submit requests containing excessively large input that is recorded into audit entries, possibly exhausting the available disk space and rendering the system inoperable.

An Open Redirect vulnerability was discovered in the SAML Single Sign-On functionality due to insufficient validation of a user-controlled redirection parameter. An unauthenticated attacker can craft a request to the SAML sign-in endpoint and poison the cached SAML redirection for other users who subsequently initiate SAML Single Sign-On, enabling phishing and credential-theft attacks, as well as disrupting SAML authentication for all affected users.

The Connect Contact Form 7 and Mailchimp plugin for WordPress up to version 0.9.78.06 is vulnerable to Stored Cross-Site Scripting via Mailchimp Merge Field Values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator accesses the injected page via Contact Lookup.

A network attacker positioned between UAA and its LDAP directory can impersonate the directory using any certificate from any trusted CA, then harvest the LDAP bind password and every end-user password sent during simple-bind authentication, and return forged group memberships that grant themselves admin scopes.

The GenerateRandomPassword function in bosh-windows-stemcell-builder uses a cryptographically weak random number generator, allowing a remote attacker to brute-force the resulting SSH login via TCP/22. Affected versions are prior to v2019.98.