CVE Vulnerability Catalog

In libcurl, the HTTP `Referer:` header persisted even when explicitly cleared. Although the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state, so the previous referrer string was erroneously reused and sent in subsequent requests.

A vulnerability in libcurl allows sending the second request's data before enforcing certificate verification when SSL session caching and early data are enabled. This occurs when the target server is replaced by an attacker's impostor machine.

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability. libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. Specifically, options related to the private key were left out from the configuration match checks.

A vulnerability allows reusing an existing live connection for a new transfer using STARTTLS even when the TLS configuration mismatches, potentially leading to unauthorized access or man-in-the-middle attacks.

In IMS, a vulnerability allows out-of-bounds read due to missing bounds check. This could lead to remote denial of service without requiring additional execution privileges.

A vulnerability in curl causes the tool layer to skip initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS when using a schemeless URL with `--proto-default sftp` (or scp), while libcurl establishes the SFTP/SCP connection. This results in curl connecting to an unverified SSH remote host without error.

Curl lacks an upper bound on memory allocation for unacknowledged WebSocket PING frames, allowing a malicious server to exhaust all available memory by sending rapid sequential PING messages.

A vulnerability in curl's QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service (DoS) against a curl or libcurl client. The helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, enabling a connected QUIC peer to continuously stream empty datagrams and indefinitely stall the client.

The AR for WooCommerce plugin for WordPress up to version 8.40 is vulnerable to Directory Traversal via the 'file' parameter. Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information. Three access controls fail: nonces are generated without authentication, the AES-256-CBC encryption key is predictable, and the Referer check is easily bypassed.

The NEX-Forms plugin for WordPress up to version 9.2.2 is vulnerable to Stored Cross-Site Scripting via the 'real_val__' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when users access affected pages.

A vulnerability in ASUS Business Manager allows a local user to execute arbitrary code with SYSTEM privileges via a tampered IPC message. The issue stems from external control of file name or path.

The unsupported ASUS AI Suite 3 driver contains a vulnerability due to improper validation of a specified quantity in input. A local user can bypass security validation and access restricted memory blocks via crafted IOCTL requests, leading to privilege escalation.

The unsupported ASUS AI Suite 3 driver contains a vulnerability due to improper validation of specified quantity in input, allowing a local user to access unintended memory regions via crafted IOCTL requests, leading to privilege escalation.

The AR for WordPress plugin up to version 8.40 is vulnerable to Directory Traversal via the 'file' parameter. An unauthenticated attacker can read arbitrary files on the server, potentially exposing sensitive information.

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS allows an unauthenticated attacker on the same local network segment to execute arbitrary code. Affected versions include 11.0 up to 11.12.4_Update1, 12.0 up to 12.12, and 2025.1 up to 2026.2.

WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS wgagent process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

An Out-of-bounds Write vulnerability in WatchGuard Fireware OS ikestubd process could allow an authenticated privileged user to execute arbitrary code via a specially crafted requests to the Management Web UI.

WatchGuard Fireware OS contains a race condition leading to a use-after-free vulnerability in LDAP authentication for the Mobile User VPN with IKEv2. A remote unauthenticated attacker could exploit this to execute arbitrary code in the context of the iked process on Fireboxes with Mobile VPN IKEv2 configured to use an external LDAP server.