CVE Vulnerability Catalog

Capgo before 12.128.2 contains a BOLA (broken object level authorization) vulnerability in the POST /build/start/:jobId and POST /build/cancel/:jobId endpoints. An attacker can exploit the controlled app_id to authorize requests, allowing them to start or cancel build jobs of other tenants.

Capgo before version 12.128.2 contains a cross-domain SSO account takeover vulnerability in the provision-user endpoint that allows attackers to merge arbitrary victim accounts based on email match without validating SSO provider domain authorization.

The AdRotate Banner Manager plugin for WordPress is vulnerable to PHP Code Injection in all versions up to and including 5.17.7 via the 'banner' attribute of the adrotate shortcode. This is due to insufficient input validation and sanitization of the banner shortcode attribute before concatenation into a PHP code string.

Picklescan before 0.0.29 fails to detect malicious idlelib.calltip.Calltip.fetch_tip calls in pickle files, allowing remote code execution. Attackers can embed undetected payloads in pickle files that execute arbitrary code when loaded via pickle.load().

Picklescan before 0.0.29 fails to detect malicious pickle files that exploit idlelib.debugobj.ObjectTreeItem.SetText function in reduce methods. Attackers can craft pickle files with embedded code that bypasses picklescan detection and executes arbitrary commands when pickle.load() is called.

A vulnerability was found in the Linux kernel's pskb_carve_inside_header() and pskb_carve_inside_nonlinear() functions, which copy the skb_shared_info structure without incrementing the reference count for the destructor_arg pointer (uarg) used by MSG_ZEROCOPY. This leads to premature freeing of ubuf_info_msgzc memory, potentially allowing privilege escalation.

CVE-2026-10745 describes an improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on Windows, allowing log injection, tampering, and forging.

The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This is due to a chain of three logic bugs that allow attackers with appropriate permissions to create malicious posts and leak password reset links.

CVE-2026-56052 describes an improper neutralization of special elements used in SQL commands, allowing for Blind SQL Injection in FunnelKit Funnel Builder.

A vulnerability was found in the Linux kernel's netfilter logging (nf_log), where dump_mac_header() fails to verify the MAC header is set before reading it. An attacker can send a crafted packet via AF_PACKET with PACKET_QDISC_BYPASS, causing an out-of-bounds read (slab-out-of-bounds) and potential data leak into kernel logs.

In the Linux kernel's xfrm/espintcp module, a vulnerability was found where the partial send state (ctx->partial) is reused before completion. The espintcp_sendmsg() function may overwrite an active send state, leading to a stale offset in a new message and a potential out-of-bounds memory read.

In the Linux kernel's batman-adv module, a buffer overflow vulnerability was found in TVLV packet processing. The function calculating the TVLV container list size used u16 type, causing integer wrap when the total exceeded 65535 bytes, leading to undersized buffer allocation and out-of-bounds write.

In the Linux kernel, a vulnerability was found in the io_uring/poll mechanism where a signed comparison in io_poll_get_ownership() prevented the slowpath from being taken when the cancel flag (IO_POLL_CANCEL_FLAG) was set. This caused cancel operations to be mishandled.

In the Linux kernel xfrm/ipcomp module, a vulnerability was found where destination pages are not freed on asynchronous compression (acomp) errors. This causes a memory leak because the destination SG list is not cleaned up on failure.

In the Linux kernel, a vulnerability in SCTP stream handling causes incomplete rollback when ADD_OUT_STREAMS is denied. Leftover metadata from removed streams can trigger a null-pointer dereference in the scheduler when the stream is re-added.

In the Linux kernel, a vulnerability was found in the ebtables module where the compat_mtw_from_user() function lacks proper validation of user-supplied match_size/target_size. This can cause an out-of-bounds read when converting ebtables extensions from 32-bit user structures to kernel native structures.

In the Linux kernel, a vulnerability exists in the SysV IPC ID allocation mechanism. The `ipc_idr_alloc()` function in the checkpoint/restore path can allocate an ID beyond the valid range (`ipc_mni`), causing incorrect IDR mapping and dangling pointers. This can lead to memory corruption and potential code execution via freed memory dereference.

In the Linux kernel, the batman-adv module (Distributed ARP Table) fails to check the return value of pskb_copy_for_clone(). A failed memory allocation leads to a NULL pointer dereference in batadv_send_skb_prepare_unicast_4addr(), causing a system crash.

A vulnerability was found in the Linux kernel's netfilter xt_policy module, affecting strict mode inbound policy matching. The match_policy_in() function processes sec_path entries in reverse order, causing inconsistent matching of multi-element inbound rules.

In the Linux kernel, the batman-adv module's tp_meter counter underflows during shutdown due to multiple callers of batadv_tp_sender_shutdown(). This causes a use-after-free when the interface is removed while a zombie sender thread loops indefinitely.