CVE Vulnerability Catalog

A vulnerability in the 'submitted together' feature in Gerrit versions 2.12 and later allows an authenticated attacker with force push permissions on a secondary branch to bypass code review and forcefully submit code to restricted branches via a crafted submission matching the topic tag of an unapproved change.

Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.

Improper handling of insufficient permissions in Routines prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

Improper input validation in Routines prior to SMR May-2026 Release 1 allows physical attackers to launch privileged activity.

An out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code.

Incorrect privilege assignment in LocationManager prior to SMR May-2026 Release 1 allows local attackers to access sensitive information.

Incorrect default permissions in FactoryCamera prior to SMR May-2026 Release 1 allow a local attacker to access a unique identifier.

The ilGhera Support System for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_ticket_content_callback' function in all versions up to and including 1.3.0. This makes it possible for unauthenticated attackers to view any support ticket content, including sensitive customer information and private communications, by providing a ticket ID.

The Broadstreet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to and including 1.53.1 due to insufficient input sanitization and output escaping. This allows authenticated attackers with administrator-level permissions or higher to inject arbitrary web scripts that execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html is disabled.

The Broadstreet plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the create_advertiser AJAX action in all versions up to, and including, 1.53.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create advertisers.

The Broadstreet plugin for WordPress in all versions up to and including 1.53.1 is vulnerable to Sensitive Information Exposure via the get_sponsored_meta() AJAX action. An authenticated attacker with subscriber-level access or higher can extract data from password-protected and private business details.

The Cost Calculator Builder plugin for WordPress (up to version 4.0.1) when used with the PRO version is vulnerable to unauthenticated price manipulation and Insecure Direct Object Reference (IDOR). An unauthenticated attacker can add WooCommerce products to the cart with attacker-controlled prices.

An authenticated user with aggregation permissions can use a densely populated chars mask and a large input string in the MongoDB aggregation operators $trim, $ltrim, and $rtrim to pin CPU utilization at 100% for an extended period. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9, and v8.3 before 8.3.2.

A use-after-free vulnerability exists in MongoDB's Field-Level Encryption (FLE) query analysis component, affecting client-side uses of mongocryptd and crypt_shared. Triggering it requires control over the structure of a client's FLE-related query.

An authenticated user can cause excess memory usage via bitwise match expression AST processing of $bitsAllSet, $bitsAnySet, $bitsAllClear, and $bitsAnyClear. This contributes to memory pressure and may lead to availability loss through OOM. This affects MongoDB Server v7.0 before 7.0.34, v8.0 before 8.0.23, v8.2 before 8.2.9, and v8.3 before 8.3.2.

Improper enforcement of the LFENCE serialization property may allow an attacker to bypass speculation barriers and potentially disclose sensitive information, potentially resulting in loss of confidentiality.

Prior to 1.2.3, Broken Access Control in Flowsint allows reading of sketch logs from any user. This vulnerability is fixed in 1.2.3.

Prior to 0.23.3, Warpgate's SSO flow does not validate the state parameter, allowing an attacker to trick a user into logging into the attacker's account. This may convince the victim to perform sensitive actions on the attacker's account.

GoJobs, a REST API for a job board platform, exposes a job retrieval endpoint that allows unauthenticated users to access job details by directly manipulating object identifiers. The endpoint lacks proper authentication and authorization checks, resulting in unauthorized access to job data.

In Flowsint prior to 1.2.3, a remote attacker can create a map node with a malicious label containing arbitrary HTML. When the map tab is selected and a node marker is clicked, the arbitrary HTML is rendered, potentially triggering stored XSS.