CVE Vulnerability Catalog

The GSheetConnector For Ninja Forms plugin for WordPress in all versions up to and including 2.0.1 is vulnerable to unauthorized data access due to a missing capability check on the 'njform-google-sheet-config' page. Authenticated attackers with Subscriber-level access and above can retrieve system information.

The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.3.96. The plugin exposes an unauthenticated booking processing endpoint (cpabc_appointments_check_IPN_verification) that trusts attacker-supplied payment notifications without verifying their origin, authenticity, or requiring proper authorization checks. Unauthenticated attackers can arbitrarily confirm bookings and insert them into the live calendar via the 'cpabc_ipncheck' parameter, triggering administrative and customer notification emails and disrupting operations.

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the panding_blood_request_action() function in all versions up to, and including, 2.1.15. This makes it possible for unauthenticated attackers to delete arbitrary posts.

The Subscriptions & Memberships for PayPal plugin for WordPress is vulnerable to fake payment creation in all versions up to and including 1.1.7 due to improper verification of IPN request authenticity. An unauthenticated attacker can create fake payment entries that did not actually occur.

The Cookie Notice & Compliance for GDPR / CCPA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's cookies_accepted shortcode in all versions up to, and including, 2.5.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

With TLS 1.2 connections, a client can use any supported digest, including a weaker one, instead of those specified in the CertificateRequest. This may weaken the security of the connection handshake.

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to excessive CPU and memory consumption during ClientHello processing.

Improper input validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions.

The server previously verified the TLS 1.3 PSK binder using a non-constant time method which could potentially leak information about the PSK binder.

SpiceDB is an open source database system for creating and managing security-critical application permissions. Prior to version 1.47.1, if a schema includes the following characteristics: permission defined in terms of a union (+) and that union references the same relation on both sides (but one side arrows to a different permission). Then SpiceDB may have missing LookupResources results when checking the permission. This only affects LookupResources; other APIs calculate permissionship correctly. The issue is fixed in version 1.47.1.

Langfuse versions 2.95.0 to before 2.95.12 and 3.17.0 to before 3.131.0 have a vulnerability in SSO provider configurations without an explicit AUTH_<PROVIDER>_CHECK setting, potentially allowing account takeover via CSRF or phishing.

ESF-IDF is the Espressif IoT Development Framework. In versions 5.5.1, 5.4.3, and 5.3.4, when the ESP32-P4 uses its hardware JPEG decoder, the software parser lacks necessary validation checks. A specially crafted malicious JPEG image could exploit the parsing routine and trigger an out-of-bounds array access. This issue has been fixed in versions 5.5.2, 5.4.4, and 5.3.5.

An out-of-bounds read in the Apple kernel was addressed with improved bounds checking. An attacker in physical proximity may be able to cause an out-of-bounds read in kernel memory.

A spoofing issue was addressed with improved truncation when displaying the fully qualified domain name in Safari 18.5 and macOS Sequoia 15.5. A website may be able to spoof the domain name in the title of a pop-up window.

A parsing issue in the handling of directory paths was addressed with improved path validation. This affects macOS Sequoia 15.5, macOS Sonoma 14.7.3, and macOS Ventura 13.7.3. An app may be able to access sensitive user data.

Black Duck SCA versions prior to 2025.10.0 had user role permissions configured in an overly broad manner. Users with the scoped Project Manager user role with the Global User Read access permission enabled access to certain Project Administrator functionalities which should have been inaccessible. Exploitation does not grant full system control, but it may enable unauthorized changes to project configurations or access to system sensitive information.

IBM Concert Software versions 1.0.0 through 2.0.0 could allow a remote attacker to hijack the clicking action of the victim, potentially leading to unintended actions on behalf of the user.

AWS Wickr before version 6.62.13 on Windows, macOS, and Linux has an improper resource release in the call termination process. A call participant may continue to receive audio input from another user after closing their call window.

In Wazuh from version 3.7.0 to before 4.12.0, the fim_alert() implementation does not check whether oldsum->md5 is NULL before dereferencing it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the Wazuh manager.

In Wazuh from version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue is patched in version 4.13.0.