CVE Vulnerability Catalog

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress in versions up to and including 6.3.2 is vulnerable to PHP Object Injection via deserialization of untrusted input. This allows authenticated attackers with administrator-level access and above to inject a PHP Object; by default, Editor-level users are granted FULL_ACCESS to the plugin's import endpoint.

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interface of the device. Insufficient validation of user-supplied file paths allows remote attackers to read arbitrary files accessible to the application. Depending on configuration, exploitation may be possible without authentication.

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability in the SCPI FILESystem command interface allows remote attackers to read or modify arbitrary files on the device through insufficient validation of file paths supplied to filesystem access commands.

An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUNT:DRIve SCPI command handler. Insufficient neutralization of user-supplied input allows remote attackers to execute arbitrary operating system commands with elevated privileges.

Text::CSV_XS versions before 1.65 for Perl read before the start of an all-blank field under allow_whitespace in strip_trail_whitespace. Under allow_whitespace, strip_trail_whitespace removes trailing spaces and tabs from each unquoted field without stopping at the start of the field. For a field of only blanks it reads the byte before the field's heap buffer. If that byte is also a space or tab, it may be zeroed and the walk continue backwards, depending on what the allocator placed there. Leading blanks are normally skipped before a field is stored, but an all-blank field still arrives after a leading escape_char that differs from quote_char, or as a quoted field in getline when its line ends in two CRs.

Text::CSV_XS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk, and after each record the parser copies the whole unparsed remainder into a new buffer. A reader with default options that is sent CSV with classic Mac line endings spends seconds of CPU time on a megabyte of input.

Text::CSV_XS versions before 1.65 for Perl allow memory exhaustion by allocating one entry per index of an RFC 7111 selector in fragment. fragment expands a row= or col= selector into an array with one element per selected index before it reads any data, and it does not clamp an explicit end column in a cell= selector to the row. Only the syntax and order of the ranges are checked, so row=1-400000000 on a two-line file allocates 400 million elements. An application that passes a request-supplied fragment to fragment or csv can be made to exhaust memory, which ends the process with an Out of memory error that eval cannot catch.

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password change for the global administrator, replace the administrator password, and authenticate as that account, resulting in complete global administrator account takeover. This issue is fixed in version 2.6.0.

In Arcane before 2.5.0, UpdateRegistry and TestRegistry allow the registry URL to change while preserving the stored encrypted token. A user with registries:update and registries:test permissions can repoint the registry URL to an attacker-controlled host, causing the preserved token or password to be sent to that host.

In jackson-core (since 2.16.0), the StreamReadConstraints.maxNameLength limit is not enforced while accumulating a JSON property name in character-input parsers (Reader, String, char[]). The code path reuses the much larger maxStringLength limit (default 100,000,000 characters), allowing roughly 200 MB to be allocated before an exception is thrown. Byte-input parsers (UTF-8) are not affected.

GIMP contains an integer overflow in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. Opening or previewing a specially crafted PowerVR (.pvr) file can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash.

OpenHuman before 0.56.0 allows cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback. An attacker with an OpenHuman account can cause a user with the local core running to visit a malicious page that requests this endpoint, switching the user's active local session to the attacker's backend account.

Sunshine from 2026.329.165800 until 2026.906.222525 accepted any client certificate that chained to a stored paired-client certificate, without requiring the presented certificate to be the exact enabled paired identity. Certificate text was compared without canonicalizing equivalent PEM encodings, allowing a previously paired client to bypass the Disable control.

LoopX from 0.0.1 until 0.4.5 in `loopx serve-status` uses `StatusRequestHandler._send_json()` and `do_OPTIONS()` to send `Access-Control-Allow-Origin: *` for unauthenticated responses on predictable loopback ports. A remote attacker can cause an operator who visits attacker-controlled web content to issue cross-origin requests to status endpoints, exposing control-plane state, goal and run information, local absolute paths, private Markdown files, and dry-run configuration projections.

ERPNext before 15.121.0 and 16.34.0 fails to enforce proper authorization checks on certain status modification endpoints. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write, submit, cancel, document, or role checks, modifying data beyond the user's permitted role.

Exposure of the SQL Black List to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of Job Discard to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Exposure of Sensitive Information to an unauthorized actor vulnerability in Apache Kylin. The issue affects versions from 4 through 5.0.4.

Tandoor Recipes before 2.6.12 allows an authenticated user with read and write API scope in the victim's Space to access and modify another same-Space member's private recipe steps. The flaw is because StepViewSet and IngredientViewSet filter only by active Space and use role-level checks instead of the private-recipe owner or sharing predicate.