CVE Vulnerability Catalog

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.

In the H.264 video parser in gst-plugins-bad, when processing a specially crafted H.264 video file or network stream with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during cleanup of partially allocated internal structures after a parse failure. This can cause the application using GStreamer to crash, resulting in a denial of service.

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accept an out-of-range value for the number of palette predictor entries. This causes the parser to write beyond the end of a fixed-size array, resulting in memory corruption and an application crash.

The ThemeREX Royal Event WordPress theme in versions up to 2.0 contains a deserialization of untrusted data vulnerability allowing object injection.

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versions of the library pass these credentials to the native child process as command-line arguments, where a local user can read them from the process argument list. To remediate this issue, users should upgrade to version 1.0.8 or later, rotate any long-term IAM user keys, revoke active role sessions where needed, and restrict or redact log data written by an affected version. 0.x users should migrate to software.amazon.kinesis:amazon-kinesis-producer 1.0.8 or later.

The WordPress plugin MasterStudy LMS in versions up to 3.7.55 contains a PHP Object Injection vulnerability exploitable by a subscriber-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin Product Feed Manager in versions up to 7.14.1 contains a PHP Object Injection vulnerability exploitable by a shop manager-level user. This may lead to injection of a malicious PHP object.

The WordPress plugin WP BASE Booking in versions up to 6.5.2 contains a privilege escalation vulnerability exploitable by a subscriber-level user. This may lead to elevated privileges within the site.

The WordPress plugin WP REST Cache in versions up to 2026.3.1 contains an unauthenticated Broken Access Control vulnerability. An unauthenticated attacker can access functions or data they should not be able to reach.

The WordPress plugin Flexible Chat in versions up to 1.1.0 contains an unauthenticated Sensitive Data Exposure vulnerability. An unauthenticated attacker can access information that should be protected.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions.

The Widget Options WordPress plugin in versions up to 4.2.5 contains an author-level Remote Code Execution (RCE) vulnerability.

The WordPress plugin eCommerce Product Catalog in versions up to 3.6.5 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

The WordPress plugin Mang Board WP in versions up to 2.4.6 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker can inject malicious script into the page.

Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.

The VikRentCar plugin in versions up to 1.4.9 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. An attacker can inject malicious JavaScript that executes in the user's browser.

The HUSKY plugin in versions up to 1.4.6 contains an unauthenticated Broken Access Control vulnerability. An attacker can bypass access control mechanisms and perform unauthorized actions.

The SMS Alert Order Notifications WordPress plugin in versions up to 4.0.2 contains an unauthenticated privilege escalation vulnerability.

Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.