CVE Vulnerability Catalog

The Events Calendar (the-events-calendar) plugin contains a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The issue affects versions from n/a through 6.18.2. This may enable unauthorized access to features or data.

The Media Player Addons for Elementor (media-player-addons-for-elementor) plugin contains a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The issue affects versions from n/a through 1.1.10. This may allow stored XSS.

Wekan, an open source kanban built with Meteor, prior to 11.11 passes authenticated user-controlled searchTerm and query values to new RegExp() without escaping regular-expression metacharacters. In MongoDB-backed deployments the resulting patterns are evaluated with PCRE2, allowing a logged-in user to submit catastrophic-backtracking expressions that consume database CPU and degrade or deny service to other users. The searchUsers method additionally requires board membership or site-admin status.

gopacket, a Go packet processing library, prior to 1.7.2 passes attacker-controlled declared lengths and counts in layers/sctp.go to the SCTP sub-decoders (decodeSCTPInit, decodeSCTPShutdown, decodeSCTPError, decodeSCTPSack, decodeSCTPParameter) without checking that each chunk contains the required fields. A crafted SCTP segment can cause out-of-bounds or inverted slice panics. The panic can terminate applications using SkipDecodeRecovery, direct registered decoders, or DecodingLayerParser with IgnorePanic; default recovery-enabled APIs convert it to a per-packet decode error.

croc, a tool for securely transferring files and folders between computers, prior to 11.5.2 treats any sender-controlled basename beginning with croc-stdin- as a trusted text-transfer artifact in the receive-side file-readiness loop (src/croc/croc.go), even when SendingText is false. This skips askReceiveOverwrite and rename handling for a predictable exact-name collision in the receiver's working directory, allowing a remote sender whose transfer the user accepts to overwrite, truncate, or replace a matching file without confirmation.

Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the AWS KMS endpoint. To remediate, users should rebuild any custom enclave image against aws-nitro-enclaves-sdk-c 0.4.6.

A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow an application that runs on the parent EC2 instance to corrupt heap memory inside a Nitro Enclave which may lead to arbitrary code execution within the enclave. To remediate this issue, users should rebuild any enclave image that includes kmstool-enclave, or code derived from it, against aws-nitro-enclaves-sdk-c 0.4.6.

In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-restricted application credential may bypass those restrictions resulting in elevation of privileges.

Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15, 5.0.11, 5.21.9, 6.10.1 allows an unauthenticated attacker to authenticate as any trusted client and gain full access to the cluster and managed virtual machines via a crafted certificate chain.

A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.0 up to 2.15.3, 2.14.0 up to 2.14.7, 2.13.0 up to 2.13.11, 2.12.0 up to 2.12.15, 2.11.0 up to 2.11.19 and possibly older versions. The authorization check introduced to protect this feature was not applied to every API route that can reach it, so an alternative request form reached the shell handler without the access check being evaluated. This could allow any authenticated user to run a pod on the management cluster.

An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having a valid TLS session, EJBCA may, in certain circumstances, cache authentication for longer than the configured maximum time (default: 30 seconds), resulting in the former administrator retaining access they should no longer have.

The Fluent CRM WordPress plugin through version 3.2.6 contains a missing authorization vulnerability due to incorrectly configured access control security levels. This may allow exploitation of misconfigured access controls.

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.

Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks, causing heap over-reads that lead to crashes or heap memory disclosure.

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that reads a GLOB block field without validating its declared length. Attackers can supply a crafted .blend file with a truncated GLOB block that triggers the out-of-bounds read and crashes Blender when opened.

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail extractor caused by 32-bit integer overflow in thumb_data_vertical_flip(). Attackers can craft a .blend file with malicious TEST block dimensions that trigger an out-of-bounds write when blender-thumbnailer or the Windows shell extension previews it, causing crashes or code execution.

Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in ptcache_data_alloc() when reading point cache files. Attackers can supply a crafted point cache file with a large totpoint value alongside a .blend file to crash Blender or execute code as the user.

This CVE ID has been rejected as a duplicate. No further vulnerability information is available.

pybars3 through 0.9.7 and pybars4 through 0.9.13 contain a code injection vulnerability in pybars/_compiler.py that allows template authors to execute Python code via unescaped bracketed path segments. Attackers can supply Handlebars templates with crafted segments in helper or block arguments to break out of string literals and execute Python in the application process.

NocoDB before 2026.08.0 contains a clickjacking vulnerability because no X-Frame-Options or CSP frame-ancestors headers are sent, allowing any origin to frame the authenticated interface. Attackers can overlay a signed-in user's session from a malicious page, tricking clicks that modify or delete records, change sharing settings, or invite collaborators.