CVE Vulnerability Catalog

EDK2 contains a vulnerability in BIOS where a user may cause an out-of-bounds write, classic buffer overflow, and incorrect calculation of buffer size via remote access. Successful exploitation can lead to arbitrary code execution. It could also impact confidentiality, integrity, and availability.

Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Link with storeToken set to plain, or with storeToken set to hashed and the global verification.storeIdentifier setting also set to hashed, enable a built-in social or Generic OAuth provider, and use account.storeStateStrategy set to database can accept an OAuth sign-in state value as a Magic Link token. These settings can cause Magic Link verification records and OAuth state to resolve to the same stored identifier, allowing an unauthenticated attacker to start OAuth sign-in for a known email address and redeem the returned state through Magic Link without controlling the mailbox or completing the provider callback. The attacker can obtain a normal session for an existing user, or create an account incorrectly marked as email verified when sign-up is enabled. This issue is fixed in version 1.7.7.

Multiple AiDot devices are vulnerable to a heap-based buffer overflow via SSDP location header parsing.

In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write potentially leading to remote code execution. These messages must come from a device that has already joined the network. Only devices supporting the Price Cluster are impacted.

In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to a crash. A limited number of values can be written using this vulnerability, so no route to remote code execution was observed. These messages must come from a device that has already joined the network. Only devices supporting the Group Cluster are impacted.

In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially leading to remote code execution. This response must come from a device that has already joined the network, and the attacker must wait for a Simple_Desc_req before the attack can be performed.

Joomla extension YOOtheme Pro versions 5.0.0–5.0.52 contains an unauthenticated remote code execution vulnerability. The publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature, allowing an attacker to reuse a signature from a legitimate public image URL, inject additional operations, traverse out of the cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

The CozyThemes Rootblox WordPress plugin through version 1.0.6 contains an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability that allows PHP Local File Inclusion.

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files such as etc/passwd.

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validation code to execute arbitrary PHP and system commands.

FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated attackers to write arbitrary files via the filePath parameter. Attackers can send a POST request with directory traversal sequences in filePath and a __CONTENT__ payload to write a JSP webshell and achieve remote code execution.

The Amelia plugin for WordPress (versions up to 2.4.11) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. This may allow manipulation of database queries.

An Authentication Bypass by Spoofing vulnerability in the Brainstorm Force SureCart plugin, affecting versions through 4.9.5. It allows authentication abuse.

NT OneAPP by NewType Infortech has an improper certificate validation vulnerability. Unauthenticated network-adjacent attackers can perform a man-in-the-middle attack because the application fails to validate the server certificate and hostname, intercepting or modifying communications between the application and the server.

The Webform module for Drupal (versions 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1) is vulnerable to code injection due to improper neutralization of special elements used in a template engine.

In TOTOLINK A950RG 4.1.2cu.5268_B20221104, the UploadCustomModule function in lib/cste_modules/product.so is vulnerable to command injection via manipulation of the FileMd5 argument. The attack can be launched remotely, and the exploit has been published and may be used.

GitLab CE/EE across many versions contains an integer overflow when compiling a specially crafted regular expression. Under certain conditions this could allow an unauthenticated user to execute arbitrary code on the GitLab server.

Cisco's internal security review discovered multiple vulnerabilities related to files or directories accessible to external parties (CWE-552). Fixes were released as part of a software hardening update.

Cisco conducted an internal security review resulting in a software hardening release that addresses multiple internally discovered vulnerabilities. CVE-2026-76529 relates to improper protection of alternate path (CWE-424).