CVE Vulnerability Catalog

In a2ui-project a2ui up to 0.10.6, the DataContext.dispatchExpressionError function in renderers/web_core/src/v0_9/rendering/data-context.ts (Error Handler component) exposes information through error messages. The vulnerability is remotely exploitable and a public exploit is available; the patch is named 8f149a1c7b0ce1fa8e93ac3adfa5fda960faeb01.

In a2ui-project a2ui up to 0.10.6, a function in renderers/web_core/src/v0_9/rendering/data-context.ts (data-context Resolver component) allows resource consumption. The attack is remote and a public exploit has been disclosed; the patch is named eb314e14fabd29cfb4a74e1202afc4fe2081efa2.

The Jupiter X Core plugin for WordPress (up to and including 4.61.0) is vulnerable to authentication bypass in its Twitter/X social login handler. The verify_twitter_callback function fails to reassign the returned credentials to the TwitterOAuth client, so the subsequent API call remains signed with the site operator's stored token, and the plugin authenticates a WordPress account based solely on the X app owner's email address.

A vulnerability in jackson-databind allows bypassing generic-argument validation: only the outer class of a type ID is checked, while attacker-selected classes inside generic arguments are accepted. This enables deserialization of dangerous classes (e.g., HashMap<FileSystemXmlApplicationContext,String>) even with a validator enabled, potentially leading to remote code execution. Affects versions 2.10.0+ and 3.0.0+; it is an incomplete fix for CVE-2026-54512.

Integer overflow vulnerability in ProtobufParser._readStringKey() in the Jackson protobuf parser. A malformed protobuf message with a map key length of 0x7FFFFFFF causes signed arithmetic overflow in the bounds check, leading to an attempt to allocate a huge buffer and an OutOfMemoryError. StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not prevent the failure.

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc in the isConfigMessageEvent function of src/Bootstrap.tsx within the PostMessage Handler component. Manipulating the parentDomain argument results in improper authentication, and the exploit has been made public and could be used. The patch is named e3babb5cd83bfe3b99f1d82358ac5c1ea8e8a688.

The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() computes the value without the overflow guard present in the blocking parser, and _startRawBinary immediately allocates the declared length. A roughly ten-byte input can force an allocation of about 2 GB, causing OutOfMemoryError or NegativeArraySizeException.

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and then calling _finishShortText(len), both using 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAX_VALUE, _inputPtr + len overflows to a negative value, the bounds check passes, and TextBuffer.expandCurrentSegment(len) performs Arrays.copyOf with no cap and throws OutOfMemoryError. maxStringLength and maxDocumentLength do not gate this path.

In Nuxt Ollama prior to 1.3.1, `src/module.ts` unconditionally merges all module options, including a configured cloud `api_key`, into `runtimeConfig.public.ollama`. Nuxt serializes this public configuration into the server-rendered HTML `window.__NUXT__` payload, exposing the API key in plaintext to any unauthenticated client. `src/runtime/composables/useOllama.ts` also reads the public key and sends it as an `Authorization` `Bearer` credential in browser-side Ollama requests.

In Thor Vector Graphics (ThorVG) prior to 1.0.7, the SfntLoader::gen function in tvgSfntLoader.cpp reads data without first checking that the buffer contains at least four bytes, causing an out-of-bounds read. Loading an undersized font via memory APIs may crash the application or disclose adjacent heap memory.

In GRR prior to version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate input to read or delete arbitrary files on the server, causing sensitive file disclosure and denial of service through file deletion. The impact is amplified when the server runs with elevated privileges.

In GRR prior to version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as `ldap_filter`, poisoning `/personnalisation/config_ldap.inc.php` and enabling remote code execution. The administrator must first successfully connect to an LDAP server, which can be attacker-controlled, and then submit malicious input on the subsequent connector settings page.

In Cronicle prior to 0.9.121, a non-administrator user or scoped API key with `create_events` and `run_events` privileges can inject top-level `uid` and `gid` fields through `/api/app/create_event` or `/api/app/update_event`. In `lib/api.js`, `requireValidEventData` uses `validateOptionalParams` as a partial allow-list that silently passes unknown keys, storing the injected fields verbatim. In `lib/job.js`, `launchJob` copies the whole event into the job, and a plugin `uid` overrides the event `uid` only when the plugin defines one. The default `shellplug` and `urlplug` plugins do not define a `uid`, so the event-controlled identity survives into child-process launch.

In GRR prior to version 4.5.0, `maj.php` reflects the `forcemaj` parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScript in a victim's browser when the victim accesses it.

The WebSub intent-verification protocol requires a subscriber to echo the hub.challenge value but does not require safe response media typing or disabled MIME sniffing. An attacker can redirect a victim browser to a crafted verification request containing HTML or JavaScript, potentially executing code in the subscriber origin.

The private keys of eight eMudhra intermediate CA certificates have been compromised, and the certificates were revoked on October 18, 2026. CVE-2026-22063 tracks relevant changes in NetApp products rather than describing a software vulnerability.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No technical details about the vulnerability are available.

A use after free in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free in the WebAudio component in Google Chrome prior to 156.0.8078.73. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

A use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.