CVE Vulnerability Catalog

In affected versions of Eclipse Theia (1.8.1 and later), the browser backend exposes privileged terminal RPC over WebSocket without service-level authentication. WebSocket origin validation is fail-open, allowing attackers to execute arbitrary OS commands.

The RTMKit (rometheme-for-elementor) plugin for WordPress up to version 2.0.7 is vulnerable to Local File Inclusion (LFI). This is due to insufficient path validation on the 'template' parameter in the render_templates AJAX endpoint, which is used directly in a require/include statement without sanitization. This allows authenticated attackers with Contributor-level access and above to include and execute files on the server ending in _templates.php, enabling the execution of any PHP code in those files.

The Destekz plugin from Raera - Ankara Web Design and Digital Advertising Agency contains a reflected XSS vulnerability due to improper input neutralization during page generation. The issue affects versions up to 02062026, and the product is no longer supported by the vendor.

A SQL injection vulnerability has been discovered in Destekz by Raera - Ankara Web Design and Digital Advertising Agency, due to improper neutralization of special elements in SQL commands. This flaw allows an attacker to execute arbitrary SQL queries on the database.

The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Headline Block 'linkMetaFieldType' Dynamic Link Attribute in all versions up to and including 2.2.1 due to insufficient input sanitization and output escaping.

The Zakra theme for WordPress up to version 4.2.0 is vulnerable to Stored Cross-Site Scripting. The REST API path bypasses sanitization for three post meta fields (zakra_menu_item_color, zakra_menu_item_hover_color, zakra_menu_item_active_color), allowing authenticated attackers with Contributor-level access or higher to inject arbitrary scripts that execute when users view the page.

A Path Traversal vulnerability in the Apache Lucene.Net.Replicator library allows unrestricted file reading outside the restricted directory. The issue affects versions from 4.8.0-beta00005 through 4.8.0-beta00017.

A vulnerability in Dell Client Platform BIOS allows authentication bypass due to a primary weakness. An unauthenticated attacker with physical access could potentially exploit this flaw, leading to information disclosure.

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

The CURCY – Multi Currency for WooCommerce plugin for WordPress up to version 2.2.14 allows unauthenticated attackers to execute arbitrary shortcodes. This is due to insufficient validation of a value before passing it to the do_shortcode function.

The LatePoint plugin for WordPress up to version 5.6.1 is vulnerable to authorization bypass. Unauthenticated attackers can modify personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including administrator accounts, by submitting the booking form with a known email address. Exploitation requires guest bookings to be enabled.

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.1.4 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can modify quizzes they do not own, overwrite result pages, and redirect notification emails to attacker-controlled addresses.

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

A vulnerability in Puppet resource_api causes sensitive parameters (e.g., passwords) to not be flagged as sensitive and are stored in cleartext in the agent's local transaction state cache. Affected versions include resource_api 1.5.0 through 1.9.1 and 2.0.0.

The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.

An improper restriction of XML external entity reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library) allows XXE attacks. Affects versions from 4.8.0-beta00005 up to 4.8.0-beta00017.

A Path Traversal vulnerability in the Lucene.Net.Replicator library allows unauthorized access to files outside the restricted directory. Affected versions are from 4.8.0-beta00005 to 4.8.0-beta00017.

A flaw was found in HPLIP (HP Linux Imaging and Printing Software) due to an incomplete fix for CVE-2026-8631. This vulnerability, caused by an integer overflow in the hpcups processing path, may allow a remote attacker to escalate privileges or achieve arbitrary code execution.

A vulnerability in libcurl allows accepting an untrusted server during SCP or SFTP transfers when using the CURLOPT_SSH_KEYFUNCTION callback. The server can present a host key type different from the one recorded in the known_hosts file, and the callback mechanism fails to enforce rejection, allowing the connection to succeed without warning.

A vulnerability in libcurl causes the HTTP `Referer:` header to persist even when explicitly cleared. According to the documentation, passing NULL to `CURLOPT_REFERER` should suppress the header, but the option fails to clear the internal state. As a result, the previous referrer string is erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.