CVE Vulnerability Catalog

The zip library for Rust, from 5.1.0 until 9.0.0, with the legacy-zip feature enabled, reserves output capacity based on an attacker-controlled ZIP64 uncompressed size before validating the compressed stream. The ShrinkDecoder path in src/legacy/shrink.rs can panic with a capacity overflow during ZipArchive::extract, and the Reduce and Implode decoders contain the same unbounded preallocation pattern. An unhandled panic can terminate an archive-processing service.

The zip library for Rust in versions 0.6.0 through 8.x verifies the HMAC of an AES entry only when the data counter reaches zero. If the reader hits the real end of the archive while data_remaining is still positive, or an encrypted entry has no payload, a clean end of stream is returned without comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can accept modified plaintext without an authentication error.

Through 9.0.4, the Rust zip library's ZipArchive treats Central Directory File Header filenames as authoritative while ZipStreamReader extracts using Local File Header filenames without reconciling the duplicate metadata. A crafted archive can appear benign to a component inspecting the central directory but cause a streaming extractor to write a different attacker-selected path and content.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

SQL injection in the database-query custom resource handlers in the AWS Cloud Development Kit (CDK) @aws-cdk/aws-redshift-alpha module before 2.274.0-alpha.0 could allow a third party who can influence construct property values to run SQL statements with Amazon Redshift superuser privileges, including granting access to all cluster users. The statements are reachable through crafted user names, comments, or passwords.

The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.

The Windows driver for the HUION Inspiroy Frego S (L310) version 20.0.1.118 contains a DLL-loading vulnerability in the installer logic. A local attacker can exploit this to execute arbitrary code.

The homestay-backend 0.0.1-SNAPSHOT application contains an IDOR vulnerability in ChatServiceImpl. An authenticated user can view conversations, read and send messages, and mark messages as read for arbitrary conversation IDs because the service does not verify that the caller is a conversation participant.

The mall-server 0.0.1-SNAPSHOT application contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

OctoPrint version 1.0.0 has a vulnerability in the getSettings function in src/octoprint/server/ajax/settings.py, in the API Key Handler component. The manipulation causes information disclosure, and the attack can be carried out remotely. The exploit is publicly available, and the issue is fixed in version 1.1.0-rc1.

Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the API, which allows a team admin to grant a team member permissions beyond those permitted by the configured permission scheme via the {{update-team-member-roles}} REST API. Mattermost Advisory ID: MMSA-2026-00734.

Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform is vulnerable to bucket squatting. An attacker can intercept and access proprietary source code, execute arbitrary code, and exfiltrate data.

This CVE ID has been rejected by runZero as unused.

This CVE ID was rejected because the reported issue could not be reproduced and the affected products are end-of-life. The ID is unused by the CNA.

This CVE ID was rejected because the reported issue was assessed as intended functionality. The ID is unused by the CNA.

This CVE ID was rejected as a duplicate — the reported issue is tracked under CVE-2026-18451.

This CVE ID was rejected because the reported issue could not be reproduced. The ID is unused by the CNA.

This CVE ID was rejected as a duplicate — the reported issue is tracked under CVE-2026-18450.

This CVE ID was rejected because the reported issue could not be reproduced. The ID is unused by the CNA.