CVE Vulnerability Catalog

A double free in the IP management daemon (ipmgmtd) of OmniOS and SmartOS allows a local user to crash the daemon. When authorizing a door request that modifies interface configuration, ipmgmt_handler() in usr/src/cmd/cmd-inet/lib/ipmgmtd/ipmgmt_door.c frees the caller's credential with ucred_free() immediately after reading the user ID, and frees it a second time on the error path if the authorization check fails. An unprivileged local user who does not hold the solaris.network.interface.config authorization can send such a request, for example IPMGMT_CMD_RESETIF, to the ipmgmtd door, causing ipmgmtd to abort; repeated requests place the svc:/network/ip-interface-management service into maintenance, preventing IP interface configuration. The early free was introduced in 2014 to support lx-branded zones (OmniOS commit 4c170900) and is not present in upstream illumos-gate. It affects OmniOS r151020 and later, and SmartOS, prior to the fix.

A missing release of resources in the illumos name service cache daemon (nscd) allows a local user to exhaust kernel memory. The nscd door server procedure, switcher() in usr/src/cmd/nscd/nscd_frontend.c, does not close file descriptors that are passed with a door call but not used by the request, and the main nscd door at /var/run/name_service_door accepts passed descriptors from any user in its zone. Because nscd also runs with an unlimited file descriptor limit, an unprivileged local user, including one in a non-global zone, can repeatedly pass a descriptor to its zone's nscd in a door_call() loop, causing the file descriptor table of nscd to grow without bound in kernel memory. This causes a denial of service of nscd and can render processes in all zones on the host unresponsive. The flaw has existed since 2006 (illumos-gate commit cb5caa98), and affects any illumos distribution prior to illumos-gate commit af810a72.

A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS instruction that accesses guest MMIO, vie_emulate_movs() and vie_emulate_stos() in usr/src/uts/intel/io/vmm/vmm_instruction_emul.c do not clear the VIES_REPEAT status flag on the final iteration. For MMIO regions emulated in the kernel (the local APIC, I/O APIC and HPET), the stale flag causes a VERIFY assertion in vie_advance_pc() to fail, and the host panics. A privileged user within a guest VM can issue a REP MOVS or REP STOS instruction against the local APIC page to cause a denial of service of the host and every other guest running on it. The flaw has existed since 2020 (illumos-gate commit e0c0d44e), and affects any illumos distribution prior to illumos-gate commit 696ecf8d.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.

The STTP-based data publisher on openPDC accepts network connections without authentication in its default configuration. An unauthenticated network attacker can connect to this interface and exchange data with it.

Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed.

In the libhangul library, when parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. Providing a specially crafted dictionary file to an application that queries it can trigger an unexpected application crash, resulting in a Denial of Service (DoS).

ProcessMaker before version 2026.14.3 is vulnerable to SQL injection in the `GET /api/1.0/tasks` endpoint via the `order_by` parameter. The `applyColumnOrdering()` method concatenates a user-controlled `process_requests` column name into a SQL subquery without validation or parameter binding. Any authenticated user can use blind, time-based queries to infer and extract data accessible to the ProcessMaker database account.

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates SHA-512, the key is 64 bytes instead of the required 32 bytes. The agent does not validate the size, causing failures in tunnel updates and configuration writes. For peers without a previously negotiated 32-byte key, the tunnel may have no preshared key, allowing an attacker with a quantum computer to decrypt traffic.

A Modbus connection feature on openPDC accepts a caller-specified destination address and port with no restriction on which internal hosts may be targeted. An authenticated user can attempt connections to arbitrary internal network destinations, revealing which destinations are reachable. With repeated attempts, an attacker may be able to map the internal network.

The Affinity by Canva application for macOS before version 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

The WPFunnels plugin for WordPress up to version 3.13.3 contains a stored XSS (Cross-site Scripting) vulnerability due to improper neutralization of input during web page generation.

The Before After Image Comparison – Image comparison for WP plugin up to version 1.1.21 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

The Jetpack plugin by Automattic up to version 16.2 contains an authentication bypass using an alternate path or channel vulnerability, allowing password recovery exploitation.

The QA Analytics qa-heatmap-analytics plugin up to version 5.3.0.0 contains a vulnerability of inserting sensitive information into sent data, allowing retrieval of embedded sensitive data.

Envira Gallery Lite before version 1.16.2 has a missing authorization vulnerability in its gallery conversion REST endpoint, allowing lower-privileged authenticated users to create and publish galleries without required capabilities. Attackers can also supply arbitrary image IDs without ownership verification to publish unauthorized content.

Affinity by Canva before version 3.3.1 did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and dereference of an untrusted pointer. A crafted document could cause memory corruption or application crash.

The Testimonials by BestWebSoft WordPress plugin through version 1.0.8 does not sanitize and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.

The Shipping for Nova Poshta WordPress plugin through version 1.19.8 does not perform any authorization, nonce, or ownership checks on one of its AJAX actions available to unauthenticated users, allowing anyone to delete shipment records of arbitrary orders and to make the store issue the carrier's waybill-deletion request using the store's own stored API credentials.