CVE Vulnerability Catalog

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress up to version 2.8.16 is vulnerable to Insecure Direct Object Reference (IDOR) via the 'data' attribute of the [adinserter] shortcode. The replace_ai_tags() function processes a {reusable-block-N} tag pattern calling get_post_field('post_content', N) without verifying user capabilities, restricting the post type to 'wp_block', or checking the post status.

The CURCY – Multi Currency for WooCommerce plugin for WordPress up to version 2.2.14 allows unauthenticated attackers to execute arbitrary shortcodes. This is due to insufficient validation of a value before passing it to the do_shortcode function.

The LatePoint plugin for WordPress up to version 5.6.1 is vulnerable to authorization bypass. Unauthenticated attackers can modify personally identifiable information (first name, last name, phone number, and notes) of any existing customer record, including administrator accounts, by submitting the booking form with a known email address. Exploitation requires guest bookings to be enabled.

The Quiz and Survey Master (QSM) plugin for WordPress up to version 11.1.4 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access or higher can modify quizzes they do not own, overwrite result pages, and redirect notification emails to attacker-controlled addresses.

The Comments – wpDiscuz plugin for WordPress up to version 7.6.56 is vulnerable to Stored Cross-Site Scripting. The vulnerability exists in the getCommentAuthor() function, which fails to properly escape the guest commenter 'Website' field before inserting it into single-quoted HTML attributes. This allows unauthenticated attackers to inject arbitrary scripts that execute when users view affected pages.

A vulnerability in Puppet resource_api causes sensitive parameters (e.g., passwords) to not be flagged as sensitive and are stored in cleartext in the agent's local transaction state cache. Affected versions include resource_api 1.5.0 through 1.9.1 and 2.0.0.

The RTMKit plugin for WordPress up to version 2.0.7 contains a stored XSS vulnerability in the Advanced Heading widget. It stems from insufficient output escaping of the 'Background Text' parameter in the render() function, allowing authenticated attackers with contributor-level access or higher to inject arbitrary scripts.

An improper restriction of XML external entity reference vulnerability in Apache Lucene.Net (Lucene.Net.Analysis.Common library) allows XXE attacks. Affects versions from 4.8.0-beta00005 up to 4.8.0-beta00017.

A Path Traversal vulnerability in the Lucene.Net.Replicator library allows unauthorized access to files outside the restricted directory. Affected versions are from 4.8.0-beta00005 to 4.8.0-beta00017.

A flaw was found in HPLIP (HP Linux Imaging and Printing Software) due to an incomplete fix for CVE-2026-8631. This vulnerability, caused by an integer overflow in the hpcups processing path, may allow a remote attacker to escalate privileges or achieve arbitrary code execution.

A vulnerability in libcurl allows accepting an untrusted server during SCP or SFTP transfers when using the CURLOPT_SSH_KEYFUNCTION callback. The server can present a host key type different from the one recorded in the known_hosts file, and the callback mechanism fails to enforce rejection, allowing the connection to succeed without warning.

A vulnerability in libcurl causes the HTTP `Referer:` header to persist even when explicitly cleared. According to the documentation, passing NULL to `CURLOPT_REFERER` should suppress the header, but the option fails to clear the internal state. As a result, the previous referrer string is erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers.

A vulnerability in libcurl allows sending the second request's data before enforcing certificate verification when SSL session caching and early data are enabled. This occurs when the target server is replaced by an attacker's impostor machine.

Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability. libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed.

A flaw in libcurl caused the command to clear proxy authentication credentials to be ineffective, leaving old credentials in memory. These credentials were then used in subsequent transfers that should not have access to them.

libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. Specifically, options related to the private key were left out from the configuration match checks.

A vulnerability in the libcurl library causes a leak of the proxy authorization header between requests. When reusing a libcurl handle for sequential transfers with environment-variable proxy configuration, the proxy authentication state is not cleared between requests. As a result, the `Proxy-Authorization:` header intended for one proxy may be sent to another.

A vulnerability in curl causes it to incorrectly use another user's password from the .netrc file when a URL with a username (without password) is provided, potentially leading to credential confusion.

A double-free vulnerability has been found in the curl library's SASL authentication handling. The GSASL context is cleaned up twice without clearing the pointer, causing free() to be called on the same memory region twice.

A flaw in curl's cookie parsing logic allows a malicious HTTP server to set 'super cookies' that bypass the Public Suffix List check. This enables an attacker-controlled origin to inject cookies that curl subsequently scopes and transmits to unrelated third-party domains.