CVE Vulnerability Catalog

mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability because safeFetch() forwards Authorization and Cookie headers on cross-origin redirects. Attackers controlling a spec host or abusing an open redirect can redirect fromURL() spec requests to their own origin to steal bearer tokens or cookies.

hydra-ray-launcher versions 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contain an arbitrary module import vulnerability via the ray_pkg_version OmegaConf resolver passing input to importlib.import_module(). Attackers controlling configuration values or command-line overrides can supply a ray_pkg_version interpolation to import any installed module, triggering its import-time side effects in the application process.

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

@pdfme/common from 5.5.10 before 6.2.6 contains an SSRF vulnerability that bypasses the isUrlSafeToFetch denylist in getB64BasePdf. Attackers can supply basePdf URLs using IPv4-mapped IPv6, [::], NAT64 or localhost alias hostnames to read loopback, internal or cloud metadata responses through generated documents.

@hapi/content from 6.0.1 before 6.0.3 contains a regular expression denial of service vulnerability in Content.disposition() caused by an incomplete fix for CVE-2026-35213. Unauthenticated remote attackers can send multipart uploads with a long Content-Disposition parameter lacking an equals sign, triggering quadratic backtracking that blocks the event loop.

The KALLYAS WordPress theme (Hogash) in versions up to 4.25.0 contains a Reflected Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into clicking a crafted link, leading to execution of malicious script in the victim's browser.

The Little Birdies WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Little Birdies from n/a through 1.3.16.

The Rhodos WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Rhodos from n/a through 1.3.3.

The Reprizo WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Reprizo from n/a through 1.0.8.

The Vagabonds WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Vagabonds from n/a through 1.3.10.

The Redy WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Redy from n/a through 1.3.5.

The Holistic Center WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Holistic Center from n/a through 1.2.6.

The Hallelujah WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects Hallelujah from n/a through 1.1.1.

The Helion WordPress theme (ThemeREX Group) in versions up to 1.1.12 contains a Deserialization of Untrusted Data vulnerability allowing Object Injection. This may lead to unexpected application behavior or code execution depending on available gadgets.

The HotLock WordPress theme contains a deserialization of untrusted data vulnerability that allows object injection. This issue affects HotLock from n/a through 1.3.9.

The Your Dress WordPress theme (AncoraThemes) in versions up to 1.4.1 contains a PHP Local File Inclusion vulnerability due to improper control of filename in include/require statements. An attacker may include local PHP files, potentially leading to code execution or information disclosure.

The Hostme v2 WordPress theme (AivahThemes) in versions up to 7.0 contains a DOM-Based Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. An attacker can trick a user into interacting with a crafted page, leading to execution of malicious script in the victim's browser.

A deserialization of untrusted data vulnerability in the AivahThemes Hostme v2 WordPress theme allows object injection. The issue affects Hostme v2 from n/a through version 7.0.

A deserialization of untrusted data vulnerability in the ThemeREX ZenSoul WordPress theme allows object injection. The issue affects ZenSoul from n/a through version 1.13.

A deserialization of untrusted data vulnerability in the ThemeREX Group Save Life WordPress theme allows object injection. The issue affects Save Life from n/a through version 1.2.14.