CVE Vulnerability Catalog

Apache Johnzon is affected by an Unsafe Reflection vulnerability — ClassConverter loads and static-initializes an attacker-named class from untrusted JSON. The issue affects versions from 1.0.0 before 2.2.0.

Apache Answer through 2.0.2 has a missing authentication for critical function vulnerability. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.

Apache Answer through 2.0.2 has an insufficient session expiration vulnerability. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.

The MapSVG plugin (interactive vector maps for WordPress) through 8.16.1 allows unrestricted upload of files with dangerous types. This enables an attacker to upload and execute a web shell on the web server.

The HivePress plugin through 1.7.32 contains a code injection vulnerability due to improper control of code generation. This allows remote code inclusion into the application.

A vulnerability in Apache Kylin involving missing authentication for in-house broadcast and polymorphic deserialization. It affects versions 4.0.0 through 5.0.4 and impacts mainly services directly exposed to the public network.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.8 contain Missing Authorization (CWE-862) and Insecure Default Initialization (CWE-1188) in the MCP proxy and OIDC registration flow. Public disclosure of OIDC configuration via GET /info and auto-enrollment of any valid OIDC token holder via POST /register without claim filtering or ban checks allow a remote attacker to self-enroll into the mesh and invoke arbitrary tools across all connected MCP backend nodes.

Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 contain Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server. An unauthenticated remote libp2p peer can bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services, including command/stdio-backed MCP servers, A2A, and inference endpoints.

A vulnerability exists in the Web Server default connection ports under the process name GeoWebServer.exe.

The Management Console fails to properly validate input related to the configuration of JDBC user stores. This weakness allows an attacker to supply specially crafted input that can lead to the execution of arbitrary code on the affected server. Successful exploitation of this vulnerability enables an attacker to execute arbitrary code on the server with the privileges of the WSO2 product. This could lead to a full compromise of the system.

A vulnerability in the Linux kernel TCP stack related to collapsing skbs in the retransmit queue has been fixed. The tcp_write_collapse_fence() function was a no-op when the write queue was empty, allowing skbs queued after a device encryption switch to be merged with earlier skbs. As a result, data could be retransmitted in cleartext (psp) or the connection could stall (tls device offload).

A use-after-free vulnerability exists in the Linux kernel's SCTP implementation. When an association is in COOKIE-ECHOED state and a peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, processing removes the transport the packet arrived on, but the subsequent DATA chunk re-registers a pointer to that freed transport. Later use of this dangling pointer (e.g., via FWD-TSN or delayed SACK timer) leads to a write to freed memory.

In the Linux kernel, the openvswitch conntrack module has a use-after-free due to extension reallocation. A raw pointer to the extensions area is wired into the expectations list, and later extension additions can invalidate it, causing a UAF when the expectation is removed.

In the Linux kernel, a race condition exists in the RISC-V KVM component during VM teardown. The non-Sstc hrtimer callback clears next_set before its final uses of the vCPU, and if teardown observes next_set as false while the callback is still running, kvm_riscv_vcpu_timer_cancel() skips hrtimer_cancel() and the vCPU can be freed before the callback completes. This results in a use-after-free detected by KASAN.

Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain cluster-admin access by using the hardcoded admin token. Attackers can send the fixed Bearer token to the gateway gRPC proxy port to manage namespaces, eventbuses, users, tokens, and role bindings, and read or publish events.

The Conversational Forms for ChatBot plugin (up to version 1.5.1) is vulnerable to deserialization of untrusted data, allowing object injection. An attacker can supply malicious data that gets deserialized by the application.

The OttoKit plugin (up to version 1.1.40) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

The LearnPress plugin for WordPress in versions up to and including 4.4.10 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'checkout-email' request parameter during the checkout AJAX action. The value passes through sanitize_text_field(), which does not strip serialized object syntax, is stored in the LearnPress session table, and later fed to unserialize() without an allowed_classes restriction.