CVE Vulnerability Catalog

KitchenOwl through 0.7.10 fails to verify that category IDs belong to the caller's household in expense and item operations. Authenticated attackers can enumerate category IDs from other households to read their category names, budgets, and colors, breaking household isolation.

Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger refunds on completed orders. Attackers with order tokens can submit arbitrary payment actions like refunds that payment gateways execute while Sylius maintains order as paid, causing financial loss.

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return forged results to the MCP client.

Joomla Extension - svenbluege.de - Reflected XSS and open redirect in Event Gallery extension < 6.5.0 - The “return” parameter is base64-decoded and written to the “Back” link without being validated.

Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopping carts that are older than 30 days will be deleted.

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.

A vulnerability in wolfSSL causes CRL checking to be skipped for certificates without an OCSP URL when both OCSP and CRL revocation checking are enabled. As a result, a certificate revoked by CRL may be accepted, and a missing OCSP responder is treated as a positive response. The issue affects versions up to 5.9.2 and is reachable over TLS 1.0-1.3 and DTLS.

A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in all type-blind sibling consumers. Affects wolfSSL versions 5.8.4 through 5.9.2 with specific macros or --enable-opensslextra, when the application calls X509_verify_cert.

wolfSSL versions 5.9.2 and earlier fail to properly enforce NameConstraints extensions when there is an unconstrained CA tier between a name-constrained intermediate CA and the leaf certificate. wolfSSL incorrectly accepts certificates for hostnames they shouldn't cover due to a chain-walking state-machine bug.

In wolfSSL versions 5.7.2 through 5.9.2, a client-side implementation flaw in RFC 6961 (multiple OCSP response stapling) can lead to certificate forgery. When a client enables OCSP stapling with HAVE_CERTIFICATE_STATUS_REQUEST_V2 and calls wolfSSL_UseOCSPStaplingV2, it accepts any certificate in the peer's chain as a CA without verifying authorization.

In all builds using (D)TLS, including default builds, there is a series of conditional states during TLS shutdown that could lead to a heap-use-after-free. If an application gets a partial wolfSSL_read() result, sometimes caused by a small user buffer, then calls wolfSSL_shutdown for a bidirectional close and attempts wolfSSL_read() again while the peer continues sending data during shutdown, it could lead to a heap-use-after-free.

In wolfSSL versions v5.3.0 through v5.9.2, when NO_SESSION_CACHE_REF is undefined, wolfSSL_get_session() returns a handle into the process-global SessionCache instead of a session object. Because the TLS 1.2 session ID is server-chosen and sent in clear, a malicious server can overwrite the client's cache entry for another server and then be accepted as the original server during session resumption without certificate or domain name verification.

The PowerPress Podcasting plugin by Blubrry for WordPress before 11.17.2 does not sanitize and escape a block attribute before outputting it in a page, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not perform capability or ownership checks on several of its AJAX actions, relying on a nonce alone, allowing users an administrator has granted access to its posting features to export the site's configured social account credentials, delete arbitrary posts and reset the plugin's configuration.

The Optima Express IDX WordPress plugin before 8.7.6 does not properly neutralise a script value submitted through one of its REST endpoints before storing it and echoing it into the document head when the post is rendered, allowing users with a role as low as author to perform Stored Cross-Site Scripting attacks.

The Optima Express IDX WordPress plugin before 8.7.6 does not perform any authorisation check on one of its AJAX actions that is available to logged-out users, allowing unauthenticated attackers to force the creation of a fixed author-role account and to repeatedly rotate its application password on any connected install.

The WP YouTube Lyte WordPress plugin before 1.7.31 does not escape some attributes of YouTube embed blocks before outputting them in an HTML attribute when rendering the block, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks.

The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthenticated users to download the digital-goods files attached to any order without authorization.

The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart from a request-supplied identifier derived from a customer's email address. An unauthenticated attacker who knows a customer's email address can confirm that the customer shops at the store and read that customer's saved cart contents.

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content. This allows users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.