CVE Vulnerability Catalog

Kata Containers prior to version 4.0.0 is vulnerable to host code execution via an unvalidated configuration path annotation. The runtime accepts an arbitrary io.katacontainers.config_path pod annotation and loads the referenced host TOML file without restriction, allowing a pod user who can place a file at a host-visible path to supply a configuration that selects an attacker-controlled hypervisor or virtio-fs daemon binary, executing code as root on the host.

LightRAG through version 1.5.4 has an API server that binds to all network interfaces with authentication disabled by default, allowing an unauthenticated network attacker to read indexed document content, upload or delete documents, modify the knowledge graph, cancel pipelines, clear caches, and consume LLM resources.

Meta Ads MCP prior to version 1.0.109 has a vulnerability in AuthInjectionMiddleware.dispatch() that unconditionally forwards unauthenticated Streamable HTTP requests to downstream MCP tool handlers without issuing a 401 response, allowing any network-reachable caller to invoke MCP tools without authentication. When no per-request credential is present, tool handlers fall back to the META_ACCESS_TOKEN environment variable, and when the downstream Meta Graph API call fails, the JSON-RPC response body includes the raw request URL with the access token, exposing the credential to the unauthenticated caller.

crypto-js prior to version 4.0.0 generates randomness in CryptoJS.lib.WordArray.random() using a custom variation of the Multiply-With-Carry pseudorandom number generator, seeded from Math.random(), instead of a cryptographically secure source. This generator was introduced in version 3.1.2-4 and remained in nearly every 3.x release. Requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities, small enough to enumerate on commodity hardware.

Improper privilege management in the XML-RPC API of Plesk before 18.0.80 allows an authenticated reseller to obtain an administrative session for the root user account.

Postiz, an open-source social media scheduling tool, has a path traversal vulnerability in the route serving locally stored media. The route requires no authentication and does not normalize paths, allowing an unauthenticated attacker to read any file readable by the process, including environment variables with JWT secrets and database credentials.

Weaver (Fanwei) E-cology 9.0 before 10.52 has a file upload vulnerability allowing remote unauthenticated attackers to upload arbitrary files, including JSP webshells, via a POST request to /workrelate/plan/util/uploaderOperate.jsp, leading to remote code execution.

Joomla extension SEBLOD versions < 3.30.0, < 4.7.0, < 6.0.1 have an unauthenticated path traversal vulnerability allowing file download from inside and outside the webroot.

Out-of-bounds Read vulnerability in Apache Fory C++ deserialization. This issue affects Apache Fory C++ versions from 0.14.0 before 1.5.0 when deserializing structs containing tagged integer fields. A crafted input payload may trigger an out-of-bounds heap read in the tagged integer fast-path deserializer, potentially causing information disclosure or denial of service.

Heap type confusion vulnerability in Apache Fory C++ deserialization. A crafted input payload can bypass type compatibility checks during polymorphic smart-pointer deserialization, causing an object of an incompatible type to be treated as the declared base type. This may result in undefined behavior and potentially lead to denial of service or arbitrary code execution.

The TeamDavid Webbox application exposes an endpoint /internalRestart that allows the server to be shut down. The endpoint is accessible to unauthenticated users over the public internet, and instead of restarting, the server completely shuts down. An attacker can trigger a persistent denial of service, and recovery requires manual administrator intervention.

An API endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow. Submitting a specially crafted JSON body (at least 8 characters long and starting with a number) by an unauthenticated attacker can cause the server to crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially lead to remote code execution and full compromise of the server.

The //serverClient_close.html endpoint in the TeamDavid Webbox application is vulnerable to a buffer overflow in multiple form data parameters. Submitting excessively long values in these parameters by an authenticated attacker can trigger a server crash, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

File upload functionalities in the TeamDavid Webbox application are vulnerable to a buffer overflow. Specifying an excessively long filename in a file upload request by an unauthenticated attacker can trigger a crash of the server, resulting in denial of service. Depending on stack state or if a stack canary can be disclosed, this buffer overflow could potentially be exploited for remote code execution, leading to full compromise of the server.

The TeamDavid Webbox application has a memory leak vulnerability that allows an unauthorized actor to read sensitive information. Accessing the URL “/.well-known/mta-sts.” causes the application to respond with memory content. By repeatedly requesting this endpoint, an attacker can access sensitive information, including user passwords. Exploitation does not require authentication.

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed plugin, this can be leveraged to achieve Remote Code Execution.

The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary order fully paid without paying and obtain goods or services for free.

The WP Events Manager WordPress plugin before version 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to authorization bypass. The plugin does not properly verify that a user is authorized to perform an action, allowing unauthenticated attackers to change the password of arbitrary user accounts, including administrators.

The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress, in all versions up to and including 1.2.3, is vulnerable to account takeover via improper password reset validation. The plugin does not properly validate a user's identity before resetting their password, allowing unauthenticated attackers to reset passwords of arbitrary user accounts, including administrators.