CVE Vulnerability Catalog

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit-specific role to read other users' appointment records, including customer names, email addresses, phone numbers and private booking comments.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

The MasterStudy LMS WordPress plugin before 3.7.50 does not verify that the requesting user owns the course before returning its enrolled-student data, allowing users with the Instructor role to disclose the names and email addresses of students enrolled in other instructors' courses.

The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gating them only on a coarse capability that lower-privileged users also hold and never confirming ownership of the targeted object, allowing authenticated users with author-level access and above to disclose absolute file paths for, overwrite the bytes of, and site-wide re-reference media belonging to other users, including administrators.

The King Addons for Elementor WordPress plugin before version 51.1.81 does not perform any capability, post-status, or password check before rendering the content of a user-supplied post, allowing users with Contributor-level access and above to read the content of private, draft, pending, and password-protected posts they are not authorized to access.

The MasterStudy LMS WordPress Plugin before version 3.7.50 does not perform per-object ownership or capability checks when updating orders through its REST API, allowing users with the Instructor role to modify any order on the site, granting free course enrolment, revoking other users' paid enrolments, and tampering with order notes.

After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.

A flaw in libmongoc's SCRAM authentication implementation causes the client to continue the handshake and transmit the client proof even when a nonce mismatch is detected in the server's first message. A man-in-the-middle attacker can inject a crafted server-first-message with a controlled salt and low iteration count, then capture the client proof for offline password cracking. The vulnerability is mitigated by TLS, which is standard in production deployments.

Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.

In Omni before versions 1.6.6 and 1.7.3, managementServer.CreateSchematic in internal/backend/grpc/schematics.go passes the caller-controlled TalosVersion field to imageFactoryClient.OverlaysVersions without validating it as a version. An authenticated Operator can submit traversal segments in TalosVersion, which url.URL.JoinPath normalizes into unintended paths on the configured image-factory host. Omni then issues HTTP GET requests to those paths and reflects error-body content, enabling same-host endpoint probing and possible disclosure of internal diagnostics.

In uniget before version 0.27.6, the hooks edit command in cmd/uniget/hooks.go parses UNIGET_EDITOR or EDITOR with strings.Split(editor, " ") and passes every space-delimited suffix as an argument to the selected editor executable. An attacker who can influence the editor environment and cause hook editing can supply unexpected editor arguments, potentially causing unintended actions with the privileges of the uniget process account. Go os/exec does not evaluate shell operators in these arguments.

In punchin-email before version 1.5.0, handleInbound delivers inbound alias mail with message.forward(), which silently drops the added Reply-To header intended to route responses through the relay. When a correspondent sends mail to an alias and the operator replies, the mail client can send directly to the correspondent from the private FORWARD_TO inbox address, exposing that address. The disclosure is limited to the operator's own email address and does not expose third-party data or provide code execution or authentication bypass.

The AsyncHttpClient (AHC) library in versions 3.0.8 through 3.0.12 does not enforce verification of SCRAM ServerSignature and Digest rspauth authentication results. On a non-TLS or compromised transport, an attacker can be accepted as the server without proving knowledge of the shared secret. The issue is fixed in version 3.0.12.

The MidnightBSD package manager mport in versions prior to 2.7.8 does not validate icmp_id and icmp_seq in ICMP replies and uses a fixed IP-header offset instead of ip_hl. A network attacker can influence mirror latency selection or trigger an out-of-bounds read via a malformed packet. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 continues after MD5File() or SHA256_File() failure and compares an expected checksum with stale data in the hash buffer instead of a newly computed digest. An attacker able to influence an installed file or hashing failure conditions can obtain a misleading integrity result or hide a checksum failure. The issue is fixed in version 2.7.8.

The MidnightBSD package manager mport in versions prior to 2.7.8 in the audit command computes adjusted local_argv and local_argc values but passes the original argument entry to audit_package(). When an operator uses an option such as -r before a package name, stale optind state can cause auditing of the option token instead of the requested package, yielding a false-negative result. The issue is fixed in version 2.7.8.

The Mattermost Desktop App in versions <=6.2 6.2.2.0 fails to validate the URL scheme when checking whether a target URL is internal to the connected server. A network-positioned attacker can load a plugin popout window over an insecure connection via a link using a downgraded URL scheme. Advisory ID: MMSA-2026-00717.

MariaDB Connector/J in versions prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9 does not enforce allowLocalInfile=false when processing a LOCAL INFILE packet. A rogue or man-in-the-middle server can cause the connector to transmit a file selected by the application despite the disabled option. The issue is fixed in versions 2.7.14, 3.3.5, 3.4.3, and 3.5.9.