CVE Vulnerability Catalog

Semantic MediaWiki from 3.0.0 before 7.3.1 contains an algorithmic complexity vulnerability in TermParser::normalize_compact_form() that allows unauthenticated attackers to cause quadratic CPU consumption. Attackers can submit long search terms with many distinct in:(...) or has:(...) expressions to Special:Search to exhaust PHP search workers when the extended search engine is enabled.

Semantic MediaWiki 3.0.0 before 7.3.1 contains an uncontrolled recursion vulnerability in LegacyParser::getSubqueryDescription() that processes nested query tokens before depth limits apply. Unauthenticated attackers can submit deeply nested query elements to the action=ask API to consume substantial CPU and memory, tying up request workers.

In affected versions of Octopus Server, OIDC token issuer validation was performed inconsistently. This could result in a token issued from a suitably configured non-legitimate issuer being accepted as a token belonging to a service account from a legitimate trusted issuer. Exploitation requires a service account with at least one OIDC identity configured, and the attacker would also need to know or guess some details of that identity.

A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-project disk data.

Origin Validation Error Vulnerability in HiRDB. This issue affects HiRDB Server Version 10 (from 10-00 before 10-12-01) and Version 9 and 9(32), including variants with Additional Function.

Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:image/svg+xml;base64. Script tags embedded in the SVG are processed when the content is rendered in the assistant window, allowing JavaScript execution and alteration of displayed content.

Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript content in the 'desc' and 'text' parameters, and the code is executed in the browser when the widget is rendered.

This vulnerability allows an authenticated IPMI Administrator to read and write arbitrary BMC physical memory. This enables code execution on the BMC operating system.

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.

The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.

An OS command injection vulnerability exists due to insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.

An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When SMS management is enabled and configured, a remote attacker with required privileges could exploit insufficient input validation to execute arbitrary commands.

A hard-coded cryptographic key vulnerability exists in OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote attacker could obtain shared key material and impersonate devices that have not regenerated their keys.

An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthenticated attacker with on-path access to the communication between the MRC Client and its server could impersonate a trusted server and conduct a man-in-the-middle attack.

The Kirki plugin for WordPress in versions up to and including 6.2.5 is vulnerable to privilege escalation via PHP Object Injection. The flaw stems from a missing capability check in the 'get-single-symbol' branch of the kirki_post_apis() AJAX dispatcher and deserialization of untrusted input, allowing authenticated attackers with Subscriber-level access and above to inject a PHP object. A POP chain enables overwriting an administrator's password and gaining administrative access.

An improper locking vulnerability in Fortinet FortiOS 8.0.0 and FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network access to the device to cause a denial of service of the HTTPS management interface via crafted HTTP requests.

The Analytics Insights – Google Analytics Dashboard for WordPress plugin up to and including version 6.3.12 is vulnerable to stored cross-site scripting via the Page Title due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an injected page.

Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by defining git filter drivers in an untrusted repository's .git/config. When started with --worktree, git worktree add applies .gitattributes and runs filter smudge, clean, or process commands before the trusted-folder check, executing attacker commands with user privileges.

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.