CVE Vulnerability Catalog

In GeoVision GV-LPC2211 V1.13, an administrator can set a PPPoE username that escapes a sourced shell configuration assignment and executes arbitrary commands as root.

In GeoVision GV-LPC2211 V1.13, an administrator can set a username containing shell metacharacters that are executed as arbitrary root commands when the stored username is later deleted.

In GeoVision GV-LPC2211 V1.13, a Guest user can overwrite device configuration and replace the administrator password through SSVR.

In crun, when built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun can execute attacker-controlled payload from the container image with host root privileges. This is a regression in crun 1.29 and affects crun >= 1.29.

A heap-based buffer overflow in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) allows attackers to cause a denial of service (process crash) or potentially execute arbitrary code. The decoder trusts the packet length field from the external device and forwards it to the host response queue without validating the destination buffer bounds; a malicious USB or BLE peripheral can advertise a payload size up to ~3 KB, exceeding the default queue slot size of 255 bytes, resulting in an unbounded heap overwrite.

A stack-based buffer overflow in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser function bhi385_parse_debug_message (in bhi385_parse.c). The function parses FIFO events and extracts an 8-bit message length directly from the attacker-controlled event payload (callback_info->data_ptr[0]) without bounds checks; copying into a fixed-size 17-byte stack buffer via memcpy with a length byte greater than 16 writes past the stack boundary, leading to firmware crash, DoS, or potentially arbitrary code execution.

A stack-based buffer overflow in the Bosch Sensortec BHI360 SensorAPI (C library) in versions up to and including commit d6b200416a. The vulnerability is in the FIFO parsing and debug logging subsystem within bhi360_parse_debug_message() in bhi360_parse.c (lines 1852-1875); the parser trusts the first payload byte as the message length and copies that many bytes into a fixed-size 17-byte stack buffer via memcpy without bounds checking. A locally or physically positioned attacker can inject a crafted debug frame with a length byte exceeding 16, corrupting adjacent stack data including the saved return address; because the overflowed buffer is subsequently passed to a printf-style logging sink, the attacker can supply format string specifiers (e.g., %n) to execute arbitrary code on the host microcontroller/SoC or cause a reliable system crash (DoS).

A vulnerability in Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into starting the CLI within an untrusted directory. The vulnerability is triggered via untrusted .env files overriding GEMINI_CLI_HOME to load malicious configuration files and bypass folder trust prompts.

Authorization bypass through User-Controlled key vulnerability in Apache Camel K. An authorization vulnerability in custom resource resolution allows a tenant to reference secrets by name in the operator namespace, potentially exposing secrets belonging to other tenants or operator components. This issue affects Apache Camel K: from 2.0.0 before 2.9.3, from 2.10.1 before 2.10.2.

The Site Reviews WordPress plugin before 8.3.0 does not prevent request data from being deserialized, and derives the key protecting that data by padding out the site's WordPress nonce key, which makes the key publicly computable on installs where that key is absent, left at its sample value, or too short to be secret. This allows unauthenticated users to inject arbitrary PHP objects on such installs. The plugin's own code contains no chain onward from the injected object, so how far it reaches depends on the other code present on the site.

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post (Contributor and above) can therefore register a new account with an arbitrary role, including Administrator, leading to full site takeover. This is an incomplete fix of CVE-2026-54807.

The miniOrange 2FA WordPress plugin before 6.3.1 and before 19.3 does not scope its second-factor attempt limit to the account being attacked, keying it instead to a client-supplied identifier that can be changed at will. An attacker who already knows a victim's password can make unlimited one-time-passcode guesses and defeat the second factor. A second validation endpoint applies no attempt limit at all.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not have any authorisation check when displaying gift card details, allowing unauthenticated users to retrieve the gift cards attached to arbitrary orders and disclose customer personal data, balances, dates and, in 3.2.9, the live redemption code, which anyone holding it can spend. Versions from 3.0.3 to 3.2.8 disclose the same data without the redemption code.

The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not reconcile the value of the gift card coupon it issues against the amount actually collected at checkout, allowing unauthenticated users to obtain store credit worth more than they paid.

A stack-based buffer overflow vulnerability in the Nintendo Switch local wireless networking functionality may allow an attacker within wireless range to execute arbitrary code using return-oriented programming (ROP) through crafted network traffic. This issue affects Nintendo Switch: before 23.0.0.

A buffer overflow vulnerability in the XML processing functionality of Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web or dataplane interface to cause a denial of service (DoS) condition on VM-Series firewalls or execute arbitrary code with root privileges on PA-Series firewalls. Panorama is also impacted.

An unauthenticated remote attacker connecting with the CORE protocol can discover cluster node details by sending a SUBSCRIBE_TOPOLOGY request prior to authentication. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

An unauthenticated remote attacker can create arbitrary durable queues via the CORE protocol, leading to unauthorized broker state manipulation and potential denial of service. The issue affects Apache Artemis 2.50.0 through 2.56.0 and Apache ActiveMQ Artemis 1.0.0 through 2.44.0.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages.

The Direct Download for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.19 via the top-level include function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. The product ownership check only verifies that some free, virtual, downloadable product exists on the site, not that the requested file path belongs to that product.