CVE Vulnerability Catalog

The Easy Digital Downloads WordPress plugin (through version 3.7.1) contains a race condition vulnerability due to improper synchronization of shared resources. This may allow an attacker to leverage race conditions.

The Amelia WordPress plugin (through version 2.4.12) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.

The LightBox Block WordPress plugin (through version 1.2.0) does not properly neutralize input during web page generation, enabling Stored Cross-site Scripting (XSS). A malicious script can be persistently stored and executed in a user's browser.

The Amelia WordPress plugin (through version 2.4.10) has missing authorization, allowing exploitation of incorrectly configured access control security levels. An attacker could perform operations they should not be permitted to.

A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.0 affecting unknown code of the Backend component. Manipulation can lead to improper authorization, and the attack can be launched remotely. The exploit has been publicly released and the vendor did not respond.

A weakness has been identified in Akuvox Akubela HyPanel PS51 51.130.40.26 affecting an unknown function of the /login file. Manipulating the engrmode argument with the input admin can lead to improper authentication, and the attack may be launched remotely. The vendor did not respond.

A security flaw was discovered in 2K Games Sid Meier's Civilization VI 1.0.12.68 in the loadstring function of the Lua sandbox component. Manipulation results in type confusion, and the attack may be initiated remotely. The exploit has been released publicly and may be used for attacks.

vLLM is an inference and serving engine for large language models. Prior to 0.32.0, the Phi-4 multimodal audio encoder in phi4mm_audio.py and phi4mm_utils.py uses eager attention by default, allowing a remote client to submit one long audio clip that materializes full attention matrices and causes quadratic GPU-memory use, leading to out-of-memory and termination of EngineCore for all users.

vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.32.0, authenticated callers can supply a chat template when no server-side --chat-template is configured, or a malicious model repository can provide a template compiled and rendered by tokenizer.apply_chat_template() without a wall-clock timeout, output-size limit, or iteration bound. Rendering runs in a ThreadPoolExecutor with one worker, so a nonterminating render can block /v1/responses and other chat-template users, while an output-expanding render can exhaust server memory.

Python Social Auth is a social authentication and registration mechanism. Prior to 6.2.0, OpenIdConnectAuth in social_core/backends/open_id_connect.py places the OpenID Connect nonce in a shared OpenIdConnectAssociation table, and get_nonce and validate_claims verify only that the nonce exists and has not expired rather than binding it to the browser session and OAuth state. An attacker who obtains a victim's unused authorization code can start a separate login to obtain valid state for the attacker's browser, submit the victim's code with that state, and pass nonce validation because the victim nonce is globally available. With DEFAULT_USE_PKCE disabled, the attacker can be logged in as the victim.

The zip library for Rust in versions 0.6.0 through 8.x verifies the HMAC of an AES entry only when the data counter reaches zero. If the reader hits the real end of the archive while data_remaining is still positive, or an encrypted entry has no payload, a clean end of stream is returned without comparing the authentication tag. Applications using by_index_decrypt, by_name_decrypt, by_path_decrypt, or password-enabled by_index_with_options can accept modified plaintext without an authentication error.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The LearnPress plugin for WordPress in versions up to and including 4.4.11 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. The flaw enables unauthorized access to functions that should be protected.

The Gallery PhotoBlocks plugin for WordPress in versions up to and including 1.3.7 has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The flaw allows stored XSS.

The mall-server 0.0.1-SNAPSHOT application contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity to a negative value. The order creation flow does not validate the resulting quantity and passes it to the stock update query, increasing inventory and creating negative-value orders.

OctoPrint version 1.0.0 has a vulnerability in the getSettings function in src/octoprint/server/ajax/settings.py, in the API Key Handler component. The manipulation causes information disclosure, and the attack can be carried out remotely. The exploit is publicly available, and the issue is fixed in version 1.1.0-rc1.

Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote unauthenticated clients to alter hostnames via JNI NewStringUTF decoding. Attackers can send overlong encodings like 0xC0 0x80 in the ClientHello server_name to confuse SNI-based certificate selection, access decisions, and logging.

Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.

netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.

Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer BIO callback caused by failing to wrap the non-application ring buffer write index. Remote TLS peers can drive handshake, renegotiation, or post-handshake messages into this buffer, triggering an out-of-bounds memcpy that crashes the JVM process.