CVE Vulnerability Catalog

In Bouncy Castle for Java before 1.85, the OpenPGP Argon2 S2K function honors attacker-chosen memory and passes. This also affects LTS before 2.73.12 and FIPS versions before specific bcpg-fips releases.

In Bouncy Castle for Java before 1.85, the CRMF/CMP password-MAC function honors an unbounded iteration count. This also affects LTS before 2.73.12 and FIPS versions before specific bcpkix-fips releases.

In Bouncy Castle for Java before 1.85, the S/MIME validator trusts the signer-asserted signingTime for path validation. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the OpenPGP CFB quick-check oracle is active on symmetric/session-key paths. This issue also affects LTS before 2.73.12 and BC-FJA before specific versions.

In Bouncy Castle for Java before 1.85, the JSSE hostname verifier enables CN-fallback by default despite documented opt-in. This issue also affects LTS and FIPS versions.

luci-app-adblock-fast before version 1.2.4-4 contains a stored cross-site scripting vulnerability in the blocklist name field. Lower-privileged users can inject active HTML, which executes in the administrator's browser when viewing the AdBlock Fast status page, under the LuCI origin.

Vikunja versions >= 0.24.0 and <= 2.3.0 contain a broken object level authorization (BOLA) vulnerability in the GET /api/v1/projects/{project}/views/{view}/tasks endpoint. The endpoint loads the project view from the URL path without verifying authorization. A link-share token holder can read kanban bucket records (bucket titles and full created_by user object) from any view in the instance. The missing authorization also creates a project/view existence oracle (404 vs non-404). Task contents remain constrained to the share's own project.

better-auth (npm) before version 1.4.2 allows an external request to configure baseURL when it is not otherwise defined (e.g., BETTER_AUTH_URL is unset). An attacker able to make the very first request to the server after startup can poison the router's base path, causing all routes to return 404 for all users (denial of service). The issue is not reachable when baseURL is explicitly configured or on typical managed hosting platforms.

The Exclusive Addons for Elementor plugin for WordPress up to version 2.7.9.8 is vulnerable to Stored Cross-Site Scripting via the 'exad_infobox_image' parameter due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access can inject arbitrary web scripts.

A flaw in the keycloak-services component of Keycloak causes improper evaluation of client state during an update operation. An attacker with client management permissions can bypass security policies by first creating a public client and then updating it to a confidential client with weaker authentication.

A flaw in Keycloak's authorization services allows a user to include a fake time value in an authorization request, overriding the actual server time. This bypasses time-based restrictions and allows access to protected resources at unauthorized times.

In Keycloak with Fine-Grained Admin Permissions V2 enabled, a sub-administrator with user creation permissions can add new users to any group, even those they are not authorized to manage.

A flaw in the full-scope-disabled client-policy executor in keycloak-services causes it to only validate the fullScopeAllowed field when explicitly provided. Omitting this field allows a delegated user to bypass the policy and create a client with full scope access, obtaining tokens with unauthorized role mappings.

The Frontend File Manager Plugin for WordPress up to version 23.6 lacks nonce validation on one of its file-metadata update actions. This allows a CSRF attack where an attacker can modify the metadata of a logged-in user's uploaded file and then download it. When guest uploads are enabled, the same action is reachable unauthenticated against any user's file.

The ProfileGrid WordPress plugin before version 5.9.9.8 does not verify that a notification belongs to the requesting user before deleting it. Any authenticated user (e.g., Subscriber) can delete other users' notifications by enumerating notification identifiers.

The Narrative Publisher WordPress plugin through version 1.0.7 does not restrict write access to a REST-exposed post meta field or escape it when rendering. Users with contributor-level access and above can store JavaScript that executes in the browser of any higher-privileged user who views the affected post.

The Event Booking Manager for WooCommerce WordPress plugin before version 5.3.7 does not properly verify authorization on the object being modified when quick-editing events, only checking a global capability. Users with the Contributor role and above can modify the title and publication status of arbitrary posts and pages on the site, including content they do not own.

The Event Booking Manager for WooCommerce WordPress plugin before version 5.3.7 does not sanitise or escape event timeline content submitted by users with post-editing access before storing it and rendering it on the public event page. Users with the Author role and above can inject arbitrary JavaScript that executes in the browser of any visitor viewing the event, including administrators.

The Event Booking Manager for WooCommerce WordPress plugin before version 5.3.7 does not prevent the deserialization of user-controlled input in some of its event content fields. Users with Contributor-level access and above can inject PHP objects. No POP chain is present in the plugin itself, but if one is present via another installed plugin, this could lead to actions such as arbitrary file deletion, sensitive data retrieval, or remote code execution. This is an incomplete fix of earlier object-injection advisories.

The LWS Optimize WordPress plugin before version 3.4 does not perform a capability check on its cache-clearing actions. Any authenticated user, including Subscribers, can flush the site's caches and force repeated cache rebuilds.