CVE Vulnerability Catalog

Axios versions 1.15.2 through 1.17.9 contain prototype-pollution read-side gadgets in Basic auth subfield handling. If an application is already affected by prototype pollution and makes an axios request with an auth object missing username/password, axios reads inherited Object.prototype values and uses them to construct an Authorization header. Axios itself does not pollute prototypes.

Budibase before version 3.38.1 contains a server-side request forgery (SSRF) vulnerability in the REST datasource integration that fails to validate HTTP redirects against the IP blacklist. Attackers with Builder role can configure a REST datasource pointing to an external server that returns a redirect to internal IP addresses, bypassing blacklist protection to access cloud metadata endpoints and internal services.

OpenRemote (org.openremote:openremote) versions up to 1.26.2 contain an insecure direct object reference (IDOR) vulnerability in the setAssetLinks endpoint of AlarmResourceImpl. The realm access check validates only a single realm obtained via realms.stream().findFirst() on a HashSet of realms from the request, rather than all realms. Due to non-deterministic HashSet iteration order, an authenticated attacker can, with roughly 50% probability per request (retryable), persist cross-tenant links and disclose victim asset names.

Wazuh 5.0.0-beta1 (fixed in 5.0.0-beta3) does not validate or override the cluster_name and cluster_node fields in inventory-sync Start FlatBuffer messages, validating only the agentid against the authenticated agent identity. This allows a low-privileged enrolled agent to spoof cluster attribution in indexed inventory and vulnerability documents by forging wazuh.cluster.name values and influencing the document _id prefix, potentially tampering with inventory records or, in shared-indexer multi-cluster deployments, poisoning another cluster's records when numeric agent IDs collide.

FreeRDP versions up to 3.28.0 contain an out-of-bounds read vulnerability in the RDP6 planar RLE bitmap decoder functions planar_decompress_plane_rle and planar_decompress_plane_rle_only in libfreerdp/codec/planar.c. Only the 1-byte control byte is bounds-checked; the subsequent 0–15 attacker-declared raw bytes are read without validating that the source buffer contains them. A malicious or compromised RDP server can send a truncated planar-encoded bitmap or surface update, causing the client to read past the end of the source buffer.

FreeRDP before version 3.29.0 contains a reachable assertion (WINPR_ASSERT(OutputBufferLength == BytesReturned)) in serial_process_irp_device_control() in channels/serial/client/serial_main.c. When serial device redirection is enabled and a server-controlled IRP_MJ_DEVICE_CONTROL request specifies an unsupported IOCTL with a non-zero OutputBufferLength, CommDeviceIoControl() can fail with BytesReturned = 0, causing the mismatch to trigger the assertion and abort the client process (denial of service).

FreeRDP before version 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client. ecam_dev_process_start_streams_request() parses a server-controlled CAM_MEDIA_TYPE_DESCRIPTION from a StartStreamsRequest PDU but validates only Format and Flags, not FrameRateDenominator. When a malicious or compromised RDP server sends a StartStreamsRequest with FrameRateDenominator set to zero, ecam_encoder_context_init() computes FrameRateNumerator / FrameRateDenominator, causing an integer division by zero (SIGFPE) and termination of the FreeRDP client process.

FreeRDP before 3.29.0 fails to properly validate server-supplied RDPDR paths in drive redirection, allowing attackers to access paths outside the configured shared root by sending non-rooted paths that bypass boundary checks.

FreeRDP before 3.29.0 improperly validates the Extended Key Usage (EKU) purpose of the peer certificate during client-side server TLS authentication. When server-purpose verification fails, the code falls back to client-purpose and any-purpose verification, allowing a certificate valid only for clientAuth to be accepted as the RDP server certificate.

FreeRDP before 3.29.0 contains an improper certificate hostname validation vulnerability. The TLS hostname matcher treats a wildcard pattern such as *.example.com as matching any hostname ending in .example.com, incorrectly accepting a wildcard certificate for multi-label subdomains like a.b.example.com.

FreeRDP before 3.29.0 contains a buffer over-disclosure vulnerability in the gateway WebSocket transport. The client's Pong reply reuses a fixed 1024-byte response stream whose length is not sealed to the actual received Ping payload, so a malicious peer causes an overlong Pong that discloses bytes beyond the received payload. A zero-length Ping triggers an assertion and terminates the client (denial of service).

A vulnerability in Zephyr's Bluetooth host causes incorrect permission checks when sending GATT notifications and indications. Passing the Characteristic Declaration attribute leads to checking declaration permissions instead of the characteristic value's security requirements, bypassing encryption or authentication.

The net_dhcpv4_msg_type_name() function in Zephyr DHCPv4 indexes a static name table after a faulty bounds check. Using sizeof instead of ARRAY_SIZE allows out-of-bounds read for message-type values from 9 up to 32 (or 64). The msg_type value originates from an unchecked raw byte from a received DHCP packet.

better-auth versions after v0.0.2 and before 1.1.16 contain a reflected XSS vulnerability on the /api/auth/error page, where the 'error' URL parameter is reflected as HTML without proper neutralization. An attacker can coerce a user into visiting a specially-crafted URL to execute arbitrary JavaScript in the user's browser.

The CubeWP Framework plugin for WordPress is vulnerable to SQL injection in the `cubewp_remove_relation()` AJAX function. The use of `wp_unslash()` removes injection protection, and the lack of `$wpdb->prepare()` allows authenticated attackers with subscriber-level access to append additional SQL queries.

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to stored cross-site scripting via the 'toggleIcon' block attribute. Authenticated attackers with contributor-level access can inject arbitrary scripts that execute when a user accesses the page.

The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to reflected cross-site scripting via the 'id' parameter. The `responsive_thumbnail_image_management()` function echoes `$_GET['id']` directly into an HTML attribute without escaping, allowing unauthenticated attackers to inject scripts via a crafted link.

The Kadence Blocks plugin for WordPress up to version 3.7.8.1 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Identity Block Inner Image Content. This is due to insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level access and above to inject arbitrary web scripts.

The PixelYourSite plugin for WordPress up to version 11.2.1 exposes sensitive WooCommerce purchase metadata via the getWooPurchaseEventParams function. Unauthenticated attackers can extract order details such as product names, IDs, quantities, prices, totals, currency, and order IDs for any existing order by supplying an invalid order key.

The GetPaid plugin for WordPress up to version 2.8.56 contains a Local File Inclusion (LFI) vulnerability via the getpaid_payment_form_element function. Authenticated attackers with administrator-level access and above can include and execute arbitrary .php files on the server, allowing PHP code execution.