CVE Vulnerability Catalog

Kyuubi Engine UI proxy accepts a host and port from the request path and proxies HTTP requests to that destination. A remote attacker with network access can cause SSRF or open-proxy behavior.

Apache Traffic Server drops the per-stream buffer cap when dechunking HTTP/2 or HTTP/3 responses, letting a slow client exhaust server memory. This affects versions from 8.0.0 through 8.1.11, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3. Users are recommended to upgrade to 9.2.15 or 10.1.4.

In the Linux kernel's Bluetooth L2CAP stack, a use-after-free vulnerability exists in l2cap_sock_new_connection_cb(). After releasing the parent lock, a child socket can be accepted and freed by another thread before dereference, leading to use-after-free.

In the Linux kernel, a vulnerability was found in the perf event group management. Removing events via perf_event_remove_on_exec() can leave an inconsistent group state when a group leader is removed while sibling events remain active. This corrupts the PMU context active list and can cause a double list addition.

Apache Traffic Server can write out of bounds or overflow integers while parsing MIME and HTTP headers. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

Apache Traffic Server forwards HTTP/2 origin trailers to HTTP/1 clients without proper chunked framing when converting HTTP/2 to HTTP/1. Affects versions 10.0.0 through 10.1.3.

Apache Traffic Server can be crashed or driven to resource exhaustion by abusive HTTP/2 framing and flow-control. Affected versions are from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.14, and from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or 10.1.4.

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses an injected page. This is exploitable because Contact Form 7 accepts array-structured input for ordinary text fields via the public REST API endpoint, and the plugin stores submitted data using $wpdb INSERT with serialize() into a custom table, bypassing WordPress save-time filtering.

HTTP Request Smuggling vulnerability in Apache Traffic Server. Affects versions 10.0.0 through 10.1.3 and 9.0.0 through 9.2.14.

A Regular Expression without Anchors vulnerability was found in Apache Traffic Server. It affects versions from 10.0.X through 10.1.3 and from 9.0.X through 9.2.14. Upgrading to version 9.2.15 or 10.1.4 fixes the issue.

A post-authentication SQL injection vulnerability was found in Koollab LMS. An authenticated attacker can use the face-to-face runs update endpoint to read the entire database and obtain valid JWT tokens for account takeover.

The miniOrange Social Login and Register WordPress plugin before 7.8.0 does not bind the one-time code used for optional email verification to the account it was issued for. This allows an unauthenticated attacker to obtain a valid session for any account, including administrators, by requesting a code for a controlled email and replaying it against the victim's email.

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions. This allows an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting (XSS).

The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler. This allows an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage connection has been configured. This is an incomplete fix of CVE-2026-9690, whose patch hardened only one of the affected cloud-storage handlers and left the others unpatched.

The Easy Digital Downloads plugin for WordPress up to version 3.6.9 allows arbitrary file upload. The `edd_do_ajax_import_file_upload()` function only checks the client-supplied Content-Type header and saves the file with its original extension to a web-accessible directory. Authenticated attackers with Shop Manager access can upload arbitrary files, potentially leading to remote code execution.

The Wholesale for WooCommerce plugin for WordPress up to version 2.0.5 allows privilege escalation. The `save_requests_meta()` function only applies `sanitize_text_field()` to the `user_role_set` parameter before passing it to `WP_User::add_role()`, without validating allowed roles. Authenticated attackers with author access can escalate their privileges to administrator.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that forwards the `SslHandshakeCompletionEvent` before asynchronous OCSP validation completes. This allows the client to send sensitive data to a revoked server before the channel is closed.

Netty before versions 4.1.136.Final and 4.2.16.Final has a vulnerability in `OcspServerCertificateValidator` that marks an outdated OCSP response as valid even if expired. This allows an attacker to replay a stale GOOD response to bypass certificate revocation.

In goshs before version 2.1.1, the bulkDownload handler for ZIP downloads did not check ACLs or custom authentication, allowing unauthenticated reads of files protected by .goshs folder ACLs and block lists. This is an incomplete fix for CVE-2026-40189.