CVE Vulnerability Catalog

The MISP Apache HTTP virtual-host configuration contains a malformed HTTP-to-HTTPS redirect missing a trailing slash in the destination URL. An attacker can exploit this to redirect users to a malicious site via a crafted HTTP request.

Anchore Enterprise from version 5.11.0 to 5.27.1 and 6.0.0 has an improper privilege escalation vulnerability in the user management API. An authenticated attacker can issue an API call to modify user permissions, gaining access to additional resources. The system-admin role cannot be granted, but a read-only user can gain write access.

Apache ActiveMQ (versions before 5.19.9 and 6.0.0 before 6.2.8) has a vulnerability in the AMQP NIO component. A remote unauthenticated attacker can send a frame with a specific size, causing NIO threads to die. Rapid repetition can exhaust the NIO thread pool, leading to denial of service.

Universal Software Inc. UKBS (versions through 28072026) has a missing authentication for critical function vulnerability. An attacker can access functions not properly constrained by ACLs. The vendor no longer supports the product.

Pivotick has an uncontrolled-recursion vulnerability when processing graph and node data. Recursive graph traversals and JSON rendering can exhaust the JavaScript call stack with specially crafted data, causing page or browser crashes.

Pivotick fails to sanitize attacker-controlled SVG markup from the style.svgIcon property before inserting it into the document. The vulnerable code assigns SVG markup to innerHTML, allowing execution of event handlers like <image> with onerror. An attacker can execute arbitrary JavaScript in the application context.

In the Joomla extension Joomdle versions prior to 3.1.1, the default configuration allows read access and password reset of CMS accounts. This is an insecure default configuration.

Parts of the DM_OP handling code assume the caller has provided the required number of buffers without checking. This can lead to access to uninitialized stack structures, causing unpredictable behavior.

The EVTCHNOP_expand_array hypercall checks for FIFO event channels being enabled, but without holding the correct lock. It can race with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.

The logic to handle periodic Viridian STIMERs performs a division with an unchecked user-controlled divisor value, that can be set to zero to cause a #DE fault.

Accesses to CMOS memory contents are done using an indirect IO port pair. Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes, allowing a guest to change the index after it being checked, causing an out-of-bound read access.

When grant-copy operations are processed, permission checks may be carried out on a page different from the one involved in the copy when the grant is already pinned, leading to inconsistency.

Platform-op operations use a system-wide lock, but the lock acquisition lacks fairness, and with XSM/Flask enabled, the lock is acquired before permission checks. This is the platform-op issue.

Sysctl operations use a system-wide lock, but the lock acquisition lacks fairness, and with XSM/Flask enabled, the lock is acquired before permission checks. This is the sysctl issue.

In openshift/oauth-proxy, the proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated low-privilege user to smuggle a forged identity.

Addressing certain issues related to long-running operations has proven overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly available, the decision was to deprecate the functionality, while still retaining it for use at own risk. Memory-wise small guests may still be okay to run.

Xenstore uses a new XEN_DOMCTL_get_domain_state to track domains. The bitmap management is tied to the binding of VIRQ_DOM_EXC. Unfortunately, an error path can tear down the bitmap even when it wasn't set up. Unprivileged domains can trigger that error path.

Out-of-bounds write in ImsService prior to SMR Jul-2026 Release 1 allows remote attackers to potentially execute arbitrary code.

The Uncanny Automator plugin for WordPress up to version 7.3.2 has missing authorization in several AJAX actions. Missing capability checks and nonce verification allow authenticated attackers with Subscriber-level access or higher to enumerate sensitive Google Contacts groups/labels and Mautic segments, tags, and contact-field definitions.

The StoreGrowth plugin for WordPress up to version 2.1.0 is vulnerable to stored XSS via the 'message_popup' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page. The 'ajd_protected' nonce is exposed to all visitors.