CVE-2025-62349 Salt Master authentication protocol downgrade may enable minion impersonation

Salt contains an authentication protocol version downgrade weakness that can allow a malicious minion to bypass newer authentication/security features by using an older request payload format, enabling minion impersonation and circumventing protections introduced in response to prior issues...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the doContent function in xmlparse.c. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers an integer overflow. Remediation...

WordPress Quiz And Survey Master plugin < 9.0.2 - Contributor+ SQLi vulnerability

Contributor+ SQLi vulnerability discovered by Project Black in WordPress Plugin Quiz And Survey Master versions 9.0.2...

WordPress Master Slider plugin < 3.10.0 - CSRF to slider deletion vulnerability

CSRF to slider deletion vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Master Slider versions 3.10.0...

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in the soupsessionredirectmessage function. Sensitive proxy credentials can be leaked due to improper handling of authorization headers during HTTP redirect processing. Remediation A fix...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the soupmessageheaderssetcontentdisposition function. An attacker can inject arbitrary HTTP headers by supplying specially crafted input containing CRLF sequences to the Content-Disposition header. Remediation A fix w...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop via the NoCloseOutputStream process. An attacker can cause the application to enter an infinite loop and exhaust system resources by sending specially crafted input to the affected stream writer. Remediation A fix was push...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via improper validation in the SeekableOutputStream process. An attacker can cause memory corruption or execute arbitrary code by providing specially crafted PNG files. Remediation A fix was pushed into th...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the gbase64encodeclose function. An attacker can cause memory corruption or application crashes by providing excessively large or untrusted input data. Remediation A fix was pushed into the master branch but not...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the parseheader function. An attacker can cause application instability or denial of service by supplying a specially crafted treemagic file that triggers a buffer underflow and out-of-bounds memory access...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the realtolower and outputmarks functions. An attacker can cause memory corruption and potentially crash or destabilize applications by submitting specially crafted and extremely large Unicode strings. Remediatio...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the Host header processing when an HTTP proxy is configured. An attacker can cause unintended or unauthorized HTTP requests to be forwarded by injecting additional HTTP headers or request bodies by supplying specially...

CVE-2025-68849

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects Quote Master: from n/a through = 7.1.1...

CVE-2026-24358

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection via the BytesGenerator class in the email module due to unquoted newlines when serializing an email message. An attacker could perform email spoofing, data exfiltration, or content manipulation by injecting malicious CRLF...

Uncontrolled Recursion

Overview protobuf is a Google’s data interchange format Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigg...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in the ParseDict function, when handling deeply nested google.protobuf.Any messages. An attacker can bypass maxrecursiondepth to exhaust the recursion stack and trigger a RecursionError. Remediation Upgrade protob...

CVE-2026-24358

Missing Authorization vulnerability in ExpressTech Systems Quiz And Survey Master quiz-master-next allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quiz And Survey Master: from n/a through = 10.3.3...

CVE-2025-68849

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Frank Corso Quote Master quote-master allows Reflected XSS.This issue affects Quote Master: from n/a through = 7.1.1...

CVE-2026-24388

Missing Authorization vulnerability in Ludwig You WPMasterToolKit wpmastertoolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPMasterToolKit: from n/a through = 2.14.0...