CVE Vulnerability Catalog

In the Linux kernel, the iforce driver lacks validation of the force-feedback effect index from the device. The index masked only with 0x7f (range 0-127) is used to address the core_effects[] array with only 32 entries, causing out-of-bounds read/write. A malicious or counterfeit device can set or clear a bit at an arbitrary offset past the object.

In the Linux kernel's mms114 touch driver, there is an indexing error for MMS134S and MMS136 controllers. The driver uses the wrong structure size (8 bytes) instead of the actual event size (6 bytes), causing touch events to be read from incorrect offsets.

In the Linux kernel's touchwin driver, there is a heap out-of-bounds write vulnerability. The packet index is not reset when the second and third data bytes do not match, allowing a malicious device to continuously increment the index and write beyond the buffer.

In the Linux kernel's mms114 driver, there is a stack out-of-bounds write vulnerability. The driver does not check the upper limit of the packet size from the device, allowing up to 255 bytes to be read into a fixed 80-byte buffer, causing stack overflow.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_ref_folio() function unlocks the request but does not re-lock it before returning, potentially leading to use-after-free.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_resend() and fuse_remove_pending_req() functions do not remove the intr_entry from the fiq->interrupts list, leading to use-after-free during iteration.

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. The fuse_uring_async_stop_queues() function may run after the last reference to ring->queue_refs has been dropped.

In the Linux kernel fuse-uring subsystem, a race condition exists regarding the queue->stopped flag. The fuse_uring_commit_fetch() function checks queue->stopped without a lock, and the value is not set under lock in fuse_uring_abort_end_requests().

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. A malicious user can send commit SQEs for requests not yet sent to the FUSE server, potentially leading to use-after-free during memcpy operations.

The WPForms Pro plugin for WordPress up to version 1.10.1.1 is vulnerable to arbitrary file upload via the ajax_chunk_upload_finalize function. File type validation occurs after data is written to disk, and failed validation does not delete the assembled file. An unauthenticated attacker can upload executable files, leading to remote code execution.

Knot Resolver before version 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.

Redis before version 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer. Deleting both consumers via XGROUP DELCONSUMER leads to a double free. This issue exists because of an incomplete fix for CVE-2026-25243.

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module. When collocations.py is invoked directly, command-line arguments are passed to eval() without validation, allowing an attacker to execute arbitrary Python code, including OS commands via the os module.

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter. An attacker can supply a crafted PGS/SUP subtitle file with mismatched frame dimensions, causing data to be copied beyond the allocated buffer, leading to heap corruption and potential code execution.

FFmpeg through version 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. An attacker can supply a crafted PNG image with a malicious eXIf chunk, causing tens of thousands of bytes to be written past the buffer boundary, leading to heap corruption and potential code execution.

FFmpeg through version 8.1.2, fixed in commit aafb5c6, contains a signed integer overflow vulnerability in the MACE6 audio decoder. An attacker can supply a crafted CAF file with a malicious bytes_per_packet value, causing an integer overflow and undersized buffer allocation, leading to a heap out-of-bounds write and potential code execution.

In FFmpeg up to version 8.1.2, there is a heap out-of-bounds write vulnerability in the vf_hqdn3d filter. An attacker can supply a crafted video where frame resolution increases between frames and filter reinitialization is disabled, leading to heap memory corruption.

In epa4all prior to version 2026-05-20, an attacker on the network path can present a self-signed TLS certificate and intercept the connection. For non-VAU connections, this allows direct read and modification of inner traffic, including smartcard operations and OIDC authentication exchanges.