CVE Vulnerability Catalog

A flaw was fixed in the Linux kernel's keyctl_describe_key(), where the key type's name could be freed by a module unload (e.g., AF_RXRPC) while the key description was being formatted. This led to a use-after-free and a page fault in string(). The fix holds key->sem across the kasprintf() call.

In the Linux kernel, keyring indexes contained kernel addresses (hashes of type and domain pointers), allowing an unprivileged user to predict key ordering and recover the kernel image address, defeating KASLR. The fix removes addresses from the entire index, replacing them with lazily allocated 64-bit IDs hashed with a SipHash key.

A use-after-free vulnerability exists in the Linux kernel key management subsystem. keyctl_read_key() checks key->type->read without holding key->sem, so a surviving RxRPC key can be read while the AF_RXRPC module is being unloaded, accessing freed module memory.

In the Linux kernel, trusted_tpm_unseal() proceeded to call pcrlock() after a TPM unseal failure; if pcrlock() succeeded, its return value overwrote the unseal error, causing key instantiation to succeed despite the failure.

In the Linux kernel, the PKCS#8 parser leaves the asym_key_ids slot empty, and key_or_keyring_common() unconditionally dereferences it when a PKCS#8 key is supplied to a key_or_keyring restriction. An unprivileged caller can trigger a NULL pointer dereference via KEYCTL_RESTRICT_KEYRING followed by add_key(), causing a kernel panic.

In the Linux kernel, print_rec() leaves 'modname' and 'offset' uninitialized, and kallsyms_lookup() only sets them on success. When the lookup fails (e.g., during module load or unload), 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(), causing a general protection fault.

In the Linux kernel, coredump_finish() releases parked threads without holding a reference on the task and outside of RCU. If the coredump client is preempted between the store and wake_up_process(), the thread can be freed and try_to_wake_up() accesses freed memory.

CVE-2026-99217 has been rejected or withdrawn by its CVE Numbering Authority. It does not describe a confirmed vulnerability.

The SUSE Rancher Fleet controller did not sufficiently restrict which kubeconfig secrets a Fleet Cluster object was allowed to reference. As a result, an ordinary user could define a cluster in a namespace they control and associate it with administrative credentials for the management cluster, causing the controller to manage the management cluster on that user's behalf with elevated privileges. This affects Fleet 0.16.0–0.16.3, 0.15.0–0.15.8, 0.14.0–0.14.12, 0.13.0–0.13.17 and possibly older versions.

In the SUSE Rancher Manager meta proxy endpoint (/meta/proxy), the allowlist decision was evaluated where it could not stop a request from being forwarded. A rejected destination was logged but the request was still handed to the proxy's transport.

Control Web Panel (CWP) before webpanel_version 1.29 contains a blind SQL injection vulnerability in an unauthenticated loopback API route that connects to MySQL as root, where the 'user' parameter is interpolated directly into a query against the oauth_clients table. Attackers can send crafted requests to perform time-based blind SQL injection and extract arbitrary database contents.

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter passed unescaped into a shell command.

Control Web Panel (CWP) before webpanel_version 1.16 contains a SQL injection vulnerability in the loopback API authentication gate access_token(), which connects to MySQL as root and interpolates attacker-controlled values directly into its query. Attackers can inject SQL through the authorization_code and client_id parameters.

Control Web Panel (CWP) before webpanel_version 1.29 contains an OS command injection vulnerability in the loopback API database restore route /v1/restoredatabase/. The restoreDBBackup() handler passes an attacker-controlled file path from the POST body into a shell command without proper escaping.

Control Web Panel (CWP) before webpanel_version 1.29 contains a missing authentication vulnerability that allows attackers able to reach the loopback API service to invoke root-privileged API routes without presenting an access token. This includes routes such as /v1/restoredatabase/, /generaluser/, /last_access/, /valid_user/, /valid_token/, and /user_panel_dashboard/.

Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the protected_directory user panel module. Unescaped input from the file POST parameter in the acc=deletedp action is passed directly into a shell_exec call, allowing attackers to execute arbitrary commands in the user panel context.

wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The HttpUtils.prepareResponse() method used the _mimeType request parameter to set the Content-Type response header without proper sanitization, allowing a CREST JSON response to be interpreted as HTML and enabling execution of arbitrary JavaScript in the victim's browser.

In INFINITT PACS (INFINITT Healthcare Co., Ltd.), the IModular.exe URI handler allows a remote unauthenticated attacker to invoke unintended application functionality and potentially execute arbitrary code via a crafted imodular:// URI containing attacker-controlled command and argument parameters.

An Otter Wiki 2.20.1 before 2.26.2 contains a file disclosure vulnerability in DataTable embedding. Attackers who can edit pages, including anonymous users under the default configuration, can read repository-internal files by setting an absolute src such as /.git/config and rendering the file as a table.

Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code. Users who can edit pages (including anonymous users under the default configuration) can place HTML inside a math fenced code block, which is rendered unescaped and executes for every viewer of the page.