CVE Vulnerability Catalog

The Unlimited Elements For Elementor WordPress plugin before version 2.0.11 does not sanitize Google review content from the Serp API before rendering it in the Google Reviews widget. This allows unauthenticated attackers to inject stored XSS via a malicious review on the business's Google listing.

In Meshtastic prior to version 2.7.23.b246bcd, a single node advertising a User.long_name with malformed character encoding can render other radios unusable over BLE when managed through the iOS app. The issue arises from accidental null terminator placement in a multibyte sequence during buffer truncation, poisoning the node database.

Keras version 3.15.0 has an unsafe deserialization vulnerability of attacker-controlled PyTorch pickle data through the public `keras.layers.TorchModuleWrapper.from_config` method. This method calls `torch.load(..., weights_only=False)` without requiring an explicit unsafe opt-in. Outside a `SafeModeScope(True)` context, unsafe deserialization is allowed by default, potentially leading to arbitrary code execution.

In the Linux kernel, a potential out-of-bounds access was found in the AMD IOMMU debugfs interface. The iommu_mmio_write() and iommu_capability_write() functions used kstrtou32_from_user() for input parsing, which could convert large values into negative integers, leading to out-of-bounds memory reads/writes.

A vulnerability in the Linux kernel's __vm_normal_page() function mishandles missing support for pmd_special()/pud_special() on 32-bit x86 systems with THP enabled. This triggers warnings, RSS counter bugs, and page state corruption during memory reclaim.

A Use-After-Free (UAF) vulnerability was found in the Linux kernel's Bluetooth BNEP module. The bnep_add_connection() function failed to hold the bnep_session_sem lock while reading dev->name, allowing a concurrent bnep_session() thread to free the net_device.

In iwlwifi driver for old devices (e.g., 7265D), a bug was found in setting TX rates due to incorrect encoding in v1 format (PLCP) instead of v3, potentially causing warnings when reported back from the device.

In the iwlwifi driver for Intel BE201 Wi-Fi 7 chipsets, a vulnerability was found where transmission is not stopped during firmware restart. After a firmware crash (e.g., NMI_INTERRUPT_UNKNOWN), the driver continues sending frames that are rejected, causing high CPU load and memory fragmentation.

A vulnerability in the KVM driver for Hygon Family 18h CPUs causes hardware to read a stale IsRunning=1 bit during ICR write emulation, failing to generate an AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. This leads to hung vCPUs and unbounded delays in guest execution.

In the Linux kernel, in the DRM MSM driver (drm/msm), a vulnerability was found due to incorrect checking of the return value of iommu_map_sgtable(). A change in the iommu_map_sgtable() interface made it return ssize_t with negative values on errors instead of size_t with zero. The code did not store the result in the appropriate type and triggered a WARN instead of returning the error.

In the Linux kernel, a bug was found in the IOMMU subsystem where the error path of the map function calls iommu_unmap(), which triggers debug routines (iommu_debug_unmap_begin/end) without a prior iommu_debug_map() call. This causes unbalanced tracking and potential debugging issues. The fix moves error handling to iommu_map_nosync() and reorders operations to record the partial mapping before unmapping it.

In the Linux kernel, a vulnerability was found in the iommupt subsystem due to missing check for PAGE_SIZE in the pgsize_bitmap. The driver may drop PAGE_SIZE from the bitmap, which is technically allowed but violates design assumptions and may cause issues with the DMA API.

In the Linux kernel, the pds_core driver fixes two bugs in pdsc_devcmd_wait: firmware crash returned stale success instead of an error, and timeout overwrote the error code with stale status.

In the wilc1000 WiFi driver, a memory leak occurs in wilc_wlan_firmware_download(). The function allocates dma_buffer but fails to free it on the first bus acquire failure, returning directly instead of using the cleanup label.

In the Linux kernel's ksmbd filesystem, a null pointer dereference vulnerability exists in the compare_guid_key() function. During durable-handle session teardown, session_fd_check() sets the conn pointer in the opinfo structure to NULL but does not remove the opinfo from the lease list. When a new session is established with the same ClientGuid and an SMB2 CREATE request with a lease context is sent, find_same_lease_key() processes the stale opinfo, and compare_guid_key() attempts to read ClientGUID through a NULL conn pointer, causing a kernel panic.

In the Linux kernel ksmbd filesystem, a null pointer dereference vulnerability was found in proc_show_files(). When an SMB2 client opens a file with a durable v2 handle and then issues SMB2 SESSION_LOGOFF, the fp->tcon pointer is cleared but the entry remains in global_ft.idr. Reading /proc/fs/ksmbd/files during this window causes a kernel panic.

A vulnerability was found in the Linux kernel's ksmbd module, where SID identifiers (Owner and Group) in the parent directory's security descriptor are not validated during ACL inheritance. This flaw could allow an attacker to manipulate file access permissions.

In the Linux kernel, a vulnerability was found in the CIFS SWN netlink implementation. Missing capability flags for generic netlink operations allow any local process to send RESOURCE_CHANGE or CLIENT_MOVE notifications to the in-kernel witness handler. Additionally, the multicast group lacks protection, enabling unprivileged processes to join and receive registration messages containing username, domain, and password for NTLM-authenticated mounts.

In the Linux kernel, a vulnerability in the ALSA PCM subsystem was found where the iov_iter setup was incorrectly applied for silencing (NULL data), leading to a bogus iov_iter calculation. On RISC-V architecture, this causes a NULL pointer dereference.

In the Linux kernel, the ALSA asihpi driver has a vulnerability allowing out-of-bounds (OOB) array access when reading the cache. The find_control() function accesses the array without proper index validation, potentially leading to memory corruption.