CVE Vulnerability Catalog

The AnythingLLM application prior to version 1.13.0 on Windows allowed the use of an encoded absolute path to the documents folder, potentially leading to access to files outside the intended documents directory.

A vulnerability in Docling from version 2.73.0 to 2.91.0 allows attackers to read arbitrary files from the file system via crafted LaTeX documents. Lack of path validation in \includegraphics, \input, and \include commands enables path traversal sequences, potentially leading to sensitive data exposure.

In concurrent-ruby up to version 1.3.6, a vulnerability allows incorrect granting of a write lock after one thread acquires the read lock 32,768 times. The lock stores thread-local read and write hold counts in one integer, where the low 15 bits are for read count and bit 15 is for WRITE_LOCK_HELD. After exceeding this threshold, the read count overflows into the write-lock bit, causing try_write_lock to incorrectly return true without setting the global RUNNING_WRITER bit.

In the Linux kernel, the DRBD driver has an RCU call imbalance in drbd_adm_dump_devices(). The function calls rcu_read_unlock() without a preceding rcu_read_lock(), which can lead to incorrect RCU behavior.

A fix in the Linux kernel for a memory leak in blk_revalidate_disk_zones(). On zone revalidation error, memory allocated for args.zones_cond was not freed.

In the Linux kernel blkcg_maybe_throttle_current() function, a missing put_disk() call on the error path causes a disk reference leak. The disk will never be freed.

A deadlock was discovered in the Linux kernel's sysfs mechanism during the RAID array clear operation (array_state=clear). The issue stems from incorrect reference release ordering, leading to recursive locking and a potential deadlock warning.

A fix in the Linux kernel for ublk where the per-IO canceled flag was not reset after fetch, potentially preventing cancellation on server failure.

In the Linux kernel, the md (RAID) module has a deadlock during raid456 reshape. I/O operations waiting for reshape progress can block array suspend because reshape is frozen and active IO references are not released.

A deadlock was discovered in the Linux kernel's Btrfs subsystem between a reflink operation and a transaction commit when the flushoncommit mount option is used. The issue occurs when reflink copies an inline extent beyond the destination file's current i_size, causing threads to block each other.

In the Linux kernel amd-pstate driver, the amd_pstate_epp_cpu_init() function has a memory leak. On failure to set epp, the cpudata object is not freed.

In the Linux kernel perf/amd/ibs driver, perf_allow_kernel() is called from NMI context, which is unsafe and can cause a crash. Permissions should be cached at initialization.

In the Linux kernel ath11k driver, memory leaks occur in ath11k_mac_setup_bcn_tmpl_ema() and ath11k_mac_setup_bcn_tmpl_mbssid(). Allocated beacon template memory is not freed on error.

A null pointer dereference vulnerability was found in the Linux kernel's bpf_lwt_xmit_push_encap function. The issue occurs when skb->_skb_refdst is not initialized during BPF program test runs, leading to a kernel crash.

A race condition in the Linux kernel during unmap operations on PMD migration entries has been fixed. The issue occurs when move_pages and munmap syscalls are executed concurrently, triggering a VM_BUG_ON in pmdp_huge_get_and_clear_full. The vulnerability affects PowerPC 64-bit architecture.

In the Linux kernel libertas driver, usb_kill_urb() is called from interrupt context, which can cause synchronization issues. Instead, the driver now checks for pending URBs.

A fix in the Linux kernel for potential deadlock in BPF local storage. Deleting selem in NMI context could deadlock, so an error check was added.

In the mt76 WiFi driver (mt7925 model), there is a bug in mt7925_mac_write_txwi where missing NULL check for 'vif' pointer can lead to NULL pointer dereference and kernel panic.

In the mt76 WiFi driver, there is a memory leak when destroying the device. Rx queues have an associated page_pool that is not destroyed in mt76_dma_cleanup, and pages are not returned to the pool when WED is not enabled.

In the Linux kernel, the mt7925 driver (mt76) has a potential deadlock in mt7925_roc_abort_sync. It calls cancel_work_sync() while roc_work() holds dev->mt76.mutex, causing a lockup. This occurs during station removal.