CVE Vulnerability Catalog

Namespace attributes are not encoded correctly during HTML serialization in typo3/html-sanitizer before version 2.3.2. This allows bypassing the XSS prevention mechanism.

In OpenVPN versions 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1, improper validation of packet length during tls-crypt-v2 key extraction allows authenticated attackers to trigger a fatal assertion and cause a denial of service via a specially crafted packet.

CodeAstro Student Attendance Management System 1.0 has a vulnerability in an unknown function of the file /attendance-php/Admin/createClass.php?action=edit. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

CodeAstro Student Attendance Management System 1.0 has a vulnerability in an unknown function of the file /attendance-php/Admin/createClass.php. Manipulation of the className argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

Path traversal vulnerability in MVT (Mobile Verification Toolkit) before version 2026.5.12 during iOS backup processing. Unsanitized file identifiers allow access to files outside the intended directory.

CodeAstro Payroll System 1.0 has a vulnerability in an unknown function of the file /view_account.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was detected in CodeAstro Payroll System 1.0 in an unknown function of the file /home_salary.php via manipulation of the rate/salary_rate arguments. The attack can be carried out remotely, and the exploit has been publicly disclosed.

Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request.

Improper access control in ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials for configured ticketing integrations via a crafted API request. Affects Devolutions Server 2026.2.4.0 and 2026.1.20.0 and earlier.

Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with write access to a vault to execute arbitrary commands on the systems managed by the affected PAM provider.

A least privilege violation was detected in the vsftpd component of TOTOLINK CP450 version 4.1.0cu.747 in the file /etc/vsftpd.conf. The attack can be initiated remotely, and the exploit has been publicly disclosed.

A hard-coded password vulnerability was found in SourceCodester Online Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System 1.0 in the import_users.php file. Manipulation of the raw_password argument with input CICT_2026 enables remote attack. Exploit is publicly available.

In the Linux kernel, a vulnerability in the v3d graphics driver allows an infinite loop. A local user can craft a self-referential ioctl extension with zero sync counts, bypassing existing guards and causing a kernel thread to hang and a CPU core to be pegged indefinitely.

In the Intel IPU6 driver in the Linux kernel, an error pointer dereference occurs in an error path. The variable isp->psys is an error pointer, not NULL, leading to dereferencing it. The fix sets isp->psys to NULL before cleanup.

In the Linux kernel, the videobuf2 subsystem lacked setting VMA flags (VM_DONTEXPAND and VM_DONTDUMP) in vb2_dma_sg_mmap, causing a WARN_ON during dma-buf memory mapping in the Apple ISP driver. The fix adds these flags for consistency with vb2_dma_contig.

In the Renesas VSP1 driver in the Linux kernel, a NULL pointer dereference occurs when unloading the module on gen 4. The cleanup code calls vsp1_drm_cleanup() instead of vsp1_vspx_cleanup() for the appropriate IP version. The fix checks the IP version and calls the correct function.

In the rtl8723bs driver in the Linux kernel, the return value of kzalloc_flex() is used without checking for allocation failure, potentially leading to a NULL pointer dereference and system crash.

In the Linux kernel, the restriction preventing multiple opens of /sys/fs/selinux/policy was removed, which previously allowed any process to block others from reading the SELinux policy. The fix eliminates the policy_opened flag and shrinks the critical section.

In the Linux kernel, a race condition in the pseries/papr-hvpipe module can cause a deadlock when interrupts fire during ioctl or release handlers.

In the libwx driver in the Linux kernel, request_threaded_irq() was used with a primary handler but no threaded handler, along with the IRQF_ONESHOT flag. This combination triggers a kernel warning. The fix switches to request_irq() and removes the unnecessary flag.