CVE Vulnerability Catalog

An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches to or instruments that process (via dtrace -p, pid probes, or USDT), the ELF parser reads heap memory beyond the allocated section cache array without bounds checking. This results in an uninitialized/out-of-bounds heap read that can cause a NULL pointer dereference crash of dtrace (DoS) or, depending on heap layout, a read-then-use of a garbage pointer controlled by adjacent allocations, providing a foothold toward further exploitation in a privileged context.

A Cross-Site Scripting (XSS) vulnerability was discovered in the GSVoIP web panel version 2.0.90. The `msg` parameter in the `/painel/gateways.php/error` endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response.

Open CASCADE Technology (OCCT) w wersji V8_0_0_rc5 zawiera wiele podatności w swoich parserach plików IGES i STEP, które mogą być wywołane przez spreparowane pliki IGES lub STEP. Problemy te obejmują odczyt poza zakresem w Geom2d_BSplineCurve::EvalD0 oraz nieskończoną rekurencję w StepShape_OrientedEdge::EdgeStart.

W podatności CVE-2026-42480 występuje błąd odczytu poza granicami stosu w funkcji VrmlData_Scene::ReadLine w parserze VRML w Open CASCADE Technology (OCCT) V8_0_0_rc5. Atakujący może wykorzystać tę lukę do wywołania odmowy usługi poprzez spreparowany plik VRML.

SQL injection vulnerability in MixPHP Framework versions 2.x through 2.2.17. The flaw exists in the joinOn function in BuildHelper.php, where the `on` array is improperly handled, allowing SQL code injection.

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 to v2.26.15.72 and WhatsApp for Android v2.25.8.0 to v2.26.7.10 could allow a user to trigger processing of media content from an arbitrary URL on another user's device, including OS-controlled custom URL scheme handlers. No evidence of exploitation in the wild has been seen.

WhatsApp for Windows prior to v2.3000.1032164386.258709 has an attachment spoofing issue. Maliciously formatted documents with embedded NUL bytes in the filename could be shown as one file type but run as an executable when opened. No evidence of exploitation in the wild has been seen.

In the Linux kernel, tcm_loop_target_reset() returned SUCCESS without draining in-flight commands, violating the SCSI EH contract. This caused a leaked LUN reference and hung configfs LUN unlink in D-state. The fix drains commands via TMR_LUN_RESET and flush_work() on all started requests.

A flaw was found in the Linux kernel XFS subsystem during inactivation of node-format extended attributes. If a log shutdown occurs after leaf/node block cancellations commit but before the attr bmap truncation commits, log recovery may follow stale pointers and trigger a metadata corruption shutdown. The fix removes child entries in the same transaction and splits truncation into two phases so root block invalidation and bmap zeroing are atomic.

In mshv_region_pin there are two issues: pin_user_pages_fast() can return a short pin count, which is treated as success and leads to memory corruption; and when an error occurs mid-loop, already pinned pages are not properly accounted for, causing a page reference leak. The fix treats short pins as errors and fixes partial batch accounting.

In the Linux kernel, the AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) when chaining a new af_alg_tsgl structure. If sendmsg() fills an SGL exactly to MAX_SGL_ENTS, a subsequent sendmsg() chains a new SGL without clearing the end marker, causing the crypto scatterwalk to hit a premature end and return NULL on sg_next().

In the Linux kernel, the net qrtr subsystem's qrtr_tx_flow uses radix_tree, whose __radix_tree_create() can leave orphaned intermediate nodes on allocation failure, causing a memory leak. The radix_tree API is deprecated, so migrating to xarray fixes the issue because xa_destroy() frees all internal nodes.

In the Linux kernel, gso_features_check() read the IPv4 frag_off field via direct pointer dereference, which could be unsafe for packets injected through PF_PACKET paths. The fix switches to skb_header_pointer() so the header read is robust whether data is linear or needs copying.

A vulnerability in the Linux kernel leaks kernel heap memory to userspace via the tc_chain_fill_node() function, which fails to initialize the tcm_info field of the tcmsg structure before sending netlink messages, exposing 4 bytes of uninitialized memory.

In the Linux kernel, the bnxt_en driver's bnxt_hwrm_func_backing_store_qcaps_v2() stores the type from the firmware response and uses it to index backing-store metadata arrays, potentially causing an out-of-bounds indexing. The fix sets the type from the current loop variable instead of relying on the firmware value.

In the Linux kernel, a vulnerability in netfilter ctnetlink causes uninitialized saved_addr and saved_proto fields in expectation structures when CTA_EXPECT_NAT is missing, leaking stale data from previous slab allocations to userspace.

A vulnerability was found in the Linux kernel's netfilter nf_tables subsystem, allowing an immediate NF_QUEUE verdict. This verdict is not used by userspace nftables tools, and the ARP family lacks queue support, potentially leading to unexpected behavior.

In the Linux kernel, hci_cmd_sync_queue_once() did not indicate whether a queue item was actually added, so callers could not tell if callbacks would be invoked, leading to resource leaks. The function was changed to return -EEXIST when the queue item already exists, and all call sites were updated accordingly.

W jądrze Linuxa naprawiono podatność związaną z Bluetooth, która występowała, gdy funkcja hci_cmd_sync_queue_once() zwracała błąd. W takim przypadku nie była wywoływana funkcja zwrotna do niszczenia, co prowadziło do wycieków pamięci.

In the Linux kernel, mesh_send() handling Bluetooth MGMT does not validate the adv_data_len field against the actual size of the flexible adv_data[] array. A truncated command can pass the existing 20..50 byte range check and drive the async mesh send path past the end of the queued command buffer.