CVE Vulnerability Catalog

A deadlock vulnerability was found in the Linux kernel's RDMA/irdma driver during netdev reset with active RDMA connections. The netdev reset triggers removal of the irdma auxiliary driver, causing a circular dependency where uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference, leading to an indefinite wait in iWARP mode.

W jądrze Linuxa naprawiono podatność związaną z błędnym logowaniem błędów w module spi-dw-dma. W przypadku wystąpienia błędu, urządzenie może nie mieć aktualnej wiadomości, co może prowadzić do awarii systemu.

In the Linux kernel XFS scrub subsystem, a fix addresses a missing unlock of dq->q_qlock before an early return in xchk_quota_item. When the xchk_fblock_process_error helper returned false, the function returned without dropping the dquot lock, risking lock leaks or deadlocks in later quota operations.

In the Linux kernel, a bug in futex_lock_pi() was found where the local pointer to an exiting thread was not cleared on retry. This caused a WARN_ON_ONCE() when a stale pointer was passed to wait_for_owner_exiting().

In the Linux kernel mac80211 module, aql_enable_write() does not serialize concurrent writes to debugfs, causing a race between the static_key_false() check and the static_branch_inc()/static_branch_dec() calls. This can result in a static_branch_dec() underflow, triggering a kernel warning and potential system instability.

In the Linux kernel bonding driver, a NULL pointer dereference vulnerability was found in bond_debug_rlb_hash_show. The function iterates over RLB hash table entries without checking if the slave field is NULL, potentially causing a system crash.

In the Linux kernel crash_dump module, a fix stops logging dm-crypt key bytes in read_key_from_user_keying. When debug logging was enabled, the function logged the first 8 bytes of the key payload, partially exposing the dm-crypt key. The fix stops logging any key bytes.

In the Linux kernel, the x86/platform/uv code mishandles deconfigured sockets. A deconfigured socket is mapped to SOCK_EMPTY (0xffff), which causes a kernel panic while allocating UV hub info structures. The fix uses NUMA_NO_NODE so the structures are allocated on valid nodes.

In the Linux kernel, the drm/i915/gt component lacks a check on the set_default_submission pointer before dereferencing it. When i915 firmware binaries are absent, the pointer is not set but is still called during suspend, causing a NULL pointer dereference and kernel crash.

In the Linux kernel SMB client, managing recv credits by counting posted recv_io and granted credits is racy. This may lead to granting credits that do not actually exist, causing communication errors.

Mahara before 25.04.2 and 24.04.11 are vulnerable to displaying results that can trigger XSS via a malicious search query string. This occurs in the 'search site' feature when using the Elasticsearch7 search plugin. The Elasticsearch function does not properly sanitize input in the query parameter.

Podatność CVE-2026-5265 dotyczy błędu w obsłudze odpowiedzi ICMP 'Destination Unreachable' lub 'Packet Too Big', gdzie nieprawidłowo kopiowane są dane z oryginalnego pakietu do ciała błędu ICMP. Problem wynika z braku walidacji długości pakietu w stosunku do rzeczywistego rozmiaru bufora pakietu.

The asset dependency graph did not restrict nodes by the viewer's DAG read permissions: a user with read access to at least one DAG could browse the asset graph for any other asset in the deployment and learn the existence and names of DAGs and assets outside their authorized scope. Users are recommended to upgrade to version 3.2.1.

The authenticated /ui/dags endpoint did not enforce per-DAG access control on embedded Human-in-the-Loop (HITL) and TaskInstance records: a logged-in Airflow user with read access to at least one DAG could retrieve HITL prompts (including request parameters) and full TaskInstance details for DAGs outside their authorized scope. Users are recommended to upgrade to version 3.2.1.

Apache ActiveMQ and ActiveMQ Web contain a Basic XSS vulnerability due to improper neutralization of script-related HTML tags in the web console. An authenticated attacker can display malicious content while browsing queues by overriding the content type to HTML and injecting HTML into a JMS selector field. Affects versions before 5.19.6 and 6.0.0 before 6.2.5.

Deserialization of Untrusted Data vulnerability in Apache DolphinScheduler RPC module affects versions >= 3.2.0 and < 3.3.1. Attackers who can access the Master or Worker nodes can compromise the system by creating a StandardRpcRequest, injecting a malicious class type into it, and sending RPC requests to the DolphinScheduler Master/Worker nodes.

The HubSpot All-In-One Marketing plugin for WordPress is vulnerable to sensitive information exposure in all versions up to and including 11.3.32 via the leadin/public/admin/class-adminconstants.php file. This allows authenticated attackers with Contributor-level access and above to extract a list of all installed plugins and their versions, which can be leveraged for reconnaissance and further attacks.

The Royal Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image captions in the Image Grid/Slider/Carousel widget in versions up to and including 1.7.1056. This is due to insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for the alt attribute context. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses a page with the malicious image displayed in the media grid widget.

The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2. This is due to missing capability checks in the get_ads_access_token() and reset_experience() AJAX handlers. While the mi-admin-nonce is localized on all admin pages (including profile.php which subscribers can access), and while other similar AJAX endpoints in the same class properly check for the exactmetrics_save_settings capability, these two endpoints only verify the nonce. This makes it possible for authenticated attackers, with subscriber-level access and above, to retrieve valid Google Ads access tokens and reset Google Ads integration settings.

Press, a Frappe custom app that runs Frappe Cloud and manages infrastructure, subscription, marketplace, and SaaS, has a reflected XSS vulnerability in the redirect parameter on the login page. The patch in commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6 fixes the issue by restricting redirects to internal URLs only.