CVE Vulnerability Catalog

In the Linux kernel, the irqchip/sifive-plic driver has a vulnerability causing interrupt freezing. The issue occurs when changing interrupt affinity while a hart is still handling the interrupt, leading the PLIC controller to ignore the completion message. This results in a complete stall of interrupts for the affected device.

W jądrze Linuxa zidentyfikowano podatność polegającą na dereferencji wskaźnika NULL w funkcji lec_arp_clear_vccs(). Problem ten występuje, gdy wiele wpisów ARP dzieli ten sam VCC, co prowadzi do awarii systemu w przypadku zamknięcia VCC.

In the Linux kernel, `drbd_request_endio()` passes `READ_COMPLETED_WITH_ERROR` to `__req_mod()` with a NULL `peer_device`, which is then dereferenced in `drbd_set_out_of_sync()`. This causes a null-pointer dereference on a local read error in DRBD.

In the Linux kernel, a vulnerability was found in the mtk_eth_soc driver where the eBPF program pointer in mtk_xdp_setup() is not reset to old_prog on error in mtk_open, and its ref-count is incorrectly decreased.

In the Linux kernel, the SMB client was fixed for an oops due to an uninitialized variable in smb2_unlink(). If SMB2_open_init() or SMB2_close_init() fails (e.g., reconnect), the iovs in rqst remain uninitialized, and calling SMB2_open_free(), SMB2_close_free(), or smb2_set_related() on them causes an oops. The fix initializes close_iov and open_iov before setting them in rqst.

In the Linux kernel, the mesh_rx_csa_frame() function in mac80211 dereferences elems->mesh_chansw_params_ie without a NULL check. When a received CSA action frame omits the Mesh Channel Switch Parameters IE (element ID 118), the pointer remains NULL, causing a kernel NULL pointer dereference and crash. The bug has been present since kernel v3.13 (2014).

Open Redirect vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.

A logic issue in Safari and Apple systems was fixed with improved state management, preventing malicious websites from accessing script message handlers intended for other origins. The patch is included in Safari 26.4, iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

A vulnerability in Safari and related Apple system components allows a malicious website to process restricted web content outside the sandbox. The issue was addressed with improved memory handling.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling. The fix is included in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.3. An app may be able to access sensitive user data.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

SSH misconfiguration in Tenable OT allows potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to glean information about the underlying system and attempt to compromise the host.

In Vim prior to version 9.2.0202, a command injection vulnerability exists in the glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may execute arbitrary shell commands. This depends on the user's 'shell' setting.

The Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts in script items, JavaScript reprocessing, and Webhooks. This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released making built-in Zabbix JavaScript objects read-only, but usage of global JavaScript variables is not recommended.

CVE-2026-32642 describes an incorrect authorization vulnerability in Apache Artemis and Apache ActiveMQ Artemis, allowing an authenticated user with 'createDurableQueue' permission to create a non-durable JMS subscription on a non-existent address, despite lacking 'createAddress' permission. Consequently, a temporary address is created, which should not occur.

Active Storage in Rails applications prior to versions 8.1.2.1, 8.0.4.1, and 7.2.3.1 allows DirectUploadsController to accept arbitrary metadata from the client and persist it on the blob. Because internal flags like identified and analyzed are stored in the same metadata hash, a direct-upload client can set them to skip MIME detection and analysis, allowing upload of arbitrary content while claiming a safe content_type and bypassing validations.

In Active Support (Ruby on Rails), SafeBuffer#% does not propagate the @html_unsafe flag to the newly created buffer. If a SafeBuffer is mutated in place (e.g., via gsub!) and then formatted with % using untrusted arguments, the result incorrectly reports html_safe? == true, bypassing ERB auto-escaping and possibly leading to XSS.