CVE Vulnerability Catalog

W podatności CVE-2026-3091 w Synology Presto Client przed wersją 2.1.3-0672 występuje niekontrolowany element ścieżki wyszukiwania, który pozwala lokalnym użytkownikom na odczyt lub zapis dowolnych plików oraz przeprowadzenie ataku typu denial-of-service podczas instalacji, poprzez umieszczenie złośliwego pliku DLL w tym samym katalogu co instalator.

In ImageMagick prior to version 7.1.2-15, a memory leak exists in `coders/ashlar.c`. The `WriteASHLARImage` allocates a structure, but when an exception is thrown, the allocated memory is not properly released, resulting in a potential memory leak.

Bludit 3.16.2 contains a stored XSS vulnerability in the post content functionality. The application performs client-side sanitation but lacks server-side enforcement. An authenticated user can inject arbitrary JavaScript into post content, which is stored and rendered to other users without proper output encoding.

Bludit 3.16.1 has a CSRF vulnerability in the /admin/uninstall-plugin/ and /admin/install-theme/ endpoints. Lack of CSRF tokens or request origin validation allows an attacker to trick an authenticated admin into performing unauthorized actions.

In Apache Airflow, when a DAG failed during parsing, error messages in the UI could include the full kwargs passed to operators. If these contained sensitive values (e.g., secrets), they might be exposed to authenticated users with permission to view that DAG.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes long runtimes. This requires a malformed /FlateDecode stream where byte-by-byte decompression is used. This is fixed in 6.7.1.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, e.g. during text extraction. This is fixed in 6.7.1.

In pypdf versions prior to 6.7.1, an attacker can craft a PDF that causes an infinite loop. This requires accessing the children of a TreeObject, e.g. as part of outlines. This is fixed in 6.7.1.

SVXportal version 2.5 and prior contain a stored cross-site scripting vulnerability in the user profile update workflow. Authenticated users can inject malicious HTML/JavaScript into fields such as Firstname, lastname, email, and image_url, which are later rendered without adequate output encoding in the administrator interface, resulting in JavaScript execution in an administrator's browser.

Stored XSS vulnerability in SVXportal 2.5 and prior. An unauthenticated attacker can inject arbitrary JavaScript via user registration fields (firstname, lastname, email), which executes in an administrator's browser when viewing the user list.

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in radiomobile_front.php via the stationid query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value into a hidden input value field, allowing attacker-supplied script injection and execution in the administrator's browser.

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in admin/log.php via the search query parameter. When an authenticated administrator views a crafted URL, the application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing attacker-supplied JavaScript to execute in the administrator's browser.

SVXportal version 2.5 and prior contain a reflected cross-site scripting vulnerability in log.php via the search query parameter. The application embeds the unsanitized parameter value directly into an HTML input value attribute, allowing an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser if the victim visits a crafted URL.

A flaw was found in QEMU where a specially crafted VMDK image could trigger an out-of-bounds read vulnerability. This may lead to a 12-byte leak of sensitive information or a denial of service (DoS) condition.

An Open Redirect vulnerability in the RedirectSlashes function of go-chi/chi version 5.2.2 and later allows remote attackers to redirect victims to malicious websites using the legitimate website domain.

Rack, a modular Ruby web server interface, prior to versions 2.2.22, 3.1.20, and 3.2.5, generates an HTML directory index where each file entry is a clickable link. If a file exists on disk whose basename starts with the javascript: scheme (e.g., javascript:alert(1)), the generated anchor's href is exactly javascript:alert(1), allowing JavaScript execution when clicked.

W jądrze systemu Linux zidentyfikowano podatność związaną z brakiem ochrony spinlock w powiadomieniach virtqueue dla urządzenia virtio-crypto. Problem występuje podczas uruchamiania polecenia benchmark openssl z wieloma procesami, co prowadzi do zawieszenia procesów openssl.

W jądrze Linuxa zidentyfikowano podatność związaną z wyciekiem licznika aktywnych połączeń w funkcji ksmbd_tcp_new_connection(). W przypadku niepowodzenia funkcji kthread_run(), transport jest zwalniany, co prowadzi do nieodpowiedniego zarządzania licznikiem active_num_conn.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do nieskończonej pętli w przypadku błędnej weryfikacji podpisu żądania SMB2. Problem występuje, gdy funkcja __process_request() nieprawidłowo ustawia wskaźnik do następnego polecenia, co skutkuje ciągłym przetwarzaniem tego samego błędnego żądania.

In the Linux kernel, the qla2xxx driver has a bug that causes a system crash during repeated module load/unload tests. When a fabric scan is in progress and the module is unloaded, DMA memory is freed in interrupt context, leading to a crash. The fix delays module unload until the fabric scan completes.