CVE Vulnerability Catalog

In the Linux kernel's io_uring/io-wq subsystem, a vulnerability can cause prolonged blocking of io-wq worker threads during exit. Processing large read operations (e.g., 2GB - 4096b) from /dev/msr* files, which lack ->read_iter() support, each read may take up to 20 seconds, leading to hung task timeouts (140 seconds) and error reports.

A stack buffer overflow vulnerability exists in Vim's NetBeans integration when processing the specialKeys command. A malicious NetBeans server can overflow the 64-byte keybuf with a single specialKeys command. The issue is fixed in Vim patch v9.1.2148.

A vulnerability in beautiful-mermaid prior to version 0.1.3 allows SVG attribute injection, leading to cross-site scripting (XSS) when rendering attacker-controlled Mermaid diagrams. User-controlled values from style and classDef directives are interpolated into SVG attribute values without proper escaping, enabling crafted input to break out of an attribute context and inject arbitrary SVG elements/attributes into the rendered output.

A flaw was identified in libsoup involving improper validation of requested byte ranges when processing specially crafted HTTP Range headers. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

An issue in the 'My Details' user profile functionality of Ideagen Q-Pulse 7.1.0.32 allows an authenticated user to view other users' profile information by modifying the objectKey HTTP parameter in the My Details page URL.

Podatność CVE-2025-13004 dotyczy oprogramowania E-Commerce Package firmy Farktor Software E-Commerce Services Inc. i pozwala na obejście autoryzacji poprzez manipulację zmiennymi kontrolowanymi przez użytkownika.

A privacy issue was addressed by moving sensitive data to a protected location. Fixed in macOS Sequoia 15.8.2 and macOS Tahoe 26.3. A malicious app may be able to access notifications from other iCloud devices.

A vulnerability in Safari and Apple systems may cause a process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling.

A vulnerability in WebKit may cause a process crash when processing maliciously crafted web content. The issue was fixed with improved memory handling in Safari 26.3, iOS 26.3, iPadOS 26.3, macOS Tahoe 26.3, and visionOS 26.3.

A vulnerability in Safari and Apple systems allows unexpected process termination when processing maliciously crafted web content. The issue was fixed by improving memory handling.

A permissions issue was addressed with additional restrictions. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.3. An app may be able to access protected user data.

An issue existed in the handling of environment variables. This was addressed with improved validation. Fixed in iOS 26.3, iPadOS 26.3, macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, macOS Tahoe 26.3, visionOS 26.3, and watchOS 26.3. An app may be able to access sensitive user data.

A permissions issue was addressed by removing the vulnerable code. Fixed in macOS Sequoia 15.7.4 and macOS Tahoe 26.3. An app may be able to access protected user data.

A vulnerability in WebKit may cause a process crash when processing maliciously crafted web content. The issue was addressed through improved state management.

A path handling issue was addressed with improved logic. This issue affects macOS (Sequoia, Sonoma, Tahoe) and may allow an app to access user-sensitive data.

MiniGal Nano version 0.3.5 and prior contain a reflected XSS vulnerability in index.php via the dir parameter. The application constructs $currentdir from user-controlled input and embeds it into an error message without output encoding, allowing an attacker to supply HTML/JavaScript that is reflected in the response.

Kimai 2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into timesheet descriptions. Attackers can insert SVG-based XSS payloads in the description field to execute arbitrary JavaScript when the page is loaded and viewed by other users.

Phraseanet 4.0.3 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts through crafted file names during document uploads. Attackers can upload files with embedded SVG scripts that execute in the browser, potentially stealing cookies or redirecting users when the file is viewed.

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. A remote attacker with an administrator account can exploit this vulnerability to launch a denial-of-service (DoS) attack.

Podatność CVE-2025-10912 dotyczy oprogramowania TemizlikYolda firmy Saastech Cleaning and Internet Services Inc. i polega na obejściu autoryzacji poprzez manipulację zmiennymi kontrolowanymi przez użytkownika.