CVE Vulnerability Catalog

Insufficient escaping of unicode characters in query log in Neo4j Enterprise and Community editions prior to 2026.01 can lead to XSS if the user opens the logs in a tool that treats them as HTML. There is no security impact on Neo4j products, but this advisory is released as a precaution to treat the logs as plain text if using versions prior to 2026.01.

Local privilege escalation vulnerability in ESET Management Agent via insecure temporary batch file execution.

A vulnerability was detected in Portabilis i-Educar up to version 2.10. It affects an unknown function in FinalStatusImportService.php of the Final Status Import component. Manipulation of the school_id argument leads to improper authorization. The attack can be executed remotely, and the exploit is public. Upgrading to version 2.11.0 addresses the issue.

A truncated 802.15.4 packet can lead to an assert, resulting in a denial of service.

A path traversal vulnerability in My Text Editor v1.6.2 allows attackers to write files to internal storage, potentially causing a Denial of Service (DoS).

Nsauditor Product Key Explorer version 4.2.2.0 contains a denial of service vulnerability that allows local attackers to crash the application by inputting a specially crafted registration key. Attackers can generate a payload of 1000 bytes of repeated characters and paste it into the 'Key' input field to trigger the application crash.

CODE::BLOCKS 16.01 contains a buffer overflow vulnerability that allows attackers to execute arbitrary code by overwriting the Structured Exception Handler with crafted Unicode characters. Attackers can create a malicious text file with 1982 bytes of buffer and shellcode to trigger remote code execution.

A race condition in the Linux kernel's SCSI layer can prevent the error handler from waking up when final commands complete concurrently. The issue stems from memory ordering problems and incorrect sequencing between counting busy commands and incrementing the failed counter. This can cause I/O on the SCSI host to become stuck in an error state.

In the Linux kernel, a URB memory leak was fixed in the CAN usb_8dev driver in the usb_8dev_read_bulk_callback() function. The issue was that the USB framework unanchors the URB before the complete callback is called, so URBs were not freed in usb_kill_anchored_urbs(). The fix re-anchors the URB to priv->rx_submitted.

In the Linux kernel arm64/fpsimd signal handling, restoring a ZA context does not allocate the task's sve_state before setting TIF_SME. This can leave a task with TIF_SME set but sve_state NULL, causing a kernel NULL pointer dereference when the register state is later saved. It affects uncommon cases where the ZA signal context was not created by the kernel in the context of the same task (e.g. save/restore with CRIU).

In the Linux kernel, the ice driver has a devlink reload call trace bug related to HWMON temperature sensor reading. ice_hwmon_init() is called in ice_init_feature() and ice_hwmon_exit() in ice_remove(), so devlink reload followed by driver removal leaves an orphaned hwmon instance and causes a page fault call trace.

In the Linux kernel LED subsystem (led-class), a race condition exists. The LED is added to leds_list before full initialization (led_init_core), creating a window where registering a default trigger can queue an uninitialized set_brightness_work, causing a kernel WARNING and potential instability.

A bug was found in the Linux kernel's hugetlb_pmd_shared() function, which incorrectly detects PMD table sharing for hugetlb pages. Instead of using the dedicated share count (pt_share_count), the function still relied on the refcount, causing shared PMD tables not to be recognized as shared. This leads to incorrect page migration (e.g., mbind) and wrong reporting in smaps and pagemap interfaces.

In the Linux kernel, a deadlock occurs due to lock ordering for hugetlb file folios during page migration. The migration path takes folio_lock then i_mmap_rwsem, while another path (hugetlbfs_fallocate) takes them in reverse order.

In the Linux kernel, a reference leak was fixed in the intel_th driver when opening an output device. The reference taken when looking up the th device was not dropped on some error paths, on close, and even on successful open. The fix ensures the reference is dropped in all cases.

In the Linux kernel, a vulnerability in the Xen scsiback driver was found where memory allocated for the vscsiblk_info structure in scsiback_probe() is not freed in scsiback_remove() or in error paths of scsiback_probe(), leading to potential memory leaks.

In the Linux kernel, a vulnerability in the vsock/virtio driver allowed TX credit to be derived solely from the remote endpoint's peer_buf_alloc. A malicious guest or host could advertise a large buffer and read slowly, forcing the other side to allocate excessive sk_buff memory, leading to out-of-memory (OOM) conditions.

In the Linux kernel, a flaw was fixed in irqchip/gic-v3-its where on 32-bit machines with CONFIG_ARM_LPAE, physical addresses above the 32-bit limit could be truncated. The ITS driver stored the physical address of the 'itt' object in a 32-bit unsigned long variable, causing crashes in the qemu virt model. The fix changes itt_addr and other physical address variables to phys_addr_t.

In the Linux kernel, a vulnerability was found in the be2net driver, involving a NULL pointer dereference in the be_cmd_get_mac_from_list function. The issue occurs when the function is called with pmac_id_valid set to false and pmac_id pointer set to NULL, leading to a write attempt at address NULL.

In the Linux kernel regmap subsystem, a race condition exists in the hwspinlock irqsave routine. The address of the shared member '&map->spinlock_flags' was passed directly to hwspin_lock_timeout_irqsave, allowing multiple contexts to overwrite the shared flags variable and corrupt the state for the current lock owner.