CVE Vulnerability Catalog

In the Linux kernel, in the ice (Intel Ethernet) driver, ice_unplug_aux_dev() checks pf->cdev_info->adev for NULL, but pf->cdev_info can also be NULL, leading to a NULL pointer dereference during reset when the driver is loaded without RDMA support. The fix introduces a flag set when the auxbus device is successfully created to avoid multiple NULL checks.

In the Linux kernel, a race condition in ftrace can trigger a WARN_ON_ONCE in trace_printk_seq() when ftrace_dump_one() runs concurrently with reading trace_pipe. The ring buffer is consumed by another reader, leaving iter.seq unpopulated.

A bug was fixed in the Linux kernel's sctp_v6_from_sk() function where sin6_scope_id and sin6_flowinfo were not initialized. This led to undefined behavior detected by KMSAN during SCTP address comparison (__sctp_v6_cmp_addr).

In the Linux kernel, a dereference of an error pointer occurs during cleanup in xe_vm_free_scratch(). To avoid this, clear any scratch_pt error pointer.

In the Linux kernel HID hid-ntrig driver, ntrig_report_version() does not check whether the device parent pointer is null, which can cause a page fault at an invalid address returned by hid_to_usb_dev(). The fix adds a null check before calling hid_to_usb_dev().

In the Linux kernel, the drm/mediatek driver lacked error handling for the old CRTC state in atomic_disable. After a hotplug event, the cursor could continue updating, leading to a kernel panic due to accessing NULL old_state->crtc. NULL pointer checks were added to prevent operations on an invalid CRTC state.

In the Linux kernel, the macb driver had incorrect call order in macb_remove(): phy_exit() was called before unregister_netdev(). This caused a kernfs warning because the PHY was being exited while the netdev was still registered. The fix moves unregister_netdev() ahead of phy_exit().

Information disclosure in the Networking: Cache component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

Incorrect boundary conditions exist in the JavaScript: GC component. This vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

A mitigation bypass exists in the Web Compatibility: Tooling component. The vulnerability was fixed in Firefox 143 and Thunderbird 143.

A spoofing issue exists in the WebAuthn component in Firefox for Android. This vulnerability was fixed in Firefox 143 and Thunderbird 143.

A same-origin policy bypass exists in the Layout component of Firefox and Thunderbird. The vulnerability was fixed in Firefox 143, Firefox ESR 140.3, Thunderbird 143, and Thunderbird 140.3.

In Focus for iOS, opening links via the contextual menu for certain URL schemes failed to load but did not refresh the toolbar correctly, allowing attackers to spoof websites if users were coerced into opening a link via long-press.

W podatności CVE-2025-6575 występuje niewłaściwe neutralizowanie danych wejściowych podczas generowania stron internetowych w Dolusoft Omaspot, co pozwala na ataki typu Reflected XSS.

The Sparkle framework includes an XPC service Downloader.xpc that is private to the bundled application by default. A local unprivileged attacker can register this service globally, inheriting the application's TCC permissions, and due to lack of client validation copy TCC-protected files to an arbitrary location. Access to other resources requires user interaction. The issue was fixed in version 2.7.2.

W podatności CVE-2025-2404 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w systemie STOYS firmy Ubit Information Technologies, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji STOYS od 2 do przed 20250916.

Podatność CVE-2025-5519 w ArgusTech BILGER umożliwia wstawienie wrażliwych informacji do wysyłanych danych poprzez wybór identyfikatora wiadomości. Problem ten dotyczy wersji BILGER przed 2.4.6.

Podatność CVE-2025-5518 dotyczy oprogramowania ArgusTech BILGER w wersjach przed 2.4.6 i polega na obejściu autoryzacji poprzez klucz kontrolowany przez użytkownika, co umożliwia wykorzystanie zaufanych identyfikatorów.

W jądrze Linuxa naprawiono podatność, która mogła prowadzić do dereferencji wskaźnika NULL w funkcji blk_mq_elv_switch_none. Problem występował po zablokowaniu q->sysfs_lock, gdy q->elevator mogło stać się NULL w wyniku zmiany windy.

A path handling issue was addressed with improved validation. The vulnerability exists in Xcode 26 and involves processing an overly large path value that may crash a process.