CVE Vulnerability Catalog

In the Linux kernel, the bnge driver has a vulnerability where a return statement is missing after auxiliary_device_uninit() in the error path. After auxiliary_device_add() fails, execution continues, potentially leading to use-after-free.

The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).

An improper initialization vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an admin-privileged attacker to corrupt RMP-covered memory, potentially leading to loss of guest memory integrity.

The mongo-go-driver contains a heap out-of-bounds read vulnerability in the CGo implementation for GSSAPI (Kerberos) authentication on Linux and macOS. The issue arises from incorrect assumptions about string termination in the GSSAPI standard, potentially leading to data disclosure.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware allows a privileged attacker to modify the lock bit, potentially downgrading the firmware and compromising system integrity.

An improper access control vulnerability in AMD Secure Encrypted Virtualization (SEV) firmware allows a malicious hypervisor to bypass RMP protections, potentially compromising SEV-SNP guest memory integrity.

A vulnerability in SEV (Secure Encrypted Virtualization) firmware causes insufficient or incomplete data removal in a hardware component, resulting in incomplete IOMMU flushing. This can potentially lead to a loss of confidentiality and integrity in guest memory.

In the Linux kernel, a vulnerability was found in the F2FS filesystem involving uninitialized value access in the f2fs_sanity_check_node_footer function. The issue was reported by syzbot and may lead to unpredictable system behavior.

A use-after-free vulnerability in SEV firmware allows a malicious hypervisor to activate a migrated guest with the SINGLE_SOCKET policy on a different socket than the migration agent, potentially leading to loss of integrity.

In the Linux kernel, a vulnerability in the mshv_vtl component occurs when registering VTL0 memory via MSHV_ADD_VTL0_MEMORY, where the computed vmemmap_shift may exceed MAX_FOLIO_ORDER, leading to incorrect behavior.

Axios can consume inherited properties from nested request option objects when the JavaScript process already has a polluted Object.prototype. The top-level merged config is protected with a null prototype, but nested plain objects such as auth and paramsSerializer are cloned into objects with a prototype.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Axios is vulnerable to read-side prototype-pollution gadgets when Object.prototype has already been polluted by another vulnerability or dependency. The most broadly reachable issue is in the bodyless method aliases: axios.get(), axios.delete(), axios.head(), and axios.options().

Path traversal vulnerability in serve-static on Windows via encoded backslash (%5C) in the request path. On Windows hosts, an encoded backslash (%5C) decodes to \, which the Windows path treats as a directory separator.

The decNumberCopy function in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflow and out-of-bounds write. This can be demonstrated by using --slurp with subtraction, such as a filter of .-. when the input has a certain form.

In the Linux kernel, in the Btrfs filesystem, an issue with readahead on the relocation inode was fixed when the filesystem uses a RAID stripe tree (RST), which could cause ENOENT errors.

In the Linux kernel, in the Bluetooth subsystem (MGMT), possible deadlocks were fixed that could occur due to hci_cmd_sync_dequeue, causing threads to block for extended periods.

A vulnerability in the Linux kernel's FUSE filesystem causes a hang during sync initialization when the FUSE server exits (e.g., due to error or crash) while processing the FUSE_INIT request. The issue stems from the lack of abort on a fatal signal, blocking filesystem creation.

Security advisory GHSA-2hw4-c9m4-f2fj concerns the knative/pkg component. Verification on 2026-05-19 confirmed end-to-end amplification of 4.5×, worse than the advisory's conservative 2× claim. A Go proof of concept (cmd/poc-c2/main.go) was built.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.