CVE Vulnerability Catalog

In the Linux kernel SMB (CIFS) client, a vulnerability exists where responses with overlapping data areas are rejected. The __smb2_calc_size() function clears data_length, which can make an invalid response appear valid.

In Catalyst::View::Wkhtmltopdf for Perl versions before 0.6.1, shell command injection (RCE) is possible via PDF render options. Options are passed directly to the wkhtmltopdf command without sanitization, allowing arbitrary command execution.

In GPU drivers, an integer overflow when calculating physical offsets for sparse PMRs may cause 32-bit truncation for PMRs larger than 4 GB, leading to incorrect GPU MMU mappings and potential access to unintended physical memory.

The Tycon Systems TPDIN-Monitor-WEB2 ships without HTTP credentials configured, intended for an installer to set them on first use. On firmware 2.4.4 and earlier, a unit left in this unconfigured state serves the web management interface without requiring any login. An attacker with network access to such a unit can reach full device controls, including power relay management, device reboot, remote access service configuration, and network settings, which could allow disruption of connected infrastructure or physical damage to equipment.

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

In epa4all, prior to version 2026-05-20, an attacker who can intercept the TLS connection between epa4all and the ePA backend can complete the VAU handshake with attacker-controlled keys and obtain the session encryption keys.

A vulnerability was found in the Linux kernel's blk_insert_cloned_request() function, which did not recompute the nr_integrity_segments for cloned requests. This can trigger a BUG_ON() during segment mapping when the bottom queue has stricter segmentation settings than the top queue.

In the Linux kernel's netfs subsystem, a use-after-free vulnerability was found in netfs_unlock_abandoned_read_pages(). The function accesses the folio index after clearing the NETFS_RREQ_IN_PROGRESS flag, potentially leading to dereference of freed memory.

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Image::WebP for Perl versions before 0.3.0 bundle a vulnerable version of libwebp (0.3.0 from 2013). The module does not link to the system libwebp but uses its own compiled copy, which has known vulnerabilities including CVE-2023-4863. Any caller decoding an untrusted WebP image reaches the vulnerable decoder, and upgrading the system library does not fix the issue.

Server-Side Request Forgery (SSRF) vulnerability in Data Quality allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for a critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

Vulnerability in `/usr/bin/larm_starter` in Loytec devices (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to escalate privileges to root via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained and has an uncontrolled recursion vulnerability. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

Vulnerability in Eclipse BaSyx Go Components allows bypassing ABAC authorization by appending a trailing slash. An unauthenticated attacker can gain unauthorized access to protected resources.

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before version 5.1.0 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the standard front-end issue tracker configuration.

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.