CVE Vulnerability Catalog

In the optional BcThemeFile plugin of baserCMS, the Admin API validates a raw path in ThemeFilesService::update() and getFullpath(), but ThemeFileForm::_execute() subsequently applies rawurldecode() to fullpath before writing. Because normalizePath() resolves only literal dot segments, percent-encoded traversal can pass the containment checks and become a path outside the theme directory at the write sink. An authenticated administrator can write PHP files into writable locations such as webroot and execute them, exceeding the intended theme-template editing boundary.

In baserCMS, list and detail actions in the Admin and Api/Admin prefixes pass request query parameters, including contain, conditions, fields, finder, and order, directly to the ORM as options. A user able to log into the admin panel can embed SQL fragments in those options to execute arbitrary SQL against the application's database, including reading password hashes from the users table. Public-page and public-API fixes released in 5.3.1 and 5.4.1 did not protect these administrative paths.

In DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9, the Android Debug Bridge daemon (adbd) lacks authentication for a critical function. The device ships with ro.adb.secure=0 and USB ADB enabled by default; once ADB over TCP is enabled, the same unauthenticated shell (uid 2000) is reachable over the network. This provides a foothold for privilege escalation to root.

Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to invoke privileged operations, including factory reset with user-data wipe (transaction 153), shutdown (105), clock/timezone change (101/123), and the firmware-apply hand-off (151), because onTransact() performs no caller-identity or permission check.

OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local unprivileged process to execute arbitrary commands as root by writing a crafted line to the Android log (logcat), which the helper reads and passes to a shell eval.

Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a local application with no permissions to execute arbitrary OS commands as root, because the handler passes a caller-supplied string to system() in the root-privileged 'assistant' daemon without any caller-identity or permission check.

Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600C firmware v0.3.9.7 through v0.6.6.9 on Android allows a physically-present attacker with USB access to execute arbitrary OS commands as root by sending the hard-coded magic string 'dji26656677' to the USB-gadget serial interface (/dev/ttyGS0), after which each subsequent line is passed to system().

A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite allows an attacker to inject JavaScript through the packages parameter of the /h/rest document editor. The editor inserts package names into script attributes without HTML encoding. When combined with CVE-2026-50053, an attacker with an ordinary Zimbra account can execute JavaScript in another signed-in user's Zimbra browser session.

In the Linux kernel, dm-integrity has a NULL pointer dereference when a device with the SB_FLAG_DIRTY_BITMAP flag is activated in 'R' mode. The dm_integrity_resume function attempts to read the journal containing the bitmap, causing a crash. The fix skips writes to the device in 'R' mode during resume.

In the Linux kernel, dm-integrity does not validate the superblock on resume, allowing a user to modify the superblock on the underlying device while the dm-integrity device is suspended. This can cause a mismatch in in-memory structure sizes and an out-of-bounds write past the journal, including a 512-byte write through a NULL pointer. The fix snapshots the validated superblock in the constructor and refuses to resume if the on-disk geometry changed.

A Linux kernel vulnerability was fixed in the sched_ext scheduler that caused a CPU hotplug hang when a dying CPU's tasks remained in the BPF scheduler. Such tasks were still counted on the runqueue, but an inactive CPU no longer called ops.dispatch() and could not pull them back, blocking the hotplug thread and cpu_down() while holding cpu_hotplug_lock. The fix re-enqueues tasks on the offline rq to the local DSQ so balance_push() can move them off.

In the Linux kernel, a flaw was fixed in iterate_dir() where the directory's i_rwsem lock was held during readdir even for immutable directories that are never removed. For the nullfs instance directory (shared across mount namespaces and kernel threads), a malicious reader could hold the lock indefinitely, blocking mkdir, lookups, and mounts for other users. A new FOP_IMMUTABLE flag was added to skip the lock for such directories.

In the Linux kernel, the ksmbd server has a heap out-of-bounds write in krb5_authenticate(). When SMB2_SESSION_SETUP is processed as a non-first element of a compounded SMB2 request, the out_len calculation omits work->next_smb2_rsp_hdr_off, overstating available buffer space and allowing memcpy() to write the AP-REP blob past response_buf. The fix subtracts this value when computing out_len.

A bug was fixed in the Linux kernel KVM on x86 regarding the per-vCPU MMIO cache. The cache was tagged with a memslot generation, but both the fill and validation paths used kvm_memslots(), which unconditionally selects address space 0 even when the vCPU runs in SMM and uses address space 1. As a result, an SMM memslot update could leave an apparently valid entry from the old SMM address space after the vCPU returns to the normal address space, letting a guest force a KVM_EXIT_MMIO for valid RAM.

In the Linux kernel, the bnxt_en driver has a DMA mapping length bug for padded small packets. bnxt_start_xmit() pads packets smaller than 52 bytes, but the length passed to dma_map_single() is not adjusted, so the NIC DMA engine reads beyond the mapped region, causing IOMMU faults and transmit queue timeouts.

In the Linux kernel, clear_inode() has an xarray node leak that can be triggered, among other ways, via madvise. Rather than fixing the leaks where they occur, the fix calls xa_destroy(), which has the side effect of cycling the i_pages lock.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during refill retry on a legacy cyclic RQ. When refill succeeds only partially, a WQE left without a replacement retains its old buffer pointer, which may be allocated to another WQE, leading to freeing a live buffer and double-publishing the same UMEM frame. The fix marks the WQE as released immediately after the driver-side free.

In the Linux kernel, the net/mlx5e driver can release a stale XSK buffer during MPWQE refill retry on a striding RQ. When XSK allocation returns -ENOMEM, actual_wq_head is not advanced and a later NAPI poll may call xsk_buff_free() again through stale pointers after frames return to the XSK pool. The fix sets all skip_release_bitmap bits in the error path of mlx5e_xsk_alloc_rx_mpwqe().

A vulnerability in the Linux kernel's IPv4/UDP handling allowed off-path attackers to conduct a side-channel attack on the FIB nexthop exception (FNHE) cache. Previously, an exception was only created if the UDP packet could be matched to an existing socket, enabling discovery of the ephemeral port used by a connected UDP socket. The fix always creates a FNHE before attempting socket matching.

A vulnerability in the Linux kernel's IPv6/UDP handling allowed off-path attackers to conduct a side-channel attack on the exception cache to discover the ephemeral port used by a connected UDP socket. Previously, an exception was only created if the UDP packet could be matched to an existing socket. The fix always creates an exception before attempting socket matching.