CVE Vulnerability Catalog

A stack overflow vulnerability exists in the WebCam Server Login functionality of GeoVision GV-VMS V20 20.0.2. A specially crafted HTTP request can lead to arbitrary code execution.

GV-VMS V20 contains a stack overflow in the gvapi endpoint authentication mechanism, where a base64-decoded string is copied into a fixed 256-character buffer without bounds checking. Because the data is fully attacker-controlled and the web server is compiled without ASLR, the vulnerability can be easily exploited to achieve remote code execution as SYSTEM.

A privilege escalation vulnerability exists in the Web Interface functionality of GeoVision LPC2011/LPC2211 1.10. A specially crafted HTTP request can lead to execute privileged operation.

There is an os command injection vulnerability in the DdnsSetting.cgi functionality of GeoVision LPC2011/LPC2211 version 1.10. A specially crafted DDNS configuration can lead to arbitrary command execution.

The User Verification by PickPlugins plugin for WordPress is vulnerable to authentication bypass in all versions up to and including 2.0.46. This is due to the use of a loose PHP comparison operator to validate OTP codes in the 'user_verification_form_wrap_process_otpLogin' function.

The User Registration Advanced Fields plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'URAF_AJAX::method_upload' function in all versions up to and including 1.6.20. This allows unauthenticated attackers to upload arbitrary files on the affected site's server.

CVE-2026-37541 describes a buffer overflow vulnerability in Open Vehicle Monitoring System 3 (OVMS3) version 3.3.005. Improper validation of the length field in GVRET binary data allows remote attackers to cause a denial of service or potentially execute arbitrary code via crafted GVRET frames.

CVE-2026-37539 describes a buffer overflow vulnerability in version 2.0.0 of the cannelloni software occurring during CAN frame parsing in the parseCANFrame and decodeFrame functions. This allows remote attackers to cause a denial of service (crash) or potentially execute arbitrary code via crafted CAN FD frames.

CVE-2026-37534 describes an integer underflow vulnerability in Open-SAE-J1939, allowing attackers to write to arbitrary memory via a crafted sequence number from the CAN frame.

The AGL app framework in versions up to 17.1.12 contains a Zip Slip vulnerability allowing path traversal and a TOCTOU race condition in the widget installation process. The is_valid_filename function does not check for dot notation directory traversal sequences, allowing files to be written anywhere on the filesystem.

MixPHP Framework versions 2.x through 2.2.17 have an unsafe deserialization vulnerability. The session and cache handlers use unserialize() on data from the filesystem in the FileHandler object.

MixPHP Framework versions 2.x through 2.2.17 have an unsafe deserialization vulnerability. The session and cache handlers use unserialize() on data from Redis in the RedisHandler object.

A vulnerability has been identified in the Linux kernel that involves missing packet data copying from the XDP buffer to the skb structure, leading to kernel memory leakage to user space. Additionally, improper skb recycling marking may corrupt the page pool state.

In the Linux kernel, a vulnerability in ip6_err_gen_icmpv6_unreach() fails to clear the cb[] field in skb2, leading to misinterpretation of control data. An attacker can send a crafted ICMPv4 packet with a CIPSO option, causing an out-of-bounds read in icmp6_send().

A vulnerability was found in the Linux kernel's ip4ip6_err() function in the IPv6-over-IPv4 tunnel. An uninitialized cb[] area in a cloned skb can be misinterpreted as an IPv4 structure, leading to attacker-controlled data reads and a stack buffer overflow.

In the Linux kernel X.25 stack, a double free of a socket buffer (skb) was discovered. When x25_queue_rx_frame fails to allocate memory, it frees the skb and returns an error, but the caller x25_backlog_rcv also attempts to free the same skb, causing a double free.

Version 7.1.2 of hashcat contains a heap-based buffer overflow vulnerability in the hex_to_binary function in the PKZIP hash parser. An attacker can exploit this flaw to cause a denial of service or potentially execute arbitrary code via a crafted PKZIP hash file.

In version 7.1.2 of hashcat, there is a heap-based buffer overflow in the Kerberos hash parser, allowing an attacker to cause a denial of service or potentially execute arbitrary code via a crafted Kerberos hash file.

A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in hashcat v7.1.2 allows for denial of service or arbitrary code execution via a crafted rule file or the -j or -k options with password candidates of 128 or more characters.

A vulnerability has been identified in the Linux kernel related to use-after-free in the __ksmbd_close_fd() function. The issue arises when a durable file handle survives session disconnect, leading to improper management of byte-range locks.