CVE Vulnerability Catalog

In the Linux kernel CIFS (SMB1) module, cifs_filldir() copies directory entry names from an SMB response using a server-supplied length without checking that the name stays within the response buffer. A malicious SMB1 server returning an oversized FileNameLength causes memchr() to read past the end of the slab buffer.

The ksmbd SMB server could overwrite ACL masks inherited from the parent directory, leading to widened effective permissions during object creation. The fix preserves original masks.

In vhost-scsi, a race condition between command submission and memory table replacement (VHOST_SET_MEM_TABLE) could cause response writes to an unrelated object after completion. The fix flushes the backend after ioctl.

An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

In the Linux kernel, the netfilter nfnetlink_log module has a synchronization issue: nfnl_log_net_exit() clears the logger pointer without waiting for an RCU grace period, potentially leading to use-after-free by concurrent packets. The fix moves the cleanup to .pre_exit to ensure RCU readers complete before freeing per-net state.

A vulnerability was found in the Linux kernel i2c/smbus subsystem due to missing early validation of SMBus block transfer length. A user-controlled oversized data->block[0] value can reach tracepoints and native smbus_xfer driver implementations unchecked, causing out-of-bounds memory access.

In the Linux kernel's DRM pagemap driver, drm_pagemap_migrate_unmap_pages() relies on the pages array for DMA unmapping, but drm_pagemap_migration_unlock_put_pages() clears the array during cleanup, leaving no valid page info. The fix calls the unmap function before unlock_put_pages to keep the array valid.

In OpenWA before 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through wildcard, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When a session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions.

In Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location not allowed by the administrator.

In Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default CSP settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer.

In Espruino 2v29 (commit bffc6d0), the jslGetTokenValueAsString() function has an out-of-bounds write vulnerability. Crafted JavaScript input with an overlong token can trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds, corrupting the adjacent tokenValue pointer and leading to memory corruption, application crashes, or denial of service.

hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.

Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination.

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.

Termix versions 2.5.0 through 2.5.1 have a vulnerability in the /homepage/proxy endpoint that passes the url parameter to http.get or https.get without destination restrictions. URL validation is only syntactic, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. An authenticated low-privilege user can exfiltrate internal service data and cloud credentials.

Snipe-IT before 8.7.0 allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with inline=true. The browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges.

Snipe-IT before 8.7.0 allows a password-authenticated session for an account with self.api permission to reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The resulting token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint, allowing account takeover.

Snipe-IT before 8.7.0 allows a user with customfields.create permission to store markup in CustomField.name, which is assigned as an unescaped bootstrap-table header title. When another user opens an asset-list page, the stored markup executes on page load in that user's session, potentially exposing same-origin data and performing authenticated actions, including privilege escalation.

The @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile packages in versions from 1.1.47 to 2.3.3 (for the first two) and from 1.3.21 to 2.3.3 (for the third) have a vulnerability that causes transactions created through a remote StorageClient to trust output locking scripts returned by the storage provider without verifying they match the requested outputs. A malicious provider can substitute a recipient script or inject an additional output, redirecting funds while the UI displays the intended recipient.