CVE Vulnerability Catalog

In the Qualcomm slimbus driver (qcom-ngd-ctrl), a potential deadlock was detected due to an ABBA locking order between tx_lock and ctrl->lock. During SSR/PDR down notification, tx_lock is acquired before ctrl->lock, while other code paths take them in reverse order, leading to a possible system hang.

In the Linux kernel's drm/amd/display driver, an out-of-bounds read was found in the dp_get_eq_aux_rd_interval() function. The aux_rd_interval array in struct dc_lttpr_caps has size MAX_REPEATER_CNT - 1 (7 elements), but the offset parameter can be up to MAX_REPEATER_CNT (8) when a sink reports 8 LTTPR repeaters. This leads to an out-of-bounds array read.

In the Linux kernel's AMD Display driver (drm/amd/display), dal_vector_reserve() uses uint32_t arithmetic for allocation size, which can wrap and allocate a smaller buffer than expected, leading to heap overflows.

A WARN warning was triggered in the Linux kernel's scx_cgroup_move_task() function during task migration by the sched_ext scheduler. The issue occurs when systemd modifies subtree_control and cgrp_moving_from is NULL, which is a legitimate CSS-based migration, not an error. The fix removes the warning while keeping ops.cgroup_prep_move() and ops.cgroup_move() paired.

In the Linux kernel, the debugobjects module has an issue on RT-enabled systems. The fill_pool() function calls rtlock_lock(), which asserts if current->pi_blocked_on is set, potentially causing a kernel panic.

A fix in the Linux kernel for debugobjects where calling fill_pool() in hardirq context during early boot could cause a deadlock.

The pretix-oppwa plugin insecurely concatenated the resourcePath parameter with the API URL, allowing an attacker to redirect requests to their own server and steal the Oppwa access token. The vulnerability is fixed by strictly validating API URLs.

A vulnerability in allegroai/clearml versions up to 1.16.5 allows relative path traversal when extracting .zip archives using ZipFile.extractall() in StorageManager._extract_to_cache(). Lack of path validation enables arbitrary file writes.

A Race Condition vulnerability in BIOVIA Workbook from Release 2021 through Release 2026 could allow a user to access unauthorized data from another user.

The vulnerability in MCO is due to missing server-side validation of uploaded file types. Validation relies solely on client-side checks, which can be bypassed. An authenticated, low-privileged attacker can upload files of arbitrary types to the server.

MCO is vulnerable to User Enumeration through authentication-related functionalities. The application returns distinguishable responses for valid and invalid users during username reminder and password reset operations, allowing an attacker to enumerate valid usernames and email addresses.

Stored Cross‑Site Scripting (XSS) vulnerability in MCO allows an attacker to upload a malicious SVG file as the application logo. The JavaScript code executes when the logo is rendered or opened.

MCO is vulnerable to Path Disclosure and Path Traversal in file handling functionality related to data export and upload. Improper validation of the filename parameter allows writing files to arbitrary locations as well as indirect disclosure of absolute server paths through error messages.

A vulnerability in MCO allows an authenticated low-privileged user to retrieve administrator access control structures via the /customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure endpoint due to missing authorization checks. This may expose sensitive permission mappings and internal configuration details.

A vulnerability in MCO allows an attacker to lock a victim's account by repeatedly resetting the password. Each reset request invalidates the previous password and temporary passwords, with no limit on the number of resets. An attacker who knows the victim's email and security question answer can effectively deny access to the account.

An IDOR vulnerability in the /customer/servlet/mco/webapi/trading-document/fetchPdfStatement endpoint allows unauthorized access to other users' trading documents. The lack of permission validation enables document retrieval based on a guessable identifier.

A vulnerability in MCO allows an authenticated user to modify group membership without proper authorization checks, leading to privilege escalation. An attacker can add themselves to arbitrary groups by providing a valid group ID, which can be obtained from other application functionalities or guessed via brute-force.

A vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 causes a mismatch in handling encoded slashes (%2F) between the middleware and Fastify's router. An attacker can bypass middleware used for authentication, authorization, rate limiting, or auditing by sending a crafted request with an encoded slash in the parameter position.

Vulnerability in @fastify/middie versions 9.1.0 through 9.3.2 causes Node.js process termination when processing malformed percent-encoded sequences in request paths. The issue only affects the standalone engine API (middie.run), not the Fastify plugin path.

In Open VSX Registry before version 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without Content-Security-Policy or Content-Disposition: attachment headers. An unauthenticated attacker can register a publisher account, upload a VSIX containing a crafted HTML payload, and trick an authenticated user into visiting the resulting URL.