CVE Vulnerability Catalog

MiniDVBLinux 5.4 contains a remote command execution vulnerability that allows unauthenticated attackers to execute arbitrary commands as root through the 'command' GET parameter. Attackers can exploit the /tpl/commands.sh endpoint by sending malicious command values to gain root-level system access.

In matio 1.5.28, a heap-based memory corruption issue was found in Mat_VarCreateStruct() when the nfields value does not match the actual number of strings in the fields array. This leads to out-of-bounds reads and invalid memory frees during cleanup, potentially causing a segmentation fault or heap corruption. NOTE: Multiple third-parties note that the available evidence does not demonstrate a vulnerability exploitable through an attacker-controlled input path.

Authentication Bypass in fosrl/pangolin v1.6.2 and before allows attackers to access Pangolin resource via Insecure Default Configuration

RustFS is a distributed object storage system built in Rust. In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no mechanism for token rotation, and universally valid across all RustFS deployments. Any attacker with network access to the gRPC port can authenticate using this publicly known token and execute privileged operations including data destruction, policy manipulation, and cluster configuration changes. Version 1.0.0-alpha.78 contains a fix for the issue.

JD Cloud NAS routers AX1800, AX3000, AX6600, BE6500, ER1, and ER2 in specific firmware versions contain an unauthorized remote command execution vulnerability. An attacker can exploit this flaw without authentication, leading to full device compromise.

Podatność typu Cross-Site Request Forgery (CSRF) w ConoHa przez GMO WING WordPress Migrator umożliwia przesyłanie powłok sieciowych na serwer WWW. Problem dotyczy WING WordPress Migrator w wersjach od n/a do 1.2.0 włącznie.

W podatności CVE-2025-15255 zidentyfikowano problem w urządzeniu Tenda W6-S 1.0.0.4(510), który dotyczy nieznanej funkcji pliku /bin/httpd komponentu R7websSsecurityHandler. Manipulacja argumentem Cookie może prowadzić do przepełnienia bufora na stosie.

In the Linux kernel, the RDMA/irdma module has a data race on the cqp_request->request_done field. The field is read without locking in irdma_handle_cqp_op while being updated in irdma_cqp_ce_handler. The issue was fixed by using READ_ONCE/WRITE_ONCE macros to prevent compiler optimizations and KCSAN warnings.

In the Linux kernel, there is a race condition in the CIFS filesystem when connecting to an IPC tree. Access to the hostname field in TCP_Server_Info is not properly protected, which can lead to it being freed in the cifsd thread and cause a use-after-free in __tree_connect_dfs_target().

In the Linux kernel, there is a double free of the xprt_ctxt pointer in the SUNRPC service. When an RPC request is deferred, the pointer is moved to svc_deferred_req, but on a second deferral it is not cleared, leading to double free or adding to a free list, which can cause an oops.

A vulnerability in the Linux kernel's CIFS module can cause a system crash (oops) during oplock break handling. The issue stems from a race between deferred close and lease breaks, potentially leading to an invalid pointer dereference during filesystem unmount.

A vulnerability was found in the Linux kernel's SMC (Shared Memory Communications) module. The smc_llc_srv_add_link() function lacked proper protection, which could lead to a race condition and result in a system panic (crash) when the server attempts to create a second link.

In the Linux kernel, a vulnerability in the mlx5e driver for Mellanox network cards causes invalid buffer access in XSK mode for legacy rq. The issue leads to double release of the buffer in the XDP_REDIRECT path, potentially causing a system crash.

In the Linux kernel, a vulnerability in the ksmbd module leads to a slab-out-of-bounds read in the init_smb2_rsp_hdr function. The issue occurs when an SMB1 mount attempt fails and the ksmbd server incorrectly handles SMB1 negotiation as an SMB2 operation, causing an out-of-bounds memory read.

In the Linux kernel, in the scsi: target: iscsit module, there is a vulnerability where commands from recovery entries are freed after the session has been closed, leading to use-after-free or NULL pointer dereference. The fix moves cleanup of recovery entries to before session freeing.

DVP-12SE11T - Out-of-bound memory write Vulnerability

DVP-12SE11T - Password Protection Bypass

Whale browser before 4.35.351.12 allows an attacker to escape the iframe sandbox in a sidebar environment.

Podatność CVE-2025-68860 dotyczy Mobile Builder, umożliwiając obejście uwierzytelniania poprzez alternatywną ścieżkę lub kanał. Problem ten występuje w wersjach od n/a do 1.4.2 włącznie.

Podatność CVE-2025-68562 w MapSVG firmy RomanCode umożliwia nieograniczone przesyłanie plików o niebezpiecznym typie, co pozwala na przesłanie powłoki sieciowej na serwer WWW. Problem dotyczy wersji MapSVG od n/a do 8.7.3.