CVE Vulnerability Catalog

In the Linux kernel, mt7996_mcu_get_eeprom() in the mt76 wifi driver (mt7996 chipset) derives the destination of the EFUSE/EXT block copy from the address reported by the MCU response (event->addr) and clamps only the copy length, never the destination offset into dev->mt76.eeprom.data. A malicious or malfunctioning device can report an arbitrary address and drive an out-of-bounds write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes past eeprom.data.

In the Linux kernel, the default EEPROM firmware is parsed and copied as a full EEPROM without checking its length. A truncated file can make the driver read beyond the firmware buffer during variant validation or the fallback copy.

In the Linux kernel, virtio_vsock_remove() stops the virtqueues and flushes each work item before freeing the enclosing virtio_vsock, but the order does not account for dependencies: tx_work may queue send_pkt_work, and send_pkt_work may queue rx_work. In particular, send_pkt_work can set restart_rx and release tx_lock, and the remove path can flush rx_work before send_pkt_work queues it, leading to a use-after-free race with kfree(vsock).

In the Linux kernel, w1_f19_i2c_master_transfer(), the master_xfer for the DS28E17 1-Wire to I2C bridge, takes the length from the device on an I2C_M_RECV_LEN read. The driver reads that many bytes into buf[1], but the caller buffer is I2C_SMBUS_BLOCK_MAX + 2 (34 bytes), so a length above 32 makes the read run past it, up to about 222 bytes out of bounds. The SMBus core check runs after master_xfer returns, by which time the write is already done.

In the Linux kernel, the "cad_pid" sysctl entry is global and kill_cad_pid() is only used in the root namespace. However, due to pid_table_root_permissions(), a non-root user can unshare pid/user namespaces and modify it from the child namespace, which is wrong.

In the Linux kernel, smack_file_send_sigiotask() was accessing both tsk->cred and __task_cred(tsk). Accessing ->cred on a non-current task is forbidden because a task can change its own ->cred pointer without synchronization, leading to a use-after-free of struct cred.

AirSane versions prior to 0.4.12 have a vulnerability in the custom HTTP server implementation that allows a remote unauthenticated attacker to cause a Denial of Service (DoS) via memory exhaustion. The HttpServer::Request::content function reads the Content-Length header and passes it directly to std::string::resize() without upper-bound validation, causing allocation of gigabytes of memory and process crash. Additionally, non-numeric characters in the Content-Length header lead to undefined behavior.

An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier ships with authentication disabled, allowing remote unauthenticated attackers to access live H.264 video and G.711 audio feeds in cleartext over unencrypted RTP/UDP.

A heap-based buffer overflow in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier allows remote unauthenticated attackers to cause a denial of service or potentially execute arbitrary code via a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes.

Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticated low-privileged user can inject PHP into executable cache files generated by WoltLab Suite Core. Attacker-controlled data can terminate the nowdoc prematurely and inject arbitrary PHP Code.

An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial of service via the FastExplorationFSM::optTimerCallback() in swarm_exploration/exploration_manager/src/fast_exploration_fsm.cpp.

The Amelia plugin in versions up to and including 2.4.9 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Sky Addons for Elementor plugin in versions up to and including 3.8.4 contains an Editor SQL Injection vulnerability. This allows users with editor privileges to inject malicious SQL queries into the database.

The Masteriyo - LMS plugin in versions up to and including 3.4.0 contains an Unauthenticated PHP Object Injection vulnerability. An attacker can inject a malicious PHP object, potentially leading to further attacks such as remote code execution.

The SMS Alert Order Notifications plugin in versions up to and including 3.9.9 contains a Subscriber Privilege Escalation vulnerability. A user with the subscriber role can elevate their privileges, gaining access to functions reserved for higher roles.

The Gato GraphQL plugin in versions up to and including 19.2.3 contains a vulnerability allowing a subscriber to escalate their privileges. A low-privileged user can gain access to functionality reserved for higher roles.

The Master Addons for Elementor plugin by Pixar Labs in versions up to and including 3.2.2 contains a missing authorization vulnerability allowing privilege abuse. An unauthorized user can perform operations they should not have access to.

A race condition in the document value layer of MongoDB Server allows concurrent server threads to operate on the same internal memory without synchronization, leading to memory corruption. An authenticated user with ordinary read-write privileges on a database can trigger this condition over the normal client protocol.

In wpa_supplicant all versions before 2.12, a missing validation in the driver-based PMKSA selection path in wpa.c allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching.

A vulnerability in Apache OpenNLP (opennlp-spellcheck extension, versions 3.0.0-M4 and 3.0.0-M5) allows an Out-of-Memory Denial of Service. The SymSpellModelSerializer.create() method reads unigram and bigram count fields from a model file and passes them directly to map pre-sizing without an upper bound, causing a crafted .bin file to attempt a 4–8 GB allocation and fail with OutOfMemoryError.