CVE Vulnerability Catalog

In the Linux kernel, the veth interface has a bug in veth_poll that uses an incorrect queue index to wake the peer TX queue. Without an XDP program, the index remains 0, which can lead to a permanent stall of the TX queue and loss of transmission.

In the Linux kernel, the ngbe driver has a NULL pointer dereference vulnerability when enabling interrupts in non-MSI-X mode. In such mode, wx->msix_entry is not allocated, and calling NGBE_INTR_MISC leads to a crash.

In the Linux kernel, the net/sched cls_u32 module has a slab-out-of-bounds read vulnerability in u32_bind_class(). The function does not check whether the object is an hnode, leading to invalid memory access.

In the Linux kernel, the cls_bpf module did not verify that a device-bound (offloaded) eBPF program is bound to the same network interface to which the classifier is being attached. This allowed attaching a program intended for device A to device B, and after deleting device A it caused a system panic.

Http4s before versions 0.23.35 and 1.0.0-M47 has a DoS vulnerability via HTTP/2 in the Ember backend. The Hpack wrapper does not include indexed headers or per-header overhead in the header size limit, allowing a small block to expand into a large in-memory representation. Multiple malicious connections can exhaust process memory.

IzPack version 5.2.6 and earlier has a path traversal vulnerability allowing writes outside the installation directory. The unpack() function does not normalize paths or enforce destination containment, allowing entries with '../' sequences to write to arbitrary locations.

LogTape before versions 1.3.11, 2.0.14, and 2.1.5 has a vulnerability in the @logtape/syslog package that allows injection of forged syslog records. The escapeStructuredDataValue() function does not neutralize control characters, and formatStructuredData() does not validate keys, enabling manipulation of frames and data elements.

Rently Smart Home versions 20.1.0 and prior have an Insufficiently Protected Credentials vulnerability. An attacker can retrieve pins including the Master Pin, overriding standard user permissions.

RustDesk before version 1.4.7 has an uncontrolled speculative memory allocation vulnerability in BytesCodec. Before authentication, the decoder trusts the payload length in the frame header and reserves memory before receiving data, allowing memory exhaustion via multiple TCP connections.

Liderahenk from version 3.4.0 before 3.5.5 has an LDAP Injection vulnerability. Improper neutralization of special elements in an LDAP query allows manipulation of queries.

GitLab EE versions from 18.9 before 19.1.7, 19.2 before 19.2.5, and 19.3 before 19.3.1 have a vulnerability that allows an authenticated user with developer role to execute arbitrary commands in a CI context. This occurs through the Claude agent processing configuration from a user-controlled source.

The Formidable Charts plugin for WordPress up to version 2.0.1 has a Directory Traversal vulnerability via the 'frm_graph' parameter. An unauthenticated attacker can read the contents of arbitrary files on the server if certain conditions are met.

On Linux, several OpenZFS ioctl authorization checks accept a capability held only within an unprivileged user namespace as equivalent to real host privilege, allowing an unprivileged local user to perform operations that should require root. Affected operations include pool-administrative operations (e.g., create, import, destroy), pool event log access (zpool events), and fault injection (zinject). Exploitation requires only that the local user can open /dev/zfs and that the kernel permits unprivileged user namespace creation.

A stack-based buffer overflow vulnerability exists in the Dia diagram editor when processing Network Bus objects from Dia XML project files. The bus_load() function reads the number of bus handles from the "bus_handles" attribute without validating an upper bound, and bus_handle_moved() allocates stack arrays based on this count. Excessive values (e.g., 262144) cause stack overflow, SIGSEGV, and potential stack frame corruption.

The vulnerability allows unauthorized generation of physical access QR codes due to the use of hard-coded credentials within the application. The generation mechanism uses the 'badge_number' parameter as the HMAC private key, which remains static and is accessible via the API using the endpoint '/club/_id_club_/member/_id_member_/resamania_qr_info'. An attacker with access to this value and to the application's cryptographic logic, which can be extracted by reverse engineering the APK as there is no code obfuscation, could generate valid QR codes indefinitely, even after the user has changed their password or logged out.

Apache APISIX has a vulnerability relying on untrusted inputs in a security decision. An attacker can escalate privileges or bypass authorization by sending certain values not properly sanitized by the attach-consumer-label plugin.

The Classified Listing - Mobile Number Verification plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.0. This is due to missing server-side Firebase OTP validation in the process_otp_login() function. This makes it possible for unauthenticated attackers to authenticate as any user with a phone number registered in the plugin's phone table by submitting an arbitrary OTP code and UID through the Firebase OTP login flow. Successful exploitation requires OTP login to be enabled with Firebase selected as the verification gateway, and requires the attacker to know or guess the target account's registered phone number. Administrator account takeover is possible if an administrator account has a phone number registered in the plugin.

NLTK versions before 3.10.0 contain a regular expression denial of service vulnerability in Text.findall() and TokenSearcher.findall() methods that accept user-supplied regular expressions without validation or timeout. Attackers can supply crafted regex patterns that cause catastrophic backtracking, resulting in indefinite CPU saturation and denial of service to all users of the Python process.

An attacker with access to an adjacent network can exploit a buffer overflow vulnerability in the DHCPv6-enabled EdgeMAX EdgeSwitch, leading to remote code execution on the device.

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside Common/Server/Utils/SSRFProtection.ts, performed by isBlockedHostnameLiteral, rejects private and loopback IPv4 ranges and tests an IPv6 value against the unspecified address, the loopback, the link-local prefix and the unique-local prefixes. A value such as [::ffff:127.0.0.1] matches none of them. The value is also recognised as an address literal rather than a name, so the path that re-checks addresses obtained from resolution is not taken. The HTTP client treats the mapped form as the embedded IPv4 address and connects to it, so an authenticated project member who can configure a webhook can direct the server at loopback services, private network ranges and link-local metadata endpoints, and the response is recorded where the webhook result can be read. Version 12.0.7 adds handling for the mapped range.