CVE Vulnerability Catalog

The Linkable Loadable Extensions (llext) subsystem in Zephyr OS mishandles PLT/RELA relocation entries when linking relocatable ELF extensions on Xtensa. The lack of validation of the r_offset field allows an out-of-bounds write beyond the extension's text buffer, leading to memory corruption in supervisor context.

The PSA Protected Storage credential backend (subsys/net/lib/tls_credentials/tls_credentials_trusted.c) declared its credential-store mutex as a plain zero-filled static struct k_mutex credential_lock; and never called k_mutex_init() on it. A statically zero-filled k_mutex has an uninitialized wait queue (its dlist head/tail are NULL instead of the self-referential sentinels that k_mutex_init/K_MUTEX_DEFINE install). The uncontended lock path does not touch the wait queue, so the defect is latent and serialized use behaves correctly.

In the Intel ALH driver function dai_alh_get_properties(), lack of range validation for stream_id leads to an out-of-bounds read and kernel information leak. The vulnerability can be exploited from user mode if access to the ALH device is granted.

A security flaw in Open5GS up to 2.7.6 affects the smf_gx_cca_cb function of the SMF Diameter Gx Credit-Control-Answer Handler, leading to denial of service. The attack can be launched remotely, and the exploit has been publicly released.

In tablib prior to 3.10.0, a stored cross-site scripting vulnerability exists in the HTML export functionality. Malicious payloads in dataset titles are interpolated unsanitized into HTML output, allowing arbitrary JavaScript execution.

In Samsung Open Source rlottie, an integer overflow vulnerability leads to buffer overflow, potentially allowing arbitrary code execution.

In Samsung Open Source rlottie, an uncontrolled resource consumption vulnerability leads to excessive memory allocation.

In Open5GS up to 2.7.6, a vulnerability in the fd_msg_sess_get function of the HSS Service component leads to denial of service. The attack can be performed remotely, and the exploit has been publicly disclosed.

A flaw has been found in Open5GS up to 2.7.1. An unknown functionality in the freeDiameter component causes memory corruption. The attack can be carried out remotely.

A vulnerability was detected in Open5GS up to 2.7.6. The function diam_log_func in lib/diameter/common/init.c of the CER Handler component is affected. Manipulation results in reachable assertion. The attack can be executed remotely. The exploit is public. Upgrading to version 2.7.7 addresses the issue.

A flaw was found in the multicloud-operators-channel component. This vulnerability allows a user with specific permissions to manipulate how the system handles sensitive information (Secrets) across different namespaces. By exploiting this, an attacker can modify these Secrets in unauthorized areas, potentially leading to unauthorized access or elevated privileges.

A vulnerability was identified in Open5GS up to 2.7.1. The function pcrf_rx_aar_cb in src/pcrf/pcrf-rx-path.c of the Diameter Rx Handler component is affected. Manipulation of the arguments num_of_media_component/num_of_sub leads to buffer overflow. The attack can be initiated remotely. The exploit is publicly available. Upgrading to version 2.7.2 addresses the issue.

A vulnerability was determined in Open5GS up to 2.7.1. The function mme_s6a_subscription_data_from_avp in src/mme/mme-fd-path.c of the Diameter S6a Interface component is affected. Manipulation of the argument msisdn_len leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed. Upgrading to version 2.7.2 resolves the issue.

A vulnerability in the Notepad++ installer for Windows 11 x64 and ARM64 prior to 8.9.7 allows PowerShell command execution in the installer's security context via subexpression syntax in the installation path when the context menu component is selected.

A vulnerability in Kestra prior to 2.0.0-rc6 exposes Micronaut management endpoints on port 8081 without authentication even when Basic Auth protects /api/v1/** on port 8080, allowing unauthenticated GET /env requests to disclose resolved configuration and POST /loggers/{name} requests to change runtime log levels.

A vulnerability in Mira cloud authentication endpoints lacks per-account rate limiting, per-IP throttling, and account lockout after repeated failed login attempts. An attacker can use brute-force methods to gain access to user accounts.

The Mira hormone monitor device firmware accepts a 0x01 write from any BLE central without authentication, causing the device to reboot into bootloader mode. An attacker could cause a denial-of-service condition or disrupt ovulation tracking and fertility monitoring workflow.

The Mira cloud API accepts the firmware version reported by the companion app as authoritative for a given device, without independently attesting the version from the device itself. An authenticated attacker could submit arbitrary firmware version strings for their own device, allowing them to evade vendor-side vulnerable-fleet analytics, suppress security update prompts to the user, and misrepresent patch-adoption metrics.

A MongoDB driver component could write sensitive configuration information, including a credential used for outbound network connectivity, to application log output in cleartext during routine client initialization. This occurs automatically as part of normal operation and requires no special privileges to trigger. A party able to read the affected application's logs or downstream log-aggregation storage could recover the credential and reuse it to authenticate to the associated network infrastructure. This issue affects confidentiality only.

When the Mira Android app opens in-app WebView content (e.g., shop redirect flows), the user's live session token is appended to the URL as a query string parameter, and a persistent user identifier is included in the WebView's User-Agent header. Both are then transmitted to third-party web properties, referrer logs, and any JavaScript running in the WebView context.