CVE Vulnerability Catalog

The execute_filter_audio function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

The execute_filter_delta function in archive_read_support_format_rar.c in libarchive before 3.7.5 allows out-of-bounds access via a crafted archive file because src can move beyond dst.

In GNU C Library versions 2.13 to 2.40, when the assert() function fails, it does not allocate enough space for the assertion failure message string and size information, which may lead to a buffer overflow if the message string size aligns to page size.

In GNU C Library versions 2.27 to 2.38, an untrusted LD_LIBRARY_PATH environment variable vulnerability allows attacker-controlled loading of dynamically shared libraries in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions).

In PHP versions 8.1.* before 8.1.31, 8.2.* before 8.2.26, 8.3.* before 8.3.14, uncontrolled long string inputs to the ldap_escape() function on 32-bit systems can cause an integer overflow, resulting in an out-of-bounds write.

In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI with catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from log messages by manipulating the log message.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when requesting an HTTP resource using the DOM or SimpleXML extensions, the wrong content-type header is used to determine the charset when the requested resource performs a redirect.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when receiving headers from an HTTP server, headers missing a colon (:) are treated as valid headers even though they are not. This may confuse applications into accepting invalid headers.

In PHP from 8.1.* before 8.1.32, 8.2.* before 8.2.28, 8.3.* before 8.3.19, 8.4.* before 8.4.5, when user-supplied headers are sent, insufficient validation of end-of-line characters may prevent certain headers from being sent or lead to certain headers being misinterpreted.

Setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. A path traversal vulnerability in PackageIndex is present in setuptools prior to version 78.1.1. An attacker can write files to arbitrary locations on the filesystem.

Vim is an improved version of the Unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. This may lead to the tb_off position within the buffer being out of bounds.

The vulnerability affects the ViewComponent component in Ruby and is related to the earlier CVE-2026-54497. The fix involved calling __vc_reset_render_state! in render_in to clear three instance variables (@__vc_controller, @__vc_helpers, @__vc_request) on every render, preventing a reused ViewComponent::Base instance from leaking the previous request's controller/helpers/request.

Crass's tokenizer did not terminate a bad URL token at a ) that followed an escaped backslash (\\). As a result, Crass consumed more input as part of the bad URL than a spec-compliant browser does. CSS sanitizers that parse untrusted CSS with Crass and re-emit it could be tricked.

In the Linux kernel, in the DRM/XE driver (guc_submit), a race condition around the suspend_pending field was fixed, which could cause assertions and warnings in certain test scenarios.

In the Linux kernel, in the Bluetooth subsystem (hci_conn), the function disable_delayed_work_sync is used instead of cancel_delayed_work_sync, which not only cancels ongoing work but also disables new submissions, which is desirable.

Per-request raw: true was ignored by some read methods, which still ran the configured serializer's load (Marshal by default) on values flagged as serialized — including get_multi, get_multi_cas, get_multi_with_metadata, get_cas and get_with_metadata.

A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

In the Linux kernel's btrfs filesystem, a use-after-free of the block device file occurs in __btrfs_free_extra_devids(). The issue may arise when mounting two btrfs images with the same fsid.

p_token and l_token were checked only for CR, LF and NUL. A token containing spaces added arbitrary meta flags to the command — e.g. changing an item's TTL on a read, creating stub items on a miss, turning a delete into a stale tombstone, or choosing incr's initial value.