CVE Vulnerability Catalog

In the Linux kernel for PowerPC, redundant preempt_disable()/preempt_enable() calls were removed from arch_irq_work_raise(). They caused a kernel panic when handling machine check exceptions (MCE) in real mode, as accessing the preempt_count in this context is invalid.

In the Linux kernel, the lm90 driver's lm90_alert() function lacks proper locking when modifying configuration registers in the SMBus alert context. Concurrent sysfs writes can overwrite these changes, re-enabling the alert line and causing an interrupt storm.

In the iwlwifi driver (Linux kernel), the function iwl_mld_remove_link() dereferences the link pointer before checking for NULL, potentially causing a memory access violation.

In the Linux kernel's SRCU mechanism, during a state transition from CPU-0 to all-CPUs, workqueue handlers may be queued on CPUs that have never been online, causing hangs on s390 systems.

Reflected XSS vulnerability in Polen Media Software and Information Services Website Template before v2 due to improper input neutralization during page generation.

Vulnerability in Zephyr's ext2 file system allows a DoS attack via a crafted ext2 image. The superblock validator does not check if s_blocks_per_group and s_inodes_per_group are non-zero, leading to division by zero during mount. On ARMv7-M/ARMv8-M platforms, this causes a fatal error and denial of service.

Path traversal vulnerability in the Datasets library up to version 5.0.0. The file_name metadata field is not properly validated before being joined to the dataset directory, allowing attackers to read arbitrary local files using '../' sequences.

Vulnerability in lakeFS up to version 1.83.0 allows authentication bypass in the /setup_comm_prefs endpoint. Unauthenticated attackers can overwrite operator metadata including email, name, and company, and modify security update preferences.

Vulnerability in Jan up to version 0.8.4 due to a CORS misconfiguration in the local API server. The server replaces trusted hosts with a wildcard, allowing network-adjacent attackers to access the unauthenticated OpenAI-compatible API.

Path traversal vulnerability in BlenderMCP before commit 30a3308 in the download_polyhaven_asset method. Attackers can inject '../' sequences in API response include keys, allowing arbitrary file overwrite.

Vulnerability in the SNMP agent in Loytec devices (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64. Unchecked input for loop condition (CWE-606) allows an unauthenticated remote attacker to cause persistent denial of service via a crafted SNMP GETNEXT request with a large OID component.

In Apache HBase, the thrift and REST services lack owner authorization in scanner fetch and close operations. A user can fetch rows from scanners opened by other users and close scanners belonging to others, breaking data isolation.

In the keycloak-services library, the core component of the Keycloak identity and access management solution, the role-users endpoint fails to check if an administrator has permission to view individual users when listing role members. A restricted administrator can see private information, such as names and email addresses, of users they should not be able to access.

In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature stores secret values in cleartext on disk when no vault is selected. A local attacker with file system access can read these secrets.

Improper access control in automation tests and workflows features of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with Reader role can execute automation tests and modify workflow properties due to missing server-side authorization.

Sensitive information disclosure in the automation jobs API of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with job or script read permission can obtain another user's OAuth refresh token via API responses that fail to strip the token.

In the Keycloak Admin REST API, used to manage security realms and clients, when processing requests for rotated client secrets stored in a secure vault, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder. This occurs due to improper boundary enforcement, leading to exposure of sensitive credentials.

In AVESİS by ABIS Technology Ltd. Co., there is a vulnerability of external control of an assumed-immutable web parameter, allowing access to functionality not properly constrained by ACLs. This affects AVESİS versions before 202606251646.

DOMPurify before version 3.4.12 fails to execute the afterSanitizeElements hook for custom elements allowed via CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into innerHTML sinks, creating second-order XSS gadgets.

Parse Server versions from 9.0.0 before 9.10.0-alpha.5 and from 8.2.2 before 8.6.86 return GraphQL validation error messages that name required custom input fields even when public introspection is disabled (graphQLPublicIntrospection: false, the default). A client holding only the public application ID, with no user session, master key, or maintenance key, can trigger validation errors to learn the names of required custom fields on classes it already references by name, partially defeating the schema-hiding intent of disabling public introspection. No stored data, credentials, optional field names, unreferenced class names, or Cloud Code function names are exposed.