CVE Vulnerability Catalog

In the Linux kernel, the irqchip/sifive-plic driver has a vulnerability causing interrupt freezing. The issue occurs when changing interrupt affinity while a hart is still handling the interrupt, leading the PLIC controller to ignore the completion message. This results in a complete stall of interrupts for the affected device.

In the Linux kernel, a vulnerability was found in the mtk_eth_soc driver where the eBPF program pointer in mtk_xdp_setup() is not reset to old_prog on error in mtk_open, and its ref-count is incorrectly decreased.

Open Redirect vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administrator: from 10.2.0 before 11.0.8.

A logic issue in Safari and Apple systems was fixed with improved state management, preventing malicious websites from accessing script message handlers intended for other origins. The patch is included in Safari 26.4, iOS 18.7.7, iPadOS 18.7.7, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

A vulnerability in Safari and related Apple system components allows a malicious website to process restricted web content outside the sandbox. The issue was addressed with improved memory handling.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was addressed with improved memory handling. The fix is included in Safari 26.4, iOS 26.4 and iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

An authorization issue was addressed with improved state management. Fixed in macOS Sequoia 15.7.4, macOS Sonoma 14.8.4, and macOS Tahoe 26.3. An app may be able to access sensitive user data.

A vulnerability in WebKit may lead to an unexpected process crash when processing maliciously crafted web content. The issue was fixed by improving memory handling in Safari 26.4, iOS 26.4, iPadOS 26.4, macOS Tahoe 26.4, and visionOS 26.4.

SSH misconfiguration in Tenable OT allows potential exfiltration of socket, port, and service information via the ostunnel user and GatewayPorts. This could be used to glean information about the underlying system and attempt to compromise the host.

In Vim prior to version 9.2.0202, a command injection vulnerability exists in the glob() function on Unix-like systems. By including a newline character (\n) in a pattern passed to glob(), an attacker may execute arbitrary shell commands. This depends on the user's 'shell' setting.

The Zabbix Agent 2 Docker plugin does not properly sanitize the 'docker.container_info' parameters when forwarding them to the Docker daemon. An attacker capable of invoking Agent 2 can read arbitrary files from running Docker containers by injecting them via the Docker archive API.

An unauthenticated attacker can exploit the Frontend 'validate' action to blindly instantiate arbitrary PHP classes. The impact depends on environment setup but appears limited at this time.

For performance reasons Zabbix Server/Proxy reuses JavaScript (Duktape) contexts in script items, JavaScript reprocessing, and Webhooks. This can lead to confidentiality loss where a regular (non-super) Zabbix administrator leaks data for hosts they do not have access to. A fix has been released making built-in Zabbix JavaScript objects read-only, but usage of global JavaScript variables is not recommended.

CVE-2026-32642 describes an incorrect authorization vulnerability in Apache Artemis and Apache ActiveMQ Artemis, allowing an authenticated user with 'createDurableQueue' permission to create a non-durable JMS subscription on a non-existent address, despite lacking 'createAddress' permission. Consequently, a temporary address is created, which should not occur.

Action Pack is a Rubygem for building web applications on the Rails framework. In versions on the 8.1 branch prior to 8.1.2.1, the debug exceptions page does not properly escape exception messages. A carefully crafted exception message could inject arbitrary HTML and JavaScript into the page, leading to XSS. This affects applications with detailed exception pages enabled (`config.consider_all_requests_local = true`), which is the default in development. Version 8.1.2.1 contains a patch.

A Cross-Site Scripting (XSS) vulnerability in Znuny::ITSM 6.5.x in the customer.pl endpoint via the OTRSCustomerInterface parameter allows an attacker to inject malicious scripts.

A vulnerability in the BFD library of GNU Binutils fails to validate relocation type values in crafted XCOFF files, leading to out-of-bounds memory reads. This can cause tool crashes or memory content disclosure.

Missing authentication in the /goform/ate endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows an adjacent unauthenticated attacker to retrieve sensitive device information, including the administrator password. An attacker can decode this value to obtain valid administrative credentials and authenticate to the device.

The esaml library (and its forks) has an XXE vulnerability. Before signature verification, esaml parses attacker-controlled SAML messages using xmerl_scan:string/2 without disabling XML entity expansion. On Erlang/OTP before version 27, Xmerl allows entities by default, enabling pre-signature XXE attacks. An attacker can read local files (e.g., Kubernetes secrets) and include their contents in the SAML document.

Versions of the jsrsasign package before 11.1.1 are vulnerable to division by zero, potentially leading to incorrect RSA public-key operations. An attacker can force these operations to return predetermined zero outputs, hiding 'invalid key' errors.