CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's ip6gre_header() function in the ip6_gre driver. The bug causes a kernel panic (kernel BUG) due to insufficient skb headroom, which can be exploited by an attacker to crash the system.

A reference count leak was discovered in the Linux kernel when deleting nexthop objects for IPv4 error routes (e.g., blackhole). Error routes were not flushed with the dead nexthop, keeping references on the nexthop object and device, preventing their release.

A race condition in the Linux kernel's MPTCP implementation during simultaneous connection setup leads to an inconsistent fallback status, triggering a WARNING and potential system crash.

A deadlock was discovered in the Linux kernel between nfc_unregister_device and rfkill_fop_write due to inverted lock ordering of device_lock and rfkill_global_mutex, causing thread blockage.

W jądrze systemu Linux zidentyfikowano podatność, która prowadziła do zakleszczenia podczas odczytu tabeli partycji z urządzenia blokowego ublk. Problem występował, gdy proces próbował uzyskać dostęp do urządzenia blokowego, co prowadziło do sytuacji, w której ten sam proces czekał na mutex, który już posiadał.

The Vanilla OS 2 Core image v1.1.0 from fabricators Ltd was found to contain static SSH keys, allowing attackers to perform a man-in-the-middle attack during connections with other hosts.

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response with Access-Control-Allow-Credentials: true. This enables malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me, exposing sensitive user session data.

A stack-based buffer overflow vulnerability in the mcp2200gpio utility in TinyOS versions up to and including 2.1.2. It is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.

The D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition.

W Angularze, platformie do tworzenia aplikacji webowych, zidentyfikowano podatność typu cross-site scripting (XSS) w kompilatorze szablonów. Problem wynika z niewłaściwego rozpoznawania atrybutów href i xlink:href w elementach SVG <script> jako kontekstu URL zasobów. Został on naprawiony w wersjach 19.2.18, 20.3.16, 21.0.7 oraz 21.1.0-rc.0.

Foomuuri contains an improper authorization vulnerability that allows arbitrary users to influence the firewall configuration. This issue affects versions before 0.31.

An improper neutralization of argument delimiters in a command (Argument Injection) vulnerability allows local users to perform arbitrary unmounts via the smb4k mount helper.

Asseco ADMX system is used for processing medical records. It allows logged-in users to access medical files belonging to other users through manipulation of GET arguments containing document IDs. This issue has been fixed in version 6.09.01.62 of ADMX.

Parsl prior to version 2026.01.05 contains a SQL Injection vulnerability in the parsl-visualize component. The application constructs SQL queries using unsafe string formatting (Python % operator) with user-supplied input (workflow_id) directly from URL routes. This allows an unauthenticated attacker with access to the visualization dashboard to inject arbitrary SQL commands, potentially leading to data exfiltration or denial of service against the monitoring database.

Asseco InfoMedica stores all users' passwords in a database in an encoded format. An attacker in possession of these encoded passwords can decode them using an algorithm embedded in the client-side part of the software. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. A low privileged user is able to obtain encoded passwords of all other accounts (including main administrator) due to lack of granularity in access control. Chained exploitation of this vulnerability and CVE-2025-8307 allows an attacker to escalate privileges. This vulnerability has been fixed in versions 4.50.1 and 5.38.0.

CoreShop prior to version 4.1.8 contains a blind SQL injection vulnerability that allows an authenticated administrator-level user to extract database contents using boolean-based or time-based techniques. The database account used by the application is read-only and non-DBA, limiting impact to confidential data disclosure only. No data modification or service disruption is possible.

The Easy Media Download WordPress plugin versions up to and including 1.1.11 is vulnerable to Reflection Injection due to improper neutralization of script-related HTML tags (Basic XSS). This could allow injection of malicious JavaScript.

The Flaming Password Reset WordPress plugin has a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This affects all versions up to and including 1.0.3.

The Effect Maker plugin (up to version 1.2.1) contains a DOM-Based XSS vulnerability due to improper neutralization of input during web page generation. This allows an attacker to execute malicious scripts in the context of the victim's browser.