CVE Vulnerability Catalog

An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows a remote attacker to obtain sensitive information via the global API request wrapper function.

An issue in the VMware datastore driver of OpenStack glance_store. When an authenticated attacker provides a maliciously crafted image location URI pointing to an external server, the _retry_request function fails to validate the destination host before attaching sensitive authentication headers.

A Server-Side Request Forgery (SSRF) vulnerability exists in the Image API (v2) of OpenStack Glance. When the show_multiple_locations configuration option is enabled in glance-api.conf, an authenticated attacker can manipulate the locations attribute of an image in the queued state by sending a crafted HTTP PATCH request.

D-Link DAP-2610 up to 2.06B08r099 contains an authenticated command injection vulnerability within the web interface at the /index.xgi endpoint. An attacker with authenticated access can exploit some parameters to execute arbitrary system commands.

This CVE ID has been rejected. It is a reservation duplicate of CVE-2026-62062. All references and descriptions have been removed to prevent accidental usage.

In the Linux kernel, the wifi mt76 (mt7921) driver lacks validation of CLC firmware records. The loader trusts the region count and each record length, so a malformed image can make the region table pointer precede the firmware buffer, make the record loop fail to advance, or index phy->clc past its end.

In the Linux kernel, a vulnerability in ppp_async causes the error path to zero the skb headroom, violating the NET_SKB_PAD guarantee. As a result, a subsequent frame can be processed without the required headroom, leading to a kernel panic (skb_under_panic) or an out-of-bounds read when CCP compression is enabled.

In the Linux kernel, the EDAC/device_sysfs poll_msec sysfs store file uses simple_strtoul(), which accepts an unsigned long, while the target field poll_msec is an unsigned int. On 64-bit systems, a value greater than UINT_MAX is silently truncated when stored.

In the Linux kernel, the drm/virtio (virtio-gpu) driver on Xen PV domains incorrectly decides whether to use the DMA API by looking only at the VIRTIO_F_ACCESS_PLATFORM feature bit. Because QEMU does not set iommu_platform on virtio-vga by default, virtio_gpu_object_shmem_init() describes the framebuffer's backing pages to the host using sg_phys() with guest-physical addresses, which in a PV domain resolve to pages belonging to another domain.

In the Linux kernel, the accel/qaic driver's resp_worker() skips the bounds checking present in decode_message(), which can lead to reading past the end of a slab allocation, infinite loops, or kernel panics. A malformed wire message sent from the device is required for these issues to occur.

In the Linux kernel, the nvme-rdma driver's queue_rq path on -EIO reports a host path error and then still cleans up the command and unmaps the SQE DMA. Because the path error helper completes the request, this results in double cleanup and DMA unmap after the request is already complete.

In the Linux kernel, nvme_query_fdp_info() is called per-path and populates head->nr_plids/head->plids for FDP registration, but nothing protects that pair from concurrent access. Two paths scanning the same namespace can race to populate it.

In the Linux kernel, the nvmet-rdma module has a resource leak. When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources.

A bug exists in the Linux kernel BPF verifier regarding speculative pointer arithmetic. When processing a pointer addition (r0 += r1), the register state is snapshotted while var_off and the 32-bit range are out of sync, triggering a register invariants violation warning. The issue affects unprivileged programs and was fixed by moving the __mark_reg32_unbounded() call after sanitize_ptr_alu().

In the Linux kernel, the BPF subsystem's bpf_map_check_op_flags() compares the CPU ID against num_possible_cpus() instead of nr_cpu_ids and cpu_possible(). With sparse CPU IDs (e.g. mask 0,2-3), invalid CPU 1 is accepted while valid CPU 3 is rejected, leading to a kernel paging fault and panic.

In the Linux kernel, the BPF subsystem's per-CPU map update paths (array, hash, cgroup storage) without BPF_F_CPU or BPF_F_ALL_CPUS use the logical CPU ID to compute the buffer offset instead of a dense offset. With sparse CPU IDs (e.g. mask 0,2-3), this causes incorrect per-CPU values and an out-of-bounds read from the update buffer for CPU3.

In the Linux kernel, the drm/gud driver does not validate that the GUD_ROTATION_0 flag is present in the device's supported rotation bitmask. A device that omits this bit from GUD_PROPERTY_ROTATION triggers the WARN_ON in drm_plane_create_rotation_property().

In the Linux kernel, the printk subsystem incorrectly uses WARN_ON() to catch kthread_run() failure, since __kthread_create_on_node() returns -EINTR upon SIGKILL. This causes spurious kernel warnings under normal conditions.

In the Linux kernel, the accel/amdxdna driver's struct amdxdna_cmd_chain contains a flexible array annotated with __counted_by(command_count). Since the structure is stored in shared AMDXDNA_BO_SHARE memory, userspace can concurrently change command_count to zero, causing the bounds check to fail and triggering a kernel panic.

In the Linux kernel, the accel/amdxdna driver allows a command chain with command_count zero to pass the payload length check, and the fill loop does not run. On firmware without AIE2_NPU_COMMAND the request is rejected, but on firmware with aie2_get_npu_chain_msg_op() it reaches drm_clflush_virt_range(cmd_buf, 0), reading the byte before the buffer and faulting on the vmap guard page.