CVE Vulnerability Catalog

In the Linux kernel VEML6075 light sensor driver, a missing bounds check on the `veml6075_it_ms` array index could cause an out-of-bounds access. The index from the configuration register can be 0-7 but the array has only 5 elements. A validation was added returning -EINVAL for invalid values.

In the Linux kernel, the ti-ads1298 ADC driver lacked bounds checking for the pga_settings array index. The ADS1298_MASK_CH_PGA mask can yield values 0-7, but the array has only 7 elements (indices 0-6). Value 7 causes an out-of-bounds read. A bounds check was added, returning -EINVAL for invalid indices.

In the Linux kernel, ksmbd module fails to validate session state in compound requests. An invalid IN_PROGRESS session can be used to trigger a remote NULL pointer dereference, causing a kernel Oops and crashing the SMB server.

A use-after-free (UAF) vulnerability was found in the Linux kernel's virtiofs when unmounting submounts. The issue occurs when iput() called from fuse_release_end() accesses a superblock that has already been destroyed.

In the Linux kernel, the rzv2h-ivc driver had a race condition where `list_del()` was called without holding the spinlock, allowing concurrent modification of the buffer list. This could lead to undefined behavior.

In the Linux kernel, in the DRM driver for AMD GPUs (amdgpu) within the VCE component, a vulnerability was found due to incomplete address patching. When only one part (low or high) of the address is valid, patching may result in writing a bad address to the firmware.

In the Linux kernel, the amdgpu driver has a vulnerability where the GART table is not zero-initialized upon allocation. After writing a single PTE entry, the TLB may speculatively load uninitialized, potentially valid-looking data from the same cache line, which can lead to the GPU using stale PTE entries.

In the Linux kernel, a vulnerability was found in the mmap_prepare mechanism where attempting to unmap a VMA during error handling in the mmap() function can cause warnings and an invalid state. The issue occurs when mmap_prepare is invoked from the mmap() hook of 'stacked' drivers (e.g., overlayfs, shm) because the VMA is not fully established in the maple tree.

A SQL Injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_schoolyr.php. Manipulating the ID argument allows remote SQL injection. The exploit is publicly available.

SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL Injection in the file /edit_subject.php via manipulation of the ID argument. The attack can be performed remotely.

In the Linux kernel, a vulnerability in the UDF filesystem allows udf_read_tagged() to skip CRC verification when the CRC length exceeds the block size. A crafted UDF image can set an oversized CRC length to bypass validation entirely, accepting the descriptor based solely on a weak 8-bit tag checksum.

In the Linux kernel, an inconsistency in the F2FS filesystem was found during fsck due to incorrect use of flags in NAT entries. The issue stems from a lack of mutual exclusion when reading flags by f2fs_need_dentry_mark() relative to the checkpoint path, leading to incorrect inode block marking.

A missing authentication vulnerability was found in simpleui version 2026.01.13 in the self.get_action function of simpleui/admin.py at the AjaxAdmin AJAX endpoint. The issue can be exploited remotely and the exploit has been made public.

A missing authentication vulnerability has been found in Gerapy up to version 0.9.13 in the project upload endpoint within gerapy/server/core/views.py. The attack can be launched remotely and a public exploit is available.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the claw_tool_invoke function of the RPC handler. Incorrect authorization allows remote exploitation without proper privileges. The exploit is public and the project has not responded to the issue report.

QueryWeaver contains an authentication bypass vulnerability allowing unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching identity before checking if the email belongs to an existing account, returning a valid authenticated session token for the victim's identity without requiring prior credentials.

In SourceCodester Class and Exam Timetabling System 1.0, a SQL injection vulnerability exists in the file /edit_room1.php. An attacker can remotely manipulate the ID argument, leading to unauthorized database access. The exploit has been publicly disclosed.

SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_rooma.php file. An attacker can manipulate the ID argument to execute remote SQL queries.

Heap buffer overflow in ProFTPD mod_sftp. An authenticated SFTP user can send a packet with length 0, causing an underflow and buffer overflow, leading to session crash or potentially further consequences.

A security flaw was discovered in zevorn rt-claw up to version 0.2.0, involving server-side request forgery (SSRF). The issue affects the receiver_thread function in the file claw/services/swarm/swarm.c within the http_request component. The attack can be performed remotely, and the exploit has been publicly released.