CVE Vulnerability Catalog

In the Linux kernel, the scsi: qla2xxx driver does not validate request_len before reading the vendor_cmd[] array in FC_BSG_HST_VENDOR requests. A caller holding CAP_SYS_RAWIO can submit a short request, triggering out-of-bounds heap reads (KASAN-detectable), mis-selecting a command, or causing a kernel panic.

In the Linux kernel, the qla_nvme_xmt_ls_rsp() function in the scsi: qla2xxx driver frees the uctx structure with kfree() on the error path without first removing it from the fcport->unsol_ctx_head list. This leaves a freed node on the list, so subsequent list_add_tail() and list_del() operations can corrupt the list or cause a kernel panic.

In the Linux kernel, the fcport->unsol_ctx_head list in the scsi: qla2xxx driver is modified from several contexts without a common lock. Concurrent add and delete operations (or two concurrent deletes) can corrupt the list pointers, since the qpair qp_lock cannot serialize this per-fcport list.

In the Linux kernel, the PMU PAI support for s390 lacked allocation of per-CPU data structures for CPUs added via hotplug. Running 'perf stat -e pai_crypto/CRYPTO_ALL/ -- <command>' while a CPU was being brought online caused pai_add() to dereference a NULL pointer and panic the kernel. CPU hotplug support (add and remove) was added to create the required per-CPU infrastructure.

In the Linux kernel, the x86/mm/pat code allocated a page table directly when splitting a large page (__split_large_page()), bypassing the standard page table allocation API. As a result, the page table was never marked as a kernel page table (ptdesc_set_kernel() was not called), so freeing such page tables did not invalidate their IOTLB entries. This can leave stale IOTLB entries for kernel page tables.

In the Linux kernel, the MPTCP receive path can, under unlucky error conditions, recursively call mptcp_data_ready() via a state change and then try to hold the data lock again. The fix breaks this recursion by adding a new flag, exiting early in subflow_state_change(), and flushing the RX queue at reset time.

In the Linux kernel, the MPTCP scheduler may race with subflow socket state changes. Data transmission on the selected socket may fail, and a later release could use mss_now reset to 0 in a divide operation.

In the Linux kernel, the __mptcp_subflow_push_pending() function incorrectly updates copied byte counters when __subflow_push_pending() errors out. This causes a counter mismatch and problems on a later push call.

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to GraphQL query injection in the export-status component. The 'export_id' value is interpolated directly into the GraphQL query string, allowing an attacker to append root-level selections such as schema introspection and send them to the Rapid7 export API using the operator's API key.

The Regesta Smart HD-PLC device from Teldat (model TLDPH16D2) with vulnerable firmware version 11.02.06.00.02 is vulnerable to Cross-Site Scripting (XSS). An attacker with network access (registration required) can inject a specific payload via the 'cmdcookie' parameter in /upgrade/index.html.

The Akia keyless entry cloud service is vulnerable to Insecure Direct Object Reference (IDOR) / missing object-level authorization. The unlock action relies on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could unlock rooms other than their own, resulting in unauthorized physical access to guest rooms at an affected property. As of 19th September 2026 the service is no longer vulnerable to this attack (feedback received by the reporter). The attack is remote but the effect is local to an affected property.

The lazy_html library (versions 0.1.0 through 0.1.13) contains a mutation XSS vulnerability. LazyHTML.to_html/2 and LazyHTML.Tree.to_html/2 decide whether to escape an element's text based solely on its tag name, so style or script elements inside SVG/MathML foreign content are serialized as HTML raw-text elements without escaping. Encoded markup such as &lt;/style&gt;&lt;img src=x onerror=...&gt; inside <svg><style> closes the element on re-parse and becomes live markup.

The cisco_firesight_manager_ACL_rule_export module in misp-modules generates a shell script (.sh) that authenticates to and calls the Cisco fireSIGHT Manager API. The module interpolates configuration values (IP address, login, password, domain ID, policy ID) and MISP attribute values (destination IPs, URLs, event info comments) directly into single-quoted shell string assignments without any escaping or sanitization. Because the values are placed inside single-quoted shell strings, any value containing a single-quote character breaks out of the quoting context, allowing an attacker to inject arbitrary shell commands into the exported script. A security analyst who executes the generated .sh file unmodified would run the injected commands with their own privileges, potentially exposing fireSIGHT Manager credentials, modifying ACL rules, or compromising the analyst workstation. Additionally, the module contained a secondary defect where the variable 'config' was only assigned inside a conditional block but referenced unconditionally afterward, causing a NameError (denial of service) when the request payload lacked a 'config' key.

Apache Qpid Broker-J improperly handles compressed data in the shared GZIP decompressor used for AMQP 0-8/0-9/0-9-1 and AMQP 0-10 message delivery, message conversion, and HTTP management JSON rendering. An authenticated message producer can exhaust memory and disrupt broker availability by processing data without a decompressed-output limit.

Apache Qpid Broker-J is vulnerable to a pre-authentication attack where type nesting can cause a StackOverflowError. This can potentially lead to denial of service.

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.

A vulnerability in Apache Qpid Broker-J (through 10.1.0) allows a pre-authentication attacker to leverage type size/count handling to cause excessive allocation. This can lead to a potential denial of service.

The MasterStudy LMS WordPress plugin from 1.9 before 3.7.50 does not verify that a course a member asks to enrol in is covered by their membership plan, nor that the plan identifier submitted with the request is one they actually hold. This allows any member to enrol themselves into restricted paid courses outside their plan and beyond the number of courses it entitles them to.

The Bookly WordPress plugin before 28.3 does not properly verify a customer's identity before updating their stored details. This allows unauthenticated attackers who know a customer's primary identifier to overwrite that customer's stored personal information such as name, email and address.

The wpForo Forum WordPress plugin from 3.0.0 before 3.1.6 does not verify the source of client-supplied IP address headers before using them to key its per-visitor rate limit on paid AI requests. This allows unauthenticated attackers to bypass the limit by spoofing the header and exhaust the site owner's metered AI credits.