CVE Vulnerability Catalog

Prior to version 8.0.0, the x/bonds module of the ixo Blockchain moved funds from an address resolved from a DID verification method without verifying that the resolved address belonged to the transaction signer. An attacker could register victims' addresses as verification methods on their own DID and move victims' balances into an attacker-controlled bond, later withdrawing and bridging the proceeds off-chain. This was exploited on ixo mainnet (ixo-5) on 2026-06-20 and fixed in v8.0.0.

In Python Social Auth prior to version 5.0.0, the partial-pipeline resume mechanism accepted partial_token as a bearer credential without binding it to the browser session that created it. Applications using resumable partial pipeline steps could allow an attacker to start an authentication flow and cause a victim's browser to resume that attacker-controlled flow.

Python Social Auth prior to version 5.0.0 in the vk-app backend accepts VK callback data without verifying the signature when the auth_key parameter is omitted. An attacker can send unsigned attacker-controlled data and authenticate as an arbitrary VK user. The issue affects only applications using the vk-app backend. The fix in version 5.0.0 requires auth_key to be present and valid.

In Python Social Auth prior to version 5.0.0, the LoginRadius backend did not validate OAuth state during the authentication flow. Applications using this backend were vulnerable to login CSRF, and an attacker could cause a victim's browser session to complete authentication using an attacker-controlled LoginRadius token.

In Python Social Auth prior to version 5.0.0, the Vend OAuth2 backend used only the numeric Vend user_id as the social-auth UID. When multiple Vend shops authenticate through the same application, users from different shops with the same internal Vend user ID could collide in the social-auth association table.

In Python Social Auth prior to version 5.0.0, the SAML backend accepted SAML responses on the Assertion Consumer Service endpoint without verifying that they matched a previously issued AuthnRequest. Applications using SAML account association could allow an attacker with a valid account on a trusted IdP to link the attacker's SAML identity to a logged-in victim's local account.

In Habitica from 4.172.1 until 5.48.2, a query parameter on the /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes.

In the Linux kernel, a vulnerability in gfs2 was fixed: gfs2_quota_init() checks for duplicate quota_change IDs while holding qd_lock and the quota hash bucket bitlock. That path used gfs2_qd_search_bucket(), which takes a lockref reference via lockref_get_not_dead(). On PREEMPT_RT this may sleep, which is not allowed under the bucket bitlock, triggering 'sleeping function called from invalid context'. The fix uses a no-ref bucket lookup in this path and continues duplicate handling without taking a lockref there. It refactors gfs2_qd_search_bucket() to build on top of the no-ref helper so lookup traversal stays in one place.

In the Linux kernel, a vulnerability in gfs2 was fixed: moved qc++ from the loop body into the for-loop increment expression in gfs2_quota_init(). This keeps iterator progression explicit and avoids mixing pointer advance with duplicate-slot handling in the loop body.

In the Linux kernel, a vulnerability in drm/xe was fixed: in xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot was never fully populated (e.g., when cleanup is triggered without a prior capture). Guard the xe_guc_capture_put_matched_nodes() call with IS_ERR_OR_NULL() to prevent a null dereference. In xe_devcoredump_free(), the deferred work is only queued when a coredump is captured, so guard cancel_work_sync() with a check on coredump->captured.

In the Linux kernel, a vulnerability in cfg80211 was fixed: rejecting duplicate entries in wiphy->cipher_suites. Duplicates do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. The WEXT compatibility code appends a WEP key length for each WEP cipher entry, which can overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE. The fix rejects duplicate cipher suite entries in wiphy_register(), causing malformed wiphy descriptions to fail early with -EINVAL.

In the Linux kernel, a vulnerability in nl80211 was fixed: rejecting beacons with bad HE operation. The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. This is now checked.

In the rtw88 driver, a NULL pointer dereference occurs in rtw_fw_adaptivity_result(). On devices with the 8821CE chip that do not define the edcca_th field, the kernel triggers an oops. The fix adds a NULL check before dereferencing, preventing the crash.

In the i3c svc driver on NPCM845, a false SLVSTART event causes an interrupt storm. After emitting a STOP condition, the controller reports a new event, creating a loop that can lock up the CPU. The fix clears the SLVSTART status bit explicitly after the STOP, breaking the loop.

In the chips-media wave5 driver, a lock issue is detected in handle_dynamic_resolution_change. The call in initialize_sequence does not properly acquire the lock. Additionally, v4l2_ctrl_find and s_ctrl can sleep, so they should not be called while holding the lock. The fix stores the fbc_buf_count value and updates the control after the lock is released.

In the chips-media wave5 driver, a use-after-free risk occurs when removing an instance from the list. The IRQ thread may acquire the spinlock between m2m_ctx release and removal, leading to a null pointer dereference.

In the Qualcomm QSPI SPI driver, incomplete error handling in runtime PM was found. During suspend or resume, the system could be left in an inconsistent state, leading to clock/power imbalances. The fix reorders operations and adds proper error checking with cleanup.

In the mac80211 module, an out-of-bounds access is detected in the function adding the radiotap header for monitoring in NAN mode. When the band is set to NUM_NL80211_BANDS, accessing the sbands array causes an error. The fix avoids accessing the array when the band is invalid.

In the Thunderbolt driver, a memory leak is found in __tb_xdomain_response(). When tb_cfg_request() fails and returns an error, it does not call the callback, leading to memory leak. The fix calls tb_cfg_request_put() on failure.

In the Thunderbolt driver, there is a missing reference to XDomain during the service's lifetime. Since the service ID is released in tb_service_release() and the ID array is owned by the parent XDomain, a use-after-free risk exists. The fix keeps the reference.