CVE Vulnerability Catalog

An issue was discovered in Denx U-Boot before 2026.04. An integer overflow vulnerability in the ZFS filesystem support can be triggered by malformed on-disk metadata. The issue may result in incorrect memory allocation followed by out-of-bounds memory access, potentially leading to a crash or arbitrary code execution during the boot process.

DWSurvey v6.14.0 is vulnerable to authentication bypass via the '/api/dwsurvey/none/' and '/api/dwsurvey/up/**' parameters.

Dell Cloud Disaster Recovery versions 20.2 and prior contain an OS Command Injection vulnerability. A high privileged attacker with remote access could exploit this to execute commands.

An issue in TokTok qTox v1.18.4 allows a local attacker to cause a denial of service via the src/persistence/serialize.cpp component.

A Predictable Resource Name vulnerability in BigQuery Import Staging in Google Cloud Vertex AI Search for Commerce prior to 2026-04-27 allows an attacker knowing the victim's project number to obtain read/write access to staged data and error logs using predictable bucket names.

An arbitrary file upload vulnerability in the /v1/my_drive/batch_upload component of cohere North AI v1.1.5 allows attackers to execute arbitrary code via uploading a crafted file.

Cohere North AI v1.1.5 was discovered to contain excessively permissive cross-domain policy with untrusted domains. This occurs via the server failing to validate the Origin header of incoming connection requests.

Bird Home Automation GmbH D1101V-F 000140 is vulnerable to incorrect access control in the key derivation process and password validation process.

NebulaGraph exposes its runtime configuration over an unauthenticated HTTP service. This service allows reading and writing gflags, enabling an attacker to change daemon behavior without restart.

ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and triggering deserialization via the Shibboleth back-channel logout endpoint. Attackers can write arbitrary serialized objects into session storage, then exploit an available POP gadget through the logout endpoint's unrestricted deserialization to write attacker-controlled PHP content to a web-accessible path and achieve remote code execution as the web server user.

SENAITE.CORE, the core framework for the SENAITE laboratory information management system, contains a vulnerability allowing unauthenticated remote code execution. Missing authorization in JSON API routes and unsafe use of eval() on input data enable an attacker to execute arbitrary Python code.

A vulnerability in the Linux kernel block subsystem was found where the timeout timer is not stopped when releasing a disk that was never added (e.g., after a failed probe). This leads to a use-after-free in the timer mechanism, potentially causing system crashes or privilege escalation.

In the Linux kernel's MPTCP module, a vulnerability was found due to lack of rejection of mutually exclusive incoming MPTCP suboptions. An attacker can send a packet with a combination of suboptions that according to RFC 8684 cannot coexist, potentially leading to unexpected network stack behavior. The fix introduces validation consistent with outgoing rules, ignoring invalid combinations.

In the Linux kernel's MPTCP module, a remote peer can send a malformed DSS with an incorrect size, causing the first suboption to be ignored but leaving some fields written, potentially leading to inconsistency or access to uninitialized data. The fix explicitly resets fields that could have been modified in case of unexpected size.

In the Linux kernel's MPTCP module, mptcp_fastopen_subflow_synack_set_params() set the is_mptfo flag before checking for queued SYN data. This caused data-less TFO SYNs to trigger a WARN and leave stale MPTFO state, potentially leading to a state-confusion bug in check_fully_established(). The fix marks the subflow as MPTFO only after confirming that an SKB was queued.

In the Linux kernel, the decode_locker() function in cls_lock_client.c contains three unsafe decode operations that allow a malicious or compromised OSD to trigger slab-out-of-bounds reads. Missing bounds checks before copying the name, an unchecked pointer advance, and an uncapped length value can lead to memory corruption. The fix replaces unsafe operations with safe variants and returns -EINVAL on any bounds violation.

In the Linux kernel, libceph may use invalid OSD indices from primary_temp in a corrupted osdmap, leading to out-of-bounds reads. The fix adds validation of indices in get_temp_osds().

In the Linux kernel, libceph's decode_watchers() lacked a bounds check before reading a 32-bit value, leading to an out-of-bounds read when struct_len=0. The fix uses the safe variant ceph_decode_32_safe.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is no limit on the number of channel program segments. Processing is recursive, which can lead to exceeding the global limit and potential issues.

In the Linux kernel, in the s390/vfio_ccw subsystem, there is a lack of verification that the first IDAW remains constant between reads. This can lead to an inconsistent set of IDAWs.