CVE Vulnerability Catalog

In the Linux kernel, a vulnerability in Ceph was found where handle_reply() stores a ceph_mds_request pointer in current->journal_info while populating inode and dentry caches. An allocation in this section can trigger direct reclaim, pruning dentries from another filesystem, which may start a JBD2 transaction in ext4. JBD2 misinterprets the Ceph pointer as a journal handle, causing a kernel crash.

In the Linux kernel, the ovpn driver's crypto completion callbacks hold references to the key slot and peer. If the peer reference is released before the callback finishes, it can lead to use-after-free or scheduling an RCU callback after rcu_barrier has run, risking a crash.

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in the default lf.query Python protocol in Google langfun versions prior to 0.1.2 allows remote unauthenticated attackers to execute arbitrary Python code in the context of the host application via crafted prompt inputs that cause the model to generate executable Python expressions evaluated without a sandbox.

In the Linux kernel's SCTP protocol, the COOKIE_ECHO state restoration does not properly validate AUTH fields (RANDOM, HMACS, CHUNKS) originating from peer-controlled cookie bytes. Forged lengths or identifiers can lead to out-of-bounds reads and even a write past a buffer, potentially enabling local privilege escalation.

In the Linux kernel for RISC-V, the ZBB-optimized strnlen loop may read one word past the count boundary when the start address is aligned and count is a multiple of word size. This can cause a page fault if the next page is unmapped.

In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.

In the Linux kernel, ipvlan interfaces do not inherit needed_headroom and needed_tailroom from the physical device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, macvlan interfaces do not inherit needed_headroom and needed_tailroom from the lower device, which can lead to insufficient space reservation for headers and trailers. This results in buffer overflows, headroom underflows, or KASAN slab-use-after-free crashes.

In the Linux kernel, the am65-cpsw-nuss driver has a bug in extracting the port ID from the source tag. It uses the full 16 bits, while only the lower 8 bits represent the port ID, which can lead to out-of-bounds memory access and system crash.

Kyverno, a policy engine for cloud native platform engineering teams, from 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to invoke generator.apply(namespace, resources) with an arbitrary target namespace. The validation in pkg/cel/policies/mpol/validate.go checks that the policy compiles but does not enforce namespace scope, and GenerateResources in pkg/cel/libs/context.go does not reject the cross-namespace target. A user who can create NamespacedMutatingPolicy objects in one namespace can cause the admission controller, operating with cluster-wide privileges, to create ConfigMaps, NetworkPolicies, Secrets, RoleBindings, and other resources in another namespace, enabling unauthorized modification and potential privilege escalation. This issue is fixed in version 1.18.2.

Use of Hard-coded Credentials vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows Try Common or Default Usernames and Passwords. This issue affects Liderahenk before 3.5.5.

An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters. This vulnerability was patched on 1 May 2026, and no customer action is needed.

The getgrav/grav-plugin-api plugin before 1.0.18 does not enforce API-key scope in the requireNotSuperTarget() function in UsersController.php across seven sensitive user-management endpoints. The check uses isSuperAdmin() on the acting account rather than verifying whether the specific API key carries super authority (via isSuperWithinScope()). As a result, an API key scoped below full super authority but belonging to a super-admin account can act against other super-admin accounts—disabling their 2FA, deleting their avatar, minting new API keys under their identity, or deleting their existing API keys.

An attacker with network access could exploit an Improper Access Control vulnerability in UniFi Protect AI Key to escalate privileges on the device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Talk Application to execute a Command Injection on the host device.

An attacker with network access and low privileges could exploit an Improper Access Control vulnerability in UniFi Access Application to escalate privileges on the host device.

An attacker with network access could exploit an Improper Input Validation vulnerability in UniFi Enterprise Audio/Video Bridge to execute a Command Injection on the device.

An attacker with network access and under certain conditions could exploit an Improper Access Control vulnerability in UniFi Connect Display Cast Pro to escalate privileges on the device.

An attacker with network access could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.

An attacker with network access and under certain conditions could exploit an Improper Neutralization of CRLF Sequences vulnerability in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances.