CVE Vulnerability Catalog

In the Linux kernel, the ab8500_fg driver's ab8500_fg_remove() destroys the workqueue while threaded interrupt handlers are still armed. A handler firing in that window queues work on the freed workqueue, causing a use-after-free. The fix tears down the workqueue through devm, registering its cleanup after the power supply and before the interrupt requests.

A vulnerability in the Linux kernel's DAMON module can cause an infinite loop in kdamond_merge_regions(). The issue stems from integer overflow when doubling the merge threshold if the maximum threshold exceeds UINT_MAX/2. The loop break condition is checked after doubling, which can bypass the safeguard under specific conditions and hang the system.

A vulnerability in the Linux kernel PCI subsystem affecting s390 systems using a machine-level hypervisor has been resolved. The shared pci_slot assignment for multifunction devices caused the hotplug driver to reset the wrong function and leak memory. A flag was added to allow per-function PCI slots for hypervisor-managed functions.

In the Linux kernel, ksmbd compound response handling extends the last response iov to an eight-byte boundary. smb2_read_pipe() allocates only the payload size, so the alignment padding can expose up to seven bytes of uninitialized kernel heap memory. The fix allocates the aligned size and clears the unused tail before pinning the response buffer.

The lack of signature verification of firmware update packages in VEO and VEO-XS Wi-Fi monitors prior to version 01.48.001 allows an attacker who controls the delivery of an update to install unauthorized firmware.

VeloCloud Edge and Gateway exhibit an out-of-bounds write vulnerability when processing tunneled IP fragments between authenticated overlay neighbors. This affects only the VeloCloud VCMP tunnel protocol. A successful exploit can cause the affected process to terminate and restart, leading to temporary traffic disruption.

An unauthenticated actor with network access to the private HA interconnect may trigger sensitive HA peer functions without verification. This could result in elevated command execution on Edge units where HA is enabled.

Kong API Gateway Enterprise has a JWT signature verification vulnerability in MCP OAuth2 and DataKit components. Improper validation of the signing algorithm allows an unauthenticated attacker to craft a forged JWT that is incorrectly accepted as valid.

In the Linux kernel, ublk_ch_mmap() rejects mmap requests with VM_WRITE set but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(). The command buffer holds kernel-written struct ublksrv_io_desc entries, so a writable mapping lets an unprivileged daemon process corrupt fields such as addr, op_flags, nr_sectors, and start_sector.

Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's extra field into Python callables via import_string, with no allowlist, and hand them to the confluent-kafka client which invokes them. Deployments with the Kafka event producer enabled build that client inside the scheduler process, so a user whose only privilege is editing Airflow connections gains arbitrary code execution in the control plane. Deployments using Google Managed Kafka are not affected because that code path overwrites any user-supplied oauth_cb.

Lack of TLS certificate validation when downloading firmware updates in VEO and VEO-XS Wi-Fi monitors (versions prior to 01.48.001) allows an attacker to perform man-in-the-middle attacks on the update channel.

Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a token that the same Authentik identity provider minted for a different client application can present it to Airflow and be authenticated as the user it names, because the audience claim is never checked. Affects deployments using the FAB auth manager with Authentik OAuth where the same Authentik instance also serves other applications.

The DuoxMe application for Android in versions prior to 4.3.4 stores sensitive information in cleartext. An attacker with local access to the device can retrieve credentials stored by the application and impersonate the user account.

Transmission of home Wi-Fi credentials without encryption during the pairing process between the DuoxMe application and VEO and VEO-XS Wi-Fi monitors (versions prior to 4.3.4 of the app and 01.50.001 of the monitor firmware) allows an attacker on the Wi-Fi Direct network to intercept the network password.

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensemble", ...) request containing newline characters. The ensemble name is not sanitized before being logged, allowing the attacker to forge log entries indistinguishable from genuine ones.

When audit logging is enabled, an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's audit log by sending a digest authentication request with tab characters in the username. The injected tabs are parsed as field separators, allowing the attacker to spoof audit results and operations.

In Apache Airflow FAB provider, deactivating a user account does not invalidate previously issued tokens. These tokens remain valid and can be used to gain access even after the account is deactivated by an administrator.

In Apache ZooKeeper, the deleteContainer opcode (0x14/20) is processed without verifying ACL permissions, allowing any authenticated client to delete empty persistent, container, and TTL nodes even without proper permissions. This is an authorization bypass and ACL enforcement bug.

On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The agent is automatically restarted, but repeated attacks can cause continuous restarts and a sustained denial of service.

In Apache Airflow Keycloak provider, the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. The lack of an allowlist allows credentials of another application to be valid Airflow login credentials.