CVE Vulnerability Catalog

In the Linux kernel, the ip6ip6_err() function clones an outer IPv6 ICMP error skb and passes it to icmpv6_send() without clearing the outer packet's metadata in skb->cb. This can lead to out-of-bounds access on the quoted inner packet and corruption of skb_shared_info.

A vulnerability was found in the Linux kernel's __filemap_add_folio() function in mm/filemap. During retries of inserting a folio into the xarray, the index was not restored to its original value, potentially placing the folio at an incorrect (rounded-down) index. This caused rare SIGILL and SIGSEGV errors in production, as executable text was found in the wrong page.

In the Linux kernel, the SCTP protocol has a bug where a chunk's transport pointer is not updated when moved to another transport's list. This can lead to use-after-free when the transport is removed and the pointer becomes stale. The fix sets chunk->transport during the move.

In the Linux kernel, the SCTP protocol has a use-after-free vulnerability in the ASCONF mechanism. The cached ASCONF chunk is not properly cleared after release, leading to access to stale memory. The fix clears the addip_last_asconf pointer after release and protects against a race with T4 expiry.

A use-after-free vulnerability was found in the Linux kernel's SCTP subsystem. An authenticated remote SCTP peer can add and remove a transport within a single ASCONF chunk, leaving the new_transport pointer dangling. Subsequent operations (e.g., sending a HEARTBEAT) may read freed memory, as shown by a KASAN report in sctp_outq_select_transport.

The WS Form LITE plugin for WordPress up to version 1.10.80 is vulnerable to PHP Object Injection via deserialization of untrusted input from form submission meta values. An unauthenticated attacker can inject a PHP object, but impact is limited unless a POP chain is present via another plugin or theme.

The Joomla extension Fabrik before version 4.7.2 contains a heredoc terminator breakout vulnerability in the calc element. Additionally, the onUpdateComment endpoint did not perform any access checks.

Joomla extension Fabrik before 4.7.2 has a missing ACL check in the download element, potentially allowing unauthorized file access.

Joomla extension Fabrik before 4.7.2 is vulnerable to Path Traversal via the image element, potentially allowing access to files outside the application directory.

Joomla extension Fabrik before 4.7.2 allows remote code execution via the image element.

Joomla extension Fabrik before 4.7.2 has an unauthenticated remote code execution vulnerability via the PHP form element, which executes user-provided code.

Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in ORDER BY, as the order parameter in list models is used in queries without validation, allowing read SQLi vectors.

Joomla extension Fabrik before 4.7.2 has an unauthenticated SQL injection in the list filter condition parameter, as the condition parameter is concatenated verbatim into the WHERE clause built by getFilterQuery(), allowing full database read.

In the Punk library for Perl before version 0.18, there is a session cookie forgery vulnerability. When a session is declared without a secret, the default HMAC key is empty, allowing an attacker to mint cookies with arbitrary contents such as user ID or role.

Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. A client registered for authorization_code alone can request client_credentials, and the requested scope is signed into the token without comparison to registration. A registered client can obtain a correctly signed token with any scope, and a resource server using Punk::OAuth2::Checker accepts it.

A vulnerability was found in TRENDnet TEW-821DAP 2.2.01b05 in the uci_safe_get function of /cgi-bin/apply_time.cgi in the NTP Timezone Configuration Handler. Manipulating the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, and cameo.cameo.syslog_server arguments leads to a stack-based buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

The Mailgun for WordPress plugin up to version 2.2.0 is vulnerable to Server-Side Request Forgery (SSRF) via path traversal. This is due to insufficient input validation in the add_list() function, which accepts user-controlled array keys from $_POST['addresses'] and passes them through sanitize_text_field(). This allows unauthenticated attackers to make authenticated POST requests to any Mailgun API endpoint using the site's API key, including creating inbound email-forwarding routes that can intercept password reset emails, leading to administrator account takeover.

A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April 4, 2026; no customer action is required.

The SmilePass Selfie Login WordPress plugin through 1.0.2 does not perform any server-side verification of the identity it is asked to authenticate, allowing unauthenticated users to log in as any registered account, including administrators.

The Social Login & Sharing buttons with Analytics By SoClever WordPress plugin through 1.2.0 does not perform any authentication, authorisation or nonce checks in one of its publicly accessible login handlers, allowing unauthenticated attackers to obtain a valid session as any existing user, including administrators. In the default case a session as the site's original administrator account is obtained without needing to know any account details at all.