CVE Vulnerability Catalog

A vulnerability in the setcred(2) system call in the Linux kernel. Before checking the caller's privileges, the user-supplied supplementary groups list is copied into a fixed-size kernel stack buffer without length validation. This can lead to a stack buffer overflow, exploitable by an unprivileged local user.

Vulnerability in Netatalk 2.1.0 through 4.4.2: incomplete sanitization of extended attribute (EA) path components allows remote authenticated attacker to write files outside intended metadata namespace via crafted EA names.

In Netatalk versions 3.1.0 through 4.4.2, multiple heap out-of-bounds reads exist in the Spotlight RPC deserialization code. A remote authenticated attacker can obtain sensitive information or cause minor service disruption.

An out-of-bounds read in ASP session ID handling in Netatalk 1.3 through 4.4.2 allows an adjacent network attacker to obtain limited information or cause a denial of service via a crafted ASP request.

A missing output length bounds check in pull_charset_flags() in Netatalk 2.0.4 through 4.4.2 allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character set data.

An integer underflow vulnerability in the dsi_writeinit() function of Netatalk versions 1.5.0 through 4.4.2 allows a remote unauthenticated attacker to cause a denial of service via a crafted DSI write request.

An authentication bypass vulnerability in Netatalk versions 2.2.2 through 4.4.2 allows a remote privileged user to authenticate as an arbitrary user via the admin auth user mechanism.

A logic error involving bitwise OR operations in Netatalk 3.1.4 through 4.4.2 allows a remote authenticated attacker to inject OS commands and execute arbitrary code.

Netatalk 1.5.0 through 4.2.2 uses a broken cryptographic algorithm in the DHCAST128 UAM, allowing a remote attacker to obtain authentication credentials or impersonate a user via cryptanalytic attack.

Netatalk versions 2.1.0 through 4.4.2 insert LDAP simple-bind passwords into log output in cleartext, allowing an attacker with access to log files to obtain LDAP credentials.

In Netatalk versions 3.0.2 through 4.4.2, an improper link resolution vulnerability allows a remote authenticated attacker to read or overwrite arbitrary files via attacker-controlled symlink creation.

In Netatalk versions 2.0.4 through 4.4.2, an out-of-bounds write due to improper null termination in convert_charset() allows a remote authenticated attacker to execute arbitrary code or cause a denial of service via crafted character data.

Netatalk versions 2.0.4 through 4.4.2 contain a stack-based buffer overflow via UCS-2 type confusion in convert_charset(). A remote authenticated attacker can execute arbitrary code or cause a denial of service.

Netatalk versions 3.1.0 through 4.4.2 contain an SQL injection vulnerability in the MySQL CNID backend, allowing a remote authenticated attacker to access, modify data, or cause a denial of service.

Vulnerability in authentik (open-source identity provider) in versions up to 2025.12.4 and 2026.2.0-rc1 through 2026.2.2. An attacker can bypass authentication via SAML NameID XML Comment Injection, allowing access to other accounts if the attacker has an account on the SAML source and can modify NameID.

nimiq-blockchain prior to version 1.4.0 has a vulnerability where a malicious network peer can crash any Nimiq full node by publishing a crafted Kademlia DHT record. The record contains a TaggedSigned<ValidatorRecord, KeyPair> with a signature field whose byte length is not exactly 64, causing a panic when unwrap() is called in the Ed25519 implementation. The BLS implementation correctly returns false, but Ed25519 panics.

A potential security vulnerability has been identified in HP Linux Imaging and Printing Software (HPLIP) that may allow escalation of privileges and/or arbitrary code execution via operating system command injection.

Crypt::SaltedHash for Perl versions up to 0.09 is susceptible to timing attacks. It uses Perl's built-in eq comparison, and timing discrepancies could be used to guess the underlying hash.

Stored XSS vulnerability in Taiko AG1000-01A SMS Alert Gateway. An authenticated attacker can inject persistent JavaScript by fragmenting malicious payloads across admin form fields, bypassing length restrictions.

The CSP report endpoint in MISP intended to limit reports to 1 KB but incorrectly accepted reports up to 1 MB before truncation. If reachable by untrusted clients, attackers can generate excessive logs, leading to resource exhaustion or log flooding.