CVE Vulnerability Catalog

A heap overflow exists in the Exynos DRM HDR driver of Samsung Exynos processors (1280, 2200, 1380) due to improper buffer size validation. This leads to kernel memory corruption and a system crash.

A vulnerability was found in GPAC up to f1219cde. An unknown function in scenegraph/vrml_tools.c of the MP4Box component leads to a null pointer dereference. The attack can only be performed locally, and the exploit has been publicly disclosed.

A buffer overflow vulnerability was found in Totolink A3002MU version Hh-B20211125.1046, in the formPortFw function of /boafrm/formPortFw (boa component). Manipulating the service_type argument causes the overflow. The attack can be initiated remotely and the exploit has been published.

A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formNewSchedule function of /boafrm/formNewSchedule (boa component). Manipulating the submit-url argument results in the overflow. The attack may be performed remotely and the exploit is now public.

A use-after-free exists in the Exynos DRM HDR driver of Samsung Exynos processors (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, 2600) due to improper cleanup upon vmap failure. This leads to a kernel crash.

An issue was discovered in the DPU of Samsung Exynos 1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600 mobile processors. A TOCTOU race condition in the Exynos DRM HDR driver leads to a heap overflow, causing a kernel crash.

N-able Mail Assure through April 2026 contains a design-level authorization flaw allowing an authenticated SMTP user to send outbound email using MAIL FROM addresses belonging to other tenants. The server accepts arbitrary sender domains without enforcing domain-to-account binding, so messages pass SPF and DMARC validation. The vendor considers this intended functionality of its shared SMTP relay architecture.

libarchive 3.8.x before 3.8.2 has a strcpy heap-based buffer overflow in the gzip writer via the original-filename field to archive_compressor_gzip_open in archive_write_add_filter_gzip.c (GHSA-92wx-p669-8gr9). This relates to bsdtar. Exploitation requires obtaining original-filename from an untrusted party.

A buffer overflow vulnerability was detected in Totolink A3002MU version Hh-B20211125.1046, in the formIpv6Setup function of /boafrm/formIpv6Setup (boa component). Manipulating the static_ipv6 argument leads to the overflow. The attack is possible remotely and the exploit has been disclosed publicly.

A buffer overflow weakness was identified in Totolink A3002MU version Hh-B20211125.1046, in the formFilter function of /boafrm/formFilter (boa component). Manipulating the ip6addr argument leads to the overflow. The attack can be executed remotely and the exploit has been made available to the public.

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. It affects an unknown part of the Anchor Tag Handler component and results in cross site scripting. Remote exploitation is possible, and the exploit has been publicly released.

A Cross-Site Scripting (XSS) vulnerability in the web backend of the Repetico app 1.9.7.31 for Android allows a remote authenticated user to execute arbitrary JavaScript code in the app's context via crafted input in the multiple-choice question text field.

A lack of length check was discovered in the buffer queue driver of Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. This leads to a Denial of Service in the kernel.

In FRRouting FRR before 8.5, the service user (usually frr) can escalate its privileges to root by monitoring the configuration directory (/etc/frr) and replacing config files upon creation with, for example, symlinks to change the ownership of arbitrary files. This is a TOCTOU Race Condition caused by a combination of touch and chown.

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be launched remotely. The name of the patch is f013270957f75e439eaf97eb2a93decb32a4543e.

A vulnerability was determined in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0 in the renderHistory function of ImageStudio.js of the Studio Components. This manipulation causes cross-site scripting (XSS). The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.

A vulnerability was found in getzep graphiti up to 0.30.2. Affected is an unknown function of the file server/graph_service/main.py of the component REST API. The manipulation results in improper authentication. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

In CVE-2026-15892, the mcumgr settings-management group handlers settings_mgmt_read(), settings_mgmt_write(), and settings_mgmt_delete() allocate a key_name buffer (and a data buffer for read) via k_malloc() when CONFIG_MCUMGR_GRP_SETTINGS_BUFFER_TYPE_HEAP is enabled. When CONFIG_MCUMGR_GRP_SETTINGS_ACCESS_HOOK is also enabled and the application access hook rejects a request by returning MGMT_CB_ERROR_RC, the handler executes return ret_rc directly, bypassing the end: label and k_free(), leaking the heap allocation on every rejected request.

In the MQTT-SN client (Zephyr, subsys/net/lib/mqtt_sn/mqtt_sn.c), process_ping() removes the gateway record after PINGREQ retries are exhausted, but the result of SYS_SLIST_PEEK_HEAD_CONTAINER is discarded, leaving gw as NULL. The code then dereferences NULL (gw->gw_id) and passes it to mqtt_sn_gw_destroy(), reaching k_mem_slab_free(&gateways, NULL) — triggering k_panic() with CONFIG_MEM_SLAB_POINTER_VALIDATE enabled, or corrupting the slab free list in the default configuration. The flaw is remotely triggerable by a malicious or compromised MQTT-SN gateway (or an on-path/adjacent attacker) that stops responding to PINGREQs.