CVE Vulnerability Catalog

Dobase versions prior to 2026.06.03 have a one-click stored DOM-based XSS vulnerability in the public, unauthenticated shared-folder image gallery. A file's name is fully attacker-controlled and never sanitized, allowing execution of malicious code in the browser of anyone with the public share link.

Mousehole prior to version 0.4.05 has its HTTP/WebSocket management boundary reachable without application-layer authentication or browser/LAN provenance checks. The service stores a MyAnonamouse (MAM) session cookie and reuses the same cookie-bearing serialization for state, API responses, and WebSocket updates, allowing any client reaching the port to read state, replace the cookie, or force MAM update side effects.

Kimai versions prior to 2.58.0 contain a server-side request forgery vulnerability in the invoice PDF preview and generation workflow. If an attacker controls Markdown content rendered into an invoice PDF, such as Customer.invoiceText, the server-side PDF renderer fetches remote image URLs embedded in Markdown, allowing outbound requests to attacker-controlled or internal targets.

The nl.nl-portal:taak package from version 1.5.0 through 3.0.0 fails to verify ownership when processing the submitTaakV2 GraphQL mutation. An authenticated user who knows or guesses another user's task ID can read its form data, overwrite its submitted data, and mark the task as completed.

OpenRemote prior to version 1.24.1 allows users with only read:assets privileges to write predicted datapoints via the predicted datapoint write endpoint. Version 1.24.1 fixes the issue.

ArduinoCore-avr versions prior to 1.8.8 allow an attacker to trigger a stack-based buffer overflow when concatenating floating-point values of sufficiently large magnitude onto an Arduino String object. Passing values near the extremes of the float or double range to String::concat(float), String::concat(double), String::operator+=(), or the + operator causes dtostrf() to write beyond the stack buffer, leading to memory corruption and denial of service.

ArduinoBLE versions prior to 2.0.2 contain a missing bounds check in the ATT layer write request handler that allows a remote, unauthenticated BLE client to corrupt memory in the ATTClass global object. Devices running ArduinoBLE with one or more characteristics configured with the BLEEncryption property are affected.

matrix-sdk-ui prior to 0.17.0 is missing a check in the message edit validation logic: when replacing an encrypted event, the replacement event itself is not required to be encrypted. This enables malicious homeserver administrators (or actors with equivalent power) to impersonate or spoof messages as if they were sent by a victim user.

In the Linux kernel, a vulnerability was resolved in drm/amd/display where HDCP configuration was not skipped in the transition state. The transition state does not have a valid dm_stream_ctx, so the HDCP routine should be skipped — it is only valid when a valid stream is created.

A flaw was found in the Linux kernel btrfs subsystem where write-protection of folios during data writeback was lost. A code change replaced folio_clear_dirty_for_io() with a plain folio_test_dirty() check, allowing a process with an mmap-ed file to modify sectors while writeback is in progress. This can cause checksum corruption, lost writes, and data corruption for compressed or inline extents.

In the Linux kernel, a race condition in the ring-buffer during subbuf resize by readers was resolved. trace_buffer subbuf_size is read lockless in ring_buffer_read_page() and ring_buffer_read_start(), while it can simultaneously be resized with ring_buffer_subbuf_order_set(). The fix uses bpage::order instead of trace_buffer::subbuf_size and adds a mutex in ring_buffer_read_start().

In the Linux kernel, a vulnerability was resolved in iomap where a non-existent integrity payload was freed. fs_bio_integrity_alloc might not allocate a bio integrity payload if PI verification is disabled on the block device — the fix checks for that case before calling fs_bio_integrity_free in iomap_bio_read_folio_range_sync to avoid a NULL pointer dereference.

In the Linux kernel, an IRQ leak on the cpuhp_setup_state error path in the nxp-pit clocksource driver was resolved. When cpuhp_setup_state fails after pit_clockevent_per_cpu_init successfully called request_irq, the error handling skips freeing the registered IRQ, leaking the IRQ line and leaving a dangling pointer as the interrupt handler's dev_id, potentially leading to a use-after-free.

A bug was fixed in the Linux kernel in backing_file_open(), which derived the path stored in a new backing file from user_file->f_path. With nested filesystems (e.g. overlayfs on top of overlayfs) this caused an incorrect internal intermediate-layer path to be stored instead of the user-visible path. As a result, files mapped through a nested overlayfs showed the wrong path in /proc/<pid>/maps and in perf/ftrace mmap records.

In the Linux kernel, ovl_create_real() in overlayfs calls end_creating() twice on the casefold-mismatch error path. This causes the parent directory's i_rwsem to be unlocked twice and the dentry reference to be released twice, leading to a deadlock on subsequent creation operations under that parent. The issue is reachable by an unprivileged user.

In the Linux kernel, the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl() perform a ptrace access check based on credentials but, unlike the corresponding procfs paths, do not hold the target task's exec_update_lock. This allows a caller to pass the check against the target's old credentials and then read the namespace after the target has execve()'d a setuid binary and committed new credentials. The fix holds exec_update_lock for reading around the ptrace check and namespace lookup.

In the Linux kernel on native sparc64, struct __kernel_old_timeval contains a four-byte hole after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit. put_itimerval() fills only the named fields in a stack-allocated __kernel_old_itimerval and copies the entire object to userspace, so getitimer() can expose the two padding holes. The fix zero-initializes the aggregate before assigning the fields.

In the Linux kernel's Rust devres layer, a race condition occurs when two paths concurrently revoke a Devres. devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync() on another CPU. The revoker that does not claim the is_available swap returns immediately, but the other may still be executing drop_in_place() on the inner data, causing a use-after-free. The fix adds a Completion that Devres::drop() waits on when it loses the is_available swap.

A use-after-free vulnerability exists in the Linux kernel's trusted keys (KEYS: trusted) module due to incorrect TPM teardown ordering. The trusted_tpm_exit() function drops the TPM chip reference and frees the digest array before unregistering the trusted key type, allowing a concurrent key operation to dereference freed memory.

A use-after-free (UAF) vulnerability in the Linux kernel's AppArmor module, related to begin_current_label_crit_section(), has been fixed. The function could directly replace credential pointers (struct cred) during an LSM hook invocation, causing task->cred and task->real_cred to become inconsistent and leading to freed credential memory still being referenced by other tasks.