CVE Vulnerability Catalog

A cross-site scripting vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0 in the file /BSIS1.php. Manipulation of the course argument leads to XSS. The attack can be launched remotely, and the exploit has been made public.

A vulnerability was found in alexta69 MeTube up to 2026.06.10. An unknown function in the file /download/.metube/cookies.txt of the Cookie File Handler component allows files or directories to be accessible. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.

A vulnerability was found in Comfast CF-N1-S 2.6.0.1. The affected function sub_41AD7C in /cgi-bin/mbox-config is vulnerable to stack-based buffer overflow via the timestr/ntp_client_enabled arguments. The attack can be launched remotely and the exploit has been made public.

This CVE has been rejected or withdrawn by its CVE Numbering Authority. No further information is available.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 4.9.8 via the get_image_src_in_base64 function. This allows authenticated attackers with subscriber-level access or above to read the contents of arbitrary files on the server, which can contain sensitive information. The base64-encoded file contents are embedded into the cached invoice HTML and served directly to the attacker via the plugin's own Print/Download invoice endpoints.

The Security Hardener plugin for WordPress up to version 2.4.4 is vulnerable to Missing Authorization. The default-enabled user-enumeration protection overwrites permission_callback on /wp/v2/users routes, stripping core capability checks. This allows authenticated attackers with Subscriber-level access to create Administrator accounts or reset existing Administrator passwords.

The PPWP – Password Protect Pages plugin for WordPress up to version 1.9.18 is vulnerable to PHP Object Injection via deserialization of untrusted input from the 'post_protection_roles' parameter. Authenticated attackers with Contributor-level access can inject a PHP Object. No known POP chain exists in the vulnerable software, but if another plugin or theme with a POP chain is installed, further attacks are possible.

docker-socket-proxy fails to properly gate read endpoints in the /containers Docker API namespace when the CONTAINERS environment variable is set. Attackers can use GET requests to /containers/{id}/archive, /containers/{id}/export, /containers/{id}/logs, and /containers/{id}/top to read arbitrary files and download entire container filesystems as tar archives.

A vulnerability has been found in Systerel S2OPC up to 1.7.3. Impacted is the function SOPC_NodeMgtHelperInternal_AddVariableNodeAttributes of the file src/ClientServer/address_space/internal/sopc_node_mgt_helper_internal.c of the component AddNodes Service. The manipulation of the argument UserAccessLevel leads to out-of-bounds read. It is possible to initiate the attack remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been disclosed to the public and may be used. The identifier of the patch is aafbd37d381b618312ebdf5ddf57027f62c14fdd. It is suggested to install a patch to address this issue.

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No further information is available.

In strongSwan before 6.0.7, identity parsing/cloning is mishandled. Parsed EAP-Identities that result in an empty but non-NULL encoding are not correctly cloned and trigger a double-free once the duplicates are destroyed.

The Infineon Airoc Wi-Fi driver has a buffer leak vulnerability in the airoc_mgmt_send() function. On every failed packet transmission, a buffer from the small fixed pool is not released, leading to pool exhaustion. Once the pool is exhausted, both transmit and receive paths fail, causing permanent loss of Wi-Fi connectivity until the device is rebooted.

In the Linux kernel, in the gpio: pca953x driver, the function pca953x_irq_bus_sync_unlock did not hold the i2c_lock during regmap calls, which could lead to incorrect register read/write under concurrent access. A previous patch only protected the write to the interrupt mask register, not the read from the direction register.

In the Linux kernel, in the DRM/AMD Display subsystem, the function dce110_set_avmute called is_tg_enabled without checking if it is implemented in the ops table for older DCE timing generators. This caused a NULL pointer dereference on Southern Islands GPUs when turning the display off over HDMI.

In the Linux kernel, in sched_ext, when a sub-scheduler enable fails before scx_link_sched(), the cleanup still runs the full scx_sub_disable(), which can race with root disable and lead to use-after-free. The fix skips the cgroup ownership reset and task walk if the scheduler was never linked.

In the Linux kernel, in NFS, the FREE_STATEID operation could be delayed, leading to a use-after-free of the 'struct nfs_server' object. The fix bumps the refcount of this object for the duration of the FREE_STATEID call to prevent cleanup while operations are in flight.

In the Linux kernel, in the soc: aspeed: lpc-snoop driver, the snoop_file_read function can cause a usercopy overflow due to lack of synchronization between the producer (IRQ) and consumer (file). The fix adds a per-channel spinlock to serialize kfifo access.

In the Linux kernel, in XFS, the function xfs_buf_free calls folio_put on a NULL pointer when backing memory allocation fails, leading to a kernel crash. The fix skips folio_put when bp->b_addr is NULL.

A race condition in the Linux kernel's ovpn subsystem between peer deletion and rehashing operations can resurrect already-removed peers in hash tables, leading to a use-after-free (UAF) vulnerability.

In the Linux kernel bonding driver (ALB mode), bond_alb_monitor() reads primary_is_promisc under RCU, then drops RCU and takes RTNL via rtnl_trylock() before undoing promiscuity on the active slave. In that window the active slave can change, leading to a null-pointer dereference (kernel panic) or an underflow of the promiscuity counter, leaving the interface in IFF_PROMISC.