CVE Vulnerability Catalog

In the Linux kernel, the AMD Display driver lacks clamping of the ReceiverID list read size during HDCP 2.x authentication over HDMI. A malicious HDMI repeater can advertise a message size larger than the destination buffer, causing an out-of-bounds write.

In the Linux kernel drm/amd/display driver, a vulnerability was found due to missing validation of HdmiRegNum and Hdmi6GRegNum fields in VBIOS tables. A malformed VBIOS can set these values up to 255, causing an out-of-bounds heap write during driver initialization.

In the Linux kernel, the AMD Display driver has a vulnerability involving NULL pointer dereference and buffer over-read in the dp_sdp_message_debugfs_write() function. The issue occurs when a connector is connected but not bound to a CRTC (e.g., after hot-plug before atomic commit), causing a kernel crash. Additionally, the function ignores the user-provided size and always copies 36 bytes, potentially reading past the user buffer.

A vulnerability in the Linux kernel's netfilter nft_fib module causes a leak of uninitialized kernel stack data to userspace. The issue occurs when the OIFNAME result register is declared with IFNAMSIZ length but only one register is written on lookup failure, leaving three registers stale. Additionally, the NFTA_FIB_F_PRESENT flag was accepted for incorrect result types, also leading to data leaks.

In the Linux kernel, a vulnerability in RDMA/umem was found where using iommu with large mapping blocks (>=4G) split across multiple SG entries caused overflow of 32-bit stack values, leading to incorrect DMA address calculation for blocks after truncation.

A vulnerability in the Linux kernel's vsock/virtio driver allows unbounded packet queuing. An attacker can send zero-length packets with the VIRTIO_VSOCK_SEQ_EOM flag, keeping rx_bytes at 0 and allowing the skb queue to grow indefinitely.

A vulnerability was found in the Linux kernel's netfilter subsystem where functions like `ip6t_eui64`, `xt_mac`, ipset types (`bitmap:ip,mac`, `hash:ip,mac`, `hash:mac`), and `nf_log_syslog` accessed the Ethernet header (`eth_hdr(skb)`) without first verifying that the skb is associated with an Ethernet device, that the MAC header is set, and that it spans at least a full Ethernet header. Missing these checks could lead to errors or potential security issues.

Vulnerability in the cjson library in Apache Kvrocks causing Lua HEAP overflow. Affects versions from 2.0.4 to 2.15.0.

A vulnerability in Apache Kvrocks affects versions from 2.2.0 through 2.15.0, and users are recommended to upgrade to version 2.16.0 to fix the issue.

A Relative Path Traversal vulnerability in Apache Kvrocks may allow attackers to access unauthorized system resources. The issue affects versions from 1.0.0 through 2.15.0.

CVE-2026-41566 involves improper handling of insufficient permissions in Apache Kvrocks version 2.8.0. This issue has been fixed in version 2.16.0.

The generic IO & Memory Access driver for PCs provided by TOSHIBA CORPORATION and Dynabook Inc. exposes its IOCTL with insufficient access control. A logged-in user without administrative privileges may access physical memory.

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental WordPress plugin is vulnerable to generic SQL Injection via the 'post_id' parameter in all versions up to and including 2.22.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.

The InPost PL WordPress plugin before 1.9.1 does not verify that the request originates from the legitimate buyer, allowing unauthenticated attackers to silently redirect the shipping destination of WooCommerce orders.

The Email Address Encoder WordPress plugin before 1.0.25 and email-encoder-premium WordPress plugin before 0.3.12 do not properly handle email replacement, which could allow unauthenticated users to perform Stored XSS attacks.

A vulnerability in the DNS system allows bypassing client certificate authentication for zone transfers (XFR) when using provide-xfr with tls-auth-name. If the request comes via TLS on the standard TLS port (not the tls-auth port) or via plain TCP on the standard port, the server does not require a client certificate, even if the provide-xfr rule specifies one.

In NSD version 4.14.0, a bug was introduced where a specially crafted APL RR with an adflength larger than permitted for the address family overwrites the stack when the zone is written to disk, with a maximum of 111 attacker-controlled bytes.

In NSD from version 4.13.0, a heap use-after-free bug was found in logging errors on TLS connections. The vulnerability causes a crash of the server process, which can be easily triggered by sending a DNS query over a DoT connection and closing the connection without reading the response.

A vulnerability in NSD allows an attacker acting as a primary server for a zone to cause a heap overflow by sending an AXFR response containing a specially crafted SVCB record with an rdata size of 65512 bytes. This causes a uint16_t variable used for memory allocation to wrap, leading to a write beyond the allocated buffer.

The Masteriyo LMS WordPress plugin before 2.2.1 does not perform authorization checks in a course-progress REST API controller, allowing unauthenticated users to read and permanently delete any user's course-progress records.