CVE Vulnerability Catalog

XWiki Platform has a vulnerability that allows discovering user password hashes bit by bit via modified LiveTableResults parameters, even after a previous patch.

Roskus Prospero Flow CRM before version 5.4.8 has an authorization bypass vulnerability in the contact management component, allowing authenticated users to overwrite contact data of other companies and download their personal data as vCard.

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification.

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed.

An improper authorization vulnerability in Attendize through commit 9289acb allows an authenticated remote attacker to inject persistent mandatory survey questions into another organizer's events via the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method loads the target event without the tenant-isolation scope, enabling cross-tenant writes; the injected question cannot be removed by the victim.

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset.

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

Use of Hard-coded Credentials vulnerability in Zyxel Networks WAH7601 allows Read Sensitive Constants Within an Executable. This issue affects WAH7601 through 20.07.2026.

In the Linux kernel, the gpu: host1x subsystem has a use-after-free vulnerability in host1x_bo_clear_cached_mappings. The __host1x_bo_unpin() function drops the last reference to the mapping and frees it, making later dereference invalid. The fix uses the local cache variable instead.

In the Linux kernel, the IB/mad subsystem has a vulnerability that allows processing unsolicited RMPP responses before they are matched to an outstanding request. This can lead to allocation or extension of RMPP state for responses that do not correspond to any sent request. The fix requires that for kernel-handled RMPP DATA responses, a match via ib_find_send_mad() must exist before entering RMPP reassembly.

A vulnerability in the Linux kernel's XFRM subsystem allows a stack-out-of-bounds read in xfrm_state_find() due to optional IPTFS templates in outbound policies not being covered by a previous fix. A local attacker can trigger a kernel panic by sending a crafted ICMP packet. The issue affects outbound policies only; IN and FWD policies are not vulnerable.

In the Linux kernel, a vulnerability in the RDMA/irdma driver allows a user to invoke rereg_mr on special memory regions (used for QP/CQ/SRQ creation) that lack a valid mkey. This triggers a real CQP command with a zero mkey, potentially causing incorrect behavior.

In the Linux kernel, the RDMA/siw driver's siw_create_qp() function calls siw_qp_add() before the QP is fully initialized, allowing other components to access a partially constructed QP. The fix moves siw_qp_add() to the end of the function after full initialization.

A vulnerability in the Linux kernel XFRM/IPsec subsystem was found. After a failed IPTFS state setup, the mode callback pointer (mode_cbs) remains in a dead state, which after module unload leads to a dangling pointer dereference by deferred GC (xfrm_state_gc_task) and a kernel panic.

A vulnerability in the Linux kernel's cfg80211 subsystem allows the sched_scan_res_wk work item to run after device unregistration, leading to a use-after-free condition. The issue is caused by missing cancellation of this work during wiphy unregister.

In the Linux kernel, the wifi mac80211 subsystem has a synchronization issue when removing an MLO link. sta_remove_link() frees the RX stats percpu buffer immediately, while the link container is freed only after RCU. This can lead to use-after-free in the fast RX path. The fix defers the percpu buffer free to an RCU callback.

In the Linux kernel's cfg80211 subsystem, there is an issue with autodisconnect work that can be queued after cancellation, leading to potential use-after-free or race during device unregistration.

In the Linux kernel's cfg80211 subsystem, there is an out-of-bounds read (slab-out-of-bounds) when checking element inheritance if an extension element has zero length. This can be triggered by a crafted frame from an AP.

In the Linux kernel's arm_ffa driver, there are out-of-bounds writes in ffa_setup_and_transmit(), especially for FFA versions < 1.2 where the reserved field has offset 24 but the size returned is 16 bytes. There is also a lack of size check for constituents.

In the Linux kernel's arm_ffa driver, there is an error in calculating the Endpoint Memory Access descriptor offset, which uses sizeof(struct ffa_mem_region) instead of ep_mem_offset, potentially leading to incorrect memory access. There is also a lack of sanity checks for offsets.