CVE Vulnerability Catalog

In the Linux kernel's netfs subsystem, a use-after-free vulnerability was found in netfs_unlock_abandoned_read_pages(). The function accesses the folio index after clearing the NETFS_RREQ_IN_PROGRESS flag, potentially leading to dereference of freed memory.

Improper access control in Azure App Service allows an unauthorized attacker to elevate privileges over a network.

Image::WebP for Perl versions before 0.3.0 bundle a vulnerable version of libwebp (0.3.0 from 2013). The module does not link to the system libwebp but uses its own compiled copy, which has known vulnerabilities including CVE-2023-4863. Any caller decoding an untrusted WebP image reaches the vulnerable decoder, and upgrading the system library does not fix the issue.

Server-Side Request Forgery (SSRF) vulnerability in Data Quality allows an unauthorized attacker to elevate privileges over a network.

Missing authentication for a critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network.

Vulnerability in `/usr/bin/larm_starter` in Loytec devices (L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) up to version 8.4.16 on LINX-A64 allows an authenticated `larmapp` attacker to escalate privileges to root via a symlink attack on `/etc/lighttpd/ssl/server.pem`.

TOML::XS versions before 0.06 for Perl bundle an unsupported and vulnerable version of tomlc99. The tomlc99 library is no longer maintained and has an uncontrolled recursion vulnerability. Any caller that passes untrusted TOML to from_toml risks a stack overflow from a deeply-nested document.

An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote authenticated users with administrator privileges to execute arbitrary commands by uploading a crafted ZIP archive containing a server-executable file.

Vulnerability in Eclipse BaSyx Go Components allows bypassing ABAC authorization by appending a trailing slash. An unauthenticated attacker can gain unauthorized access to protected resources.

The Project Management, Bug and Issue Tracking Plugin WordPress plugin before version 5.1.0 does not sanitize and escape user input before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks. This is exploitable in the standard front-end issue tracker configuration.

Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network.

Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network.

Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network.

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network.

Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network.

Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network.

Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, bypassing OT segmentation.

9router 0.4.59 contains a chain of vulnerabilities: a hardcoded default password (123456), a bypass of the LOCAL_ONLY network gate via a spoofed Host header, and unvalidated arguments passed to child_process.spawn() when registering MCP plugins. A remote, unauthenticated attacker can log in with the default credential, spoof the Host header to reach local-only routes, and register a malicious MCP plugin to achieve arbitrary code execution on the host operating system.

Cal.com (calcom/cal.diy) before version 5.9.9 is vulnerable to unauthenticated remote code execution. The application bundles a version of Next.js whose React Server Components (RSC) request handling deserializes attacker-controlled input. A remote attacker can send a crafted RSC request and cause arbitrary code execution on the server without authentication or user interaction. The flaw originates from CVE-2025-55182 in Next.js and is fixed in version 5.9.9 by updating the dependency.