CVE Vulnerability Catalog

CVE-2026-0300 describes a buffer overflow vulnerability in the User-ID™ Authentication Portal service of Palo Alto Networks PAN-OS software, allowing an unauthenticated attacker to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets.

Vulnerability in Apache::Session::Generate::ModUniqueId versions 1.54 through 1.94 for Perl causes session IDs to be generated based on the UNIQUE_ID environment variable from Apache mod_unique_id. The ID relies on IPv4 address, PID, epoch time, a 16-bit counter, and thread index, with no obfuscation, making it predictable.

A vulnerability has been identified in the Linux kernel that has been resolved. The issue concerns passing flow_id to the set_rps_cpu() function, which may lead to out-of-bounds access and system crashes.

A race condition was found in the Linux kernel's tcp_v6_syn_recv_sock() function. After tcp_v4_syn_recv_sock() returns, the child socket is already visible in the TCP ehash table, but the pinet6 pointer still points to the listener's structures, potentially causing issues.

In the Linux kernel, a vulnerability was found in netconsole where the message passed from the console subsystem is not guaranteed to be null-terminated, leading to out-of-bounds reads. KASAN reported a slab-out-of-bounds error during message processing.

In the Linux kernel, the dlm_search_rsb_tree function lacks validation of the len parameter from network messages. When exceeding DLM_RESNAME_MAXLEN, it can cause an out-of-bounds write.

W jądrze Linuxa rozwiązano podatność związaną z systemem plików btrfs, która występowała w funkcji btrfs_sync_file(). Użycie overlay na btrfs prowadziło do błędnego przypisania superbloku, co mogło skutkować awarią systemu.

In the Linux kernel, the AVX2 implementation for pipapo sets in netfilter has a bug that returns non-matching entries on expiry. The issue occurs when AVX2 match functions process the last field without consuming the entire input, leading to false element collision reports.

W jądrze systemu Linux zidentyfikowano podatność, która prowadzi do dostępu poza granice tablicy dev->_tx[], gdy trace->type.bit6 jest ustawione, a is_input jest prawdziwe. Problem ten występuje, gdy urządzenie wejściowe ma więcej kolejek RX niż urządzenie wyjściowe TX.

Missing invocation of the session ID change method after session binding in Apache Wicket can be exploited for a session fixation attack.

Heap-based buffer overflow vulnerability in the mod_proxy_ajp module of Apache HTTP Server. If mod_proxy_ajp connects to a malicious AJP server, that server can send a crafted AJP message causing a write of 4 attacker-controlled bytes beyond the end of a heap buffer.

CoreDNS versions prior to 1.14.3 incorrectly handle TSIG authentication in gRPC, QUIC, DoH, and DoH3 transports. For gRPC and QUIC, the server only checks the TSIG key name but does not validate the HMAC, so any request with a matching key name is considered authenticated. For DoH and DoH3, the issue is more severe – the server never inspects the TSIG record at all, so any request with TSIG is treated as authenticated.

Masa CMS versions 7.2.0-7.2.9, 7.3.0-7.3.14, 7.4.0-7.4.9, and 7.5.0-7.5.2 have an SQL injection vulnerability in the unauthenticated JSON API. The altTable parameter is injected directly into the SQL FROM clause, allowing an unauthenticated attacker to read sensitive data from any table.

Masa CMS is an open source content management system. In versions 7.2.0 through 7.2.9, 7.3.0 through 7.3.14, 7.4.0 through 7.4.9, and 7.5.0 through 7.5.2, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's handling of the sortDirection parameter. The parameter value is concatenated directly into SQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to extract sensitive information, modify or delete database records, or potentially achieve remote code execution on the underlying database server.

Masa CMS is an open source content management system. In versions 7.5.2 and earlier, a SQL injection vulnerability exists in the beanFeed.cfc component within the getQuery function's processing of the sortBy parameter. The application fails to properly sanitize or parameterize this input before incorporating it into dynamic SQL statements. An unauthenticated remote attacker can execute arbitrary SQL commands against the database, potentially gaining access to sensitive data, modifying or deleting records, or escalating privileges to administrative control. This issue has been fixed in versions 7.2.10, 7.3.15, 7.4.10, and 7.5.3. As a workaround, configure WAF rules to block malicious SQL patterns in the sortBy parameter sent to beanFeed.cfc.

PhpSpreadsheet in multiple versions (up to 1.30.2, 2.0.0-2.1.14, 2.2.0-2.4.3, 3.3.0-3.10.3, 4.0.0-5.5.0) is vulnerable to Remote Code Execution (RCE) via a user-controlled filename argument in IOFactory::load(). An attacker can supply a PHP stream wrapper path (e.g., phar://, ftp://, ssh2.sftp://) that passes the is_file() check in File::assertFile(). The phar:// wrapper triggers deserialization of PHAR metadata, potentially leading to RCE if a suitable gadget is available.

A buffer overflow vulnerability in D-Link DI-8100 version 16.07.26A1 in the function url_rule_asp of the file /url_rule.asp (POST Parameter Handler) allows remote attackers to potentially execute arbitrary code. The exploit has been publicly disclosed.

Kestra version 1.3.3 and earlier is vulnerable to SQL injection. The vulnerability occurs because user-controlled input from a GET parameter is directly concatenated into an SQL query without proper sanitization or parameterization.

In OpenCTI, versions 6.6.0 through 6.9.12, there is a privilege escalation vulnerability that can be exploited by unauthenticated attackers to query the API as any existing user, including the default admin account.

A weakness has been identified in D-Link DI-8100 16.07.26A1. Affected is the function sprintf of the file /auto_reboot.asp. Manipulation of the argument enable/time causes buffer overflow. The attack can be initiated remotely. The exploit has been made public.