CVE Vulnerability Catalog

Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from that top-level WSDL is handed off to WSDL4J, which does not disable DOCTYPE declarations or external entities. As a result, the protections applied to the top-level document do not extend to imported documents, leaving imported WSDL/XSD content vulnerable to XML External Entity (XXE) attacks.

An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue by using a default limit of 500 parameters.

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the `c_hash` parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider (IdP) that omits the `c_hash`, the RP becomes vulnerable to Authorization Code Substitution/Injection attacks. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue.

Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, meaning that a denial of service attack is possible if the user doesn't explicitly set the limit. Users should update to Apache CXF 4.2.3 or 4.1.8 or 3.6.12 which fixes this problem by imposing a default attachment size limit of 50mb.

A vulnerability was found in Shibby Tomato 1.28.0000 in the function new_qoslimit_stop of /tmp/qoslimittc_stop.sh. Manipulating the wan_iface argument leads to OS command injection. The attack can be launched remotely.

An improper access control vulnerability in CatchPulse could allow a non-administrative local attacker to connect to an unrestricted kernel filter communication port and bypass CatchPulse's security policy enforcement.

In the Linux kernel, the ALSA us144mkii driver's capture_urb_complete() calls usb_anchor_urb() on every completion callback, even though the URB is already anchored. This corrupts the anchor's doubly-linked list and inflates the URB refcount, leading to a use-after-free when the stream is stopped.

A vulnerability in the Linux kernel crypto driver for Amlogic SoCs (meson_crypto_probe) causes a double cleanup on allocation failure, leading to a slab-use-after-free in kthread_destroy_worker. This can be triggered by a malicious module or reproducer, potentially causing memory corruption.

In the Linux kernel, the smb2_aead_req_alloc() function has an error code bug: the *num_sgs variable is u32, so ERR_PTR(*num_sgs) does not work correctly. This can lead to returning an invalid error pointer, which when dereferenced causes a system crash.

In the Linux kernel's FUSE-uring subsystem, there are data races on the ring->ready field. On weakly-ordered architectures, the store to fiq->ops can be reordered before the store to ring->ready, potentially leading to use of a stale fiq->ops pointer. Additionally, the fast-path read of ring->ready is unmarked, which KCSAN may flag.

In the Linux kernel's ARC EMAC ethernet driver, there is a vulnerability where interrupts are not quiesced before requesting IRQ. This may allow stale or latched interrupts to be delivered during teardown, leading to a race with net_device release.

In the Linux kernel, the brcmfmac driver has a vulnerability where the bus_reset work item is not drained on device removal, leading to a use-after-free when the work callback runs after the drvr structure is freed.

In the Linux kernel's esd_usb CAN driver, there is a vulnerability where anchored URBs are not killed before freeing netdevs. This causes a use-after-free during device disconnect, as private data is freed before attempting to kill the URBs.

In the Linux kernel's USB gadget f_midi driver, a use-after-free vulnerability exists because the midi->work work item is not canceled before the f_midi object is freed. This allows the work handler to run after memory has been released. The issue was found by an in-house static analysis tool.

In the Broadcom BDC UDC driver in the Linux kernel, there is a use-after-free and NULL pointer dereference vulnerability. Interrupt handling and delayed work can execute after memory structures are freed during driver removal, potentially leading to system crash or code execution.

A SQL injection vulnerability was detected in SourceCodester Computer Repair Shop Management System 1.0 in /classes/Master.php?f=delete_product. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely.

A vulnerability was detected in TinyAGI 0.0.20 in the processMessage function of packages/main/src/index.ts in the Message API Endpoint component. Missing authorization allows remote attack. The exploit is public, and the project has not responded.

A vulnerability was found in TinyAGI 0.0.20 in the collectFiles function of packages/core/src/response.ts in the Message API Endpoint component. This manipulation causes file inclusion. The attack can be initiated remotely, and the exploit is public.

In the GStreamer gst-plugins-good package, the rtph264depay and rtph265depay RTP depayloader elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing. A remote attacker can send a continuous stream of RTP fragments without end-of-fragment markers, causing the buffer to grow unbounded until memory exhaustion.