CVE Vulnerability Catalog

In the Linux kernel's rhashtable library, there is a use-after-free vulnerability during table restart. When the table is freed during resize, the iterator does not clear iter->p, leading to a dereference of freed memory in rhashtable_walk_next(). This affects netlink_diag and TIPC.

In the Linux kernel, KVM nVMX has a vulnerability where the shadow VMCS is freed while vmcs01 still points to it. Due to asynchronous VMCLEAR, the vCPU may migrate before the pointer is cleared, leading to VMCLEAR on freed memory. The fix hides the shadow VMCS only after explicit VMCLEAR completes.

In the Linux kernel, KVM x86 has an issue where the check for invalid/obsolete root occurs before making MMU pages available for the shadow MMU. If reclaiming shadow pages zaps an in-use root, KVM may map memory into an invalid root, violating the invariant that invalid pages are never on the active MMU list. The fix moves the check after making MMU pages available.

The Create Block WordPress plugin before version 2.10.0 does not correctly escape user-supplied text before writing it into a generated PHP pattern file, allowing a multisite subsite administrator to inject and execute arbitrary PHP code on the server.

LINE Android app prior to version 26.7.2 has a code injection vulnerability in the profile rendering component. The component does not adequately validate or sandbox externally supplied script content in profile templates, allowing an attacker to execute code with the app's privileges when a victim views the profile. A server-side mitigation has been deployed that also protects existing clients.

A heap-buffer-overflow vulnerability exists in the APNG (Animated PNG) file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to a BPP mismatch in the load_layer() function. Both vulnerabilities can be triggered by opening a specially crafted image file, potentially leading to code execution.

In Zyxel ATP, USG FLEX, USG FLEX 50(W), and USG20(W)-VPN firmware, there is a path traversal vulnerability in the CLI command used to execute configuration files. An authenticated attacker with administrator privileges can execute a crafted malicious configuration file on the device.

In Zyxel WAX650S firmware versions through 7.10(ABRM.4)C0, a post-authentication command injection vulnerability exists in the "export-cgi" CGI program. An authenticated attacker with administrator privileges can execute OS commands on the device.

A vulnerability in Node.js HTTP/2 handling allows retained header blocks to bypass maxSessionMemory, potentially leading to remote memory exhaustion. Affects Node.js versions 24.x and 22.x.

In an application with CustomSounds storage configured to FileSystem, there is an unauthenticated path traversal (LFI) vulnerability under /custom-sounds/. By including ../ sequences in the request path, an attacker can read arbitrary files outside the base directory.

Microsoft Edge (Chromium-based) has an origin validation error that allows an unauthorized attacker to perform spoofing over a network.

In Microsoft Edge (Chromium-based), a type confusion vulnerability allows an unauthorized attacker to execute code over a network.

An origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

A use-after-free vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.

In Microsoft Edge for Android, a vulnerability involving external control of file name or path allows an unauthorized attacker to disclose information locally.

In Microsoft Edge for Android, an external control of file name or path vulnerability allows an unauthorized attacker to disclose information over a network.

A use-after-free vulnerability was found in Microsoft Office Excel that allows an unauthorized attacker to execute code over a network.

The SBN UDP interface in NASA cFS v7.0.1 allows an attacker to cause a Denial of Service (DoS) by sending a crafted SBN frame.

Adobe Campaign Classic (ACC) is affected by a Violation of Secure Design Principles vulnerability that could result in a Security feature bypass. An attacker can leverage this to bypass security measures and gain unauthorized read access. Exploitation does not require user interaction.

python-cryptography, a cryptographic library for Python, prior to version 49.0.0, is vulnerable to DoS via resource exhaustion. When resolving invalid certificate chains with duplicate self-signed certificates, processing recursively invokes the same candidate, leading to exponential blowup. An attacker can supply a chain causing processing time over 5 seconds, leading to denial of service. Fixed in version 49.0.0.