CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel i2c/smbus subsystem due to missing early validation of SMBus block transfer length. A user-controlled oversized data->block[0] value can reach tracepoints and native smbus_xfer driver implementations unchecked, causing out-of-bounds memory access.

In the Linux kernel's DRM pagemap driver, drm_pagemap_migrate_unmap_pages() relies on the pages array for DMA unmapping, but drm_pagemap_migration_unlock_put_pages() clears the array during cleanup, leaving no valid page info. The fix calls the unmap function before unlock_put_pages to keep the array valid.

In OpenWA before 0.23.5, the /events WebSocket gateway delivers the session.qr event to a VIEWER API key that subscribes by event name or through wildcard, even though GET /api/sessions/{sessionId}/qr requires the OPERATOR role. When a session is waiting to be paired, the exposed QR lets the key holder link an external device to the WhatsApp account and then read and send messages outside OpenWA and its audit trail. Keys restricted through allowedSessions remain limited to those sessions.

In Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the iframe src traversal guard did not treat literal backslashes as path separators after decoded dot segments. A crafted source could pass an allowed_iframes subpath check while browser URL normalization moved the iframe outside the intended allowed path. The resulting iframe could load content from a location not allowed by the administrator.

In Discourse before 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the video placeholder component allowed crafted HTML to cause an attribute breakout and inject an attacker-controlled event handler. An authenticated user with default trust-level posting privileges could store the crafted placeholder in a post. When another user opened the post and clicked the video play overlay, the handler could execute arbitrary JavaScript in the viewer's session. Default CSP settings block inline event handlers, but instances with CSP disabled or relaxed could allow the script to read page content and make authenticated requests as the viewer.

In Espruino 2v29 (commit bffc6d0), the jslGetTokenValueAsString() function has an out-of-bounds write vulnerability. Crafted JavaScript input with an overlong token can trigger a one-byte write beyond the JsLex.token buffer in RELEASE/NO_ASSERT builds, corrupting the adjacent tokenValue pointer and leading to memory corruption, application crashes, or denial of service.

hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser.

Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 file containing an avcC or hvcC atom with a declared size smaller than the atom header size can cause the payload-size calculation to wrap to a large unsigned value. The resulting invalid buffer allocation and copy operations can cause application termination.

libde265 commit 4d45a6b contains a NULL pointer dereference vulnerability in the NAL parsing path. When de265_push_NAL() is called with a zero-length NAL unit, the resulting NAL_unit may retain a NULL backing buffer, which is subsequently passed as the destination argument to memcpy() in NAL_unit::set_data(). Although the copy length is zero, this violates the nonnull requirement of memcpy() and results in undefined behavior, causing process termination in UBSan-instrumented builds and denial of service.

libsndfile 1.2.2 contains an integer overflow vulnerability in mat4_read_header() when parsing crafted MAT4 (MATLAB v4) files.

Termix versions 2.5.0 through 2.5.1 have a vulnerability in the /homepage/proxy endpoint that passes the url parameter to http.get or https.get without destination restrictions. URL validation is only syntactic, allowing requests to loopback, RFC1918, link-local, and cloud metadata destinations. An authenticated low-privilege user can exfiltrate internal service data and cloud credentials.

Snipe-IT before 8.7.0 allows an authenticated user with file-management access to upload XML and XSLT attachments and request them with inline=true. The browser can process an attacker-controlled xml-stylesheet reference and execute JavaScript generated by the stylesheet in the Snipe-IT origin. A victim must open the attachment URL, after which the script can read same-origin data and perform authenticated actions with the victim's privileges.

Snipe-IT before 8.7.0 allows a password-authenticated session for an account with self.api permission to reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web middleware group but not the API middleware group. The resulting token can read and modify resources with the victim's permissions and, for an administrator, can reach the users/two_factor_reset endpoint, allowing account takeover.

Snipe-IT before 8.7.0 allows a user with customfields.create permission to store markup in CustomField.name, which is assigned as an unescaped bootstrap-table header title. When another user opens an asset-list page, the stored markup executes on page load in that user's session, potentially exposing same-origin data and performing authenticated actions, including privilege escalation.

The @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile packages in versions from 1.1.47 to 2.3.3 (for the first two) and from 1.3.21 to 2.3.3 (for the third) have a vulnerability that causes transactions created through a remote StorageClient to trust output locking scripts returned by the storage provider without verifying they match the requested outputs. A malicious provider can substitute a recipient script or inject an additional output, redirecting funds while the UI displays the intended recipient.

phpMyFAQ before 4.1.6 has a vulnerability in the StopWords::add() method that builds a SQL INSERT statement using sprintf() and inserts the user-supplied stop word value directly into the query without calling the database escaping function. An authenticated administrator can submit a crafted value that breaks out of the SQL string literal and injects arbitrary SQL, including dropping tables, exfiltrating data, or modifying other rows.

MongoDB Compass can interpolate a database name without escaping into the initial input of its embedded MongoDB shell when a user opens the shell from that database's view. A user with privileges to create databases on a server that a Compass user connects to may, under specific conditions, have content evaluated as shell input within the Compass process, with that process's privileges.

Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can cause a caller-supplied lock owner value to be evaluated as an aggregation expression rather than as a literal value. An authenticated user who can influence the owner value may take over or prematurely expire a lock held by another process, leading to duplicated or conflicting operations.

A flaw in the Linux kernel's ksmbd module related to DACL permission checks has been fixed. The access control logic did not consider an Authenticated Users ACE (S-1-5-11), causing files accessible to authenticated users to incorrectly fail with STATUS_ACCESS_DENIED. Additionally, maximal access calculation combined access masks from all ACEs regardless of whether their SID applied to the current user, potentially granting rights belonging to unrelated principals.

In the Linux kernel, gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() uses the size_dais, size_controls and size_widgets fields to compute section offsets without validating them against the fetched size. A module reporting a small topology size but large section sizes makes offsets point past the allocation, causing out-of-bounds reads.