CVE Vulnerability Catalog

A flaw was found in the Observability Operator where deploying a Namespace-Scoped MonitorStack creates a ServiceAccount with a ClusterRole. This allows a Kubernetes account with only namespaced-level roles to escalate privileges to the cluster level by impersonating that ServiceAccount.

Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

W podatności CVE-2025-64293 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniach SQL, co prowadzi do możliwości ataku typu SQL Injection w aplikacji Golemiq 0 Day Analytics w wersjach od n/a do 4.0.0 włącznie.

CentralSquare Community Development version 19.5.7 has an Authentication Bypass vulnerability that allows attackers to access the admin panel without admin credentials.

CentralSquare Community Development version 19.5.7 has a SQL Injection vulnerability that allows attackers to inject SQL via the permit_no field.

In the Linux kernel TLS subsystem, if tls_strp_msg_hold fails for async decryption, it can lead to use-after-free (UAF) of the skb or writing to userspace memory after recv() returns.

In the Linux kernel on x86, switch_mm_irqs_off() lacks a memory barrier (smp_mb()) between the loaded_mm store and the tlb_gen load. This can cause context switching to miss a tlb_gen update and fail to flush TLBs, leading to stale data usage.

In the Linux kernel's IPv6 tunnel (ip6_tunnel), there is no limit on headroom growth, leading to perpetual tunnel expansion. A similar issue in IPv4 has already been fixed.

In the accel/qaic driver of the Linux kernel, the function find_and_map_user_pages() may return 0 before allocating an sgt when the DMA request length is 0 or when the device requests continuation after all bytes have been transferred. This leads to a general protection fault when accessing the uninitialized sgt.

In the Linux kernel's NVMe over Fabrics subsystem (nvmet-fc), a reference leak occurs for the target port (tgtport). When multiple LS commands are in flight, only one work item is queued, leading to unreleased references.

In the Linux kernel's networking stack, the sk_setup_caps() function uses unprotected access to dst->dev, which can lead to use-after-free (UAF). The fix introduces RCU protection for the access.

In the BPF verifier of the Linux kernel, the check_alu_op() function accepts negative values for the 'offset' field in ALU instructions because the condition 'insn->off > 1' passes all negative values. The fix tightens validation to require offset to be exactly 0 or 1.

In the Linux kernel, the SMC subsystem function smc_clc_prfx_match() uses sk_dst_get(sk)->dev without proper RCU or RTNL locking, potentially leading to use-after-free on the device structure.

In the Linux kernel's ext4 filesystem, there is no validation for an invalid combination of INLINE_DATA and EXTENTS flags in an inode. This combination can lead to a BUG_ON in ext4_es_cache_extent() due to integer underflow.

In the drm/xe/guc driver of the Linux kernel, during forced driver unbind, an exec queue may still be running and deregistration via GuC fails because CT communication is already disabled. This leads to resource leaks and memory management errors.

In the Linux kernel, a vulnerability in the NXP i.MX8 ISI (Image Sensor Interface) M2M driver causes improper streaming cleanup. Imbalanced streamon/streamoff calls (e.g., when exiting an application with Ctrl+C) prevent the usage_count from reaching zero, leaving the ISI channel unfreed. Additionally, an input line width over 2K triggers a WARN_ON().

A vulnerability in the Linux kernel related to the use of smp_processor_id() in preemptible code has been fixed. The bug report concerned a warning generated by dhcpcd, indicating improper use of this function in a preemptible context.

W jądrze systemu Linux zidentyfikowano podatność, która została naprawiona. Problem dotyczy sytuacji, w której timer dl_server nie jest zatrzymywany przed wyłączeniem CPU, co prowadzi do ostrzeżenia w jądrze podczas operacji usuwania CPU.

In the XSK (AF_XDP) subsystem of the Linux kernel, the xdp_desc validation functions do not reject certain invalid values, such as desc->len close to U32_MAX with non-zero tx_metadata_len, which can lead to integer overflows and transmission of invalid frames.

In the Linux kernel, the IPv6 stack's ip6_output() function did not use RCU, allowing a use-after-free (UAF) when accessing the device via dst_dev_rcu(). The fix adds RCU and removes unnecessary rcu_read_lock/unlock pairs from ip6_finish_output2().