CVE Vulnerability Catalog

A vulnerability was found in the Linux kernel's ip4ip6_err() function in the IPv6-over-IPv4 tunnel. An uninitialized cb[] area in a cloned skb can be misinterpreted as an IPv4 structure, leading to attacker-controlled data reads and a stack buffer overflow.

In the Linux kernel X.25 stack, a double free of a socket buffer (skb) was discovered. When x25_queue_rx_frame fails to allocate memory, it frees the skb and returns an error, but the caller x25_backlog_rcv also attempts to free the same skb, causing a double free.

Version 7.1.2 of hashcat contains a heap-based buffer overflow vulnerability in the hex_to_binary function in the PKZIP hash parser. An attacker can exploit this flaw to cause a denial of service or potentially execute arbitrary code via a crafted PKZIP hash file.

In version 7.1.2 of hashcat, there is a heap-based buffer overflow in the Kerberos hash parser, allowing an attacker to cause a denial of service or potentially execute arbitrary code via a crafted Kerberos hash file.

A stack-based buffer overflow in mangle_to_hex_lower() and mangle_to_hex_upper() in hashcat v7.1.2 allows for denial of service or arbitrary code execution via a crafted rule file or the -j or -k options with password candidates of 128 or more characters.

A vulnerability has been identified in the Linux kernel related to use-after-free in the __ksmbd_close_fd() function. The issue arises when a durable file handle survives session disconnect, leading to improper management of byte-range locks.

W jądrze Linuksa naprawiono podatność, która pozwalała na zapis poza granicami bufora w funkcji smb2_get_ea(). Problem występował z powodu braku sprawdzenia długości bufora przed zastosowaniem wyrównania pamięci, co mogło prowadzić do nadpisania sąsiedniej pamięci jądra.

Apache MINA versions 2.1.0 to 2.1.11 and 2.2.0 to 2.2.6 are vulnerable to arbitrary code execution due to a lack of class verification in the AbstractIoBuffer.resolveClass() method. The fix was introduced in versions 2.1.12 and 2.2.7.

The fix for CVE-2026-41409 was not applied to the 2.1.X and 2.2.X branches of Apache MINA. The issue concerns an incomplete fix for CVE-2024-52046, where the classname allowlist for deserialization was applied too late.

The Temporary Login plugin for WordPress is vulnerable to Authentication Bypass in versions up to and including 1.0.0. This is due to improper input validation in the maybe_login_temporary_user() function, allowing authentication without a valid token.

JS8Call versions 2.3.1 and earlier, as well as JS8Call-improved before version 3.0, have a stack-based buffer overflow vulnerability that occurs during a radio transmission of @APRSIS GRID followed by a long Maidenhead locator. This issue occurs in the grid2deg function in APRSISClient.cpp.

Bitwarden CLI version 2026.4.0, obtained from npm on April 22, 2026, contained embedded malicious code. This incident is related to a Checkmarx supply chain issue.

A security vulnerability has been detected in Totolink NR1800X version 9.1.0u.6279_B20210910 in the function find_host_ip of the lighttpd component. Manipulation of the Host argument leads to stack-based buffer overflow.

A vulnerability was identified in the Totolink A8000RU device version 7.1cu.643_b20200521, affecting the function in the file /cgi-bin/cstecgi.cgi of the CGI Handler component. Manipulation of the argument proto leads to OS command injection.

A high severity authentication bypass vulnerability was found in Traefik's ForwardAuth and snippet-based authentication middleware. The issue stems from improper sanitization of header aliases using underscores instead of dashes, allowing an attacker to inject spoofed trust context and bypass authentication without valid credentials.

An authentication bypass vulnerability was found in Traefik's ForwardAuth middleware when trustForwardHeader=false is set and Traefik runs behind a trusted upstream proxy. The issue is fixed in versions 2.11.43, 3.6.14, and 3.7.0-rc.2.

CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to version 14.50. Attackers controlling a modified server can send a special packet that can overwrite a small portion of memory, potentially leading to memory corruption or denial of service.

CVE-2026-33446 is a buffer overflow in the authentication sub-system of the Secure Access client prior to version 14.50. Attackers controlling a modified server can send a special packet that can overwrite a small portion of memory, potentially leading to memory corruption or denial of service.

Podatność na przejście ścieżki w punkcie końcowym /content/images/add w shopizer v3.2.5 umożliwia atakującym zapis dowolnych plików w dowolnej ścieżce zapisu za pomocą odpowiednio skonstruowanego żądania POST.

W wersji 5.15.1 JeeSite występuje problem z parametrem fileMd5 w punkcie końcowym /a/file/upload, który pozwala uwierzytelnionym atakującym z uprawnieniami do przesyłania plików na wykonanie ataku typu path traversal. Umożliwia to zapisanie dowolnych plików z dozwolonymi rozszerzeniami w dowolnych lokalizacjach systemu plików, gdy przesyłanie w kawałkach jest włączone.