CVE Vulnerability Catalog

In TS3 Manager prior to 2.2.6, the /api/download handler passes the attacker-controlled port parameter to socket.connect and returns the error message as text/html without a Content Security Policy. When a logged-in operator follows a crafted link, the reflected script executes in the manager origin, and the token cookie lacking HttpOnly, Secure, and SameSite can be read. This enables operator-session hijacking and control of the managed TeamSpeak server. The issue is fixed in 2.2.6.

In the FaustWP WordPress plugin prior to 1.8.11, only the ciphertext in the token envelope is authenticated, and the 16-byte initialization vector is excluded from the HMAC. A logged-in non-administrator who obtains an authorization code from GET /generate can modify the unauthenticated initialization vector so that CBC decryption changes the token type and user identifier while the HMAC remains valid. This can yield an Administrator access token and permit full WordPress REST API access, administrator-account creation, plugin installation, and arbitrary code execution. The issue is fixed in 1.8.11.

In Traccar prior to 6.14.0, an authenticated non-readonly user with access to an object usable in a permission pair can submit DELETE /api/permissions with an extra attacker-controlled JSON key. Validation checks only the first two keys, but removePermission() concatenates every map key into the SQL WHERE clause as column identifiers, enabling SQL injection and extraction of arbitrary database values, including administrator email, password hashes, and salts. The issue is fixed in 6.14.0.

In lxc-ci, images built from images/archlinux.yaml prior to the 2026-05-28 Arch Linux image publication retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine created from that image. An attacker who controls an HTTP package mirror or can intercept mirror traffic can use the shared pacman signing private key to sign modified packages that affected clients accept as trusted. Installing those packages permits arbitrary code execution as root on the client system. The issue is fixed in Arch Linux images published on or after 2026-05-28.

A stack-based buffer overflow vulnerability has been discovered in MCC Universal Library for Linux (uldaq). This may result in information disclosure or arbitrary code execution. The vulnerability affects uldaq v1.2.1 and prior versions.

A vulnerability has been found in code-projects Matrimonial System 1.0. It affects the writepartnerprefs function in /partner_preference.php, where manipulation of the education argument leads to SQL injection. The attack can be executed remotely and the exploit has been publicly disclosed.

In NetLicensing MCP Server prior to 0.1.6, HTTP requests to /mcp that omit API key credentials pass through ApiKeyMiddleware without authentication. The downstream context then falls back to the operator's API key, allowing an unauthenticated attacker to invoke MCP tools and perform operations on licensing objects, including destructive deletes.

In OpenDDS prior to 3.34.0, a network attacker can send a malformed RTPS UDP submessage that causes the read pointer to advance beyond valid data. This results in a SIGSEGV in the receive thread and termination of the DDS process. No authentication or user interaction is required.

In rabbitmq-c prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune.frame_max value, leading to a heap buffer overflow and memory corruption. This can cause denial of service and theoretically code execution.

MISP contains a stored cross-site scripting (XSS) vulnerability in the Overmind theme's statistics views. The event General card and the server/feed preview card constructed donut chart legend labels by directly concatenating object name or category keys into an innerHTML string without HTML-encoding. Because MISP object names are user-controllable by any authenticated user with sufficient permissions, an attacker could craft a name containing malicious markup. When any other user viewed the affected Overmind dashboard, the injected markup would be interpreted as live HTML/JavaScript in the victim's browser.

MISP contains a vulnerability in its background job dispatch mechanism that allows remote code execution as the web user. Background job arguments are passed directly as the argv of the CakePHP console process. The events/contact endpoint passes user-controlled fields (message and person) into job arguments without validation. An attacker can set the person field to a reserved switch and the message field to a phar:// URI pointing to a malicious archive, leading to PHP code execution.

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into ClickHouse string literals without escaping. An authenticated attacker can inject SQL through funnel step definitions to execute arbitrary queries and read results in HTTP responses.

A flaw was found in the Linux kernel's batman-adv module in the batadv_bla_add_claim() function, which adds claims and modifies backbone CRC values. When the new-claim code path runs in parallel with the change-backbone code path, the backbone_gw pointer can be switched twice, producing an incorrect CRC. This wrong CRC is never recomputed from stored claims, causing persistent inconsistency.

In the Linux kernel, the dm-pcache module did not validate cache segment IDs from persistent memory before indexing into cache->segments[]. With only CRC protection using a public seed, an attacker with CAP_SYS_ADMIN supplying the cache device could cause out-of-bounds reads and writes via crafted metadata. The fix adds validation and rejects invalid segment IDs with -EIO.

A use-after-free vulnerability was found in the Linux kernel's virtio_pmem driver for NVDIMM persistent memory. The issue occurs when a request has already been freed by the submitter but is still reachable via the virtqueue, leading to waking up freed memory during interrupt handling.

In the Linux kernel, the drm/v3d driver does not clear queue->active_job when v3d_fence_create() fails. The run_job() callbacks for BIN, RENDER, TFU and CSD assign the job to queue->active_job before calling v3d_fence_create(); on failure they return NULL, leaving a dangling pointer. The fix adds a failure path clearing active_job.

In the Linux kernel, cros_typec_register_partner_pdos() copies partner PDOs from the EC TYPEC_STATUS response into the fixed caps_desc.pdo[PDO_MAX_OBJECTS] array (7 entries) without validating the count. If source_cap_count or sink_cap_count exceeds 7, memcpy writes past the stack array — a count of 255 overflows it by about 1 KB. The fix validates the counts and skips PDO registration when exceeded.

A use-after-free vulnerability exists in the Linux kernel HID subsystem. When a driver calls hid_device_io_start() and then fails during later initialization, unwinding via hid_hw_stop() can free the hidraw structure while in-flight HID reports are still being processed on another CPU, causing a dereference of freed memory. Eight drivers are affected because they do not call hid_device_io_stop() before hid_hw_stop().

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd and vddcInd indices from VBIOS-parsed tables. Invalid indices could cause out-of-bounds access to voltage lookup tables.

In the Linux kernel, the drm/amdgpu/pm/powerplay module lacked bounds checks on vddInd, vddciInd and mvddInd indices from VBIOS-parsed tables across nine sites. Invalid indices could cause out-of-bounds access to vddc, vddci and vddmem lookup tables.