CVE Vulnerability Catalog

In the Linux kernel, an inconsistency in the F2FS filesystem was found during fsck due to incorrect use of flags in NAT entries. The issue stems from a lack of mutual exclusion when reading flags by f2fs_need_dentry_mark() relative to the checkpoint path, leading to incorrect inode block marking.

A missing authentication vulnerability was found in simpleui version 2026.01.13 in the self.get_action function of simpleui/admin.py at the AjaxAdmin AJAX endpoint. The issue can be exploited remotely and the exploit has been made public.

A missing authentication vulnerability has been found in Gerapy up to version 0.9.13 in the project upload endpoint within gerapy/server/core/views.py. The attack can be launched remotely and a public exploit is available.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the claw_tool_invoke function of the RPC handler. Incorrect authorization allows remote exploitation without proper privileges. The exploit is public and the project has not responded to the issue report.

QueryWeaver contains an authentication bypass vulnerability allowing unauthenticated attackers to obtain valid session tokens for existing accounts by submitting a signup request with a known victim email address. The signup route unconditionally creates and links a new token to the matching identity before checking if the email belongs to an existing account, returning a valid authenticated session token for the victim's identity without requiring prior credentials.

In SourceCodester Class and Exam Timetabling System 1.0, a SQL injection vulnerability exists in the file /edit_room1.php. An attacker can remotely manipulate the ID argument, leading to unauthorized database access. The exploit has been publicly disclosed.

SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_rooma.php file. An attacker can manipulate the ID argument to execute remote SQL queries.

Heap buffer overflow in ProFTPD mod_sftp. An authenticated SFTP user can send a packet with length 0, causing an underflow and buffer overflow, leading to session crash or potentially further consequences.

A security flaw was discovered in zevorn rt-claw up to version 0.2.0, involving server-side request forgery (SSRF). The issue affects the receiver_thread function in the file claw/services/swarm/swarm.c within the http_request component. The attack can be performed remotely, and the exploit has been publicly released.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/tools/tool_net.c. Manipulation of the url argument leads to server-side request forgery (SSRF). The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the Swarm RPC Receiver component. The handle_rpc_request function in claw/services/swarm/swarm.c causes incorrect authorization, allowing remote exploitation. The exploit has been publicly disclosed and may be used.

A server-side request forgery (SSRF) vulnerability was found in the rt-claw library up to version 0.2.0 in the claw_net_get and claw_net_post functions. The issue is in the file claw/services/tools/net.c, where the url argument can be manipulated by an attacker. The exploit has been made public, and the project has not responded to the report.

Vulnerability in urwid web backend (urwid/display/web.py) generating session IDs using cryptographically insecure Mersenne Twister PRNG. Attacker can reconstruct PRNG state after observing ~334 IDs and predict all sessions. Also, session ID is used as FIFO filename in /tmp, allowing local users to enumerate active sessions.

Heap-based buffer overflow in getData() function in OpenPLC_v3 (webserver/core/modbus_master.cpp). Function reads data between delimiters into a buffer without size check, allowing authenticated attacker to send crafted HTTP POST to /modbus with oversized device_name, causing heap corruption.

SurrealDB before version 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by redirecting to blocked IP addresses. Attackers can host a public server that redirects to internal resources.

SurrealDB before versions 2.0.5, 2.1.5, and 2.2.2 fails to properly escape table and field names in the CLI export command. An authenticated System User with OWNER or EDITOR roles can create tables or fields with malicious SurrealQL names; when a higher-privileged user imports the backup, the injected code executes, enabling privilege escalation and root-level takeover.

SurrealDB before versions 2.2.6, 2.3.6, 2.1.8, and 3.0.0-alpha.7 fails to validate DNS-resolved hostnames against deny-net restrictions in http::* functions. An authenticated user can use a hostname that resolves to a blocked IP, bypassing access controls.

Vulnerability in SurrealDB before version 1.1.0. Improper parsing of ID, DB, and NS headers in HTTP REST API requests with special characters. Unauthenticated attacker can send crafted HTTP requests causing an uncaught exception that crashes the server.

SurrealDB before version 1.1.1 contains a format string vulnerability in the rquickjs Exception::throw_type function when scripting is enabled. Attackers with scripting privileges can supply format string sequences in error inputs.

Vulnerability in SurrealDB before version 1.5.5 (and 2.0.0-beta before 2.0.0-beta.3) in the RPC API. An unauthenticated attacker can supply a binary object with a subquery in place of credentials, leading to execution of the subquery in the context of the database owner with editor role.