CVE Vulnerability Catalog

In the Linux kernel's netfilter nfnetlink_log, an uninitialized heap memory leak was found in the NFULA_PAYLOAD attribute. The __build_packet_message() function manually constructs the attribute, copying only payload data without zeroing the padding bytes, leaking kernel heap contents to userspace.

In the Linux kernel, the netfilter nf_conntrack_sip module has a vulnerability due to the use of an uninitialized rtp_addr variable in the process_sdp function. When the SDP body lacks active media descriptions, the variable remains uninitialized, causing SIP session addresses to be overwritten with arbitrary stack data.

In the Linux kernel, a vulnerability in the netfilter x_tables subsystem allows xt_match and xt_target extensions registered with NFPROTO_UNSPEC to be loaded by the ARP protocol family. Due to mismatched hook masks (NF_INET_* vs NF_ARP), validation passes incorrectly, leading to NULL pointer dereference and kernel panic.

In the Linux kernel, the HFSC network scheduler (sch_hfsc) is vulnerable to a divide-by-zero in rtsc_min(). The issue occurs when the difference of two 64-bit scaled values exceeds 2^32 and is stored in a 32-bit variable, truncating it to zero and causing a division error.

A vulnerability was found in the Linux kernel's flow classifier (cls_flow) for shared QoS blocks. The flow_change() function calls tcf_block_q() and dereferences q->handle, which is NULL for shared blocks, causing a NULL pointer dereference and system crash.

In the Linux kernel, a NULL pointer dereference was found in the cls_fw classifier when using filters on shared blocks. The issue occurs when an empty cls_fw filter is attached to a shared block and a packet with a nonzero skb mark is classified, causing a system crash.

W jądrze systemu Linux zidentyfikowano podatność, która pozwala na przekazanie wartości interwału równiej zeru do funkcji br_mrp_start_test() i br_mrp_start_in_test(), co prowadzi do pętli, która wyczerpuje pamięć systemową i powoduje panikę jądra. Problem ten dotyczy również funkcji br_mrp_start_in_test_parse() dla ramek testowych interkonektów.

In the Linux kernel, in the netfilter: ipset subsystem, a vulnerability was found in the mtype_del function that incorrectly handles logically empty buckets. The function failed to release a bucket when all entries were removed but the n->pos pointer still pointed past deleted slots.

In the Linux kernel, in the netfilter subsystem (nfnetlink_log), a bug was found in the size calculation of NLMSG_DONE messages. The netlink header size is not accounted for, which can trigger a WARN splat and drop the message.

A vulnerability in the Linux kernel's ip6_datagram_send_ctl() function for IPv6 allows a 16-bit opt_flen accumulator to overflow when multiple IPV6_DSTOPTS control messages are sent. This causes header size underestimation and triggers a kernel panic via skb_under_panic(), leading to a local DoS.

A vulnerability in the Palo Alto Networks Cortex XDR agent for Windows allows a local Windows administrator to disable the agent. The issue stems from a flaw in the protection mechanism.

W podatności CVE-2026-40447 występuje przepełnienie lub owinięcie liczb całkowitych w Samsung Open Source Escargot, co prowadzi do nieokreślonego zachowania. Problem ten dotyczy wersji Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

W podatności CVE-2026-40446 występuje problem z dostępem do zasobów przy użyciu niekompatybilnego typu ('confusion type') w Samsung Open Source Escargot, co umożliwia manipulację wskaźnikami. Problem ten dotyczy wersji Escargot: 97e8115ab1110bc502b4b5e4a0c689a71520d335.

A Stored Cross-Site Scripting (XSS) vulnerability in the NightWolf Penetration Testing Platform allows an attacker to inject and execute a malicious script in the user's browser.

Podatność związana z deserializacją niezaufanych danych w Samsung Open Source Escargot Java Script może prowadzić do stanu odmowy usługi poprzez przerwanie procesu. Problem dotyczy wersji escargot przed commit hash 97e8115ab1110bc502b4b5e4a0c689a71520d335.

A user interface issue in Microsoft Edge (Chromium-based) can lead to misrepresentation of critical information. This allows an unauthorized attacker to perform spoofing over a network.

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. Configured ClaimMapper and Authorizer were bypassed for the AdminService/StreamWorkflowReplicationMessages endpoint, allowing unauthenticated access.

In the LangSmith JavaScript/TypeScript SDK (langsmith) prior to version 0.5.18, an incomplete prototype pollution fix was found. The baseAssignValue() function only guards against the __proto__ key but fails to prevent traversal via constructor.prototype, allowing an attacker who controls keys in data processed by the createAnonymizer() API to pollute Object.prototype and affect all objects in the Node.js process.

A vulnerability in Axios versions prior to 1.15.0 and 0.3.1 allows a gadget-style attack chain where prototype pollution in a third-party dependency can be leveraged to inject unsanitized header values into outbound HTTP requests.

An SSRF vulnerability in GeoNode versions 4.4.5 and 5.0.2 (and prior) allows authenticated attackers to send outbound network requests to arbitrary URLs by submitting a crafted service URL during form validation. Insufficient IP filtering in the WMS service handler enables probing of internal network resources, including loopback addresses, RFC1918 private ranges, link-local addresses, and cloud metadata services.