CVE Vulnerability Catalog

A flaw was found in p11-kit where a remote attacker could call the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior.

A vulnerability has been discovered in Grafana OSS that allows an authorization bypass in the provisioning contact points API. Users with Editor role can modify protected webhook URLs without the required alert.notifications.receivers.protected:write permission.

Mattermost Plugins versions <=11.4, 11.0.4, 11.1.3, 11.3.2, and 10.11.11.0 fail to validate incoming request size, allowing an authenticated attacker to disrupt service via the webhook endpoint.

A flaw was found in GIMP, which is a heap buffer over-read in the PCX file loader due to an off-by-one error. A remote attacker could exploit this by convincing a user to open a specially crafted PCX image.

A NULL pointer dereference vulnerability was found in the Linux kernel's icmp_tag_validation() function. When hardened PMTU mode is enabled (ip_no_pmtu_disc=3) and an ICMP Fragmentation Needed packet with an inner IP header containing an unregistered protocol number is received, a kernel panic occurs in softirq context.

A vulnerability in NATS-Server before versions 2.11.15 and 2.12.6 allows a malicious client to cause unbounded memory usage before authentication via WebSockets connection. The attack requires sending a corresponding amount of data and is a milder variant of CVE-2026-27571.

Domoticz versions prior to 2026.1 contain a stored cross-site scripting vulnerability in the Add Hardware and rename device functionality. An authenticated administrator can inject malicious code via crafted names containing script or HTML markup, which is stored and executed in the browsers of other users viewing the affected page.

A vulnerability in the web-based management interface of Cisco Catalyst SD-WAN Manager allows an authenticated, remote attacker to perform a cross-site scripting (XSS) attack against a user of the interface. This is due to insufficient input validation.

W jądrze systemu Linux zidentyfikowano podatność, która pozwala na błędne usunięcie gniazda z kolejki odbiorczej przez zbieranie śmieci (GC) w wyniku wywołania MSG_PEEK. Problem ten występuje w sytuacji, gdy gniazdo jest zamykane podczas sprawdzania jego stanu przez GC, co prowadzi do nieprawidłowego wniosku o martwym gnieździe.

W jądrze systemu Linux zidentyfikowano podatność związana z wyciekiem pamięci w funkcji ice_set_ringparam. Problem polega na tym, że w przypadku niepowodzenia alokacji rx_rings, tx_rings i xdp_rings pozostają niezwolnione, co prowadzi do wycieku pamięci.

A NULL pointer dereference vulnerability was found in the Linux kernel's bridge br_do_suppress_nd() function. It occurs when IPv6 is disabled via ipv6.disable=1 and an ICMPv6 Neighbor Discovery packet reaches the bridge, causing a kernel crash.

In the Linux kernel, the ETS (Enhanced Transmission Selection) network scheduler has a divide-by-zero vulnerability in the offload path. The issue is caused by unsigned integer overflow when computing WRR weights, potentially leading to a kernel panic.

W jądrze Linuxa zidentyfikowano podatność związaną z niewłaściwym dziedziczeniem parametrów przez zadania SCHED_DEADLINE podczas zmiany priorytetu. Problem ten może prowadzić do błędów w obliczaniu pasma, gdy zadanie nie jest poprawnie oznaczane jako wzmocnione.

In the Linux kernel, the dell-wmi-sysman driver's set_new_password() function hex dumped the entire buffer containing plaintext passwords. The hex dump has been removed to prevent credential leakage.

An AB-BA deadlock was discovered in the Linux kernel during PHY LED trigger registration. The issue occurs when both LEDS_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled, causing mutual blocking when accessing the trigger list and the RTNL mutex.

In the Linux kernel, the kalmia USB driver lacks validation of USB endpoints. A malicious USB device without the expected endpoints can cause a kernel crash when the driver blindly accesses them.

A vulnerability has been identified in the Linux kernel in the ioremap_prot() function, which may lead to memory read errors from the kernel level on arm64 systems with PAN enabled. The issue lies in returning a new user mapping that is inaccessible to the kernel.

In the Linux kernel irdma driver, a kernel stack leak was found in irdma_create_user_ah(). The reserved field of the response structure is not zeroed before being sent to userspace, leaking 4 bytes of stack memory.

A vulnerability was found in the Linux kernel's MPTCP (Multipath TCP) endpoint management. It triggers a warning when removing an endpoint with both 'signal' and 'subflow' flags while the MPTCP subflow limit is set to 0. The issue stems from incorrectly marking the endpoint as used, leading to state inconsistency.

A vulnerability in the Linux kernel allows changing the transmission hash policy to vlan+srcmac while an XDP program is loaded on a bond in 802.3ad or balance-xor mode. This can lead to incompatibility and errors when destroying bonds.