CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.29)
An improper access control vulnerability in Windows Hyper-V allows an authorized attacker to disclose information locally.
A protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally.
An exposure of sensitive information in Windows File Explorer allows an authorized attacker to disclose information locally.
An exposure of sensitive information in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.
An untrusted pointer dereference vulnerability in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to disclose information locally.
Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network.
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
Insecure permissions in Hubert Imoveis e Administracao Ltda Hub v2.0 1.27.3 allow authenticated attackers with low-level privileges to access other users' information via a crafted API request.
A vulnerability was found in the Linux kernel's ip6gre_header() function in the ip6_gre driver. The bug causes a kernel panic (kernel BUG) due to insufficient skb headroom, which can be exploited by an attacker to crash the system.
A reference count leak was discovered in the Linux kernel when deleting nexthop objects for IPv4 error routes (e.g., blackhole). Error routes were not flushed with the dead nexthop, keeping references on the nexthop object and device, preventing their release.
A race condition in the Linux kernel's MPTCP implementation during simultaneous connection setup leads to an inconsistent fallback status, triggering a WARNING and potential system crash.
A deadlock was discovered in the Linux kernel between nfc_unregister_device and rfkill_fop_write due to inverted lock ordering of device_lock and rfkill_global_mutex, causing thread blockage.
W jądrze systemu Linux zidentyfikowano podatność, która prowadziła do zakleszczenia podczas odczytu tabeli partycji z urządzenia blokowego ublk. Problem występował, gdy proces próbował uzyskać dostęp do urządzenia blokowego, co prowadziło do sytuacji, w której ten sam proces czekał na mutex, który już posiadał.
The Vanilla OS 2 Core image v1.1.0 from fabricators Ltd was found to contain static SSH keys, allowing attackers to perform a man-in-the-middle attack during connections with other hosts.
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response with Access-Control-Allow-Credentials: true. This enables malicious third-party websites to perform authenticated cross-origin requests against the Eramba API, including endpoints like /system-api/login and /system-api/user/me, exposing sensitive user session data.
A stack-based buffer overflow vulnerability in the mcp2200gpio utility in TinyOS versions up to and including 2.1.2. It is caused by unsafe use of strcpy() and strcat() functions when constructing device paths during automatic device discovery. A local attacker can exploit this by creating specially crafted filenames under /dev/usb/, leading to stack memory corruption and application crashes.
The D3D Wi-Fi Home Security System ZX-G12 v2.1.17 is susceptible to RF jamming on the 433 MHz alarm sensor channel. An attacker within RF range can transmit continuous interference to block sensor transmissions, resulting in missed alarms and loss of security monitoring. The device lacks jamming detection or mitigations, creating a denial-of-service condition.
W Angularze, platformie do tworzenia aplikacji webowych, zidentyfikowano podatność typu cross-site scripting (XSS) w kompilatorze szablonów. Problem wynika z niewłaściwego rozpoznawania atrybutów href i xlink:href w elementach SVG <script> jako kontekstu URL zasobów. Został on naprawiony w wersjach 19.2.18, 20.3.16, 21.0.7 oraz 21.1.0-rc.0.
A flaw was found in Keycloak regarding the authorization header parser. This parser is overly permissive regarding the formatting of the 'Bearer' authentication scheme, accepting non-standard characters as separators and tolerating case variations that deviate from RFC 6750 specifications.
The deploy-stub component in Panda3D up to version 1.10.16 contains a denial of service vulnerability due to unbounded stack allocation. The alloca() function allocates memory for argv_copy and argv_copy2 based on attacker-controlled argc without validation. Supplying a large number of command-line arguments can exhaust stack space and propagate uninitialized stack memory into Python interpreter initialization, causing a reliable crash and undefined behavior.