CVE Vulnerability Catalog

GNU Emacs before 31.2 (and TRAMP through 2.8.2) allows OS command injection via a filename because tramp-user-regexp has an incomplete list of disallowed inputs. NOTE: this issue exists because of an incomplete fix for CVE-2026-79992.

databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can be specified by any authenticated user. For example, --result-file=/app/public/index.php can write to index.php. In other words, quoting prevents OS command injection in mariadb-dump, but the argument injection alone is sufficient for code execution indirectly.

Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web interface. Affects versions before 11.2.

A vulnerability was identified in zhayujie CowAgent up to 2.2.0 in the json.loads function of the Streaming Tool-Call Argument Handler. Manipulation leads to resource allocation issues. The attack can be initiated remotely and the exploit is publicly available.

Interuse i-Bos version 3.0 has an SQL injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker to manipulate database queries.

A vulnerability in the Zephyr Bluetooth LE stack allows a remote, unauthenticated attacker to trigger a use-after-free in L2CAP CoC channel handling with dynamic PSMs. By sending a data frame followed by a disconnect request, the attacker can cause the system workqueue to process work referencing a freed channel, leading to memory corruption or workqueue corruption.

The LLCP implementation in Zephyr's Bluetooth LE Controller retains a receive node after accepting LL_PHY_UPDATE_IND, but invalid-PDU paths fail to release it before completing the procedure. An attacker can send a PDU sequence causing an assertion failure (device crash) or leaking nodes from the receive pool, leading to Bluetooth unavailability until reboot.

A vulnerability in the Bluetooth Link Layer control procedure code (ull_llcp_conn_upd.c) causes a retained RX node not to be released when the Connection Update / Connection Parameter procedure takes the 'invalid PDU, terminate the connection' path. This results in a leak of a node from the controller's RX pool. The issue is remotely triggerable by a peer device in radio range without pairing, bonding, or encryption.

The Bluetooth Link Layer Control Procedure (LLCP) implementation for Connected Isochronous Stream (CIS) creation leaks a retained RX node (ctx->node_ref.rx). When the invalid PDU paths in ull_llcp_cc.c terminate the connection without releasing that retained node, the invariant checked in llcp_lr_check_done() and llcp_rr_check_done() is broken. A peer device within radio range can trigger this with a single extra LL Control PDU on an unauthenticated, unencrypted ACL link.

Vulnerability in the I2S driver for Espressif (ESP32) chips in Zephyr OS. The i2s_esp32_trigger_check() function does not validate stream pointers for RX/TX directions, leading to NULL dereference when only one direction is configured. An unprivileged user-mode thread can call i2s_trigger() with an unsupported direction and cause a kernel panic (denial of service).

The NXP MCUX TRNG entropy driver in Zephyr (drivers/entropy/entropy_mcux_trng.c) passes the caller's byte count directly to the SDK routine TRNG_GetRandomData(), which on i.MX RT5xx/RT6xx parts always copies whole 32-bit words and rounds entropy draws up to a multiple of 128 bytes. A request length not a multiple of four causes an underflow in the SDK's buffer-full check, leading to an overflow of up to 127 bytes past the caller's buffer.

The RFC 6528 initial-sequence-number implementation in subsys/net/ip/tcp.c derived every TCP ISN from SHA-256(unique_key || four-tuple) plus an uptime-derived offset, where unique_key is a 128-bit secret filled once by sys_csrand_get(). The return value of that call was discarded and the once guard was latched to true even when the call failed. Because sys_csrand_get() leaves the destination buffer untouched on failure, a single failed call left unique_key as its all-zero BSS content for the remainder of the boot, with no retry, no log message and no fallback.

A vulnerability in Zephyr's syscall verifiers z_vrfy_fuel_gauge_get_props() and z_vrfy_fuel_gauge_set_props() allocates variable-length arrays on the kernel stack sized directly by an unvalidated caller-supplied len argument. Because no bounds check occurs before allocation and copying, a user-mode thread (with CONFIG_USERSPACE) can trigger an out-of-bounds write in supervisor mode with attacker-controlled length and, on the permitted path, attacker-controlled content.

An out-of-bounds read vulnerability was found in the IPv6 subsystem of the Zephyr stack in net_route_ipv6_packet(). The issue stems from missing validation of whether a neighbor cache entry has a link-layer address before using it. An attacker on the same link can force an unresolved neighbor state and trigger an out-of-bounds read past the address array, potentially causing a system panic or data leak.

The Goodix GT9xx input driver in drivers/input/input_gt911.c reads the touch point count from the controller's status register and masks it with 0x0F, yielding a value of 0..15. This value is used directly as the loop bound for filling the stack array point_reg[], sized to CONFIG_INPUT_GT911_MAX_TOUCH_POINTS (Kconfig range 1..5, default 1). A controller reporting more points than the array holds causes up to 112 bytes of peer-supplied data to be written past the end of the array on the system workqueue thread's stack.

In the Zephyr zbus subsystem, the proxy agent IPC backend (subsys/zbus/proxy_agent/zbus_proxy_agent_ipc.c) logged the channel name of a rejected inter-domain frame using a plain %s conversion without ensuring NUL termination. The struct zbus_proxy_msg frame carries a fixed-size channel_name[] array as its last member, and the only code verifying termination rejects exactly such frames — so the warning printed a non-terminated buffer precisely on the error paths. Any peer domain able to place a frame of sizeof(struct zbus_proxy_msg) bytes on the bound ipc_service endpoint can trigger it.

omarchy-theme-set in Omarchy 4 before 4.0.1 allows code execution via a third-party theme because the files placed into ~/.local/state/omarchy/current/theme may include executable content from an untrusted Git repository.

Several Postiz endpoints return the complete database row of the record they operate on instead of only the fields the client needs. Two of them include secrets the caller is not meant to receive: the public API's channel delete returns the channel's platform access token and refresh token, and GET /user/organizations returns each organization's API key to every member. Both endpoints require a valid session, API key or OAuth token and are scoped to the caller's own organization.

pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated attackers to bypass API access checks by spoofing the Host header. Attackers can send Host: localhost with private_api_key=dev772277 and the default allowed URL to retrieve member emails, IP addresses, phone numbers, and bank account fields.

pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitive member data because UserController::users() and user() return unfiltered database rows. Attackers holding a valid private API key can retrieve bcrypt password hashes, non-expiring hashValidation reset tokens, and TOTP secrets to take over accounts and bypass two-factor authentication.