CVE Vulnerability Catalog

A vulnerability in the parse_month function (/time/strptime.rs) of relibc (commit ab6a2e) allows an attacker to cause a Denial of Service (DoS) by parsing a crafted input.

In RustFS from version 1.0.0-alpha.1 to 1.0.0-beta.9, when the FTP frontend is enabled, the read and probe handlers (RETR, SIZE, MDTM, CWD) bypass the IAM authorization function, allowing any authenticated FTP user to read and stat any object in any bucket regardless of their IAM policy.

In RustFS versions from 1.0.0-alpha.1 to 1.0.0-beta.9, an authorization bypass was found in the bucket replication admin API. The ListRemoteTargetHandler for listing remote replication targets only checks whether request credentials exist, but does not verify that the caller has replication or administrator permissions. As a result, an authenticated user with no effective bucket or admin permissions can list remote replication target configuration for a bucket.

In the Linux kernel, a vulnerability in the vfio/pci driver causes DMABUFs not to be cleaned up before the PCI function is disabled during device shutdown. This creates a race window where after clearing the MSE bit, BARs remain accessible via DMABUF.

In the Linux kernel, a vulnerability in the F2FS filesystem was found where f2fs_sbi_show() reads extension_list, extension_count, and hot_ext_count without holding sb_lock. Concurrent modification via sysfs can lead to inconsistent reads, potentially causing out-of-bounds access or displaying stale data.

A use-after-free vulnerability was found in the Linux kernel's enetc network driver, related to DMA buffer handling in the NTMP mechanism. The bug can lead to silent memory corruption when a freed DMA buffer is reused by hardware.

In the Linux kernel, the mailbox-test driver fails to free channels on probe error, causing a memory leak and potential use-after-free (UAF) scenarios because the client structure is removed automatically by devm.

In the Linux kernel, the mailbox-test driver has a double-free vulnerability when the RX channel is aliased to the TX channel with different MMIO. Freeing both channels triggers the bug.

In the Linux kernel, a use-after-free vulnerability was found in the DRM driver for Intel Xe GPUs. The xe_eu_stall_stream_close() function called drm_dev_put() before disabling the stream and freeing resources, potentially accessing freed memory.

In the Linux kernel's idpf driver, a vulnerability causes double free and use-after-free in auxiliary device error paths. When auxiliary_device_add() fails, the error handling code incorrectly falls through, freeing the same iadev structure twice and accessing freed memory.

In the Linux kernel's Btrfs filesystem, a bug was found where the dirty_pages io tree was prematurely cleared after a failed write during transaction commit. This caused dirty extent buffers to not be properly cleaned up during unmount, leading to warnings and potential data loss.

In the Linux kernel IOMMU subsystem for Intel VT-d, a vulnerability was found causing NULL pointer dereference or refcount corruption. The issue occurs when teardown operations are executed without checking if the dev_pasid structure exists, potentially leading to system crashes or memory safety violations.

In OpenProject before versions 17.3.3 and 17.4.1, there is a CSRF vulnerability on the /users/:id path via the POST parameter user[admin]. An attacker can exploit this to unauthorizedly change admin privileges.

OpenProject versions prior to 17.3.3 and 17.4.1 store the OneDrive/SharePoint userless OAuth access token in plaintext in Rails.cache under a deterministic key. The token is continuously refreshed by an hourly cron and OAuth call sites, and none of the allowed cache backends (file_store, memcache, redis) encrypt data at rest.

In RustFS 1.0.0-beta.4, authenticated users with PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write arbitrary objects into other users' buckets, completely breaking multi-tenant isolation. The vulnerability chains three flaws: no ../ sanitization in tar entry key normalization, IAM wildcard matching using raw (uncleaned) paths, and filesystem path cleaning resolving ../ across bucket boundaries.

A vulnerability in OpenProject before versions 17.3.3 and 17.4.1 allows the journal diff endpoint to disclose hidden historical field values without enforcing object and field visibility.

Cudy LT300 running firmware prior to version 2.5.12 contains an OS command injection vulnerability. An authenticated attacker can inject shell metacharacters into the cbid.system.ntp.current POST parameter in the system time configuration interface, leading to remote code execution.

A vulnerability in Envoy allows a crash when using the %REQUESTED_SERVER_NAME(X:Y)% log format with HOST_FIRST or SNI_FIRST options and a missing host header. Affected versions are 1.37.0 through 1.37.4 and 1.38.0 through 1.38.2.

A vulnerability in Devolutions Remote Desktop Manager allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name collision with an existing VPN script link. The issue affects the custom PowerShell VPN editor in versions 2026.2.5 through 2026.2.11.

The extract-zip library does not validate symlink targets when extracting zip archives. When processing a malicious zip file containing a symlink with a relative path like '../../../../etc/passwd', extract-zip extracts the symlink without validation, allowing it to point outside the extraction directory. Depending on how extract-zip is used, an attacker could read or write to arbitrary files.