CVE Vulnerability Catalog

A vulnerability in the Linux kernel's IB/isert (iSER) module allows an unauthenticated initiator to declare more data in a login PDU than was actually sent. This leads to an out-of-bounds read before authentication, potentially causing information disclosure or a system crash.

In the Linux kernel's sunrpc subsystem, xprtsock functions use plain stores and loads for shared callback pointers sk_data_ready and sk_write_space. This can lead to another CPU using a stale pointer after the original callbacks are restored. The fix adds READ_ONCE/WRITE_ONCE for these operations.

In the Linux kernel nvmet subsystem, nvmet_auth_negotiate() performs a heap out-of-bounds read because it does not validate the host-supplied transfer length (tl) or the halen/dhlen values. A malicious or non-conformant host can supply a too-small tl or too-large halen/dhlen (up to 255), causing reads past the allocated buffer. The fix passes tl into the function and rejects invalid values.

In the Linux kernel's smb (smbdirect) module, completion queues created by ib_alloc_cq_any() were torn down with ib_destroy_cq(), which did not cancel the previously queued ib_cq_poll_work(). A late completion (e.g. an RNR error from Soft-RoCE/rxe) re-queued the poll work on the already-freed CQ, causing a use-after-free.

In the Linux kernel NFSv4 client, nfs4_alloc_client() allocates an NFSv4.0 callback identifier before finishing client setup. If a later initialization step fails, the error path frees the nfs_client directly via nfs_free_client(), bypassing removal of the cb_ident_idr entry and leaving a stale pointer to freed memory.

A vulnerability exists in the Linux kernel's inetpeer rate limiting system, which stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. An off-path adversary can predict the tree topology and force eviction of targeted nodes, resetting their rate-limiting token buckets, which allows bypassing IP-keyed ICMP rate limits and inferring open UDP ports. The fix randomizes the RB-tree node comparison using SipHash with a secret key.

In the Linux kernel, the NFSv4.1 implementation fails to zero referring call lists before decoding. decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), leaving each referring_call_list uninitialized, and decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().

Vulnerability in ash_authentication related to dynamic_oidc strategy that fails to maintain proper identity namespace separation across connections. An attacker controlling one connection can be signed in as a local user created through a different connection because user identities are not correctly separated.

In pgAdmin 4, the 'webserver' authentication source was vulnerable because WebserverAuthentication.get_user() fell back to reading the username directly from inbound HTTP request headers when the WSGI/CGI environment lookup returned nothing. As a result, any client able to reach pgAdmin could supply that header itself and authenticate as any username, including an existing Administrator, without a password. The issue affects versions from 6.2 before 9.18 and only applies when 'webserver' is enabled in AUTHENTICATION_SOURCES.

In ash_authentication there is an improper authentication vulnerability that allows an attacker to sign in as another user by linking their OAuth2 identity to an account that is not theirs. The attacker can attach a verified email to an account matched on other attributes, leading to session hijacking.

In CakePHP, the FunctionsBuilder methods (cast, extract, datePart, dateAdd) allow SQL injection by improperly handling user-controlled input. Untrusted data is incorporated into SQL syntax without proper escaping, potentially enabling attackers to execute arbitrary queries.

In Vendure, the createCustomerAndUser function in external authentication matches an existing customer by email address and attaches a new external authentication method without requiring verification. An attacker can use an unverified email to hijack the victim's account.

In vm2 before 3.11.6, the builtin: ['*'] configuration does not restrict access to os and dns builtins, allowing sandbox code to read host process identity and network topology. Attackers can use dns.setServers() to hijack the host process's DNS resolver globally.

vm2 through 3.11.6 does not normalize 'node:'-prefixed builtin specifiers when matching negative (deny) entries in a NodeVM wildcard require policy. A policy such as ['*', '-node:child_process'] fails to deny the canonical child_process module because matching uses exact string comparison against canonical builtin names. Sandboxed code can therefore obtain the host child_process builtin and gain access to process-spawning APIs such as execSync and spawn, equivalent to host command execution.

In vm2 versions 3.10.1 through 3.11.6, there is a sandbox escape via WebAssembly.compileStreaming and instantiateStreaming, allowing attackers to access the host process object on Node.js 26, leading to full host control.

In vm2 before 3.11.8, there is a sandbox escape vulnerability via console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and execute code on the host process, bypassing code generation restrictions.

In vm2 versions from 3.11.0 before 3.11.8, host TypedArray and ArrayBuffer prototypes are not protected from sandbox mutation. Attackers can modify prototypes, affecting host-created typed arrays and potentially leading to unauthorized actions.

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin. On Node.js 24+, module.builtinModules exposes the scheme-only key node:test, which is not covered by vm2's family-based DANGEROUS_BUILTINS protection, and because requireImpl() strips only a single 'node:' prefix, sandbox code calling require('node:node:test') receives a proxy to the host module, with node:test.run() forwarding attacker-controlled execArgv (e.g. --eval) to execute arbitrary JavaScript in an unrestricted host process.

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.