CVE Vulnerability Catalog

W jądrze Linuxa rozwiązano podatność dotyczącą systemu plików F2FS, która mogła prowadzić do wycieków liczników odniesień podczas odmontowywania. Problemy te były widoczne w testach Xfstests generic/335 i generic/336, które czasami kończyły się awarią.

W jądrze Linuxa naprawiono podatność związaną z funkcją team_queue_override_port_prio_changed(), która sprawdza, czy port jest włączony. Zgłoszono błąd syzkaller związany z usunięciem elementu z listy, co prowadzi do uszkodzenia struktury danych.

W jądrze Linuxa zidentyfikowano podatność związaną z walidacją adresu PHY w sterowniku ASIX. Złośliwe lub uszkodzone urządzenie może zwrócić nieprawidłowy adres, co prowadzi do problemów z działaniem systemu.

A low-privilege authenticated Samba AD user can modify internal LDB special DNs via LDAP access, enabling a domain takeover.

A TSIG packet with name compression can crash DNS. Incorrect size calculations when a TSIG record contains compressed names lead to a large out-of-bounds write, causing a server crash.

In GNU patch through version 2.7.6, there is a double free vulnerability in the another_hunk function in pch.c, which can cause a denial of service via a crafted patch file. This issue exists because of an incomplete fix for CVE-2018-6952.

Vulnerability description is not available.

A vulnerability in the libheif library used by sharp (which Next.js uses for image optimization) can lead to remote code execution when AVIF files are optimized. Until a fix has propagated, optimization of AVIF files is disabled.

When invoked with --remote-header-name (-J), curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows a remote HTTP server to overwrite files.

Nodemailer resolves an international (IDN / non-ASCII) recipient domain to a different Punycode label than every UTS-46-conformant parser (web browsers, WHATWG URL Standard, Node's url.domainToASCII, Python's idna). Its address normalizer (_normalizeAddress) may lead to incorrect domain resolution, enabling phishing or message misdirection.

No detailed description is available for CVE-2026-109117. Information about the vulnerability type, affected component, and exploitation mechanism is not provided.

A vulnerability in mysql2 (in lib/compressed_protocol.js, line 43) where zlib.inflate is used to decompress packets. When a connection is created with compress: true and the server advertises CLIENT_COMPRESS, each incoming packet is decompressed without limits, potentially leading to excessive memory usage or DoS.

Nodemailer's email-address parser treats an RFC 5322 comment inside the domain as a point to concatenate the surrounding text, rather than as folding whitespace (CFWS) that terminates the domain. This can lead to incorrect parsing, e.g., [email protected](x)evil.c..., potentially redirecting messages or bypassing validation.

Nodemailer's disableFileAccess/disableUrlAccess options are a security sandbox that forbids untrusted message content from reading local files or making outbound HTTP(S) requests. The fix for GHSA-wqvq-jvpq-h66f may be incomplete, allowing bypass of the sandbox.

Nodemailer's address parser parses comma-separated addresses in quadratic time (O(n²)) in the number of addresses. A single crafted address string (e.g., To, Cc, Bcc, From, Reply-To) can cause significant slowdown.

A rogue MySQL server (or a man-in-the-middle) can force mysql2 to send credentials in plaintext by requesting an auth switch to mysql_clear_password. The driver complies without verifying that TLS is active.

No detailed description is available for CVE-2026-87866. Only the CVE identifier is provided, with no information about the affected component, exploitation mechanism, or attack conditions.

gorilla/websocket used math/rand (a cryptographically weak pseudo-random number generator) to generate WebSocket frame mask keys. Masking keys MUST be unpredictable to prevent frame content injection attacks.

Several vulnerabilities (two rated critical under CVSSv3) have been discovered and fixed in the upstream libheif dependency. They can lead to remote code execution (RCE) on glibc-based Linux under certain conditions.

In the Linux kernel, in the L2TP subsystem, a possible tunnel refcount underflow was fixed, which could occur during session deletion when the tunnel pointer was invalid.