CVE Vulnerability Catalog

An improper initialization vulnerability in the AMD Secure Encrypted Virtualization (SEV) firmware allows an admin-privileged attacker to corrupt RMP-covered memory, potentially leading to loss of guest memory integrity.

The touch utility in uutils coreutils is vulnerable to a TOCTOU race condition during file creation. After identifying a missing path, the utility later attempts creation using File::create(), which internally uses O_TRUNC. An attacker can exploit this window to create a file.

A vulnerability in the rm utility of uutils coreutils allows bypassing safeguards that protect the current directory. The utility correctly refuses to delete . or .., but fails to recognize equivalent paths with trailing slashes, such as ./ or .///.

The html.Parse function in the golang.org/x/net/html package enters an infinite loop when processing specially crafted HTML input. An attacker can exploit this vulnerability to cause a denial of service (DoS).

The 'id' utility in uutils coreutils miscalculates the 'groups=' section of its output. The implementation uses the user's real GID instead of their effective GID to compute the group list, leading to potentially divergent output compared to GNU coreutils.

A logic error in the `ln` utility of uutils coreutils causes the program to reject source paths containing non-UTF-8 filename bytes when using target-directory forms (e.g., `ln SOURCE... DIRECTORY`). While GNU ln treats filenames as raw bytes and creates links correctly, the uutils implementation enforces UTF-8 encoding.

The vulnerability in the Crass library causes unbounded processing of scientific notation in CSS values before clamping the result to Float::MAX. An attacker can send a small crafted CSS string that forces excessive CPU and memory consumption.

A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape.

The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used. It is recommended to use the maintained package github.com/ProtonMail/go-crypto/openpgp instead.

No description is available for CVE-2026-6502. The nature of the vulnerability cannot be determined.

The html.Parse function in golang.org/x/net/html has quadratic parsing complexity for specially crafted HTML inputs, which can lead to denial of service (DoS).

Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields. OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure.

A segmentation fault was discovered in the libde265 library (commit d9fea9d) in the decoder_context::compute_framedrop_table() function. This vulnerability may cause crashes in applications using this library.

An issue was discovered in py-lmdb 0.97 where for certain values of md_flags, mdb_node_add does not properly set up a memcpy destination, leading to an invalid write operation. This occurs when accessing a data.mdb file supplied by an attacker.

An issue in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host, allowing attackers to view sensitive information.

Checking excessively long DSA keys or parameters may be very slow. Applications using EVP_PKEY_param_check() or EVP_PKEY_public_check() to verify DSA public keys or parameters may experience long delays.

Serving WebSocket protocol upgrades over an HTTP/2 connection could result in a Null Pointer dereference, leading to a crash of the server process, degrading performance.

Windows libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Libarchive has a remote code execution vulnerability. Technical details are not provided in the description.

Null pointer dereference in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows an attacker to crash the server via a malicious request.