CVE Vulnerability Catalog

CVE-2026-13163 describes an open redirect vulnerability in the _safe_redirect function of the click-tracking endpoint in Mailerup versions before 1.0.0. This allows remote unauthenticated attackers to redirect victims to arbitrary external sites, potentially leading to phishing attacks.

Flowise through version 2.2.7 contains a SQL injection vulnerability in the importChatflows API. Due to insufficient validation of the chatflow.id value, an authenticated user can supply a crafted JSON import file whose id field is concatenated unsanitized into a SQL IN clause, allowing arbitrary SQL to be executed, including blind and error-based extraction of data from the credential table.

In ccyl13 Pentestify version 1.0.0 and lower, there is a Server-Side Request Forgery (SSRF) vulnerability in the PDF generation endpoint. An attacker can exploit this flaw to send requests to arbitrary internal or external URLs, potentially leading to the exposure of sensitive data.

In the Linux kernel's ksmbd (SMB) filesystem, a missing access control for FSCTL_SET_SPARSE was found. The fsctl_set_sparse() function modifies the sparse attribute of a file without checking if the share is read-only or if the client has proper permissions (FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES).

TortoiseGitBlame is vulnerable to argument injection via malicious Git history filenames, leading to arbitrary file write in TortoiseGit.

In the Linux kernel, a vulnerability in the SMC (Shared Memory Communications) subsystem causes a NULL pointer dereference in the smc_msg_event tracepoint. The tracepoint unconditionally dereferences conn->lnk, which is NULL for SMC-D connections, leading to a kernel crash on the first sendmsg() or recvmsg() call on an SMC-D socket when tracing is enabled.

In the Linux kernel, the tun_put_user() function declares an on-stack struct virtio_net_hdr_v1_hash_tunnel without zeroing it. For non-tunnel packets, only the first 10 bytes are initialized, leaving bytes 10..23 as stack garbage. An unprivileged user can set the vnet header size to 24 bytes, causing 14 bytes of kernel stack data to be leaked to userspace on every read of a non-tunnel packet.

In the Linux kernel, a vulnerability in the RDS/IB driver causes a NULL pointer dereference in rds_ib_send_cqe_handler() when handling masked atomic completions. The rds_ib_send_unmap_op() function lacks handling for masked atomic opcodes (IB_WR_MASKED_ATOMIC_CMP_AND_SWP and IB_WR_MASKED_ATOMIC_FETCH_AND_ADD), returning NULL and triggering a kernel panic in softirq context.

A NULL pointer dereference vulnerability was found in the Linux kernel's BPF subsystem within bpf_sk_storage_clone and bpf_sk_storage_diag_put_all functions. A concurrent RCU reader can observe a storage element (selem) still on the list after its smap pointer has been cleared by bpf_selem_unlink_nofail(), leading to a crash.

In the Linux kernel, a stack info leak was found in the tap driver via the SIOCGIFHWADDR ioctl. The tap_ioctl() function copies 16 bytes of an uninitialized sockaddr_storage structure to userspace, while netif_get_mac_address() only writes 6 bytes of the MAC address, leaving 8 bytes uninitialized. These 8 bytes may leak sensitive kernel data, including pointers, defeating KASLR.

In the Linux kernel, the jitterentropy crypto mechanism replaced a long-held spinlock with a mutex. Previously, the spinlock was held during expensive entropy generation and SHA3 conditioning, causing CPU stalls for parallel readers.

A vulnerability was found in the Linux kernel's IPC Shared Memory (shm) subsystem. The orphan cleanup function (shm_destroy_orphaned) does not properly synchronize reading the shm_nattch counter with update operations, potentially leading to premature removal of a shared memory segment.

A vulnerability was found in the Linux kernel's AF_UNIX socket implementation. The SIOCATMARK ioctl, which reports the urgent data mark position (MSG_OOB), was accessible for all socket types, even though MSG_OOB is only supported for SOCK_STREAM. For SOCK_DGRAM and SOCK_SEQPACKET sockets, which reject MSG_OOB, the call now returns -EOPNOTSUPP.

In the Linux kernel's batman-adv module, a vulnerability exists where the currently selected gateway pointer is not cleared during mesh teardown, leaving stale state that can break subsequent mesh recreation.

In the Linux kernel VRF subsystem, a potential NULL pointer dereference (NPD) was found when removing a port from a VRF. RCU readers may assume a net device is a VRF port and call l3mdev operations on a new master device (e.g., a bridge) that lacks them, leading to NULL dereference.

In the Linux kernel netfilter/ipset subsystem, a vulnerability was found in IPv4 range iteration for hash:ip,mark, hash:ip,port, hash:ip,port,ip, and hash:ip,port,net sets. The 32-bit iterator may advance past the end of the requested range after processing the last address, causing a later retry to continue from an unintended position.

In the Linux kernel, the batman-adv module is vulnerable to recursive processing of BATADV_UNICAST_FRAG packets. A malicious sender can craft a packet whose reassembled payload is itself a BATADV_UNICAST_FRAG packet, causing unbounded recursion and kernel stack exhaustion.

In the Linux kernel, the batman-adv module has a NULL pointer dereference vulnerability. When a network interface is disabled, its mesh_iface pointer is set to NULL, but batadv_v_ogm_send_meshif() may still dispatch OGMv2 packets through the disabled interface, causing a crash due to accessing NULL.

The MotorDesk plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.1.2. This is due to missing or incorrect nonce validation on the motordesk_admin_home function.

The Book a Room Event Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in all versions up to and including 1.9. This is due to missing or incorrect nonce validation in the settings_form()/update_settings() functionality.