CVE Vulnerability Catalog

In the Linux kernel, the drm/amdkfd driver has a vulnerability where the CRIU control stack checkpoint copy is not bounded to the allocated BO size. The copy uses the hardware value cp_hqd_cntl_stack_size, which may be larger than the allocated region, leading to out-of-bounds read and kernel data leak to userspace. The fix clamps the copy size to the buffer size.

In the Linux kernel, the drm/vmwgfx driver has a vulnerability due to lack of validation of the array_size field in the vmw_surface_metadata structure. This field comes from userspace and should be validated against specific limits depending on the available Shader Model.

In the Linux kernel's drm/vc4 driver, vc4_gem_object_mmap() rejects writable mappings of validated shader BOs but leaves VM_MAYWRITE set. Userspace can map the BO read-only and then make it writable with mprotect().

In the Linux kernel's btrfs filesystem, when splitting extent maps, the new maps inherit the EXTENT_FLAG_LOGGING flag, which is never cleared. This can lead to a WARN_ON and use-after-free when the map is freed.

In the Linux kernel's txgbe network driver, txgbe_read_eeprom_hostif() always copies round_up(length, 4) bytes into the caller buffer, which is allocated with exactly 'length' bytes. A non-4-aligned length causes an out-of-bounds write (heap overflow).

In the Linux kernel's libceph library, there is a bug in handle_get_version_reply() which uses msg->front_alloc_len as the decode boundary for MON_GET_VERSION_REPLY. Since this is the buffer size, not the actual received bytes, a truncated reply can cause an uninitialized memory read from stale tail bytes.

In the Linux kernel's VXLAN driver, there is a missing CAP_NET_ADMIN requirement in the device network namespace during changelink operations. A caller privileged in the device namespace but not in the underlay namespace can modify VXLAN tunnel configuration, potentially leading to unauthorized changes.

calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before update_annotations() passes attacker-controlled JSON to db.merge_annotations_for_book(), which allows a readonly user or an anonymous user on an unauthenticated deployment to persist unauthorized book annotation changes. This issue is fixed in version 9.12.0.

Calibre before version 9.12.0 processes attacker-controlled composite_template metadata from malicious EPUB, OPF, PDF, or similar files through program: and a nested template() call whose formatter does not inherit allow_python_templates=False, allowing a nested python: template to reach compile_python_template and execute arbitrary Python code when the file is opened or imported. This issue is fixed in version 9.12.0.

Kestra before version 2.0.0 passes the user-controlled http() uri argument to URI.create() and the server-side HTTP client without restricting private, loopback, or link-local destinations, allowing an unauthenticated attacker to import and execute a flow that accesses internal services or cloud metadata.

Kestra before version 2.0.0-rc6 serves GET /worker without authentication and serializes the complete live Task object, which can expose commands, environment variables, HTTP headers, connection details, plaintext credentials, and execution identifiers while the main API on port 8080 remains protected. This issue is fixed in 2.0.0-rc6.

The Mira Android companion app v4.5.15.4 identifies the paired Mira hormone analyzer by performing a substring match against the BLE advertisement name only, with no cryptographic peripheral authentication, MAC allowlist, or bonded-identity check. An attacker could capture live session token information and inject forged hormone measurements into the victim's cloud record and clinical trend view.

In the Mira hormone monitor device firmware v1.7.1.47 build 01070147, a remote unauthenticated attacker within BLE range (approximately 10–30 meters) can silently rebind the device to an attacker-controlled account, extract stored hormone measurements in cleartext, cause a denial-of-service via malformed or undocumented command opcodes, and passively track the user via a static random BLE address that never rotates.

libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built with the libssh2 SSH backend (USE_SSH=libssh2) contain a shell command injection vulnerability that allows remote attackers to execute arbitrary commands on an SSH server by supplying a repository path containing unescaped shell metacharacters such as single quotes, semicolons, or pipes. The gen_proto() function in ssh_libssh2.c inserts the repository path directly into a shell command string without escaping special characters before passing it to libssh2_channel_exec(), enabling an attacker to craft a malicious submodule URL in a .gitmodules file that, when processed during a recursive clone, causes the remote server's shell to interpret injected commands under the victim's SSH user account.

cJSON versions 1.5.0 through 1.7.19 contain an incorrectly-resolved name or reference vulnerability in the decode_pointer_inplace() function within cJSON_Utils.c that allows unauthenticated attackers to cause JSON Patch operations to target wrong object keys by supplying crafted JSON Pointer escape sequences (~0 or ~1) in patch paths. Attackers can submit malicious RFC 6902 JSON Patch input to applications using cJSONUtils_ApplyPatches() or cJSONUtils_ApplyPatchesCaseSensitive() to silently corrupt data or delete unintended keys, potentially bypassing authorization controls in applications that rely on JSON Patch for access-controlled data modification.

Use after free in Blink in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in HTML in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Extensions in Google Chrome prior to 151.0.7922.137 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: High)

Use after free in TabStrip in Google Chrome on Mac prior to 151.0.7922.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in V8 in Google Chrome prior to 151.0.7922.137 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)