CVE Vulnerability Catalog

In the Linux kernel, the amdgpu driver fixed an issue with doorbell mapping. Previously, xa_store_irq() allowed a newly created queue to overwrite an existing doorbell mapping, potentially causing misrouting of fence IRQ processing or erasing another queue's mapping. The fix uses xa_insert_irq(), which rejects mapping a reserved doorbell to a new queue.

In the Linux kernel, the ksmbd (SMB server) module has a vulnerability due to missing validation of the num_subauth field when copying ACE entries in the set_ntacl_dacl function. A malicious authenticated client can send a crafted security descriptor with an invalid num_subauth value, leading to an out-of-bounds heap read of approximately 1 KB.

In the Linux kernel, ksmbd has an issue with bounding the DACL dedup walk to copied ACEs. When copying ACEs stops early due to size overflow, the number of ACEs reflects only copied ones, but set_posix_acl_entries_dacl() still uses the original count, leading to scanning beyond the copied array.

In the Linux kernel, ksmbd has an issue with validating ACE size against SID sub-authorities. set_ntacl_dacl() does not verify that the declared ACE size contains all sub-authorities, leading to copying undersized ACEs and later out-of-bounds reads during deduplication.

A deadlock was found in the Linux kernel audit subsystem when duplicating executable-related rules. The issue occurs during file rename operations when an active audit rule matches the moved file — audit_dupe_exe() attempts to re-acquire the parent directory lock (I_MUTEX_PARENT) already held by the rename operation, causing a recursive locking deadlock. The patch introduces struct audit_watch_ctx to pass the fsnotify event context and avoid redundant path resolution.

Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the permission save endpoint, which performs no authorization check before synchronizing the submitted permissions to the specified role.

A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution.

Insufficiently Protected Credentials vulnerability in Zyxel Networks WAH7601 allows Retrieve Embedded Sensitive Data. This issue affects WAH7601 through 20072026.

In the Linux kernel, the Wacom HID driver has an issue where after starting HID hardware, but before registering input devices and initializing LEDs, failures can occur. In such cases, driver resources are released without stopping the HID hardware, potentially leading to an incorrect state. The fix routes post-start failures through hid_hw_stop() before releasing resources.

In the Linux kernel, the Bluetooth hci_uart driver did not clear the HCI_UART_SENDING bit when canceling write_work, which blocked future writes after reopening the device. The fix clears this bit and safely cancels the work using disable_work_sync and enable_work.

A stored cross-site scripting (XSS) vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar.

A server-side request forgery (SSRF) vulnerability in Koito through v0.3.2 allows an authenticated user to make the server perform HTTP requests to arbitrary internal or external hosts by supplying a crafted image_url value in the PATCH /apis/web/v1/album/{id}/image endpoint.

A missing authentication vulnerability in FUXA through 1.3.3 allows an unauthenticated remote attacker to query all historical sensor data via the DAQ_QUERY Socket.IO event. When secureEnabled=true, all other sensitive Socket.IO events (DEVICE_BROWSE, HOST_INTERFACES, DEVICE_TAGS_REQUEST, etc.) call isSocketAdminAuthorized to verify the connection token, but the DAQ_QUERY handler in server/runtime/index.js lacks this check entirely.

A time-of-check/time-of-use (TOCTOU) race condition in fastschema through v0.15.1 allows an unauthenticated remote attacker to bypass the OTP attempt limit on the account recovery flow, enabling brute-force attacks on 6-digit OTP codes.

A NULL pointer dereference vulnerability in fastschema through v0.15.1 allows an unauthenticated remote attacker to crash the server process with a single HTTP request. The sendOTPEmail function in pkg/auth/local.go dereferences a pointer obtained from an unchecked error path without validating it is non-nil, causing a fatal panic that terminates the entire server when a recovery request is sent to the /api/auth/local/recover endpoint.

A server-side request forgery (SSRF) vulnerability in duhow/xiaoai-patch through commit fb07049 allows a remote attacker to make the Xiaomi smart speaker perform HTTP requests to arbitrary internal or external URLs. The /auth endpoint in api/main.py uses the user-supplied url POST parameter to redirect to a Home Assistant instance without validating the destination URL, enabling internal network scanning and access to internal services.

An OS command injection vulnerability in NASA HyperCP (main branch) allows a network-adjacent attacker who can intercept or spoof responses from oceandata.sci.gsfc.nasa.gov to execute arbitrary system commands on the researcher's workstation.

A cross-site request forgery (CSRF) vulnerability in FreePBX Framework 17.0 allows an unauthenticated remote attacker to perform administrative actions on behalf of an authenticated administrator.

An OS command injection vulnerability in 4xmen/pm2panel (all versions) allows an authenticated remote attacker to execute arbitrary system commands on the host. The pm2panel.js handler at line 188 passes the unsanitized req.query.id parameter directly to exec('pm2 restart ' + id) without input validation or shell escaping, enabling command chaining via semicolons or other shell metacharacters.

A path traversal vulnerability in o1lab/xmysql (all versions) allows an unauthenticated remote attacker to read and download arbitrary files from the server. The lib/xapi.js file at lines 338 and 424 uses the user-controlled req.query.name parameter in path.join(cwd, name) without sanitization before passing it to res.download, enabling directory traversal via ../ sequences to access sensitive system files.