CVE Vulnerability Catalog

In the Linux kernel I2C subsystem, there is a race during adapter deregistration. An adapter can be looked up via i2c_get_adapter() after its resources have been freed, leading to a use-after-free.

In the Synaptics RMI4 (F3A) driver, the keymap is allocated for at most 6 entries, but the GPIO count (0-127) is not bounded. A device with gpio_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Synaptics RMI4 (F30) driver, the keymap is allocated for at most 6 entries, but the GPIO/LED count (0-31) is not bounded. A device with gpioled_count > 6 causes out-of-bounds read in the interrupt and via EVIOCGKEYCODE/EVIOCSKEYCODE ioctls, potentially leaking adjacent slab memory to userspace.

In the Goodix touchscreen driver, the contact count reported by the device is not clamped. The max_touch_num value (0-15) is taken from configuration without clamping, which can lead to a stack out-of-bounds write in goodix_ts_read_input_report() when touch_num > 10.

In the Linux kernel, the iforce driver lacks validation of the force-feedback effect index from the device. The index masked only with 0x7f (range 0-127) is used to address the core_effects[] array with only 32 entries, causing out-of-bounds read/write. A malicious or counterfeit device can set or clear a bit at an arbitrary offset past the object.

In the Linux kernel's mms114 touch driver, there is an indexing error for MMS134S and MMS136 controllers. The driver uses the wrong structure size (8 bytes) instead of the actual event size (6 bytes), causing touch events to be read from incorrect offsets.

In the Linux kernel's touchwin driver, there is a heap out-of-bounds write vulnerability. The packet index is not reset when the second and third data bytes do not match, allowing a malicious device to continuously increment the index and write beyond the buffer.

In the Linux kernel's mms114 driver, there is a stack out-of-bounds write vulnerability. The driver does not check the upper limit of the packet size from the device, allowing up to 255 bytes to be read into a fixed 80-byte buffer, causing stack overflow.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_ref_folio() function unlocks the request but does not re-lock it before returning, potentially leading to use-after-free.

In the Linux kernel FUSE filesystem, a use-after-free vulnerability exists. The fuse_resend() and fuse_remove_pending_req() functions do not remove the intr_entry from the fiq->interrupts list, leading to use-after-free during iteration.

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. The fuse_uring_async_stop_queues() function may run after the last reference to ring->queue_refs has been dropped.

In the Linux kernel fuse-uring subsystem, a race condition exists regarding the queue->stopped flag. The fuse_uring_commit_fetch() function checks queue->stopped without a lock, and the value is not set under lock in fuse_uring_abort_end_requests().

In the Linux kernel fuse-uring subsystem, a use-after-free vulnerability exists. A malicious user can send commit SQEs for requests not yet sent to the FUSE server, potentially leading to use-after-free during memcpy operations.

The WPForms Pro plugin for WordPress up to version 1.10.1.1 is vulnerable to arbitrary file upload via the ajax_chunk_upload_finalize function. File type validation occurs after data is written to disk, and failed validation does not delete the assembled file. An unauthenticated attacker can upload executable files, leading to remote code execution.

Knot Resolver before version 6.4.1 allows remote code execution via a heap-based buffer overflow in the DoQ (DNS-over-QUIC) receive path.

Redis before version 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the same NACK (pending entry) is referenced by more than one consumer. Deleting both consumers via XGROUP DELCONSUMER leads to a double free. This issue exists because of an incomplete fix for CVE-2026-25243.

Weintek cMT3092X HMI allows a non-privileged user to modify tokens to escalate privileges.

Weintek cMT3092X HMI allows a non-privileged user to modify cookies to gain elevated privileges.

NLTK (Natural Language Toolkit) before version 3.9.3 contains an eval injection vulnerability in the nltk.collocations module. When collocations.py is invoked directly, command-line arguments are passed to eval() without validation, allowing an attacker to execute arbitrary Python code, including OS commands via the os module.

FFmpeg 7.0 through 8.1.2, fixed in commit 4da9812, contains a heap out-of-bounds write vulnerability in the vf_quirc filter. An attacker can supply a crafted PGS/SUP subtitle file with mismatched frame dimensions, causing data to be copied beyond the allocated buffer, leading to heap corruption and potential code execution.