CVE Vulnerability Catalog

In the Linux kernel's netfs subsystem, an overrun vulnerability was found in netfs_extract_user_iter(). If iov_iter_extract_pages() overfills the pages[] array, excess pages may be included in the constructed iterator, leading to memory corruption.

In the Linux kernel, a vulnerability was found in the mlx5e driver for Mellanox network cards, involving unprotected writes to the ICOSQ during CPU affinity changes while NAPI polling is active. Lack of synchronization can lead to queue data corruption and hardware errors.

In the Qualcomm PHY driver (qmp-usbc) in the Linux kernel, an out-of-bounds array access occurs in the DP swing configuration because the boundary check uses "> 4" instead of ">= 4", allowing index 4 to access memory beyond the allocated 4x4 arrays.

In the Linux kernel, the krb5 crypto library and AF_RXRPC lack length checks before decryption/verification. New facilities for pre-checking message length have been added, and AF_RXRPC now validates DATA packets secured with RxGK.

The Easy Appointments plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check and missing nonce verification on the `ea_delete_multiple_connections` AJAX action in all versions up to and including 3.12.27.

Out-of-bounds read vulnerability (CWE-125) in BACnet packet parsing (`bacdt_datetime_to_tod`) in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.18 on LINX-A64. An unauthenticated remote attacker can crash `linx_a64.exe` and ultimately reboot the device by sending a malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with an invalid month value.

Reflected Cross-Site Scripting (CWE-79) in LWEB802 in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious `project` or `mspParams` parameter.

Exposure of Sensitive Information (CWE-200) in LWEB802 browser `localStorage` in Loytec LWEB-802 before version 5.0.8 on all platforms. An unauthenticated remote attacker can leak stored management credentials via a crafted link.

In Devolutions PowerShell Universal 2026.2.2 and earlier, the variables feature suffers from code injection. An authenticated user with variable write permission can execute arbitrary PowerShell code via a crafted variable value that is not properly escaped when written to the configuration file.

Code injection vulnerability in the schedule feature of Devolutions PowerShell Universal 2026.2.2 and earlier. An authenticated user with schedule creation permission can execute arbitrary PowerShell code via crafted schedule parameter names.

Improper Authentication (CWE-287) in the PAM configuration in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A local attacker can authenticate as a uid=0 account without a password and obtain a root shell via an `/etc/passwd` entry with an empty password field.

Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. A `superadmin`-group attacker can reset the password of any LARM user (including the `larmapp` service account) via the `set-passwd` subcommand.

Stored Cross-Site Scripting (CWE-79) in the OPC XML-DA server statistics in Loytec products (LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD) through version 8.4.16 on LINX-A64. An unauthenticated remote attacker can execute arbitrary JavaScript in an administrator's browser (session hijacking, credential theft, device reconfiguration) via a crafted `User-Agent` header in a `POST /da` request.

Note: This CVE and blog post don't exist because we determined this is actually a cloud-only issue. Access controls are 'broken' when a user can access resources they are not authorized to access. An attacker can bypass any access control mechanisms in a web application and gain unauthorized access to resources not available with their permissions.

Denial of service vulnerability in Apache Neethi when manually retrieving remote policy references via API. Retrieving a huge policy can cause resource exhaustion. Fixed in version 3.2.3 by imposing a default maximum data size.

Bypass of the maximum number of normalized policy alternatives in Apache Neethi 3.2.2 via crafted policies, potentially leading to DoS via resource consumption. Fixed in version 3.2.3.

Uncontrolled recursion vulnerability in Apache Neethi when parsing policies without IDs or with deeply nested structures, leading to DoS via memory exhaustion. Fixed in version 3.2.3.

NULL pointer dereference vulnerability in Apache NimBLE in the LE Long Term Key Request event. Requires disabled asserts and a bogus controller, so severity is low. Affects versions through 1.9.0. Fixed in 1.10.0.

Reachable assertion vulnerability in Apache NimBLE. A specially crafted ATT Read Multiple Variable Response can trigger an assert in the ATT parser. Requires prior request from the DUT. Severity medium. Affects versions through 1.9.0. Fixed in 1.10.0.

Out-of-bounds write and integer underflow vulnerability in Apache NimBLE BASS service. Improper validation when parsing "Add Source" and "Modify Source" operations can lead to stack buffer overflow or arbitrary out-of-bound read. Requires pairing and authentication. Affects versions through 1.9.0. Fixed in 1.10.0.