CVE-2022-1999

CVE-2022-1999 affects GitLab CE/EE, all versions before 14.10.5, 15.0 before 15.0.4, and 15.1 before 15.1.1. under certain conditions, an unprivileged user could change a labels description via the REST API. The issue is documented across multiple feeds (NVD, OSV, Nessus plugins) with consistent ...

CVE-2024-53190

The CVE 2024-53190 entry describes a Linux kernel issue in the Realtek RTLWiFi driver, where the efuse read path (read_efuse/read_efuse_byte during rtl8192cu probe) could loop up to 10k times on failure, causing extended system hang. The mitigated behavior is to drastically reduce retry attempts ...

CVE-2022-46283

This CVE-2022-46283 entry is rejected/not used as stated in the Description.

CVE-2022-1186

The WordPress plugin Be POPIA Compliant (vulnerable up to 1.1.5) exposes site visitors’ emails and usernames to unauthenticated users via an API route. Root cause cited in multiple sources is insufficient access controls on the API route (no restrictions on sensitive data exposure). No exploit de...

CVE-2024-56576

CVE-2024-56576 affects the Linux kernel media: i2c tc358743 driver. The issue occurs when an error happens in probe(): the previously alarmed polling timer is not removed, causing a timer callback on freed arguments and a crash. A patch fixes the crash by removing the polling timer in the probe e...

CVE-2022-1505

The RSVPMaker WordPress plugin has an unauthenticated SQL Injection in rsvpmaker-api-endpoints.php (and related ~rsvpmaker-email.php) due to insufficient escaping/parameterization. Affects versions up to 9.2.6 per CVE-2022-1505; impact is disclosure of database data. Connected sources reiterate t...

CVE-2024-8377

This CVE ID is rejected/not used and does not represent an active vulnerability entry.

CVE-2025-24884

The CVE-2025-24884 entry concerns kube-audit-rest, a simple logger for Kubernetes API mutations. When the here-described full-elastic-stack example vector is used, previous values of Kubernetes secrets could be disclosed in audit messages due to the logger capturing sensitive data. Fixed in versi...

CVE-2024-53685

CVE-2024-53685 concerns the Linux kernel Ceph path construction: when the full path built by ceph_mdsc_build_path() exceeds PATH_MAX, the function enters an endless retry loop, effectively DoS-ing the system. The description notes the fix is to remove the retry and fail with ENAMETOOLONG instead,...

CVE-2022-2884

CVE-2022-2884 affects GitLab CE/EE with authenticated remote code execution via the Import from GitHub API endpoint. Affected versions span from 11.3.4 up to 15.1.5, and also include 15.2.x (up to 15.2.3) and 15.3.x (up to 15.3.1), according to the vulnerability description. Public exploit activi...

CVE-2025-21646

In CVE-2025-21646, the afs issue in the Linux kernel is resolved by enforcing a maximum cell name length of 253 bytes. The kafs filesystem previously allowed up to 256 bytes, but creating a directory under /proc/net/afs/ with that name hit procfs’ 255-byte filename limit, causing a warning. The D...

CVE-2024-56701

CVE-2024-56701: Linux kernel powerpc/pseries code fixed a sleeping-lock issue by changing dtl_access_lock to a rw_semaphore because kmalloc() can sleep while held. Root cause: a non-sleeping lock protected code path that sleeps, causing a potential sleep in atomic context. Impact is local (LOCAL)...

CVE-2021-42013

Summary: CVE-2021-42013 covers an incomplete fix to CVE-2021-41773 in Apache HTTP Server 2.4.49/2.4.50. Root cause: path traversal vulnerabilities in the 2.4.50 fix could map URLs outside configured directories; if CGI is enabled for aliased paths, remote code execution could occur. Affected vers...

CVE-2016-1908

OpenSSH CVE-2016-1908 affects the OpenSSH client before 7.2, where cookie generation for untrusted X11 forwarding can be mishandled when the local X server lacks the SECURITY extension. This could allow remote X11 clients to trigger a fallback to trusted forwarding, bypassing intended access cont...

CVE-2024-57948

Summary (CVE-2024-57948) : In the Linux kernel, the mac802154 subsystem had a vulnerability where, during removal of an IEEE 802.15.4 network interface, a list-del operation could run on a stale sdata entry if local interfaces had not been validated first. This could allow a corrupted list path t...

CVE-2020-25681

CVE-2020-25681 affects dnsmasq up to version 2.83. The vulnerability is a set of DNSSEC-related heap/buffer overflows: CVE-2020-25681 (sort_rrset overflow), CVE-2020-25682 (extract_name length issue), CVE-2020-25683 (get_rdata memcpy overflow), CVE-2020-25684/25685/25686 (reply_query handling tha...

CVE-2019-1068

CVE-2019-1068 is a remote code execution vulnerability in Microsoft SQL Server caused by a stack overflow in the svl.dll component during processing of internal functions. An authenticated attacker (low privileges) can trigger it remotely via a specially crafted SQL query , gaining code execution...

CVE-2024-56592

CVE-2024-56592 (Linux kernel) relates to BPF hash table management for maps. The vulnerability arises when a map element is freed while holding a bucket lock, triggering a lockdep warning due to bpf_map_fd_put_ptr() calling bpf_map_free_id() which acquires map_idr_lock. The fix defers free_htab_e...

CVE-2024-56597

CVE-2024-56597 is a confirmed Linux kernel vulnerability affecting the JFS filesystem logic. The issue is a shift-out-of-bounds in jfs/dbSplit, triggered when dmt_budmin is less than zero, leading to errors in later stages. The fix adds a pre-check in dbAllocCtl to return an error earlier, preven...

CVE-2024-53147

CVE-2024-53147 affects the Linux kernel exFAT filesystem driver. When directory size is at least a cluster and start_clu becomes an invalid/EOF cluster due to filesystem corruption, the code may access ei->hint_femp.eidx outside the directory, causing out-of-bounds access and potential filesys...

CVE-2023-52924

CVE-2023-52924 describes a Linux kernel vulnerability in nf_tables/netfilter where expired elements were wrongly skipped during a set walk, causing use-count inconsistencies and potential WARNs during chain removal. The issue arises in asymmetry between preparation/commit phases when a set elemen...

CVE-2024-41935

CVE-2024-41935 (Linux kernel, f2fs) : The issue concerns the f2fs extent tree shrink operation. The patch changes the shrink process to operate on read extent nodes in batches, reducing the time a core rwlock is held and preventing potential kernel hangs when the extent tree contains a large numb...

CVE-2024-57849

The CVE-2024-57849 issue is in the Linux kernel s390 CPUMF sampling path. When a CPU is hotplugged out while a performance event is still active on that CPU, the hotplug/removal sequence can cause SDBs (sampling data buffers) to be freed while still in use, creating a potential use-after-free con...

CVE-2024-53196

CVE-2024-53196 affects the Linux kernel (arm64/KVM). The issue is that KVM could retire an aborted MMIO instruction and advance the PC even when a synchronous external abort was pending, triggering a kernel WARN in kvm_emulate.h and related call paths. The documented fix is to skip MMIO emulation...

CVE-2020-8492

CVE-2020-8492 describes a Regular Expression Denial of Service (ReDoS) in Python’s urllib.request.AbstractBasicAuthHandler that can be triggered by a malicious HTTP server. The vulnerability affects Python 2.7 (up to 2.7.17) and multiple 3.x releases (up to 3.8.1 per the CVE summary). Connected a...

CVE-2024-55881

CVE-2024-55881 : In the Linux kernel, KVM for x86 had a fix to correctly detect 64‑bit hypercalls during complete_hypercall_exit() for guests with protected state (e.g., SEV-ES/SEV-SNP). The change replaces is_64_bit_mode() with is_64_bit_hypercall() to determine 64‑bit mode when the vCPU state n...

CVE-2022-0482

Easy!Appointments before 1.4.3 is affected by a Broken Access Control vulnerability that allows an unauthorized user to retrieve sensitive appointment data via a public-facing API endpoint (examples reference /index.php/backend_api/ajax_get_calendar_events) due to missing authentication/permissio...

CVE-2024-56584

CVE-2024-56584 concerns the Linux kernel: a flaw in io_uring/tctx could leave tctx->xa head non-NULL after xa_store() allocation failures, even when there are no entries. Syzbot WARN_ON_ONCE(!xa_empty(&tctx->xa)) could trigger during final put of an io_uring_task. The available documents de...

CVE-2024-57931

CVE-2024-57931 is a Linux kernel issue in the SELinux subsystem: when evaluating extended permissions, the patch changes behavior to ignore unknown permissions instead of triggering a BUG(), allowing future permissions to be added without breaking older kernels. The unit described in connected da...

CVE-2022-0665

Vulnerability summary (CVE-2022-0665) : A path traversal flaw exists in pimcore/pimcore prior to version 10.3.2. The vulnerability stems from insufficient validation of the importFile parameter at the endpoint /admin/translation/import, allowing an attacker to delete arbitrary files on the server...

CVE-2024-56637

CVE-2024-56637 (Linux kernel) : A race in netfilter/ipset where the ipset module reference may be unloaded while a set-type backend module is being requested, potentially causing a kernel crash. The race can be triggered by inserting an mdelay() immediately after nfnl_unlock(). The vulnerability ...

CVE-2024-36472

In GNOME Shell versions through 45.7 , a portal helper can be launched automatically without user confirmation. This occurs because an adversary—such as one controlling a local Wi-Fi network—can provide specific network responses that trigger the helper. Once launched, the helper may load untrust...

CVE-2024-57929

CVE-2024-57929 : In the Linux kernel, the vulnerability stems from dm-array: when dm_bm_read_lock() fails, a faulty dm_block pointer can be left behind, leading to a double release in dm_array_cursor_end() and a subsequent BUG_on in dm-bufio. The fix (as described in the CVE text) sets the cached...

CVE-2025-21632

CVE-2025-21632: In the Linux kernel, a patch fixes shadow stack handling for x86 XSAVE state accessed via ptrace. Previously, regset get/set paths could be invoked with shadow stacks disabled (ARCH_SHSTK_SHSTK==0), causing get_xsave_addr() to return NULL and trigger a WARN_ON in ssp_get. The fix ...

CVE-2024-56594

CVE-2024-56594 references a Linux kernel vulnerability in the DRM/AMDGPU path where the sg segment length was not properly limited. The issue could cause over-mapping of AMDGPU sg length and trigger warnings from debug_dma_map_sg(), due to an incorrect max_segment_size. The connected advisories (...

CVE-2024-56590

The CVE-2024-56590 entry concerns the Linux kernel Bluetooth stack (hci_core) and a fix for not checking whether skb actually contains an ACL header in hci_acldata_packet. The issue could cause access to uninitialized/invalid memory beyond skb->data when an ACL header is absent. The fix is a k...

CVE-2024-27032

The Linux kernel 's f2fs file system component contains a vulnerability where a kernel panic can be triggered during recovery. Specifically, if FAULT_BLOCK is enabled, the function f2fs_reserve_new_block() may return -ENOSPC, leading to a panic. Additionally, if the fault injection rate is set to...

CVE-2024-57904

CVE-2024-57904 affects the Linux kernel’s IIO subsystem for at91: the at91_ts_register path frees the wrong object during error handling. The code currently calls input_free_device() on st->ts_input, but the err path can run before iio_dev is assigned to st->ts_input. The fix is to call inp...

CVE-2021-4034

Polkit pkexec (setuid) contains a local privilege escalation flaw where pkexec fails to validate the calling parameter count and may treat crafted environment variables as commands, enabling unprivileged users to execute arbitrary code with root privileges. This has been reported across multiple ...

CVE-2024-53220

The CVE-2024-53220 issue concerns the f2fs file system in the Linux kernel. The root cause is that dirty data was not accounted correctly in __get_secs_required(), which can trigger a system panic when certain conditions (checkpoint_disabling and lfs_mode) are both enabled, leading to over-alloca...

CVE-2024-29740

A security vulnerability exists in the ACPM subcomponent of Google Pixel devices. The flaw is caused by a missing bounds check in the tmu_set_table function of the tmu.c file, leading to a potential out-of-bounds write . This vulnerability can result in a local escalation of privilege (EoP) witho...

CVE-2025-21679

CVE-2025-21679—Linux kernel (btrfs): The issue arises in get_canonical_dev_path() where d_path()’s possible error is not handled, causing an invalid memory access on the subsequent strscpy() call. The patch reintroduces proper error handling for d_path() to prevent the memory access, addressing t...

CVE-2022-27873

CVE-2022-27873 affects Autodesk Fusion 360 through the document parser’s Insert SVG pathway. The affected component is the SVG insertion logic in Fusion 360, which can cause the application to initiate arbitrary HTTP requests and potentially disclose the victim’s public IP (and possibly other inf...

CVE-2024-56700

CVE-2024-56700: Linux kernel wl128x media driver fix for an atomicity race in fmc_send_cmd() with fmdev->resp_skb modification, which could allow a null dereference when skb = fmdev->resp_skb is executed after the value changes. The advisory states the fix is to perform the fmdev->resp_s...

CVE-2024-56691

CVE-2024-56691 affects the Linux kernel driver path for mfd: intel_soc_pmic_bxtwc. The vulnerability stems from the driver not respecting IRQ domains when creating each MFD device, exposing a faulty IRQ handling path (WARN on IRQ 0) due to using a vIRQ rather than proper IRQ domain numbering. The...

CVE-2024-56562

CVE-2024-56562 relates to the Linux kernel i3c master code. The issue was a copy-paste error that freed the wrong pointer: it freed the dyn_addr instead of init_dyn_addr in i3c_master_put_i3c_addrs(), leading to a mismanagement of the init_dyn_addr resource when boardinfo is present. The patch re...

CVE-2021-3827

CVE-2021-3827 concerns Keycloak where the default ECP binding flow can bypass other authentication flows, enabling an attacker to bypass MFA by sending a SOAP AuthnRequest with an Authorization header containing user credentials. Exploitation affects confidentiality and integrity as described in ...

CVE-2024-56636

CVE-2024-56636 refers to a Linux kernel vulnerability in the geneve path where code assumed the MAC header was already present in the output path. The fix changes the code to reference the MAC header safely by using skb_eth_hdr() instead of eth_hdr(), preventing potential misreads when mac header...

CVE-2024-53233

CVE-2024-53233 affects the Linux kernel and describes a utf8_load() path error where a bad UTF-8 version request could trigger a kernel oops due to symbol_put() handling. The root cause is that symbol_put() was given a pointer instead of the unique symbol string, leading to a kernel BUG at kernel...

CVE-2022-0862

CVE-2022-0862 describes a password-change protection weakness in McAfee Enterprise ePolicy Orchestrator (ePO) before 5.10 Update 13, via a depreciated API. A remote attacker could change the password of a compromised session without knowing the current password. The UI removed this functionality ...