CVE-2021-21999

Affected products: VMware Tools for Windows (11.x.y before 11.2.6), VMware Remote Console for Windows (12.x before 12.0.1), and VMware App Volumes (2.x before 2.18.10 and 4 before 2103). Root cause: local privilege escalation via placing a malicious file named openssl.cnf in an unrestricted direc...

CVE-2024-53169

The CVE-2024-53169 issue is in the Linux kernel nvme-fabrics shutdown path. A race can occur when the nvme keep-alive async request sneaks in during controller shutdown, potentially racing with admin queue destruction and the hw/hctx queue dispatcher. If the in-flight keep-alive touches the admin...

CVE-2024-53184

CVE-2024-53184 affects the Linux kernel ubd subsystem, where release-time drvdata access could cause crashes during device removal. The fix replaces drvdata usage with container_of() to locate the ubd instance, preventing a NULL-deref crash when removing a ubd device. The advisories (Unity Linux ...

CVE-2024-53234

CVE-2024-53234 : In the Linux kernel’s EROFS, a vulnerability in handling NONHEAD lclusters with delta[1] caused inadequate decompressed lengths for FIEMAP mappings. The root cause was unconditional bailing when delta[1]==0 for NONHEAD lclusters, which could affect crafted images/filesystems from...

CVE-2022-44543

The CVE-2022-44543 issue affects the TYPO3 femanager extension (versions prior to 5.5.2, 6.x prior to 6.3.3, and 7.x prior to 7.0.1). The vulnerability arises from mishandling the usergroup.inList protection, enabling creation of frontend users in restricted groups when a usergroup field is prese...

CVE-2025-25202

CVE-2025-25202 affects Ash Authentication (Elixir) in installations bootstrapped with the igniter installer from v4.1.0 up to but not including v4.4.9. The issue is that magic link tokens—as well as tokens revoked manually—could be verified as valid even after revocation, effectively making magic...

CVE-2022-1338

The CVE-2022-1338 entry affects the WordPress plugin Easily Generate Rest API Url (versions

CVE-2022-2227

GitLab CE/EE vulnerability CVE-2022-2227: Improper access control in the runner jobs API allows a previous maintainer of a project with a specific runner to access job and project metadata. Affected versions: all prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. The provided docum...

CVE-2024-57838

CVE-2024-57838 affects the Linux kernel on s390 where stack-depot filtering cannot de-duplicate stacks because the .irqentry.text section is empty. The root cause is that IO/EXT interrupt handlers were not correctly placed into the .irqentry.text region on s390, hindering stack trace filtering fo...

CVE-2024-56533

The CVE-2024-56533 vulnerability affects the Linux kernel’s ALSA usx2y driver. It stems from using snd_card_free() during USB disconnection, which waits for all open fds to close and can delay release, potentially blocking USB IOCTLs and causing a soft lockup. The advisory notes replacing snd_car...

CVE-2022-2117

The CVE-2022-2117 entry concerns the WordPress plugin GiveWP . Affected versions are up to and including 2.20.2 , where the vulnerable /donor-wall REST-API endpoint exposed donor information to unauthenticated users even when the donor wall was disabled. The issue is resolved in version 2.20.2 (a...

CVE-2022-1559

Clipr WordPress plugin

CVE-2021-42013

Summary: CVE-2021-42013 covers an incomplete fix to CVE-2021-41773 in Apache HTTP Server 2.4.49/2.4.50. Root cause: path traversal vulnerabilities in the 2.4.50 fix could map URLs outside configured directories; if CGI is enabled for aliased paths, remote code execution could occur. Affected vers...

CVE-2024-53152

CVE-2024-53152 is a Linux kernel vulnerability affecting Tegra194 PCIe endpoints. The issue: when PERST# is asserted and refclk is disabled, endpoint cleanup paths (dw_pcie_ep_cleanup and pci_epc_deinit_notify) access hardware registers, crashing the endpoint due to host-required refclk. The fix ...

CVE-2016-8743

The CVE-2016-8743 issue affects Apache HTTP Server. It concerns how whitespace is accepted in requests and sent in response lines and headers in all releases before 2.2.32 and 2.4.25. The root problem is liberal whitespace handling, which can enable request smuggling, response splitting, and cach...

CVE-2020-25681

CVE-2020-25681 affects dnsmasq up to version 2.83. The vulnerability is a set of DNSSEC-related heap/buffer overflows: CVE-2020-25681 (sort_rrset overflow), CVE-2020-25682 (extract_name length issue), CVE-2020-25683 (get_rdata memcpy overflow), CVE-2020-25684/25685/25686 (reply_query handling tha...

CVE-2024-53159

CVE-2024-53159 is rejected/not used and does not represent an active vulnerability entry.

CVE-2024-53193

CVE-2024-53193 – Linux kernel (Loongson2 clock) vulnerability : A memory corruption bug occurred in loongson2_clk_provider where a flexible array member (clk_hw_onecell_data.hws) was placed in the middle of the provider struct, causing clp->clk_lock to be overwritten during allocation and writ...

CVE-2024-53176

CVE-2024-53176 in the Linux kernel SMB/CIFS unmount path could race with cached directory operations, leaving dentries in use and triggering kernel BUGs. The fix drops dentries via queued work (cfid_put_wq) and ensures close_all_cached_dirs() flushes that work, with final cleanup performed by ser...

CVE-2024-57876

CVE-2024-57876 affects the Linux kernel DRM/DP MST code. The vulnerability arises when the MST topology is removed during reception of a Down/Up Sideband message, where drm_dp_mst_topology_mgr::up_req_recv and down_rep_recv states can be reset out of order by another thread via drm_dp_mst_topolog...

CVE-2024-56610

CVE-2024-56610 is a Linux kernel issue where KCSAN’s report_filterlist_lock, originally protected by a non-raw spinlock, could lead to a data race on PREEMPT_RT. The patch converts the filter list lock to raw_spinlock to avoid sleeping in atomic contexts on RT kernels; it notes that memory alloca...

CVE-2024-27058

CVE-2024-27058 affects the Linux kernel: a race in tmpfs involving dquot rb_tree handling. The root cause is that fetching the rb_tree root node was not protected by dqio_sem, allowing a concurrent tree rebalance to mislead the search and trigger a warning in shmem_release_dquot. This is addresse...

CVE-2022-1766

CVE-2022-1766 affects Anchore Enterprise tooling (anchorectl) version 0.1.4, where credentials used to access the Anchore Enterprise API were improperly stored in the Software Bill of Materials (SBOM) generated by anchorectl. The issue enables exposure of access credentials via SBOM contents and ...

CVE-2022-2401

Mattermost CVE-2022-2401 affects Mattermost Server (Mattermost) up to version 6.7.0. The issue is an unrestricted information disclosure where team members can access some sensitive user information by directly calling APIs. The related records consistently cite the affected product/version and t...

CVE-2024-3832

CVE-2024-3832 affects Google Chrome/Chromium via the V8 engine. Description: object corruption in V8 prior to 124.0.6367.60 could be exploited by a crafted HTML page to trigger a remote issue. Affected software: Chromium/Chrome (Chromium-based browser). Underlying cause: object corruption in V8 a...

CVE-2020-13957

CVE-2020-13957 affects Apache Solr configurations via the ConfigSets API. IBM and OSV/NVD sources confirm that improper access control allows bypassing security checks for dangerous features when uploading/configuring ConfigSets, potentially enabling remote code execution. Affected Solr ranges in...

CVE-2022-1431

CVE-2022-1431 affects GitLab versions 12.10.x prior to 14.8.6, 14.9.x prior to 14.9.4, and 14.10.x prior to 14.10.1. The root cause is improper handling of malicious requests to the PyPi API endpoint, allowing uncontrolled resource consumption and potential denial of service. Affected component i...

CVE-2022-1545

GitLab CE/EE information-disclosure vulnerability (CVE-2022-1545): an unauthorised project member tagged in a note could disclose details of confidential notes created via the API. Affected versions include GitLab 13.2 up to 14.8.6, 14.9 up to 14.9.4, and 14.10 up to 14.10.1. Remediation is upgra...

CVE-2022-2458

CVE-2022-2458 is an XML External Entity (XXE) vulnerability affecting IBM Business Automation Manager/Open Editions (Business Central) and Kie-Server APIs. The weakness arises from processing XML input with external entities due to a weakly configured XML parser, enabling an attacker to cause Ext...

CVE-2024-56585

CVE-2024-56585 : In PREEMPT_RT Linux kernels on LoongArch, a sleeping-in-atomic-context issue arises due to a GFP flag change (GFP_KERNEL to GFP_ATOMIC) for alloc_pages_node() in setup_tlb_handler(). The underlying problem is that PREEMPT_RT replaces normal spinlocks with rt-spinlocks, and rt_spi...

CVE-2022-1442

CVE-2022-1442 affects the WordPress Metform plugin up to version 2.1.3. The vulnerability stems from improper access control in the ~/core/forms/action.php file, allowing an unauthenticated attacker to view API keys and secrets for multiple integrated third‑party services (e.g., PayPal, Stripe, M...

CVE-2016-1908

OpenSSH CVE-2016-1908 affects the OpenSSH client before 7.2, where cookie generation for untrusted X11 forwarding can be mishandled when the local X server lacks the SECURITY extension. This could allow remote X11 clients to trigger a fallback to trusted forwarding, bypassing intended access cont...

CVE-2020-0796

CVE-2020-0796 (SMBGhost) is a Windows SMBv3 Client/Server remote code execution vulnerability. The CIRCL sighting notes publicly available PoC activity and a Metasploit module trajectory, indicating a pre-auth RCE path via SMBv3 processing. References cited include PoC/exploit context for SMBGhos...

CVE-2025-21691

The CVE-2025-21691 entry concerns the Linux kernel cachestat syscall. The issue arose because the cachestat() addition did not include the writability/ownership permission check that mincore() had, allowing potential misuse when reading page cache stats. The connected advisories confirm a code-le...

CVE-2025-21651

Technical details about CVE-2025-21651 are not present in the provided connected documents; the materials only reference the Linux kernel hns3 issue and a fix. Monitor for updates from official sources.

CVE-2024-24199

CVE-2024-24199 concerns SmartDNS. Multiple connected sources confirm a misaligned address in smartdns/src/dns.c that can cause undefined behavior. The impact statements in OSV/Ubuntu advisories indicate a potential denial of service or arbitrary code execution, depending on the environment. The C...

CVE-2025-21663

CVE-2025-21663 : In the Linux kernel, the net: stmmac: dwmac-tegra driver incorrectly reads the IOMMU Stream ID (SID) from a hard-coded MGBE0 SID for all Tegra MGBEs. This prevents proper SID handling for non-MGBE0 controllers, leading to issues such as transmit timeouts and potential kernel pani...

CVE-2024-34923

CVE-2024-34923 affects Avocent DSR2030 and SVIP1020 appliances. A reflected cross-site scripting (XSS) vulnerability exists in the web interface: DSR2030 firmware 03.04.00.07 up to 03.07.01.22 (before 03.07.01.23) and SVIP1020 firmware 01.06.00.03 (before 01.07.00.00). Risk is described as a refl...

CVE-2022-2469

CVE-2022-2469 affects GNU SASL libgsasl: server-side read-out-of-bounds when interacting with a malicious authenticated GSS-API client. The CVSS metrics in the entry show NETWORK attack, LOW complexity, LOW privileges, with HIGH confidentiality and HIGH availability impact. Connected documents fr...

CVE-2024-27072

CVE-2024-27072 in the Linux kernel fixes a deadlock by removing locks in media: usbtv: usbtv_video_free() and by avoiding an unnecessary usbtv_stop() call during device unregister. The issue could manifest when disconnecting while streaming (and now even when not streaming). The patch eliminates ...

CVE-2012-2052

CVE-2012-2052 affects Adobe Photoshop CS5 (12.x) before 12.0.5 and CS5.1 (12.1.x) before 12.1.1, due to a stack-based buffer overflow in the U3D.8BI library plugin. The vulnerability can be triggered by processing a crafted Collada (.dae) asset, specifically via a long Collada asset element in th...

CVE-2022-2756

Kavita before 0.5.4.1 is affected by a Server-Side Request Forgery (SSRF) in the GitHub repository kareadita/kavita. The Nuclei template and Huntr entry describe an SSRF that can allow an attacker to access sensitive information, modify data, and potentially perform unauthorized administrative ac...

CVE-2021-4034

Polkit pkexec (setuid) contains a local privilege escalation flaw where pkexec fails to validate the calling parameter count and may treat crafted environment variables as commands, enabling unprivileged users to execute arbitrary code with root privileges. This has been reported across multiple ...

CVE-2022-1598

The CVE-2022-1598 entry concerns the WPQA Builder WordPress plugin (pre-5.5) with an improper access control in a REST API endpoint, enabling unauthenticated users to view private questions/messages between site users. Affected software: WPQA Builder WordPress plugin prior to version 5.5. Root ca...

CVE-2022-1808

The CVE-2022-1808 entry concerns polonel/trudesk prior to version 1.2.3, describing an execution with unnecessary privileges (privilege escalation) vulnerability. Affected component is the Trudesk application as deployed from that repository; the underlying root cause is improper privilege handli...

CVE-2024-37031

The CVE-2024-37031 entry describes a stored XSS vulnerability in Active Admin (Ruby on Rails) before 3.2.2, triggered when users create entities with arbitrary names used as dynamic form legends. The root cause is the dynamic name value being reflected in admin forms, enabling an attacker to inje...

CVE-2025-26491

CVE-2025-26491 is a duplicate of CVE-2025-26494 (per the initial description). Connected documents provide concrete details for CVE-2025-26494: a Server-Side Request Forgery (SSRF) vulnerability that allows authentication bypass in Tableau Server, affecting versions 2023.3 through 2023.3.5. The s...

CVE-2019-0196

The CVE-2019-0196 issue affects Apache HTTP Server 2.4.x (noted in several advisories) where the http/2 request handling could access freed memory during a string comparison to determine the request method, potentially causing incorrect request processing. This is tied to mod_http2 and is describ...

CVE-2020-35489

Summary (CVE-2020-35489): The WordPress plugin Contact Form 7 (before 5.3.2) is vulnerable to an unrestricted file upload leading to remote code execution because a filename can contain special characters. Affected product: WordPress Contact Form 7 plugin; affected version range: prior to 5.3.2. ...

CVE-2024-25709

Mode C: Normal details available CVE-2024-25709 is a stored Cross-Site Scripting (XSS) vulnerability affecting Esri Portal for ArcGIS. The connected PTSecurity advisory specifies affected versions: Esri Portal for ArcGIS 10.8.1 through 10.8.1 – 1121. The issue allows a remote attacker to craft a ...