CVE-2022-24897

CVE-2022-24897 affects XWiki Commons/Velocity integration. The Velocity scripting feature allowed scripts to access the Java File API, enabling read/write operations on the filesystem when scripts ran with Script rights. Vulnerable versions include 2.3 prior to 12.6.7, 12.10.3, and 13.0. The root...

CVE-2022-25636

CVE-2022-25636 affects the Linux kernel (5.4–5.6.10) via an out-of-bounds heap write in net/netfilter/nf_dup_netdev.c related to nf_tables_offload. This enables local privilege escalation. The connected documents confirm the affected range and the heap OOB write, but do not provide a detailed fix...

CVE-2021-22543

CVE-2021-22543 is described in connected advisories as a local privilege-escalation through KVM and improper handling of VM_IO|VM_PFNMAP VMAs, which can bypass RO checks and allow reading/writing guest memory by a privileged VM operator. Technical details across sources indicate the vulnerability...

CVE-2020-24588

The CVE-2020-24588 entry relates to the 802.11 Wi‑Fi fragmentation/ A‑MSDU handling issue where the plaintext QoS header flag isn’t authenticated, enabling an attacker to inject packets by sending non‑SSP A‑MSDU frames (FragAttacks). Connected Astra Linux advisories describe this as a variant of ...

CVE-2019-11479

The CVE-2019-11479 family (SACK/MSS issues on the Linux kernel) stems from a hard-coded MSS of 48 bytes, enabling remote DoS via fragmented TCP handling. Public docs list CVE-2019-11477 (SACK Panic), CVE-2019-11478 (SACK Slowness/Excess Resource Usage), and CVE-2019-11479 (Low MSS) with kernel-wi...

CVE-2016-9079

CVE-2016-9079 is a use-after-free vulnerability in Mozilla Firefox/Thunderbird SVG Animation. Affected: Firefox < 50.0.2, Firefox ESR < 45.5.1, Thunderbird

CVE-2022-30952

CVE-2022-30952 affects Jenkins Pipeline SCM API for Blue Ocean Plugin (

CVE-2019-11135

CVE-2019-11135 is a TSX Transactional Synchronization Extensions-related vulnerability in Intel CPUs causing potential information disclosure via a side channel when TSX Acknowledges an abort. The connected documents describe a subsequent issue (CVE-2019-19338) in the fix path for CVE-2019-11135 ...

CVE-2019-1125

CVE-2019-1125 is a Linux kernel local information-disclosure vulnerability related to SWAPGS speculation (Spectre variant 1). The issue allows a local attacker to read kernel/privileged memory through speculative execution on most x86 processors; mitigation relies on memory barriers to limit spec...

CVE-2019-2729

CVE-2019-2729 affects Oracle WebLogic Server (Web Services component) with unauthenticated remote code execution via deserialization. Affected versions are 10.3.6.0.0, 12.1.3.0.0, and 12.2.1.3.0. The vulnerability stems from improper deserialization (WebLogic Web Services / XMLDecoder context) an...

CVE-2026-63030

CVE-2026-63030 is a critical WordPress Core flaw in the REST API batch endpoint that, when combined with CVE-2026-60137, enables unauthenticated SQL injection via the author__not_in path and can lead to Remote Code Execution. Affected releases include WordPress 6.9.0–6.9.4 and 7.0.0–7.0.1; fixed ...

CVE-2026-49975

The CVE-2026-49975 entry describes a memory-allocation vulnerability in Apache HTTP Server's mod_http2 that can cause a denial of service via malicious HTTP requests. Affected products/versions reported across sources include Apache httpd 2.4.17 through 2.4.67. The Debian security trackers confir...

CVE-2024-26875

The CVE-2024-26875 entry affects Linux kernel media: pvrusb2, where risk came from a use-after-free in pvr2_context_set_notify due to a race with pvr2_context_disconnect involving a disconnect_flag. The provided fix moves the disconnect_flag assignment to after all code in pvr2_context_disconnect...

CVE-2021-38561

CVE-2021-38561 affects golang.org/x/text/language in golang.org/x/text before 0.3.7, with a potential out-of-bounds read during BCP 47 language tag parsing that can cause DoS on untrusted input. Connected advisories confirm this vulnerability also affects several packages (e.g., podman, buildah, ...

CVE-2019-11582

Atlassian SourceTree for Windows is affected by CVE-2019-11582. A remote code execution vulnerability exists in the URI handling component for Windows versions starting with 0.5a up to, but not including, 3.1.3. An unauthenticated attacker can exploit this by sending a crafted URI; user interacti...

CVE-2018-1002105

CVE-2018-1002105 affects Kubernetes: before versions v1.10.11, v1.11.5, and v1.12.3, the kube-apiserver mishandles error responses to proxied upgrade requests. This flaw lets specially crafted requests establish a connection through the API server to backends and then send arbitrary requests over...

CVE-2020-7063

The CVE-2020-7063 issue affects PHP 7.2.x < 7.2.28, 7.3.x < 7.3.15, and 7.4.x

CVE-2016-6415

CVE-2016-6415 is an information-disclosure vulnerability in Cisco IOS, IOS XE, IOS XR (and PIX prior to 7.0) where the IKEv1 security-negotiation code lacks sufficient checks, enabling an unauthenticated remote attacker to read memory contents via an SA negotiation request. Affected products span...

CVE-2024-10318

Summary of CVE-2024-10318: A session-fixation vulnerability in the NGINX OpenID Connect reference implementation arises from nonce validation being skipped at login. This allows an attacker to coerce a victim’s session to an attacker-controlled account, enabling potential misuse of the victim’s s...

CVE-2021-26272

CVE-2021-26272 is a ReDoS in CKEditor 4 Autolink: by pasting crafted URL-like text and pressing Enter/Space, a victim can trigger a denial-of-service. The publicly documented detail confirms CKEditor 4.x up to before 4.16 is affected; remediation is to upgrade to CKEditor 4.16+ or apply a fix as ...

CVE-2025-62168

Squid (proxy/cache) prior to version 7.2 is affected by information disclosure due to failure to redact HTTP authentication credentials in error handling. The vulnerability can allow a remote, unauthenticated attacker to learn credentials or tokens used by a trusted client or internal web applica...

CVE-2021-46948

CVE-2021-46948 relates to the Linux kernel sfc/farch driver. The TX queue lookup in TX event handling could start from a TXQ label instead of a TXQ type, causing efx_channel_get_tx_queue() to potentially return NULL and trigger a NULL dereference/panic. The advisory states this vulnerability was ...

CVE-2023-22103

CVE-2023-22103 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 8.0.34 and earlier, and 8.1.0. Attack via network with high privileges can cause a hang or frequent crash (DoS) of MySQL Server. CVSS v3.1 base score 4.9 (Availability). Remediation: upgrade to a fixed package/version...

CVE-2022-29914

CVE-2022-29914 describes a memory-safety/logic issue in Firefox/Thunderbird where reusing existing popups could cover the fullscreen notification UI, enabling browser spoofing attacks. Affected products include Thunderbird < 91.9, Firefox ESR < 91.9, and Firefox

CVE-2020-10713

CVE-2020-10713 affects GRUB2 prior to 2.06. The flaw allows an attacker to hijack/tamper the GRUB verification process and bypass Secure Boot, enabling arbitrary code execution during boot when a crafted grub.cfg is processed. Exploitation requires local access or access to modify boot/network se...

CVE-2018-10858

The connected documents confirm CVE-2018-10858 is a heap-buffer overflow in Samba client handling of extra-long filenames in directory listings, enabling arbitrary code execution on a Samba client. Affected versions include Samba before 4.6.16, 4.7.9, and 4.8.4. Mitigation/patches: updates to fix...

CVE-2012-1182

The CVE-2012-1182 issue in Samba stems from the PIDL-based DCE/RPC code generator not validating array lengths during RPC handling, creating an out-of-bounds/heap-overflow condition that enables remote code execution. Affected branches include Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6...

CVE-2024-27198

CVE-2024-27198 affects JetBrains TeamCity prior to 2023.11.4, where an authentication bypass enables attackers with no privileges to perform admin actions and potentially achieve remote code execution (RCE). Connected PoC/documentation detail a bypass that abuses a REST API routing flaw via an un...

CVE-2021-46949

CVE-2021-46949 concerns the Linux kernel sfc (Solarflare) network driver path: farch TX queue lookup during TX flush done handling. The root cause is starting TXQ processing from a TXQ instance number (qid) rather than a TXQ type, which could cause efx_get_tx_queue() to return NULL and trigger pa...

CVE-2023-20006

CVE-2023-20006 affects Cisco ASA/FTD on Cisco Firepower 2100 Series appliances, where the hardware SSL/TLS offload cryptography implementation error can cause an unauthenticated attacker to trigger a device reload and DoS. The root cause is an implementation flaw in hardware-based SSL/TLS process...

CVE-2022-27508

CVE-2022-27508 is an unauthenticated denial-of-service vulnerability affecting Citrix ADC and Citrix Gateway, specifically the 12.1-64.16 release. The CVE is detailed in Citrix Security Bulletin CTX457048, which confirms the DoS impact and that Citrix has published fixes. Other connected sources ...

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2025-25065

CVE-2025-25065 : A SSRF flaw in the RSS feed parser of Zimbra Collaboration affects 9.0.0 before Patch 43, 10.0.x before 10.0.12, and 10.1.x before 10.1.4. The issue allows unauthorized redirection to internal network endpoints via the RSS parser. Root cause and impact are described in the provid...

CVE-2023-33460

CVE-2023-33460 involves a memory leak in the yajl JSON library (yajl_tree_parse) that can cause out-of-memory conditions and server crashes for the affected 2.1.0 release. Connected advisories confirm patches by various distributions (e.g., Debian, AlmaLinux, Amazon Linux, CBL-Mariner, Astra Linu...

CVE-2020-13576

CVE-2020-13576 affects Genivia gSOAP 2.8.107, where the WS-Addressing plugin can be exploited by a crafted SOAP request to achieve remote code execution. Public documents confirm the root cause is in the WS-Addressing plugin, enabling code execution on a networked host. Debian LTS advisories show...

CVE-2019-3846

CVE-2019-3846 affects the upstream kernel’s Marvell mwifiex wireless kernel driver. The description documents a memory corruption flaw that could allow privilege escalation when connecting to a malicious wireless network. Connected sources confirm this is within the mwifiex driver and describe th...

CVE-2014-0196

CVE-2014-0196 affects the Linux kernel (through 3.14.3) specifically the n_tty_write function in drivers/tty/n_tty.c. The flaw permits a local user to trigger a race condition between read and write operations with long strings in the LECHO & !OPOST case, enabling denial of service (memory corrup...

CVE-2022-37734

CVE-2022-37734 is a documented Denial of Service in GraphQL Java. The vulnerability arises from an uncontrolled resource consumption flaw, exploitable by sending specially-crafted requests (Directive overloading). Affected graphs-java implementations listed in sources include the fix versions: 19...

CVE-2020-14812

CVE-2020-14812 affects Oracle MySQL Server (component: Server: Locking) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. Exploitation can lead to a hang or frequent crashes (DoS) with network access. Remediation status varies by distribution; Debian LTS notes a fix...

CVE-1999-0001

CVE-1999-0001 concerns a DoS in BSD-derived TCP/IP stacks: ip_input.c can crash or hang when remote attackers send crafted packets. The description across connected sources reiterates that remote packet crafting triggers a denial of service, with no publicly stated exploit details or mitigation i...

CVE-2025-20362

CVE-2025-20362 affects Cisco Secure Firewall ASA/FTD VPN web server. Root cause: improper validation of user-supplied input in HTTP(S) requests, allowing an unauthenticated remote attacker to access restricted VPN-related URL endpoints. Impact: potential DoS via unexpected reloads (and in some re...

CVE-2025-3248

CVE-2025-3248 : Langflow versions prior to 1.3.0 are vulnerable to unauthenticated remote code execution via the /api/v1/validate/code endpoint. The root cause is execution of arbitrary Python code through unsanitized input passed to exec(), allowing an attacker to run arbitrary commands without ...

CVE-2023-22518

CVE-2023-22518 (Confluence DC/Server): An improper authorization vulnerability allowed an unauthenticated attacker to reset Confluence and create an instance administrator, enabling full admin control and potential data loss. Affected products include Confluence Data Center (all versions) and Con...

CVE-2023-26083

CVE-2023-26083 is a Mali GPU Kernel Driver information-disclosure vulnerability affecting Midgard, Bifrost, Valhall, and Avalon kernels (versions listed in source). An unprivileged user can cause kernel metadata exposure via a tlstream/Timeline facility, enabling a 16-byte attacker-controlled dat...

CVE-2022-31081

CVE-2022-31081 affects the Perl HTTP::Daemon library. Versions prior to 6.15 are vulnerable due to improper handling of the Content-Length header, which could enable HTTP request smuggling and potentially allow privileged access to APIs or poisoning of intermediate caches. The issue is documented...

CVE-2026-5281

CVE-2026-5281 is a use-after-free in Dawn (Chromium’s graphics layer/WebGPU) affecting Google Chrome versions prior to 146.0.7680.178. A remote attacker who has gained control of the renderer process can execute arbitrary code via a crafted HTML page. Publicly available Chromium/Chrome advisories...

CVE-2023-22527

CVE-2023-22527 is an OGNL/SSTI-based remote code execution vulnerability in Atlassian Confluence Data Center and Server. Affected versions include Confluence Data Center/Server 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0–8.5.3 (per multiple exploits). Anonymous attackers could trigger RCE via a ...

CVE-2023-25652

CVE-2023-25652 affects Git before 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.** The vulnerability arises when feeding specially crafted input to git apply --reject, which can cause a path outside the working tree to be overwritten with partially con...

CVE-2022-31128

Tuleap CVE-2022-31128 affects Tuleap Community Edition prior to 13.10.99.82 and Tuleap Enterprise Edition prior to 13.10-3. The issue arises from improper verification of fine-grained permissions when creating Git branches via the REST API (POST git/:id/branches); users could create branches rega...

CVE-2021-46925

CVE-2021-46925 affects the Linux kernel’s net/smc: a race between smc_cdc_tx_handler() and smc_release() can lead to a use-after-free of smc_sock, causing a kernel panic when CDC messages are in flight. The root cause is a race where smc_cdc_tx_handler() may access a smc_sock that has already bee...