CVE-2021-46948

CVE-2021-46948 relates to the Linux kernel sfc/farch driver. The TX queue lookup in TX event handling could start from a TXQ label instead of a TXQ type, causing efx_channel_get_tx_queue() to potentially return NULL and trigger a NULL dereference/panic. The advisory states this vulnerability was ...

CVE-2023-22103

CVE-2023-22103 affects Oracle MySQL Server (Server: Optimizer). Affected: MySQL 8.0.34 and earlier, and 8.1.0. Attack via network with high privileges can cause a hang or frequent crash (DoS) of MySQL Server. CVSS v3.1 base score 4.9 (Availability). Remediation: upgrade to a fixed package/version...

CVE-2021-22543

CVE-2021-22543 is described in connected advisories as a local privilege-escalation through KVM and improper handling of VM_IO|VM_PFNMAP VMAs, which can bypass RO checks and allow reading/writing guest memory by a privileged VM operator. Technical details across sources indicate the vulnerability...

CVE-2018-1002105

CVE-2018-1002105 affects Kubernetes: before versions v1.10.11, v1.11.5, and v1.12.3, the kube-apiserver mishandles error responses to proxied upgrade requests. This flaw lets specially crafted requests establish a connection through the API server to backends and then send arbitrary requests over...

CVE-2014-0196

CVE-2014-0196 affects the Linux kernel (through 3.14.3) specifically the n_tty_write function in drivers/tty/n_tty.c. The flaw permits a local user to trigger a race condition between read and write operations with long strings in the LECHO & !OPOST case, enabling denial of service (memory corrup...

CVE-2023-25652

CVE-2023-25652 affects Git before 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1.** The vulnerability arises when feeding specially crafted input to git apply --reject, which can cause a path outside the working tree to be overwritten with partially con...

CVE-2023-0386

CVE-2023-0386 describes a Linux kernel OverlayFS uid-mapping bug that lets a local user escalate privileges by improperly handling execution of setuid-capable files copied between mounts. Connected advisories confirm this CVE affecting upstream Linux kernel and note fixes via newer kernel package...

CVE-2021-33044

CVE-2021-33044 is an authentication bypass vulnerability in Dahua IPC/IPCam/VTH/VTO devices that can be triggered during login by crafting malicious data packets, allowing bypass of device identity authentication. Connected sources provide concrete technical context, including PoCs and exploit co...

CVE-2020-10713

A flaw exists in grub2 prior to version 2.06 that allows an attacker to hijack and tamper with the GRUB verification process , enabling a bypass of Secure Boot protections. To exploit this, an attacker must first establish system access through methods such as physical access, altering a pxe-boot...

CVE-2016-6415

CVE-2016-6415 is an information-disclosure vulnerability in Cisco IOS, IOS XE, IOS XR (and PIX prior to 7.0) where the IKEv1 security-negotiation code lacks sufficient checks, enabling an unauthenticated remote attacker to read memory contents via an SA negotiation request. Affected products span...

CVE-2011-4969

CVE-2011-4969 : XSS in jQuery prior to 1.6.3 when using location.hash to select elements. A remote attacker could inject arbitrary script/HTML into a page. Affected: jQuery versions before 1.6.3. Remediation: upgrade to 1.6.3 or later (patches/fixes cited by IBM and vendor advisories). Public ref...

CVE-2023-22527

CVE-2023-22527 is an OGNL/SSTI-based remote code execution vulnerability in Atlassian Confluence Data Center and Server. Affected versions include Confluence Data Center/Server 8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, and 8.5.0–8.5.3 (per multiple exploits). Anonymous attackers could trigger RCE via a ...

CVE-2022-2586

CVE-2022-2586 is a Linux kernel use-after-free in netfilter nf_tables related to nft objects/expressions referencing nft sets across tables. Connected Astra Linux advisories confirm the fix was applied by updating the kernel to address: netfilter nf_tables: do not allow SET_ID to refer to another...

CVE-2022-30952

CVE-2022-30952 affects Jenkins Pipeline SCM API for Blue Ocean Plugin (

CVE-2021-41864

CVE-2021-41864 affects the Linux kernel (pre-5.14.12) in prealloc_elems_and_freelist() within kernel/bpf/stackmap.c. An unprivileged local user can trigger an eBPF multiplication overflow, causing an out-of-bounds write and potential memory corruption or system crash. The issue is fixed in Linux ...

CVE-2018-10858

The connected documents confirm CVE-2018-10858 is a heap-buffer overflow in Samba client handling of extra-long filenames in directory listings, enabling arbitrary code execution on a Samba client. Affected versions include Samba before 4.6.16, 4.7.9, and 4.8.4. Mitigation/patches: updates to fix...

CVE-2021-46925

CVE-2021-46925 affects the Linux kernel’s net/smc: a race between smc_cdc_tx_handler() and smc_release() can lead to a use-after-free of smc_sock, causing a kernel panic when CDC messages are in flight. The root cause is a race where smc_cdc_tx_handler() may access a smc_sock that has already bee...

CVE-2023-40167

CVE-2023-40167 (Jetty) affects Jetty Java-based web server/servlet engine. Prior to Jetty 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts a "+" character before the Content-Length in HTTP/1 header fields, which is non-RFC compliant. This could enable request smuggling in scenarios where a dow...

CVE-2023-20006

CVE-2023-20006 affects Cisco ASA/FTD on Cisco Firepower 2100 Series appliances, where the hardware SSL/TLS offload cryptography implementation error can cause an unauthenticated attacker to trigger a device reload and DoS. The root cause is an implementation flaw in hardware-based SSL/TLS process...

CVE-2023-33460

CVE-2023-33460 involves a memory leak in the yajl JSON library (yajl_tree_parse) that can cause out-of-memory conditions and server crashes for the affected 2.1.0 release. Connected advisories confirm patches by various distributions (e.g., Debian, AlmaLinux, Amazon Linux, CBL-Mariner, Astra Linu...

CVE-2023-22518

CVE-2023-22518 (Confluence DC/Server): An improper authorization vulnerability allowed an unauthenticated attacker to reset Confluence and create an instance administrator, enabling full admin control and potential data loss. Affected products include Confluence Data Center (all versions) and Con...

CVE-2022-27508

CVE-2022-27508 is an unauthenticated denial-of-service vulnerability affecting Citrix ADC and Citrix Gateway, specifically the 12.1-64.16 release. The CVE is detailed in Citrix Security Bulletin CTX457048, which confirms the DoS impact and that Citrix has published fixes. Other connected sources ...

CVE-2022-31017

Zulip Server contains a logic error in versions 2.1.0 through 5.2 where a private stream with protected history, upon edits, erroneously causes an API event that includes the edited message to all current subscribers. The issue stems from the server sending the edited message via an API event to ...

CVE-2021-29425

CVE-2021-29425 affects Apache Commons IO up to version 2.6, specifically FileNameUtils.normalize. With inputs such as "//../foo" or "\..\foo", normalization can yield a value that does not escape to higher directories, potentially enabling access to the parent directory if the resulting path is u...

CVE-2016-7407

CVE-2016-7407 affects Dropbear SSH. The dropbearconvert tool allows arbitrary code execution via a crafted OpenSSH key file due to improper handling of ASN.1 OpenSSH keys in Dropbear before version 2016.74. The impact is remote code execution with the privileges of the dropbearconvert/dropped pro...

CVE-2025-0762

A use after free vulnerability in Google Chrome (prior to version 132.0.6834.159 ) exists within the DevTools component. A remote attacker can exploit this flaw via a crafted Chrome Extension to trigger heap corruption , potentially leading to arbitrary code execution or a service failure . Mitig...

CVE-2024-3833

CVE-2024-3833 is a Chrome/Chromium WebAssembly object-corruption vulnerability (via a crafted HTML page) tracked as high-severity, with reported fixes in Chromium 124.0.6367.60 and later (ChromeOS notes cite 124.0.6367.95; Debian security advisories list 124.0.6367.60 as the fixed version). Affec...

CVE-2024-2511

The OpenSSL package is vulnerable to a Denial of Service (DoS) condition where certain non-default TLS server configurations cause unbounded memory growth during TLSv1.3 sessions. This occurs if the SSL_OP_NO_TICKET option is used without early_data support and default anti-replay protection. Und...

CVE-2023-32003

CVE-2023-32003 is described in the connected F5 advisory as a path-traversal flaw in Node.js 20's experimental permission model, where fs.mkdtemp() and fs.mkdtempSync() lack a necessary permission-check, allowing a malicious actor to create an arbitrary directory. The impact is limited to users e...

CVE-2022-37734

CVE-2022-37734 is a documented Denial of Service in GraphQL Java. The vulnerability arises from an uncontrolled resource consumption flaw, exploitable by sending specially-crafted requests (Directive overloading). Affected graphs-java implementations listed in sources include the fix versions: 19...

CVE-2019-3846

CVE-2019-3846 affects the upstream kernel’s Marvell mwifiex wireless kernel driver. The description documents a memory corruption flaw that could allow privilege escalation when connecting to a malicious wireless network. Connected sources confirm this is within the mwifiex driver and describe th...

CVE-2026-45149

The CVE-2026-45149 issue affects the brace-expansion library (Julian Gruber) where the max option was applied too late for 5.0.0–5.0.5. When expanding a large numeric range (e.g., {1..10000000}), the code builds all intermediate elements before enforcing max, allocating about 505 MB and taking ~8...

CVE-2025-25065

A server-side request forgery (SSRF) vulnerability exists in the RSS feed parser component of Zimbra Collaboration . This flaw allows an attacker to perform unauthorized redirection to internal network endpoints. The vulnerability affects Zimbra Collaboration 9.0.0 before Patch 43, 10.0.x before ...

CVE-2023-36478

CVE-2023-36478 (Jetty) affects Jetty 9.x/10.x/11.x: an integer overflow in MetaDataBuilder.checkSize can cause HPACK header lengths to overflow, potentially enabling a remote denial-of-service via malformed HTTP/2 header values. The flaw occurs when length is large and Huffman encoding is used, c...

CVE-2022-0194

Netatalk (vulnerable component: ad_addcomment) is affected by CVE-2022-0194. The flaw stems from improper validation of user-supplied data length before copying into a fixed-size stack buffer, enabling an unauthenticated attacker to execute arbitrary code with root privileges on affected installa...

CVE-2022-31128

Tuleap CVE-2022-31128 affects Tuleap Community Edition prior to 13.10.99.82 and Tuleap Enterprise Edition prior to 13.10-3. The issue arises from improper verification of fine-grained permissions when creating Git branches via the REST API (POST git/:id/branches); users could create branches rega...

CVE-2021-41183

CVE-2021-41183 concerns jQuery-UI’s Datepicker in the embedded jQuery-UI copy used by OTRS (notably in the 1.12.1 series). The vulnerability arises from accepting values for the various *Text options from untrusted sources, which could allow execution of untrusted code. The issue is fixed in jQue...

CVE-2020-14812

CVE-2020-14812 affects Oracle MySQL Server (component: Server: Locking) with affected versions 5.6.49 and prior, 5.7.31 and prior, and 8.0.21 and prior. Exploitation can lead to a hang or frequent crashes (DoS) with network access. Remediation status varies by distribution; Debian LTS notes a fix...

CVE-2020-12888

CVE-2020-12888 affects the Linux kernel VFIO PCI driver (through 5.6.13) and arises from improper handling of accesses to disabled MMIO space. A local attacker or a guest VM with VFIO access could trigger a denial of service or crash by exploiting writes/reads to disabled memory regions. Connecte...

CVE-2022-41724

CVE-2022-41724 describes a vulnerability where large TLS handshake records may cause panics in crypto/tls implementations. Affected are Go TLS clients (including TLS1.3 and TLS1.2 with session resumption) and TLS1.3 servers that request client certificates. Technical cause is panics when construc...

CVE-2022-31081

CVE-2022-31081 affects the Perl HTTP::Daemon library. Versions prior to 6.15 are vulnerable due to improper handling of the Content-Length header, which could enable HTTP request smuggling and potentially allow privileged access to APIs or poisoning of intermediate caches. The issue is documented...

CVE-2020-11896

CVE-2020-11896 affects the Treck TCP/IP stack prior to version 6.0.1.66 and enables Remote Code Execution via IPv4 tunneling. The Ripple20 set documents multiple vulnerabilities in this stack; a PoC exploit exists (e.g., Digi Connect ME 9210). Connected advisories (Cisco, Fortinet, F5, others) di...

CVE-2021-46910

CVE-2021-46910 affects the Linux kernel ARM MM fixing path in kmap_local: when CONFIG_DEBUG_KMAP_LOCAL is enabled, per-CPU fixmap slots can grow and collide with the virtual DT mapping, potentially triggering an OOPS on systems with many CPUs. The disclosed remediation in the provided materials i...

CVE-2023-52441

CVE-2023-52441 affects the Linux kernel ksmbd component. The vulnerability is an out-of-bounds issue in init_smb2_rsp_hdr() that occurs when a client issues an SMB2 negotiate followed by SMB1 negotiate; the code could incorrectly treat SMB1 packets as SMB2, triggering an out-of-bounds path. The a...

CVE-2023-4039

CVE-2023-4039 describes a GCC stack-protector issue on AArch64: failure of -fstack-protector to detect buffer overflows in C99-style dynamically-sized locals/alloca, unlike static locals. The default overflow handling would terminate the process, but an attacker might influence control flow if an...

CVE-2023-4428

CVE-2023-4428 affects Chromium-based browsers (Chrome/Chromium) and relates to an out-of-bounds memory access in CSS that could allow a remote attacker to read memory via a crafted HTML page. The issue is classified with high severity and a network attack vector, with user interaction required. T...

CVE-2022-3775

CVE-2022-3775 affects grub2 font rendering (grub_font_construct_glyph). The issue arises when rendering certain unicode sequences: the code does not adequately validate the glyph width/height against the bitmap, causing an out-of-bounds write to grub2 heap, leading to memory corruption and potent...

CVE-2018-10545

Technical details (affected products, versions, exploit information, and fixes) are not provided in the supplied documents. Please monitor for updates.

CVE-2025-66200

Apache HTTP Server versions 2.4.7 through 2.4.65 are vulnerable to a mod_userdir+suexec bypass via the AllowOverride FileInfo vulnerability. Attackers with the ability to use the RequestHeader directive in htaccess files can cause certain CGI scripts to execute under an unexpected userid . This i...

CVE-2024-24919

CVE-2024-24919 is a zero-day-like vulnerability in Check Point Security Gateways (Remote Access VPN/Mobile Access blades) allowing unauthenticated remote readers to fetch arbitrary files via path traversal (e.g., aCSHELL/../../../../../../../etc/shadow). Public PoCs and in-the-wild mentions exist...