Search: Value

A vulnerability in the Linux kernel's atl1e network driver could cause a soft lockup due to an out-of-range hardware pointer read during PCIe link or MAC reset. This issue results from the hardware reporting an invalid hw_next_to_clean value, causing an infinite loop in the driver code. The problem has been fixed in several commits.

A vulnerability in the Linux kernel's Multipath TCP (MPTCP) implementation was fixed involving an uninitialized value in the mptcp_write_data_fin function. The issue occurs when sending a DATA_FIN without data, where specific DSS mapping and checksum computations are required but were not properly initialized due to changes in packet handling code. This flaw could lead to incorrect packet construction in MPTCP connections.

A heap out-of-bounds read vulnerability exists in libdvdnav versions before 7.0.0. This flaw occurs in the dvdnav_describe_title_chapters function when processing an oversized vts_ttn value, allowing reading beyond the part-of-title array. Crafted DVDs or disc images can trigger this, potentially causing application crashes during chapter enumeration.

CVE-2026-112048 is a vulnerability in libspatialite up to version 5.1.0 where the polygon ring count is not properly validated in the ParseWkbPolygon function. This flaw allows attackers to supply crafted polygon data that triggers uncontrolled interior-ring memory allocation, potentially causing process crashes or heap memory corruption on 32-bit systems.

libtta versions up to and including 2.3 contain an integer overflow vulnerability in the function tta_decoder_init_get_info(). This flaw allows attackers to craft malicious .tta audio files that trigger a heap buffer overflow on 32-bit systems by exploiting unvalidated header fields, specifically by using a sample rate of 1 combined with a large samples value. The vulnerability can cause application crashes due to wrapped seek table allocations.

A Cross-Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.11.002. The flaw arises because the plugin does not properly escape a category navigation value before reflecting it into a JavaScript event handler on gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary scripts that execute in the browser of anyone who clicks the crafted breadcrumb link, including logged-in administrators.

Coder versions prior to 2.34.7 have an IP spoofing vulnerability in the ExtractRealIPAddress middleware. This flaw causes the software to trust the leftmost client-supplied X-Forwarded-For header value instead of the IP appended by a reverse proxy. Attackers can exploit this to bypass per-IP rate limits on login, one-time passcode, and password validation endpoints, enabling brute-force attacks and falsifying IP addresses in audit logs.

phpMyFAQ versions from 4.2.0-alpha up to but not including 4.2.0-beta contain a stored cross-site scripting (XSS) vulnerability in the SvgSanitizer component. This flaw allows FAQ editors to store executable SVG files by exploiting how script tags can be split around removed tokens, enabling script execution when victims open the affected files. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1.

CVE-2026-111881 is an integer underflow vulnerability in FreeRDP versions from 3.14.1 up to but not including 3.32.0. The flaw exists in the WinPR BMP writer component, where an incorrect stride calculation leads to passing a very large value (SIZE_MAX - 3) to a function that zeroes memory. This occurs when processing crafted 1-bit-per-pixel BMP images from a malicious RDP clipboard peer, potentially causing a client crash or out-of-bounds memory write.

The Contact Form 7 Signature Addon WordPress plugin up to version 4.2.2 has a vulnerability where it does not sanitize the signature field value before using it to build an email attachment path. This allows unauthenticated attackers to perform path traversal attacks to attach arbitrary files from the wp-content directory to outgoing emails. If the form is configured to send a copy to an attacker-controlled email address, the attacker can read the contents of targeted files.

A stored cross-site scripting (XSS) vulnerability exists in the User Registration & Membership WordPress plugin up to version 5.2.8. The flaw allows unauthenticated attackers to inject malicious scripts via the Checkbox Field Value due to insufficient input sanitization and output escaping. The vulnerability is reachable through an AJAX action that lacks nonce validation, enabling arbitrary script execution when users access the injected content.

ZoneMinder versions from 1.37.48 up to but not including 1.38.3 contain an OS command injection vulnerability in the downloadEvents() function. This occurs because the monitor Name value is manually wrapped in single quotes instead of properly escaped, allowing shell metacharacters to break out of the quoting. An attacker with monitor-create or monitor-edit permissions can store a malicious monitor Name, which is then executed when a user with Events View permission exports events. This vulnerability is fixed in version 1.38.3.

WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to run code via the template parameter of the public GET /rss/{feed_id} endpoint. Attackers can supply a non-built-in ext value and a {{=expression}} template whose object-subclass traversal bypasses the eval denylist to run OS commands as the service account.

CVE-2026-105959 is a high severity vulnerability in the spice-server component of Red Hat Enterprise Linux 6. It involves an integer overflow or wraparound issue where a size_t allocation size is truncated to int during a malloc callback. This flaw allows a malicious authenticated SPICE client to trigger a large heap buffer overflow during VM live migration by sending a crafted max_encoders value in migration data.

The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential value shipped verbatim in its own public source as a valid API key, which allows unauthenticated attackers to retrieve the stored crawl-analytics log, including each recorded visitor's IP address, user agent and referer.