Thu, May 01 · 03:15 PM CDTCVE-2022-49770
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ceph: avoid putting the realm twice when decoding snaps fails When decoding the snaps fails it maybe leaving the 'first_realm' and 'realm' pointing to the same snaprealm memory. And then it'll put it twice and could cause random use-after-free, BUG_ON,
CVECVE-2022-49770
SeverityCRITICAL
TypeUPDATED
PublishedThu, May 01 · 03:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-52440
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob() If authblob->SessionKey.Length is bigger than session key size(CIFS_KEY_SIZE), slub overflow can happen in key exchange codes. cifs_arc4_crypt copy to session key array from SessionKey from c
CVECVE-2023-52440
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 21 · 08:15 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-52480
9.8/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix race condition between session lookup and expire Thread A + Thread B ksmbd_session_lookup | smb2_sess_setup sess = xa_load | | | xa_erase(&conn->sessions, sess->id); | | ksmbd_session_destroy(sess) --> kfree(sess) | // UAF! | sess->last_acti
CVECVE-2023-52480
SeverityCRITICAL
TypeUPDATED
PublishedThu, Feb 29 · 06:15 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2026-16242
9.4/10 · Must read/watchNVDvuln
Summary
A flaw was found in the Konnectivity proxy-server configuration for hosted control planes. The agent-facing listener was started without --cluster-ca-cert (and without token-based agent authentication), so client certificates were not validated. A remote attacker who can reach the Konnectivity cluster endpoint could co
CVECVE-2026-16242
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jul 20 · 08:16 AM CDT
ModifiedSun, Aug 16 · 09:16 AM CDT
CVE-2022-4993
9.1/10 · Must read/watchNVDvuln
Summary
HTML::FormHandler versions through 0.40068 for Perl allow attacker selected method dispatch and resource exhaustion because _apply_actions and add_error use error message text built from request data as a Locale::Maketext bracket notation template. add_error hands its first argument to the language handle as the Locale
CVECVE-2022-4993
SeverityCRITICAL
TypeUPDATED
PublishedThu, Aug 13 · 05:17 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-32249
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: not allow guest user on multichannel This patch return STATUS_NOT_SUPPORTED if binding session is guest.
CVECVE-2023-32249
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 16 · 02:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-3867
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds read in smb2_sess_setup ksmbd does not consider the case of that smb2 session setup is in compound request. If this is the second payload of the compound, OOB read issue occurs while processing the first payload in the smb2_ses
CVECVE-2023-3867
SeverityCRITICAL
TypeUPDATED
PublishedSat, Aug 16 · 02:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-52441
9.1/10 · Must read/watchNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out of bounds in init_smb2_rsp_hdr() If client send smb2 negotiate request and then send smb1 negotiate request, init_smb2_rsp_hdr is called for smb1 negotiate request since need_neg is set to false. This patch ignore smb1 packets after ->ne
CVECVE-2023-52441
SeverityCRITICAL
TypeUPDATED
PublishedWed, Feb 21 · 08:15 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2025-49794
9.1/10 · Must read/watchNVDvuln
Summary
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the schema elements. This flaw allows a malicious actor to craft a malicious XML document used as input for libxml, resulting in the program's crash using libxml or
CVECVE-2025-49794
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedSun, Aug 16 · 12:16 AM CDT
CVE-2025-49796
9.1/10 · Must read/watchNVDvuln
Summary
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of service or other possible undefined behavior due to sensitive
CVECVE-2025-49796
SeverityCRITICAL
TypeUPDATED
PublishedMon, Jun 16 · 04:15 PM CDT
ModifiedSun, Aug 16 · 12:16 AM CDT
CVE-2022-49328
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: mt76: fix use-after-free by removing a non-RCU wcid pointer Fixes an issue caught by KASAN about use-after-free in mt76_txq_schedule by protecting mtxq->wcid with rcu_lock between mt76_txq_schedule and sta_info_[alloc, free]. [18853.876689] ===========
CVECVE-2022-49328
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 26 · 07:01 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-49519
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ath10k: skip ath10k_halt during suspend for driver state RESTARTING Double free crash is observed when FW recovery(caused by wmi timeout/crash) is followed by immediate suspend event. The FW recovery is triggered by ath10k_core_restart() which calls dr
CVECVE-2022-49519
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 26 · 07:01 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-49974
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: HID: nintendo: fix rumble worker null pointer deref We can dereference a null pointer trying to queue work to a destroyed workqueue. If the device is disconnected, nintendo_hid_remove is called, in which the rumble_queue is destroyed. Avoid using that
CVECVE-2022-49974
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 18 · 11:15 AM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-52479
8.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix uaf in smb20_oplock_break_ack drop reference after use opinfo.
CVECVE-2023-52479
SeverityHIGH
TypeUPDATED
PublishedThu, Feb 29 · 06:15 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2025-1244
8.8/10 · Worth your timeNVDvuln
Summary
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect.
CVECVE-2025-1244
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 12 · 03:15 PM CST
ModifiedSat, Aug 15 · 10:16 PM CDT
CVE-2026-1784
8.8/10 · Worth your timeNVDvuln
Summary
The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy. It was found that the checks performed on the spec.path YAML stanza in a Route document was insufficient and could allow a controlled injection of the HAProxy configuration.
CVECVE-2026-1784
SeverityHIGH
TypeUPDATED
PublishedTue, Jun 02 · 09:16 AM CDT
ModifiedSun, Aug 16 · 10:16 AM CDT
CVE-2026-49332
8.5/10 · Worth your timeNVDvuln
Summary
A flaw was found in openshift/oauth-proxy. The proxy sets authenticated identity headers using only dash-variant keys (X-Forwarded-User) but does not strip underscore-variant keys (X_Forwarded_User) from incoming requests. WSGI and PHP frameworks normalize both variants to the same variable, allowing an authenticated l
CVECVE-2026-49332
SeverityHIGH
TypeUPDATED
PublishedTue, Jul 28 · 01:18 PM CDT
ModifiedSun, Aug 16 · 10:16 AM CDT
CVE-2022-50442
8.4/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Validate buffer length while parsing index indx_read is called when we have some NTFS directory operations that need more information from the index buffers. This adds a sanity check to make sure the returned index buffer length is legit, or
CVECVE-2022-50442
SeverityHIGH
TypeUPDATED
PublishedWed, Oct 01 · 12:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-3865
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix out-of-bound read in smb2_write ksmbd_smb2_check_message doesn't validate hdr->NextCommand. If ->NextCommand is bigger than Offset + Length of smb2 write, It will allow oversized smb2 write length. It will cause OOB read in smb2_write.
CVECVE-2023-3865
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 16 · 02:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2023-4130
8.1/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix wrong next length validation of ea buffer in smb2_set_ea() There are multiple smb2_ea_info buffers in FILE_FULL_EA_INFORMATION request from client. ksmbd find next smb2_ea_info using ->NextEntryOffset of current smb2_ea_info. ksmbd need to v
CVECVE-2023-4130
SeverityHIGH
TypeUPDATED
PublishedSat, Aug 16 · 02:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-49363
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to do sanity check on block address in f2fs_do_zero_range() As Yanming reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215894 I have encountered a bug in F2FS file system in kernel v5.17. I have uploaded the system call sequ
CVECVE-2022-49363
SeverityHIGH
TypeUPDATED
PublishedWed, Feb 26 · 07:01 AM CST
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-49969
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: clear optc underflow before turn off odm clock [Why] After ODM clock off, optc underflow bit will be kept there always and clear not work. We need to clear that before clock off. [How] Clear that if have when clock off.
CVECVE-2022-49969
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 18 · 11:15 AM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-50034
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3 fix use-after-free at workaround 2 BUG: KFENCE: use-after-free read in __list_del_entry_valid+0x10/0xac cdns3_wa2_remove_old_request() { ... kfree(priv_req->request.buf); cdns3_gadget_ep_free_request(&priv_ep->endpoint, &priv_req->request);
CVECVE-2022-50034
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 18 · 11:15 AM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-50151
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix random warning message when driver load Warning log: [ 4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xa20 (GFP_ATOMIC). Fix your code! [ 4.150340] CPU: 1 PID: 175 Comm: 1-0050 Not tainted 5.15.5-00039-g2fd9ae1b568c #20 [
CVECVE-2022-50151
SeverityHIGH
TypeUPDATED
PublishedWed, Jun 18 · 11:15 AM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
CVE-2022-50256
7.8/10 · Worth your timeNVDvuln
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/meson: remove drm bridges at aggregate driver unbind time drm bridges added by meson_encoder_hdmi_init and meson_encoder_cvbs_init were not manually removed at module unload time, which caused dangling references to freed memory to remain linked in
CVECVE-2022-50256
SeverityHIGH
TypeUPDATED
PublishedMon, Sep 15 · 02:15 PM CDT
ModifiedSat, Aug 15 · 01:17 PM CDT
