| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| In the Linux kernel, the following vulnerability has been resolved:
fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal
CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so
`cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls
`fwctl_register()` and then `device_add()`, fwctl_class is not yet
registered because fwctl_init() hasn't run, causing `class_to_subsys()` to
return NULL and skip knode_class initialization.
On device removal, `class_to_subsys()` returns non-NULL, and
`device_del()` calls `klist_del()` on the uninitialized knode, triggering
a NULL pointer dereference. |
| Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security.devlxd.management.volumes is enabled. |
| A privilege escalation vulnerability exists in LXD from 6.0 before 6.9, 5.21.0 before 5.21.5, and 5.0.0 before 5.0.7 regarding the handling of project-restriction policies during snapshot restoration.. An authenticated project operator in a restricted multi-tenant environment can bypass policy restrictions by importing a maliciously crafted instance backup containing restricted configuration keys within a snapshot. When the snapshot is restored, these restricted keys are applied to the live instance without policy validation. Starting the modified instance grants the operator unauthorized host root access. |
| OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in 17.3.3 and 17.4.1. |
| Contributor SQL Injection in WP Post Author <= 3.9.1 versions. |
| Contributor SQL Injection in WP Job Portal <= 2.5.2 versions. |
| Unauthenticated SQL Injection in wpDataTables <= 7.4 versions. |
| Subscriber SQL Injection in Tourfic <= 2.22.5 versions. |
| Administrator SQL Injection in Popup box <= 6.0.1 versions. |
| Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. |
| Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. |
| Contributor SQL Injection in wpForo Forum <= 3.0.9 versions. |
| Contributor SQL Injection in Contest Gallery <= 30.0.0 versions. |
| Unauthenticated SQL Injection in GeoDirectory <= 2.8.162 versions. |
| Unauthenticated SQL Injection in Advance Product Search <= 1.4.4 versions. |
| Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. |
| Subscriber Broken Access Control in WPCafe <= 3.0.14 versions. |
| Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, several direct, index-addressed Ollama proxy routes accept a caller-supplied url_idx path parameter and use it as a raw index into the admin-configured OLLAMA_BASE_URLS list. Access control on these routes validates only whether the user may use the requested model, never which backend the request is routed to. Any authenticated user can append an arbitrary url_idx to force their request onto an Ollama backend they were never authorized to reach, including internal, higher-privilege, or explicitly admin-disabled backends. This vulnerability is fixed in 0.9.6. |
| Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. |
| Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a Stored SQL Injection vulnerability through graph_name_regexp in the Reports feature. This issue has been fixed in version 1.2.31. |
