Search vulnerabilities

Expected end of text, found '–' (at char 11), (line:1, col:12)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,880

CVE-2026-108779

erzhongxmu JEEWMS WmSttInGoodsController.java WmSttInGoodsController.list sql injection

A vulnerability was identified in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected is the function WmSttInGoodsController.list of the file src/main/java/com/zzjee/wm/controller/WmSttInGoodsController.java. Such manipulation of the argument searchstr leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Erzhongxmu Jeewms
Products
Jeewms Jeewms
CVE-2022-41850

kernel: Race condition in roccat_report_event in drivers/hid/hid-roccat.c

roccat_report_event in drivers/hid/hid-roccat.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free in certain situations where a report is received while copying a report->value is in progress.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux
Products
Debian Linux Linux Kernel
CVE-2022-41849

Kernel: A race between ufx_ops_open() and ufx_usb_disconnect() may result in UAF

drivers/video/fbdev/smscufx.c in the Linux kernel through 5.19.12 has a race condition and resultant use-after-free if a physically proximate attacker removes a USB device while calling open(), aka a race condition between ufx_ops_open and ufx_usb_disconnect.

CVSS 3.1 · 4.2 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux
Products
Debian Linux Linux Kernel
CVE-2022-41674

kernel: u8 overflow problem in cfg80211_update_notlisted_nontrans()

An issue was discovered in the Linux kernel before 5.19.16. Attackers able to inject WLAN frames could cause a buffer overflow in the ieee80211_bss_info_update function in net/mac80211/scan.c.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Debian Fedoraproject Linux and 1 more
Products
Debian Linux Fedora Linux Kernel and 3 more
CVE-2022-41218

kernel: Report vmalloc UAF in dvb-core/dmxdev

In drivers/media/dvb-core/dmxdev.c in the Linux kernel through 5.19.10, there is a use-after-free caused by refcount races, affecting dvb_demux_open and dvb_dmxdev_release.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2022-40768

kernel: leak of sensitive information due to uninitialized data in stex_queuecommand_lck() in drivers/scsi/stex.c

drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lacks a memset for the PASSTHRU_CMD case.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Linux
Products
Debian Linux Fedora Linux Kernel
CVE-2022-40307

kernel: use-after-free in efi_capsule_write in capsule-loader.c

An issue was discovered in the Linux kernel through 5.19.8. drivers/firmware/efi/capsule-loader.c has a race condition with a resultant use-after-free.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux
Products
Debian Linux Linux Kernel
CVE-2022-40304

libxml2: dict corruption caused by entity reference cycles

An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic errors. In one case, a double-free can be provoked.

CVSS 3.1 · 7.8 High EPSS 5.8% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-40303

libxml2: integer overflows with XML_PARSE_HUGE

An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. This results in an attempt to access an array at a negative 2GB offset, typically leading to a segmentation fault.

CVSS 3.1 · 7.5 High EPSS 41.4% KEV · Not listed
Vendors
Apple Netapp Redhat and 1 more
Products
Ipados Iphone Os Macos and 22 more
CVE-2022-39188

kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry

An issue was discovered in include/asm-generic/tlb.h in the Linux kernel before 5.19. Because of a race condition (unmap_mapping_range versus munmap), a device driver can free a page while it still has stale TLB entries. This only occurs in situations with VM_PFNMAP VMAs.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Redhat
Products
Debian Linux Linux Kernel Enterprise Linux and 2 more
CVE-2022-37454

XKCP: buffer overflow in the SHA-3 reference implementation

The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute arbitrary code or eliminate expected cryptographic properties. This occurs in the sponge function interface.

CVSS 3.1 · 9.8 Critical EPSS 7.4% KEV · Not listed
Vendors
Debian Extended Keccak Code Package Project Fedoraproject and 6 more
Products
Debian Linux Extended Keccak Code Package Fedora and 6 more
CVE-2022-36946

kernel: DoS in nfqnl_mangle in net/netfilter/nfnetlink_queue.c

nfqnl_mangle in net/netfilter/nfnetlink_queue.c in the Linux kernel through 5.18.14 allows remote attackers to cause a denial of service (panic) because, in the case of an nf_queue verdict with a one-byte nfta_payload attribute, an skb_pull can encounter a negative skb->len.

CVSS 3.1 · 7.5 High EPSS 8.9% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel Active Iq Unified Manager and 7 more
CVE-2022-36879

kernel: xfrm_expand_policies() in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice

An issue was discovered in the Linux kernel through 5.18.14. xfrm_expand_policies in net/xfrm/xfrm_policy.c can cause a refcount to be dropped twice.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel A700s and 43 more
CVE-2022-36123

kernel: lacks a certain clear operation for the block starting symbol (.bss) cause a denial of service or gain privileges

The Linux kernel before 5.18.13 lacks a certain clear operation for the block starting symbol (.bss). This allows Xen PV guest OS users to cause a denial of service or gain privileges.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Linux Netapp
Products
Linux Kernel H300s H300s Firmware and 8 more
CVE-2022-35260

curl: .netrc parser out-of-bounds access

curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.

CVSS 3.1 · 6.5 Medium EPSS 2.7% KEV · Not listed
Vendors
Apple Haxx Netapp and 1 more
Products
Macos Curl Clustered Data Ontap and 9 more
CVE-2022-35252

curl: Incorrect handling of control code characters in cookies

When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.

CVSS 3.1 · 3.7 Low EPSS 3.8% KEV · Not listed
Vendors
Apple Debian Haxx and 3 more
Products
Macos Debian Linux Curl and 18 more