Total
451 CVE
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2019-15167 | 1 Tcpdump | 1 Tcpdump | 2025-12-03 | 9.1 Critical |
| The VRRP parser in tcpdump before 4.9.3 has a buffer over-read in print-vrrp.c:vrrp_print() for VRRP version 3, a different vulnerability than CVE-2018-14463. | ||||
| CVE-2024-53020 | 1 Qualcomm | 468 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 465 more | 2025-11-28 | 8.2 High |
| Information disclosure may occur while decoding the RTP packet with invalid header extension from network. | ||||
| CVE-2025-21463 | 1 Qualcomm | 422 Ar8035, Ar8035 Firmware, Csr8811 and 419 more | 2025-11-28 | 7.5 High |
| Transient DOS while processing the EHT operation IE in the received beacon frame. | ||||
| CVE-2024-53026 | 1 Qualcomm | 468 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 465 more | 2025-11-28 | 8.2 High |
| Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. | ||||
| CVE-2024-53021 | 1 Qualcomm | 450 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 447 more | 2025-11-28 | 8.2 High |
| Information disclosure may occur while processing goodbye RTCP packet from network. | ||||
| CVE-2025-21487 | 1 Qualcomm | 455 205 Mobile Platform, 205 Mobile Platform Firmware, 215 Mobile Platform and 452 more | 2025-11-28 | 8.2 High |
| Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. | ||||
| CVE-2025-47318 | 1 Qualcomm | 407 Apq8017, Apq8017 Firmware, Apq8064au and 404 more | 2025-11-28 | 7.5 High |
| Transient DOS while parsing the EPTM test control message to get the test pattern. | ||||
| CVE-2025-21488 | 1 Qualcomm | 217 Fastconnect 6200, Fastconnect 6200 Firmware, Fastconnect 6700 and 214 more | 2025-11-28 | 8.2 High |
| Information disclosure while decoding this RTP packet headers received by UE from the network when the padding bit is set. | ||||
| CVE-2025-27041 | 1 Qualcomm | 127 Ar8035, Ar8035 Firmware, Fastconnect 6900 and 124 more | 2025-11-05 | 5.5 Medium |
| Transient DOS while processing video packets received from video firmware. | ||||
| CVE-2025-27045 | 1 Qualcomm | 37 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 34 more | 2025-11-05 | 6.1 Medium |
| Information disclosure while processing batch command execution in Video driver. | ||||
| CVE-2025-27049 | 1 Qualcomm | 63 Fastconnect 6700, Fastconnect 6700 Firmware, Fastconnect 6900 and 60 more | 2025-11-05 | 5.5 Medium |
| Transient DOS while processing IOCTL call for image encoding. | ||||
| CVE-2025-27064 | 1 Qualcomm | 155 Fastconnect 6900, Fastconnect 6900 Firmware, Fastconnect 7800 and 152 more | 2025-11-05 | 6.1 Medium |
| Information disclosure while registering commands from clients with diag through diagHal. | ||||
| CVE-2025-47362 | 2 Qnx, Qualcomm | 78 Qnx, Msm8996au, Msm8996au Firmware and 75 more | 2025-11-05 | 6.1 Medium |
| Information disclosure while processing message from client with invalid payload. | ||||
| CVE-2024-34459 | 1 Xmlsoft | 2 Libxml2, Xmllint | 2025-11-04 | 7.5 High |
| An issue was discovered in xmllint (from libxml2) before 2.11.8 and 2.12.x before 2.12.7. Formatting error messages with xmllint --htmlout can result in a buffer over-read in xmlHTMLPrintFileContext in xmllint.c. | ||||
| CVE-2024-24246 | 2 Fedoraproject, Qpdf Project | 2 Fedora, Qpdf | 2025-11-04 | 5.5 Medium |
| Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::__shared_count() function at /bits/shared_ptr_base.h. | ||||
| CVE-2024-24476 | 2 Fedoraproject, Wireshark | 2 Fedora, Wireshark | 2025-11-04 | 7.5 High |
| A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lookup_str(), size components. NOTE: this is disputed by the vendor because neither release 4.2.0 nor any other release was affected. | ||||
| CVE-2023-45919 | 1 Mesa3d | 1 Mesa | 2025-11-04 | 5.3 Medium |
| Mesa 23.0.4 was discovered to contain a buffer over-read in glXQueryServerString(). NOTE: this is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controller server. | ||||
| CVE-2023-39541 | 1 Weston-embedded | 1 Uc-tcp-ip | 2025-11-04 | 5.9 Medium |
| A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv6 ICMPv6 packet. | ||||
| CVE-2023-39540 | 1 Weston-embedded | 1 Uc-tcp-ip | 2025-11-04 | 5.9 Medium |
| A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01. A specially crafted network packet can lead to an out-of-bounds read. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability concerns a denial of service within the parsing an IPv4 ICMP packet. | ||||
| CVE-2024-50022 | 2 Linux, Redhat | 2 Linux Kernel, Enterprise Linux | 2025-11-03 | 5.5 Medium |
| In the Linux kernel, the following vulnerability has been resolved: device-dax: correct pgoff align in dax_set_mapping() pgoff should be aligned using ALIGN_DOWN() instead of ALIGN(). Otherwise, vmf->address not aligned to fault_size will be aligned to the next alignment, that can result in memory failure getting the wrong address. It's a subtle situation that only can be observed in page_mapped_in_vma() after the page is page fault handled by dev_dax_huge_fault. Generally, there is little chance to perform page_mapped_in_vma in dev-dax's page unless in specific error injection to the dax device to trigger an MCE - memory-failure. In that case, page_mapped_in_vma() will be triggered to determine which task is accessing the failure address and kill that task in the end. We used self-developed dax device (which is 2M aligned mapping) , to perform error injection to random address. It turned out that error injected to non-2M-aligned address was causing endless MCE until panic. Because page_mapped_in_vma() kept resulting wrong address and the task accessing the failure address was never killed properly: [ 3783.719419] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.049006] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.049190] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.448042] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.448186] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3784.792026] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3784.792179] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.162502] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.162633] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.461116] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.461247] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3785.764730] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3785.764859] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.042128] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.042259] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.464293] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.464423] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3786.818090] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3786.818217] Memory failure: 0x200c9742: recovery action for dax page: Recovered [ 3787.085297] mce: Uncorrected hardware memory error in user-access at 200c9742380 [ 3787.085424] Memory failure: 0x200c9742: recovery action for dax page: Recovered It took us several weeks to pinpoint this problem, but we eventually used bpftrace to trace the page fault and mce address and successfully identified the issue. Joao added: ; Likely we never reproduce in production because we always pin : device-dax regions in the region align they provide (Qemu does : similarly with prealloc in hugetlb/file backed memory). I think this : bug requires that we touch *unpinned* device-dax regions unaligned to : the device-dax selected alignment (page size i.e. 4K/2M/1G) | ||||