The FunnelKit plugin for WordPress (versions ≤3.5.3) contains a critical vulnerability allowing unauthenticated attackers to install arbitrary plugins due to missing capability checks and weak nonce validation in the install_or_activate_addon_plugins() function. This is a pre-authentication remote code execution vector with a CVSS 9.8 severity rating that enables complete site compromise through malicious plugin installation.
A remote code execution vulnerability in CloudClassroom-PHP-Project v1.0 (CVSS 9.8). Risk factors: public PoC available.
Critical remote code execution vulnerability in EfroTech Time Trax v1.0 that exploits improper file upload validation in the leave request form's attachment functionality. An authenticated attacker with low privileges can upload and execute arbitrary code on the server, achieving complete system compromise with high confidentiality, integrity, and availability impact. The vulnerability is classified as actively exploitable (CVSS 9.9) and represents an immediate threat to all deployed instances.
CloudClassroom-PHP-Project v1.0 contains a critical SQL injection vulnerability in the loginlinkadmin.php component that allows unauthenticated attackers to bypass authentication and gain unauthorized administrative access by injecting malicious SQL payloads into the username field. With a CVSS score of 9.8 and network-accessible attack vector requiring no privileges or user interaction, this vulnerability poses immediate and severe risk to all deployments. While specific KEV status and EPSS data were not provided in the intelligence sources, the combination of complete authentication bypass capability, high CVSS score, and trivial exploitation complexity suggests this is actively exploitable and likely to be targeted by opportunistic attackers.
D-Link DPH-400S/SE VoIP phones running firmware v1.01 contain hardcoded provisioning credentials (PROVIS_USER_PASSWORD) embedded directly in the firmware binary, allowing attackers with firmware access to extract sensitive authentication material via static analysis tools. This critical vulnerability (CVSS 9.8) enables unauthorized access to device management functions and potentially user accounts, with network-accessible exploitation possible if combined with firmware extraction techniques.
CryptPad versions prior to 2025.3.0 contain a critical authentication bypass vulnerability that allows attackers to circumvent Two-Factor Authentication (2FA) enforcement through a trivial path parameter manipulation. An attacker who obtains valid user credentials can bypass 2FA protection by URL-encoding a single character in the access path, gaining full account access without the second authentication factor. The vulnerability has a CVSS score of 9.1 (Critical) and requires no special privileges or user interaction to exploit.
SQL Injection vulnerability in pbootCMS versions 3.2.5 and 3.2.10 that allows unauthenticated remote attackers to execute arbitrary SQL queries via crafted GET requests, potentially leading to unauthorized data disclosure, modification, or system compromise. With a CVSS score of 8.8 and network-accessible attack vector requiring only user interaction, this represents a critical threat to publicly exposed pbootCMS installations. The vulnerability's high impact on confidentiality, integrity, and availability suggests potential for large-scale exploitation if proof-of-concept code becomes available.
A cross-site scripting vulnerability in Real Estate Management 1.0 (CVSS 8.1). Risk factors: public PoC available.
A buffer overflow vulnerability (CVSS 7.8) that allows a local attacker. Risk factors: public PoC available.
A remote code execution vulnerability in all (CVSS 7.2). Risk factors: public PoC available. Vendor patch is available.
A denial of service vulnerability (CVSS 7.1) that allows a remote attacker. Risk factors: public PoC available.
Buffer overflow vulnerability in the PFCP (Packet Forwarding Control Protocol) library used by open5gs 2.7.2 and earlier. The vulnerability exists in the `ogs_pfcp_dev_add` function due to missing length validation on the `session.dev` field, allowing a local attacker with low privileges to cause a buffer overflow that can result in information disclosure, integrity compromise, or denial of service. The vulnerability has not been reported as actively exploited in the wild (no KEV status indicated), but the low attack complexity and local attack vector make it a practical concern for compromised or insider threat scenarios.
CryptPad is a collaboration suite. Prior to version 2025.3.0, the "Link Bouncer" functionality attempts to filter javascript URIs to prevent Cross-Site Scripting (XSS), however this can be bypassed. There is an "early allow" code path that happens before the URI's protocol/scheme is checked, which a maliciously crafted URI can follow. This issue has been patched in version 2025.3.0.
A remote code execution vulnerability in the PDF scanning processes of ClamAV could allow an unauthenticated (CVSS 9.8). Critical severity with potential for significant impact on affected systems.
CVE-2025-51381 is an authentication bypass vulnerability in KCM3100 version 1.4.2 and earlier that allows unauthenticated attackers on the local network (LAN) to completely bypass product authentication and gain full system access. The vulnerability has a critical CVSS score of 9.8 with no authentication or user interaction required, enabling attackers to achieve complete confidentiality, integrity, and availability compromise of affected devices.
The Pixabay Images plugin for WordPress versions up to 3.4 contains an arbitrary file upload vulnerability in the pixabay_upload function due to missing file type validation. Authenticated attackers with Author-level access or higher can upload arbitrary files to the server, potentially enabling remote code execution. This vulnerability has a CVSS score of 8.8 (High) and represents a significant risk to WordPress installations using this plugin.
Use-after-free vulnerability in Google Chrome's Metrics component that allows remote attackers to exploit heap corruption and achieve arbitrary code execution through a crafted HTML page. The vulnerability affects Chrome versions prior to 137.0.7151.119 and requires only user interaction (clicking a link/viewing a page) with no special privileges. This is a high-severity remote code execution vector with active exploitation risk given the ubiquity of Chrome and the low attack complexity.
CVE-2025-36049 is a security vulnerability (CVSS 8.8). High severity vulnerability requiring prompt remediation.
High-severity integer overflow vulnerability in the V8 JavaScript engine within Google Chrome that enables out-of-bounds memory access through a maliciously crafted HTML page. The vulnerability affects Chrome versions prior to 137.0.7151.119 and requires only user interaction (clicking a link, visiting a page) with no special privileges needed. Successful exploitation allows attackers to read sensitive data, modify content, or crash the browser with a CVSS score of 8.8.
The tarteaucitron.io WordPress plugin before 1.9.5 uses query parameters from YouTube oEmbed URLs without sanitizing these parameters correctly, which could allow users with the contributor role and above to perform Stored Cross-site Scripting attacks.
Remote denial-of-service vulnerability in the Cisco AnyConnect VPN server affecting Cisco Meraki MX and Z Series Teleworker Gateway devices. An unauthenticated attacker can exploit variable initialization errors during SSL VPN session establishment by sending crafted HTTPS requests, causing the AnyConnect service to restart and disconnecting all active VPN sessions while blocking new connections. With a CVSS score of 8.6 and network-exploitable attack vector requiring no authentication, this vulnerability poses significant risk to organizations relying on these devices for remote access infrastructure.
Privilege escalation vulnerability in the Linux kernel's eBPF (Berkeley Packet Filter) subsystem where a locally authenticated attacker can craft malicious BPF programs that redirect packets with invalid packet lengths, causing kernel memory corruption and potential denial of service or privilege escalation. The vulnerability affects Linux kernel versions prior to the fix commit and requires local access with unprivileged user privileges to exploit. This is not currently listed as actively exploited in CISA KEV, but the high CVSS score (7.8) and local attack vector with low complexity make it a priority for systems running vulnerable kernels.
CVE-2025-38079 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Use-after-free vulnerability in the Linux kernel's TIPC (Topology and Dependency Discovery Protocol) subsystem where the tipc_aead_encrypt_done() function in net/tipc/crypto.c may access freed memory during cryptographic operations. Unprivileged local users (PR:L) can trigger this by manipulating network namespaces and TIPC bearer configurations, causing kernel memory corruption that could lead to information disclosure, privilege escalation, or denial of service. The vulnerability has a reproducible proof-of-concept requiring namespace manipulation and TIPC key configuration.
CVE-2025-38024 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Resource leak vulnerability in the Linux kernel's MPTCP (Multipath TCP) implementation where subflow sockets fail to be cleaned up if socket creation is blocked by a CGROUP_INET_SOCK_CREATE eBPF program, leading to memory exhaustion. This affects Linux kernel versions prior to the fix commit, requiring local privilege access (unprivileged user with capability to trigger eBPF cgroup socket creation policies). While not known to be actively exploited in the wild, the vulnerability enables local privilege escalation through resource exhaustion and potential information disclosure via unfreed memory structures.
A denial of service vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Potential buffer overflow vulnerability in the Linux kernel's ASoC Intel AVS audio driver caused by improper use of snprintf() instead of scnprintf(). While the vulnerability has a high CVSS score of 7.8 (local privilege escalation), the actual exploitability is low because the overflow scenario is acknowledged as 'unrealistic' in the kernel patch. The vulnerability affects Linux kernel versions with the Intel AVS audio subsystem and requires local access with non-root privileges to exploit.
Use-after-free vulnerability in the Linux kernel's AMD GPU (amdgpu) driver that occurs when amdgpu_cs_vm_handling returns an error, causing the bo_list_mutex to be unlocked twice-once inside the function and again in amdgpu_cs_parser_fini. This leads to refcount underflow and potential memory corruption. The vulnerability affects unprivileged local users on systems with AMD GPUs and Linux kernel versions around 5.20, allowing denial of service and potential privilege escalation through memory corruption exploitation.
Use-after-free vulnerability in the Linux kernel's firmware_loader subsystem that allows local attackers with low privileges to achieve code execution with high impact. The vulnerability occurs in firmware_upload_unregister() where device_unregister() can free memory that is subsequently dereferenced, enabling privilege escalation and system compromise. The flaw was discovered by the kernel test robot and is fixed by preserving a module reference before device cleanup.
A remote code execution vulnerability (CVSS 7.8) that allows userspace. High severity vulnerability requiring prompt remediation. Vendor patch is available.
Use-after-free (UAF) vulnerability in the Linux kernel's memory allocation tag tracking system that occurs when module percpu counters are freed prematurely during module unloading while allocation tags remain referenced. An unprivileged local attacker can trigger this vulnerability to read/write kernel memory or cause denial of service by accessing memory allocated by an unloaded module. The vulnerability affects Linux kernels with memory allocation profiling enabled and has a CVSS score of 7.8 (high severity).
Memory corruption vulnerability in the Linux kernel's fastrpc driver that occurs during device probe when the devicetree defines more sessions than the FASTRPC_MAX_SESSIONS compile-time limit. An attacker with local access and low privileges can trigger out-of-bounds memory writes to the fixed-size session array, potentially achieving information disclosure, privilege escalation, or denial of service. The vulnerability requires malicious or misconfigured devicetree configuration and is not known to be actively exploited in the wild, but represents a real risk in systems with untrusted device configuration sources.
Memory corruption vulnerability in the Linux kernel's fastrpc (Fast RPC) subsystem that allows a local, low-privileged attacker to corrupt kernel memory and potentially achieve privilege escalation or denial of service. The vulnerability exists in the session allocation logic where an off-by-one error in the overflow check causes the session counter to be incremented even when no sessions remain available, enabling out-of-bounds writes to a fixed-size slab-allocated array during fastrpc_session_alloc() calls on device open. This affects Linux kernel versions prior to the patch, with CVSS 7.8 (High) indicating significant local privilege escalation risk; exploitation requires local file system access to /dev/fastrpc-* device nodes.
A buffer overflow vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
CVE-2022-50192 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Use-after-free (UAF) vulnerability in the Linux kernel's SPI controller registration code that occurs when devm_add_action() fails during device manager initialization. The vulnerability affects Linux kernel versions containing the vulnerable simplification commit 59ebbe40fb51, allowing local attackers with low privileges to trigger a double-decrement of a reference counter, leading to memory corruption and potential privilege escalation or denial of service. The vulnerability requires local access and is not known to be actively exploited in the wild.
Use-after-free vulnerability in the Linux kernel's RDMA/irdma driver that allows a local privileged attacker to cause a denial of service or potentially execute arbitrary code. The vulnerability occurs during CQ (Completion Queue) destruction when an interrupt may trigger processing of a CQE (Completion Queue Entry) after the CQ resources have already been freed, creating a race condition window. This affects Linux kernel versions with the vulnerable irdma driver code path, with no evidence of active KEV exploitation or widespread POC availability at the time of disclosure.
Metadata reservation exhaustion vulnerability in the Linux kernel's Btrfs filesystem that affects zoned storage devices. When writing data to zoned filesystems, the metadata reservation calculation uses a fixed BTRFS_MAX_EXTENT_SIZE constant that does not account for smaller zone append limits, causing the number of extents to be severely underestimated. This leads to metadata buffer exhaustion and system warnings/failures on small RAM environments, allowing local attackers with write access to cause denial of service by triggering resource exhaustion through normal file write operations.
CVE-2022-50066 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Buffer overflow vulnerability in the Linux kernel's DSA SJA1105 driver that occurs when dsa_devlink_region_create() fails during initialization, causing the priv->regions array to be accessed with a negative index (-1). This affects Linux kernel versions containing the vulnerable sja1105_setup_devlink_regions() function and requires local access with limited privileges to trigger. While not known to be actively exploited in the wild (KEV status not confirmed), the CVSS 7.8 High severity score reflects significant local impact potential including information disclosure and denial of service.
Use-after-free vulnerability in the Linux kernel's NFC pn533 driver that occurs when a pn532 UART device is removed while a command timeout timer is still pending. An attacker with local access and low privileges can trigger a kernel crash or potentially achieve code execution by forcing device removal while timer callbacks are executing. This vulnerability affects Linux kernel versions with the vulnerable pn533 driver and has been patched; there is no evidence of active exploitation in the wild.
CVE-2025-38019 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
CVE-2025-38013 is an array-index-out-of-bounds vulnerability in the Linux kernel's mac80211 WiFi subsystem where the n_channels field is not properly initialized before use in the cfg80211_scan_request structure, allowing a local unprivileged attacker to trigger memory safety violations. The vulnerability affects Linux kernel versions with the vulnerable code path in net/mac80211/scan.c and can lead to information disclosure, memory corruption, or denial of service. This is not currently listed as actively exploited in public KEV databases, but UBSAN detection indicates the issue is triggerable via syzkaller fuzzing.
CVE-2022-50219 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Use-after-free vulnerability in the Linux kernel's CoreSight debugging subsystem that occurs when device connections are improperly cleaned up during module removal. An attacker with local privilege (user-level access) can trigger a kernel crash or potentially achieve code execution by unloading CoreSight devices in a specific order, exploiting the failure to clear fwnode field references after dropping refcounts. The vulnerability affects Linux kernels before version 5.19 and has a high CVSS score of 7.8 (High severity), though real-world exploitability is limited by the requirement for local user access and specific hardware/driver configuration.
Use-after-free vulnerability in the Linux kernel's netfilter nf_tables subsystem where SET_ID lookups can incorrectly reference sets from different tables, allowing a local attacker with low privileges to cause a use-after-free condition when tables are removed. With CVSS 7.8 (High) and CWE-416 classification, this affects local privilege escalation scenarios; exploitation requires local access but no special privileges or user interaction.
CVE-2022-50212 is a security vulnerability (CVSS 7.8) that allows chain_id. High severity vulnerability requiring prompt remediation. Vendor patch is available.
A buffer overflow vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.
CVE-2022-50179 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.