Missing authorization in Droip plugin for WordPress (all versions ≤2.2.6) allows authenticated attackers with Subscriber-level privileges to manipulate content and settings via droip_post_apis() AJAX handler. Exploitable actions include arbitrary post deletion/creation, post duplication, settings modification, and user account manipulation. Requires only low-privilege authenticated access (PR:L) for high-impact compromise of confidentiality, integrity, and availability (CVSS 8.8). No public exploit identified at time of analysis.
Arbitrary file upload in Themeum Droip WordPress plugin (versions up to 2.5.1) permits authenticated attackers with Subscriber-level privileges or higher to upload malicious files without file type validation in the make_google_font_offline() function, enabling remote code execution on the affected server. CVSS 8.8 severity reflects low privilege requirement (PR:L) and complete confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Salesforce Tableau Server on Windows and Linux allows authenticated attackers with low privileges to conduct Server-Side Request Forgery attacks through the Amazon S3 Connector module, enabling resource location spoofing that could result in unauthorized access to internal systems and data exfiltration. Versions before 2025.1.3, 2024.2.12, and 2023.3.19 are affected. EPSS score of 0.04% (12th percentile) indicates minimal observed exploitation activity, and no public exploit has been identified at time of analysis.
Local privilege-relevant memory-safety flaw in the Linux kernel's NFC NCI UART line-discipline driver (drivers/nfc/nci/uart.c) allows a local attacker to trigger use of a partially-initialized tty->disc_data pointer. The driver assigned tty->disc_data before the NCI device was successfully opened, so if the underlying hardware sent data (or the NCIUARTSETDRIVER ioctl failed) during that window, code paths could operate on a device object that was never fully set up or was torn down on error. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile); the issue was fixed upstream by exposing disc_data only on the success path.
Out-of-bounds read in the Linux kernel virtio-net driver (through 6.16-rc3 and affected stable branches) lets a malicious or buggy virtio backend trigger a read past the allocated buffer inside xdp_linearize_page when XDP is used on the interface. The flaw stems from the driver reading follow-on ring buffers without validating that the reported received length fits within the allocated page, enabling potential information disclosure or a guest crash. There is no public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hard-to-weaponize local kernel memory-safety bug.
Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server allows a local attacker to corrupt kernel memory by racing network-namespace teardown against TIPC connection handling. The flaw, CWE-416, occurs because tipc_topsrv_stop() dereferences a tipc_conn after dropping the IDR lock while tipc_conn_recv_work() may have concurrently released the object's final reference. It carries a 7.8 (High) CVSS and is fixed upstream; there is no public exploit identified at time of analysis and its EPSS score is very low (0.17%).
Local privilege escalation and memory corruption in the Linux kernel's MediaTek MMC/SD host controller driver (mtk-sd) occurs because msdc_start_data() proceeds with a DMA transfer using stale settings after msdc_prepare_data() fails to map the DMA region. An attacker with local access to a system using MediaTek SD/MMC hardware can trigger an out-of-bounds write (CWE-787) leading to kernel memory corruption with high confidentiality, integrity, and availability impact. This is a code-quality/robustness fix in mainline kernel development (regression affects 6.16 release candidates and backported stable branches); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.17%, 7th percentile).
Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra I2C driver (i2c-tegra) lets a malicious or malfunctioning SMBus peripheral trigger a buffer over-read during an SMBus block read, because the driver trusted the device-supplied message length without validating it. A local attacker able to control an attached I2C/SMBus device, or to drive such a transfer, can leak adjacent kernel memory or crash the system. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.
Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).
Local privilege escalation via use-after-free in the Linux kernel's ROSE (amateur-radio X.25 PLP) networking stack, where rose_rt_device_down() mishandles neighbour-array compaction and leaves dangling rose_neigh pointers. A local attacker able to manipulate ROSE routing/devices can trigger access to freed kernel memory (CWE-416), enabling memory corruption that can lead to full compromise (confidentiality, integrity, and availability all High). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile) and it is not on CISA KEV.
Local privilege/security-policy bypass in the Linux kernel's secretmem subsystem allows LSM and SELinux access controls to be evaded on secretmem file descriptors because the S_PRIVATE flag was left set after alloc_anon_inode(), causing inode_init_security_anon() checks to be skipped. The affected code paths are the anonymous-inode helpers used by secretmem (memfd_secret) and KVM guest_memfd, present in Linux 6.16 release candidates and a Debian backport. There is no public exploit identified and EPSS is very low (0.16%), so the practical impact is a defense-in-depth regression that lets a local process create secretmem objects that mandatory-access-control policy should have denied.
Local privilege-escalation-class memory corruption in the Linux kernel's IPMI message handler (ipmi_msghandler) affects the ipmi_create_user() code path, where a list iterator that fails to match the requested intf->intf_num is left pointing at an invalid list-head-derived address and then passed to atomic_dec(&intf->nr_users), corrupting kernel memory. Local low-privileged users interacting with the IPMI subsystem can trigger the flaw, and with a CVSS of 7.8 (high) it threatens full confidentiality, integrity, and availability of the host. This is no public exploit identified at time of analysis, and the low EPSS (0.15%) reflects a niche, hardware-dependent subsystem rather than a mass-exploitation target.
Local privilege escalation and denial of service in the Linux kernel's AMD Platform Management Framework (amd-pmf) driver stems from a double-free (CWE-415) triggered when Smart PC setup fails: dev->buf is freed but not nulled, then freed again during amd_pmf_remove(). The fix converts the driver's allocations to device-managed (devm_*) allocations. No public exploit identified at time of analysis, and EPSS probability is low (0.15%), consistent with a hard-to-reach local-only kernel bug affecting AMD systems on kernels around 6.14-6.16-rc.
Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.
Kernel WARN triggered in the Linux kernel FUSE filesystem allows a local user mounting a DAX-backed FUSE filesystem to hit an unhandled warning in truncate_folio_batch_exceptionals() during inode eviction (fuse_evict_inode) on file close. The FUSE driver was missing the DAX-entry cleanup fix that xfs and ext4 already received (commit 0e2f80afcfa6), so DAX exceptional entries remained on the mapping at truncate time. Only pre-release kernels 6.16-rc1 through 6.16-rc3 are affected; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).
Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.
Local privilege escalation and host memory corruption in the Linux kernel's LoongArch KVM hypervisor (6.16 release candidates rc1-rc3) arises because the EIOINTC virtual irqchip fails to validate a user-space-supplied 'num_cpu' value against EIOINTC_ROUTE_MAX_VCPUS, allowing an array pointer overflow. A local user with permission to create KVM virtual machines can trigger out-of-bounds access in host kernel memory. No public exploit identified at time of analysis; EPSS is low (0.14%, 4th percentile) and the issue was fixed upstream before the 6.16 final release.
Local privilege escalation and denial of service in the Linux kernel's LoongArch KVM hypervisor arises from an array index overflow when handling writes to the EIOINTC_ENABLE register of the emulated extended I/O interrupt controller. Affecting mainline 6.16 release candidates (rc1-rc3) on LoongArch hosts, a low-privileged actor able to program the virtual interrupt controller can write out of the bounds of a kernel array, corrupting memory with high confidentiality, integrity, and availability impact (CVSS 7.8). There is no public exploit identified at time of analysis and EPSS probability is low (0.14%, 4th percentile).
A null pointer dereference vulnerability exists in the AMD display driver within the Linux kernel, where the dce_hwseq structure is accessed without proper null checking in the dce110_blank_stream function. The vulnerability affects Linux kernel versions up to 6.16-rc2 and could allow a local attacker with low privileges to cause a system crash or potentially execute arbitrary code with kernel privileges. With an EPSS score of only 0.02% and no known active exploitation, this represents a low real-world risk despite the high CVSS score.
Out-of-bounds shift in the Linux kernel Squashfs filesystem allows a local attacker to trigger memory corruption by racing a LOOP_SET_BLOCK_SIZE ioctl against a concurrent Squashfs mount on the same loop device, causing sb_min_blocksize() to return 0 and the code in squashfs_fill_super() to compute a shift exponent of 64. The affected subsystem is the kernel Squashfs driver (fs/squashfs/block.c) on Linux and downstream distributions such as Debian 11. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
An issue in ETSI Open-Source MANO (OSM) 14.0.x before 14.0.3, 15.0.x before 15.0.2, 16.0.0, and 17.0.0 allows a remote authenticated attacker to escalate privileges via the /osm/admin/v1/users. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Out-of-bounds access in the Linux kernel's GPIO-based regulator driver (regulator/gpio) allows a local, low-privileged actor to trigger memory corruption on systems where the regulator is configured with more than one GPIO (config::ngpios > 1). The driver under-allocated the drvdata::gpiods array to hold a single gpio_desc pointer instead of ngpios pointers, so subsequent indexing reads beyond the allocation. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds page table read in the Linux kernel's memory-management rmap subsystem (mm/rmap) allows a local low-privileged user to trigger disclosure of adjacent kernel memory or a crash via the batched unmap path in try_to_unmap_one(). The flaw affects 6.16 release-candidate kernels (6.16-rc1 through rc5) where a large folio's PTE mappings span beyond a single page table, causing folio_unmap_pte_batch scanning to read past the end of a PTE table. Rated CVSS 7.1 (high) with high confidentiality and availability impact; EPSS is very low at 0.16% and there is no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.