Memory leak and refcount imbalance in Linux kernel VLAN 0 handling allows local attackers with low privileges to trigger denial of service via kernel panic when toggling the rx-vlan-filter feature at runtime on bonded or team interfaces. The vulnerability affects kernel versions 6.16-rc1 through rc3 and potentially earlier versions; vendor-released patches are available across affected stable branches.
Denial of service in Linux kernel net/sched subsystem allows local authenticated attackers to trigger a kernel panic (BUG_ON) by manipulating HTB qdisc (hierarchical token bucket queue discipline) configuration with nested qdisc classes, causing htb_lookup_leaf to encounter an empty rbtree. The vulnerability requires low privilege and local access; no special user interaction is needed once a malicious qdisc configuration is set up. Vendor-released patches are available across multiple stable kernel series.
Weak cryptographic hashing (CWE-327) in VaelsysV4's PHP web interface exposes sensitive information to authenticated remote attackers who can manipulate the xajaxargs parameter of /grid/vgrid_server.php. Affected versions span the 5.1.0 and 5.4.0 release lines; patched releases 5.1.1 and 5.4.1 are available. No public exploit identified at time of analysis per CISA KEV, but a public proof-of-concept exists, and the EPSS score of 0.03% confirms very limited real-world exploitation activity to date.
A race condition in the Linux kernel's net/sched sch_qfq module allows local authenticated attackers to cause denial of service through NULL pointer dereference or use-after-free errors when concurrent threads modify queue aggregation structures during packet scheduling. The vulnerability requires low privileges and has a low real-world exploitation probability (EPSS 0.02%), though a vendor patch is available.
DNS resolve confusion in netavark, the Rust-based network stack for Podman containers, causes container name lookups to be forwarded to unexpected external DNS servers due to a regression that removed the dns.podman search domain. Affected deployments on Red Hat Enterprise Linux 8/9/10 and OpenShift Container Platform 4.0 running netavark < 1.15.1 are subject to misdirected container DNS resolution when host resolv.conf search domains contain a record matching a running container's hostname. The impact is limited to information disclosure (CVSS 3.7, Low), with no confirmed active exploitation and no public exploit identified at time of analysis.
SQL injection in Campcodes Courier Management System 1.0 via the ID parameter in /view_parcel.php allows authenticated remote attackers to execute arbitrary SQL queries with limited data exposure impact. The CVSS score of 2.1 reflects constraints imposed by authentication requirements (PR:L) and restricted scope, but publicly available exploit code exists; however, the 0.06% EPSS score indicates minimal real-world exploitation likelihood despite public disclosure.
File upload restriction bypass in 299Ko CMS 2.0.0 allows authenticated administrators to upload arbitrary files via the /admin/filemanager/view endpoint, classified as critical but constrained by high-privilege requirement. The vulnerability stems from improper access controls in the file management component (CWE-284). While a public exploit disclosure exists, the EPSS score of 0.06% and CVSS 2.0 reflect the mitigation factor of administrator-level privileges required (PR:H), making real-world exploitation practical only against compromised or malicious admin accounts.
Improper export of Android application components in bsc Peru Cocktails App 1.0.0 allows local authenticated attackers to access unexported activities, services, or broadcast receivers defined in AndroidManifest.xml, leading to information disclosure. The vulnerability has been publicly disclosed with exploit code available, though real-world risk is minimal given the low CVSS score (1.9) and EPSS exploitation probability (0.02%), indicating this affects only authenticated users with local device access and results in limited confidentiality impact.