F5 BIG-IP APM (Access Policy Manager) contains a remote code execution vulnerability triggered by specific malicious traffic when an access policy is configured on a virtual server.
Use-after-free in the Linux kernel's octeontx2-pf network driver allows a local low-privileged user to trigger memory corruption via the otx2_tc_add_flow() traffic-control offload path, where new_node is dereferenced after being queued for freeing with kfree_rcu() outside a valid RCU read-side region. Successful exploitation can cause a denial of service (kernel crash) and, depending on heap state, potential local privilege escalation. There is no public exploit identified at time of analysis, and the low EPSS score (0.19%) reflects the narrow, hardware-specific attack surface.
Out-of-bounds memory access in the Linux kernel's in-kernel SMB/CIFS client (smb2_compound_op() in fs/smb/client) stems from wrong index references when iterating over compound SMB2 response buffers; a computed index at or above MAX_COMPOUND drives reads/writes past the response array. A machine mounting a share from a malicious or compromised SMB server can have its kernel process attacker-influenced compound responses, leading to memory corruption, denial of service, or potential privilege escalation. It carries a CNA-assigned CVSS 9.8, but there is no public exploit identified at time of analysis and EPSS is very low (0.19%, 8th percentile), so real-world exploitation pressure is currently minimal.
Local privilege-escalation-class use-after-free in the Linux kernel's futex subsystem (requeue-PI path) lets a low-privileged local user race futex_wait_requeue_pi() against futex_requeue() so a kernel wakeup dereferences an on-stack futex_q structure that has already been freed and returned to userland. The flaw carries high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 15th percentile), consistent with a hard-to-weaponize timing race.
Account takeover in WordPress Orion SMS OTP Verification plugin (versions ≤1.1.7) allows unauthenticated remote attackers to reset arbitrary user passwords without identity verification. Attackers knowing a target's phone number can change that user's password to an attacker-controlled OTP, gaining complete account access with full privileges. CVSS 9.8 (Critical) reflects network-accessible, no-authentication-required exploitation with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Arbitrary file upload in Flex QR Code Generator plugin (WordPress) versions ≤1.2.5 allows unanauthenticated remote attackers to upload malicious files without restriction, enabling remote code execution on vulnerable web servers. The flaw stems from absent file type validation in the save_qr_code_to_db() function, accessible over the network with no authentication barrier. With CVSS 9.8 (critical) and EPSS data unavailable, this represents a severe exposure for WordPress sites running the affected plugin. No public exploit identified at time of analysis, and not listed in CISA KEV, but the trivial attack complexity (AC:L, PR:N) makes this a high-priority remediation target.
Guest-to-host memory corruption in the Linux kernel's Intel i40e Ethernet driver arises because the `ring_len` value supplied by an SR-IOV virtual function is written straight into the hardware memory context (HMC) with no bounds or alignment checking. A malicious or compromised VF owner (typically a guest VM given passthrough access to an Intel 700-series NIC) can specify out-of-range or misaligned Tx/Rx queue lengths, corrupting host-side descriptor context and impacting the host beyond the VF's boundary (CVSS 8.8, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile), consistent with a driver-level bug requiring a specific virtualization deployment.
Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.
Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.
Out-of-bounds access in the Linux kernel's Intel i40e (40GbE) Ethernet driver arises from a flawed bounds check on the 'action_meta' value used during traffic-control/hardware-offload configuration, allowing a local user with network-configuration privileges to trigger an out-of-bounds dereference. The upstream fix corrects the comparison to 'greater or equal' so that indices at the array boundary are rejected. No public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the assigned CVSS is 8.8 (Local, low complexity), reflecting high impact to a system carrying this Intel NIC and driver.
Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.
A use-after-free write in the Linux kernel's Realtek rtw89 Wi-Fi driver lets kernel memory be corrupted when rtw89_core_tx_kick_off_and_wait() races with the TX-completion/status path (rtw89_pci_release_txwd_skb) and dereferences an skb_data buffer that was already freed back to skbuff_head_cache. The flaw was caught by KFENCE during Wi-Fi scan completion and is triggered by a timing race between the waiting and signaling sides of a completion object, affecting systems using Realtek rtw89-supported chipsets. There is no public exploit identified at time of analysis, it is not in CISA KEV, and the EPSS probability is low (0.19%, 9th percentile); the fix has been merged upstream.
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_sync.c) lets an in-range attacker corrupt kernel memory during HCI ACL/LE connection setup. When a connection object is still pending command submission (conn->state == BT_OPEN), a concurrent HCI Connection Complete event can free the hci_conn structure while hci_acl_create_conn_sync (and hci_le_create_conn_sync) still writes to it. CVSS is 8.8 over an adjacent (Bluetooth-range) vector; there is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile).
Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c) allows an in-range attacker to corrupt kernel memory when the host processes an HCI_EV_NUM_COMP_PKTS event without properly locking hdev, letting hci_conn_tx_dequeue read a connection object already freed by a concurrent hci_conn_del/abort path. The flaw was found via KASAN fuzzing on kernel 6.16-rc7 and is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.17%).
WPBifröst WordPress plugin through version 1.0.7 allows low-privileged authenticated users to escalate to full administrative access. Subscribers and higher roles can exploit a missing capability check in the ctl_create_link AJAX handler to create new administrator accounts and immediately log in with full site control. With CVSS 8.8 (High) and EPSS data unavailable, severity is driven by the low privilege requirement (PR:L) and complete system compromise (C:H/I:H/A:H). No public exploit identified at time of analysis, and not listed in CISA KEV, but the attack is trivially automatable once an attacker holds any authenticated role.
Local privilege-to-kernel buffer overflow in the Linux kernel's hi311x (Holt HI-3110) CAN controller driver allows a user with network configuration capability to trigger an out-of-bounds heap write by injecting an oversized CAN XL frame. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN_MTU and push a crafted frame through PF_PACKET whose length field (up to 0xff) is copied verbatim in hi3110_hw_tx(), overflowing an 8-byte buffer by up to 247 bytes. There is no public exploit identified at time of analysis, and the EPSS score is low (0.22%, 13th percentile); the issue has been resolved upstream in the mainline and stable kernel trees.
Local privilege-holders can trigger a kernel heap buffer overflow in the Linux mcba_usb CAN driver (Microchip CAN BUS Analyzer USB adapter) by raising the interface MTU beyond CAN_MTU and injecting a crafted CAN XL frame through a PF_PACKET raw socket. Because the driver never implemented ndo_change_mtu(), an attacker can set an oversized MTU (e.g. 9999), then send an ETH_P_CANXL frame whose flags byte is misread as the classic-CAN length field, causing memcpy to copy up to 247 bytes past the intended 8-byte buffer. This is a memory-corruption issue with high confidentiality, integrity and availability impact (CVSS 7.8); there is no public exploit identified at time of analysis, though the advisory includes a detailed reproduction, and EPSS is low at 0.22%.
Local privilege-context buffer overflow in the Linux kernel's ETAS ES58x CAN USB driver (etas_es58x) lets a user with network capabilities corrupt kernel memory by injecting oversized CAN XL frames. Because the driver never implemented ndo_change_mtu(), an attacker can raise the interface MTU beyond CAN limits, then use a PF_PACKET raw socket with ETH_P_CANXL to smuggle a frame whose length field (up to 0xff) is memcpy'd into an 8-byte buffer, overflowing it by up to 247 bytes. CVSS is 7.8 (High); there is no public exploit identified at time of analysis and EPSS is low (0.22%), consistent with the requirement for local access and specific ETAS hardware.
Local privilege-enabled buffer overflow in the Linux kernel's sun4i_can CAN controller driver (Allwinner A10/A20 SoCs) allows an attacker holding network-admin capability to write out of bounds by injecting oversized CAN XL frames. Because the driver never populated ndo_change_mtu(), the interface MTU can be raised past CAN_MTU, letting a PF_PACKET raw socket push a frame whose length field is misread as a CAN data length, overflowing a fixed buffer by up to 247 bytes. There is no public exploit identified at time of analysis and EPSS is low (0.22%), but the description includes a detailed, working reproduction path.
Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).
Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.
Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel process-creation path arises because copy_process() takes the wrong error-exit label after futex_hash_allocate_default() fails, releasing tasklist_lock and siglock that were never acquired. This lock imbalance can corrupt kernel synchronization state on the fork error path, with a potential for kernel crash or exploitation to gain elevated privileges. No public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a subtle, hard-to-trigger error-handling defect rather than a widely-weaponized bug.
Local privilege escalation and memory corruption in the Linux kernel's fbcon (framebuffer console) subsystem stems from integer overflows in fbcon_do_set_font() when computing font buffer sizes from user-controlled parameters. A local, low-privileged attacker who can invoke the font-setting ioctl can trigger undersized allocations followed by heap buffer overflows during font data copying, potentially achieving code execution in kernel context. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the fix has been merged and backported across stable kernel trees.
Local privilege escalation via memory corruption in the Linux kernel Bluetooth management (MGMT) subsystem allows a local attacker with Bluetooth management access to trigger a use-after-free of a struct mgmt_pending object. The flaw arises from a race between MGMT command completion callbacks and the pending-command list being freed (e.g. during device power-off), enabling reads/writes of freed slab memory that can corrupt kernel state. No public exploit identified at time of analysis, and EPSS is very low (0.03%); it is a KASAN-detected, fuzzer-reported issue rather than one with confirmed in-the-wild use.
Local privilege escalation and memory corruption in the Linux kernel's xc5000 DVB tuner driver (media subsystem) arises from a use-after-free in xc5000_release(): the function used cancel_delayed_work() which does not wait for an already-running timer_sleep delayed work item, so the xc5000_priv structure can be kfree()'d while the work callback still dereferences it. An attacker able to trigger tuner device teardown while the delayed work is active can win the race and cause the callback to operate on freed memory, potentially corrupting kernel memory. There is no public exploit identified at time of analysis and the flaw carries a low EPSS (0.22%); it was found via static analysis and fixed upstream.
Resource-exhaustion denial of service in the Linux kernel's Intel i40e (700-series Ethernet) driver allows a malicious or compromised Virtual Function to request an unbounded number of MAC/VLAN filters against its Physical Function, because the driver never enforced a maximum filter count. A guest controlling an SR-IOV VF can degrade or crash networking for the host PF and other VFs (CVSS 7.3, scope-changed). There is no public exploit identified at time of analysis, and the EPSS probability is low (0.20%, 10th percentile).
Memory disclosure and denial of service in the Linux kernel's SCSI target (LIO) subsystem arises when reading the configfs attribute exposed by target_lu_gp_members_show() in drivers/target/target_core_configfs.c. Because snprintf() returns the length it *would* have written, a combined HBA name plus device name exceeding the 256-byte LU_GROUP_NAME_BUF buffer causes the subsequent memcpy() to copy past the buffer, tripping the kernel's overflow detection and potentially leaking adjacent memory or crashing the host. This is no public exploit identified at time of analysis, with a low EPSS score of 0.24% (15th percentile) and no CISA KEV listing.
Local privilege escalation via memory corruption in the Linux kernel's iommufd subsystem allows a low-privileged local user to trigger a use-after-free by racing the abort path of IOMMU object allocation. Because fput() defers file release to a workqueue while the code immediately kfree()s the tied iommufd_object, the deferred release() decrements a users refcount on already-freed memory, corrupting the slab. Only pre-release 6.17-rc kernels are affected; EPSS is 0.10% (1st percentile) and there is no public exploit identified at time of analysis.
SQL injection in the TARIFFUXX WordPress plugin up to version 1.4 allows authenticated attackers with Contributor-level or higher privileges to inject malicious SQL commands via the 'id' attribute in the 'tariffuxx_configurator' shortcode, enabling unauthorized extraction of sensitive database information. The vulnerability exploits insufficient input sanitization in SQL query construction and requires authenticated access, resulting in a CVSS 6.5 (medium-high) rating with confirmed confidentiality impact but no availability or integrity compromise.
Binary MLM Plan plugin for WordPress versions up to 3.0 grants the manage_bmp capability to all users upon registration, allowing unauthenticated attackers to register via the plugin's form and immediately escalate privileges to manage plugin settings. This privilege escalation affects all installations with the vulnerable plugin active, with a CVSS score of 6.5 reflecting moderate confidentiality and integrity impact. No public exploit code or active exploitation has been confirmed at the time of analysis.
Stored Cross-Site Scripting (XSS) in the Digiseller WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'ds' shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users viewing the affected page, enabling session hijacking, credential theft, or malware distribution. CVSS 6.4 reflects network accessibility and lower-privileged attacker requirements; no public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in WP BookWidgets plugin for WordPress allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the 'bw_link' shortcode due to insufficient input sanitization and output escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser context. This vulnerability affects all versions up to and including 0.9. No public exploit code or active exploitation in the wild has been confirmed at the time of analysis.
Double free memory management vulnerability in Apple operating systems (iOS, iPadOS, macOS, tvOS, visionOS, watchOS) allows local apps to trigger unexpected system termination through memory corruption. Affecting iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, macOS Ventura 13.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation confirmed; EPSS score of 0.01% indicates minimal real-world exploitation probability despite moderate CVSS rating.
Local applications on macOS can bypass access controls to read sensitive user data through a logic flaw in permission enforcement, fixed in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7. The vulnerability requires user interaction to trigger (such as launching a malicious app) and affects all three recent macOS versions. With an EPSS score of 0.01% and no confirmed active exploitation, this represents a low real-world exploitation probability despite moderate CVSS severity.
Unauthenticated attackers can read sensitive profile data from the latest SSO login in the YourMembership Single Sign On (YM SSO Login) WordPress plugin through versions 1.1.7 due to a missing capability check on the 'moym_display_test_attributes' function. The vulnerability allows remote, unauthenticated access to confidential user information without any user interaction, presenting a direct information disclosure risk. No active exploitation has been confirmed at the time of analysis, though the low attack complexity and CVSS score of 5.3 indicate moderate real-world risk.
Unauthenticated attackers can access sensitive information through publicly exposed log files in the Content Writer WordPress plugin versions up to 3.6.8. The plugin fails to properly restrict access to log files, allowing remote attackers without authentication or user interaction to view potentially sensitive data stored in these logs. This vulnerability carries a moderate CVSS score of 5.3 with confirmed public information disclosure impact.
Unauthenticated attackers can delete rows from the wp_wdplugin_style database table in the WhyDonate WordPress plugin (versions up to 4.0.15) due to a missing capability check on the remove_row function. This allows unauthorized modification of site styling configuration without authentication, impacting data integrity for affected WordPress installations. No public exploit code or active exploitation has been confirmed at the time of analysis.
SQL Injection in onOffice for WP-Websites plugin (versions ≤6.5.1) allows authenticated attackers with Editor-level access or above to extract sensitive database information by injecting arbitrary SQL queries via the insufficiently escaped 'order' parameter. The vulnerability requires high privileges and user interaction is not needed, resulting in a CVSS score of 4.9 with confirmed confidentiality impact but no integrity or availability compromise.
Mail in Lockdown Mode on iOS and iPadOS allows information disclosure through remote image loading when forwarding emails, bypassing Lockdown Mode's protections designed to prevent such tracking. Apple released patches in iOS 18.6 and iPadOS 18.6 that prevent remote image loading in this scenario. The vulnerability requires user interaction (forwarding an email) and affects unauthenticated remote attackers, with an EPSS score of 0.03% indicating low real-world exploitation probability despite the network attack vector.
A security vulnerability in A data corruption vulnerability (CVSS 4.4). Remediation should follow standard vulnerability management procedures.
Library Management System plugin for WordPress versions up to 3.1 allows authenticated Subscriber-level users to modify plugin settings and features due to missing capability checks in the owt7_library_management_ajax_handler() AJAX function. An attacker with minimal WordPress account privileges can remotely manipulate plugin configuration without administrative authorization, leading to unauthorized changes to library data and system behavior. No active exploitation or public exploit code has been identified at this time.
In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE.
In the Linux kernel, the following vulnerability has been resolved: nexthop: Forbid FDB status change while nexthop is in a group The kernel forbids the creation of non-FDB nexthop groups with FDB nexthops: # ip nexthop add id 1 via 192.0.2.1 fdb # ip nexthop add id 2 group 1 Error: Non FDB nexthop group cannot have fdb nexthops. And vice versa: # ip nexthop add id 3 via 192.0.2.2 dev dummy1 # ip nexthop add id 4 group 3 fdb Error: FDB nexthop group can only have fdb nexthops. However, as long as no routes are pointing to a non-FDB nexthop group, the kernel allows changing the type of a nexthop from FDB to non-FDB and vice versa: # ip nexthop add id 5 via 192.0.2.2 dev dummy1 # ip nexthop add id 6 group 5 # ip nexthop replace id 5 via 192.0.2.2 fdb # echo $? 0 This configuration is invalid and can result in a NPD [1] since FDB nexthops are not associated with a nexthop device: # ip route add 198.51.100.1/32 nhid 6 # ping 198.51.100.1 Fix by preventing nexthop FDB status change while the nexthop is in a group: # ip nexthop add id 7 via 192.0.2.2 dev dummy1 # ip nexthop add id 8 group 7 # ip nexthop replace id 7 via 192.0.2.2 fdb Error: Cannot change nexthop FDB status while in a group. [1] BUG: kernel NULL pointer dereference, address: 00000000000003c0 [...] Oops: Oops: 0000 [#1] SMP CPU: 6 UID: 0 PID: 367 Comm: ping Not tainted 6.17.0-rc6-virtme-gb65678cacc03 #1 PREEMPT(voluntary) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014 RIP: 0010:fib_lookup_good_nhc+0x1e/0x80 [...] Call Trace: <TASK> fib_table_lookup+0x541/0x650 ip_route_output_key_hash_rcu+0x2ea/0x970 ip_route_output_key_hash+0x55/0x80 __ip4_datagram_connect+0x250/0x330 udp_connect+0x2b/0x60 __sys_connect+0x9c/0xd0 __x64_sys_connect+0x18/0x20 do_syscall_64+0xa4/0x2a0 entry_SYSCALL_64_after_hwframe+0x4b/0x53