N-central < 2025.4 can generate sessionIDs for unauthenticated users4. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 83.2% and no vendor patch available.
N-able N-central remote monitoring and management platform versions before 2025.4 contain multiple XML External Entity injection vulnerabilities. Attackers can exploit these to read sensitive files from the RMM server, including configuration files containing credentials for all managed endpoints.
JVC VN-T IP-camera models firmware versions up to 2016-08-22 (confirmed on the VN-T216VPRU model) contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Tinycontrol LAN Controller v3 (LK3) firmware versions up to 1.58a (hardware v3.8) contain a missing authentication vulnerability in the stm.cgi endpoint. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Ozeki SMS Gateway versions up to and including 10.3.208 contain a path traversal vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Epson Stylus SX510W embedded web management service fails to properly handle consecutive ampersand characters in query parameters when accessing /PRESENTATION/HTML/TOP/INDEX.HTML. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Longjing Technology BEMS API versions up to and including 1.21 contains an unauthenticated arbitrary file download vulnerability in the 'downloads' endpoint. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
In the Linux kernel, the following vulnerability has been resolved: tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Use After Free vulnerability could allow attackers to access freed memory to execute arbitrary code or crash the application.
A security vulnerability has been detected in SourceCodester Survey Application System 1.0. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service ('webs') fails to enforce maximum lengths. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
A flaw was found in the Observability Operator. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
UCanCode E-XD++ Visualization Enterprise Suite contains an untrusted pointer dereference vulnerability via the TKDRAWCAD.TKDrawCADCtrl.1 ActiveX control. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) protocol handler smc_clc_prfx_match() lets a remote peer potentially trigger memory corruption during connection establishment. The flaw stems from dereferencing a destination cache device pointer (sk_dst_get(sk)->dev) outside RCU/RTNL protection in the listen path, so the dst entry can be freed concurrently. There is no public exploit identified at time of analysis and the EPSS probability is negligible (0.03%); notably the function's return value is unused by its caller, further limiting practical impact.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Out-of-bounds heap write in the Linux kernel's Btrfs filesystem allows local corruption of adjacent memory when btrfs_encode_fh() encodes a connectable file handle whose parent inode resides in a different subvolume/root. The function reserves only BTRFS_FID_SIZE_CONNECTABLE (32 bytes) but then writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (40 bytes), producing an 8-byte overflow at fid->parent_root_objectid when the caller's buffer (*max_len) is undersized. No public exploit has been identified at time of analysis, EPSS is low (0.07%), and the upstream commit notes the condition is not easily triggerable, making this a defensive hardening fix rather than an urgent externally-exploited flaw.
Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Incorrect fault-handling in the SPARC (Niagara) implementation of copy_from_user and copy_to_user in the Linux kernel causes wrong remaining-byte calculations and a broken epilogue when a user-space memory reference faults, leading to kernel crashes and incorrect return values from these core copy routines. The flaw is SPARC-architecture specific (Niagara/UltraSPARC T-series) and is fixed upstream; it is tagged as a denial-of-service issue. No public exploit identified at time of analysis, and EPSS is very low (0.07%, 21st percentile).
Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.
Local privilege-constrained denial of service (and potential broader constraint bypass) in the Linux kernel BPF subsystem allows a user who can load BPF programs to bypass expected_attach_type enforcement via tailcall maps. A program can tailcall into an incompatible program whose verifier access rules were relaxed by its expected_attach_type (e.g. an XDP program returning xdp_md->egress_ifindex or a CGROUP_SOCK_ADDR program calling bpf_bind()), reaching code paths that dereference uninitialized state - demonstrated as a NULL pointer dereference of xdp_buff->txq in bpf_prog_test_run_xdp(). No public exploit identified at time of analysis; EPSS probability is very low (0.05%, 16th percentile) and it is not listed in CISA KEV.
Local privilege-relevant memory corruption in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem stems from flawed user-message limit accounting, including improper reference counting and a use-after-free when messages are allocated in the receive path. A local user with access to the IPMI device can trigger the flaw to crash the system or potentially corrupt kernel memory, and while tagged as Denial of Service, the CVSS:3.1 vector rates full confidentiality, integrity, and availability impact (7.8). There is no public exploit identified at time of analysis, and the very low EPSS score (0.03%, 10th percentile) reflects limited near-term mass-exploitation expectation.
Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Local denial of service and potential information disclosure in the Linux kernel's SMC (Shared Memory Communications) subsystem arises because smc_clc_prfx_set() dereferences sk_dst_get(sk)->dev during connect() without holding RCU or RTNL, creating a use-after-free window on the destination cache entry. A local user opening an AF_SMC socket can trigger the freed dst->dev access, risking a kernel crash or leaked memory. No public exploit identified at time of analysis, EPSS is negligible (0.03%), and it is not on CISA KEV; the upstream fix switches to __sk_dst_get()/dst_dev_rcu() under rcu_read_lock().
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
Denial of service in the Linux kernel's netfilter nf_tables subsystem allows a local user with network-administration capability to crash the host by referencing an NFT_OBJECT_SYNPROXY stateful object from the OUTPUT hook, triggering unbounded recursion (synproxy sends a SYN-ACK that re-enters the OUTPUT chain, which re-invokes synproxy) until the kernel stack guard page is hit. The fix adds validate functions to the objref and objrefmap expressions so nftables rejects such rules with 'Operation not supported.' No public exploit has been identified at time of analysis and EPSS is negligible (0.03%), but a vendor patch is available and Ubuntu has shipped fixes.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Denial of service in the Linux kernel networking stack (page_pool subsystem) can crash affected systems at boot, originally observed on 32-bit PA-RISC hardware. The PP_MAGIC_MASK introduced for page_pool page tagging was defined too wide, causing page_pool_page_is_pp() to mistake ordinary kernel pointers for page_pool-tagged pages (false positives) and panic the machine. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.03%); this is a reliability/robustness regression rather than an attacker-driven flaw.
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.