Memory corruption in the Linux kernel's s390/ctcm mainframe network driver stems from a double-kfree: mpc_rcvd_sweep_req() frees the mpcginfo structure, then ctcmpc_unpack_skb() frees the same pointer again after the conditional call returns. Discovered via clang static analysis, it affects IBM Z (s390) systems using the CTCM MPC networking driver and could lead to kernel memory corruption, denial of service, or potentially escalation when a crafted MPC sweep-request frame is processed. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.05%), and it is not listed in CISA KEV; the fix has shipped in stable kernel releases.
Memory corruption in WatchGuard Fireware OS enables unauthenticated remote attackers to crash the VPN subsystem via malformed IKEv2 traffic, resulting in a Denial of Service condition. Affected are deployments running Fireware OS 12.6.1 through 12.11.4 and 2025.1 through 2025.1.2 where either Mobile User VPN with IKEv2 is active or Branch Office VPN uses IKEv2 with a dynamic gateway peer. No public exploit code or active exploitation has been identified; EPSS sits at the 20th percentile, indicating low current adversary interest despite the high CVSS 4.0 score of 8.7.
Remote code execution in WatchGuard Fireware OS is achievable by an authenticated privileged user via a specially crafted CLI command that triggers an out-of-bounds write in the CLI component. The flaw spans three major release branches - 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - covering multiple years of Fireware development. No CISA KEV listing or public exploit has been identified at time of analysis; EPSS at 0.15% (35th percentile) reflects low current exploitation probability, consistent with the high-privilege requirement.
Arbitrary code execution in WatchGuard Fireware OS's CLI component affects authenticated privileged users who issue specially crafted IPSec configuration commands, triggering a CWE-787 out-of-bounds write. All major Fireware OS release trains from 11.0 through the current 2025.1.2 branch are affected, making this a broad-impact issue for organizations running WatchGuard network security appliances. No public exploit identified at time of analysis, and EPSS at 0.15% (35th percentile) indicates low near-term opportunistic exploitation probability, though the privileged-access requirement limits the realistic attacker pool to insiders or already-compromised admin accounts.
The OTP Integration Kit for PingFederate fails to enforce HTTP method validation and state validation properly. The server advances the authentication state without verifying the OTP, thereby bypassing multi-factor authentication.
Out-of-bounds write in WatchGuard Fireware OS's certificate request CLI command enables arbitrary code execution on affected network security appliances. The flaw affects three distinct version branches - Fireware OS 12.0 through 12.11.4, 12.5 through 12.5.13, and 2025.1 through 2025.1.2 - and requires a privileged, authenticated session to trigger. No public exploit code or CISA KEV listing has been identified; EPSS of 0.11% (30th percentile) reflects low current exploitation probability, but the high-confidence RCE impact on a network security appliance warrants prompt patching for affected organizations.
The E-POINT CMS eagle.gsam-1169.1 file upload feature improperly handles nested archive files. An attacker can upload a nested ZIP (a ZIP containing another ZIP) where the inner archive contains an executable file (e.g. webshell.php). When the application extracts the uploaded archives, the executable may be extracted into a web-accessible directory. This can lead to remote code execution (RCE), data disclosure, account compromise, or further system compromise depending on the web server/process privileges. The issue arises from insufficient validation of archive contents and inadequate restrictions on extraction targets.
CVE-2025-13932 is a security vulnerability (CVSS 8.3). High severity vulnerability requiring prompt remediation.
open-webui v0.6.33 is vulnerable to Incorrect Access Control. The API /api/tasks/stop/ directly accesses and cancels tasks without verifying user ownership, enabling attackers (a normal user) to stop arbitrary LLM response tasks.
XPath Injection in WatchGuard Fireware OS exposes sensitive Firebox configuration data to remote unauthenticated attackers via the authentication or management web interface. Affected systems span four major version branches from 11.11 through 2025.1.2, covering a wide range of deployed Firebox hardware appliances. Exploitation is conditioned on the authentication hotspot feature being enabled; no public exploit code exists and EPSS sits at 0.11% (30th percentile), indicating low observed exploitation activity despite the high CVSS 4.0 score of 8.2.
Out-of-bounds memory access in the Linux kernel's arm64 protected-KVM (pKVM) hypervisor allows a compromised or malicious host kernel to read beyond the bounds of the hypervisor's FF-A (Arm Firmware Framework) shared-memory buffer by supplying an unvalidated composite-memory-region offset in the range [U32_MAX - sizeof(struct ffa_composite_mem_region) + 1, U32_MAX]. Because the host is normally treated as untrusted relative to the hypervisor in the pKVM confidential-compute model, this breaks the host/hypervisor isolation boundary (CVSS scope change) and can disclose hypervisor memory or crash it. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), consistent with a hard-to-reach, config-specific hypervisor bug rather than mass exploitation.
Medtronic CareLink Network allows an unauthenticated remote attacker to perform a brute force attack on an API endpoint that could be used to determine a valid password under certain circumstances. This issue affects CareLink Network: before December 4, 2025.
A security vulnerability in Taiko Alethia (CVSS 8.0). High severity vulnerability requiring prompt remediation.
Stale extent-map cache handling in the Linux kernel's OCFS2 clustered filesystem lets a local, low-privileged user with access to an OCFS2 mount crash the kernel and read or corrupt on-disk extent data. After a reflinked (OCFS2_EXT_REFCOUNTED) extent is moved or defragmented, the in-memory extent cache retains stale flags while the disk holds updated ones; a subsequent write hits a BUG_ON in ocfs2_refcount_cal_cow_clusters(), producing a panic (denial of service) and potential data/integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a niche, non-KEV local kernel bug rather than a mass-exploited flaw.
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Memory-map miscalculation in the Linux kernel's nios2 architecture code allows local low-privileged users to trigger kernel paging failures and denial of service on affected nios2 (soft-core) systems built with CONFIG_FLATMEM. Because memblock.current_limit is left at its default MEMBLOCK_ALLOC_ANYWHERE when pfn limits are computed, max_low_pfn can exceed max_pfn and push mem_map beyond valid DRAM, producing 'Unable to handle kernel paging request' oopses and kernel panics. No public exploit identified at time of analysis; EPSS is 0.04% (11th percentile) and the flaw is not in CISA KEV.
Uninitialized-memory read in the Linux kernel's HFS+ filesystem driver (__hfsplus_ext_cache_extent) allows a local actor who can write to a mounted HFS+ volume to trigger use of uninitialized heap data, leading to information disclosure or a kernel crash. The flaw, found by syzbot via KMSAN on kernel 6.12-rc5, is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 11th percentile). Distributions including Ubuntu (USN-8029/8030/8033/8034) and Debian (DLA-4404-1) have shipped patches.
Uninitialized-memory (KMSAN uninit-value) defect in the Linux kernel HFS filesystem driver allows a local attacker who can mount or operate on a crafted HFS volume to corrupt on-disk allocation state and destabilize the filesystem. The bitmap buffer in hfs_mdb_get() was allocated with kmalloc() (leaving residual heap garbage) and later consumed by hfs_find_set_zero_bits() during block allocation, so non-zero uninitialized bits can drive incorrect bitmap decisions leading to volume corruption and driver misbehavior. Discovered by syzbot fuzzing; there is no public exploit identified at time of analysis and EPSS risk is very low (0.04%).
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. One of the middlewares included in this application, LocalhostAuthMiddleware, authenticates users as ionadmin if the REMOTE_ADDR property in request.META is set to 127.0.0.1, to 127.0.1.1, or to ::1. Any user with local access to the server may bypass authentication.
Local privilege-context memory corruption in the Linux kernel's GPIO character device (gpio cdev) subsystem allows a use-after-free on the file structure backing an open GPIO chardev descriptor. When a GPIO line-change event fires after the final fput() has dropped the fd's reference count to zero but before the deferred .release() callback unregisters the notifier, the kernel calls get_file() on a file with a zero refcount, triggering a use-after-free (warned as 'f_count incremented from zero; use-after-free condition present'). No public exploit has been identified at time of analysis and the EPSS score is negligible (0.03%), consistent with a hard-to-win local race rather than a widely exploited flaw.
Denial of service in the Linux kernel EROFS filesystem driver (versions 6.15 through the 6.17.x series before 6.17.6) lets a local user crash the system by mounting or reading a specially crafted read-only filesystem image. The flaw lives in the 'encoded extents' feature added in Linux 6.15, where malformed physical-length (plen) values and out-of-48-bit physical block addresses trigger an out-of-bounds access in z_erofs_submit_queue(). No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), but vendor patches are available and the issue is tracked by Ubuntu (medium priority) and Debian.
Local privilege-relevant memory corruption in the Linux kernel's io_uring resource (rsrc) subsystem stems from faulty offset arithmetic when computing the first page of a coalesced folio from an unaligned user virtual address, allowing a local low-privileged user submitting io_uring requests to trigger out-of-bounds access with high confidentiality, integrity, and availability impact. Fixed upstream and backported to stable trees (6.12.36, 6.15.5, 6.16); no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 6th percentile). Not listed in CISA KEV.
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Missing authentication for critical function vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows local users to execute arbitrary code via unspecified vectors.
Out-of-bounds write vulnerability in cgi components in Synology DiskStation Manager (DSM) before 7.2.1-69057-2 and 7.2.2-72806 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.
There is a relative path traversal vulnerability in the NI System Web Server that may result in information disclosure. Successful exploitation requires an attacker to send a specially crafted request to the NI System Web Server, allowing the attacker to read arbitrary files. This vulnerability existed in the NI System Web Server 2012 and prior versions. It was fixed in 2013.
Missing authorization vulnerability in BeeDrive in Synology BeeDrive for desktop before 1.4.2-13960 allows remote attackers to delete arbitrary files via unspecified vectors.
Incorrect access control in the component ApiPayController.java of platform v1.0.0 allows attackers to access sensitive information via unspecified vectors.
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap (Port 162) requests, which could allow an attacker to inject SQL commands.
Incorrect access control in the component orderService.queryObject of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Incorrect access control in the component ApiOrderService.java of platform v1.0.0 allows attackers to access sensitive information via a crafted request.
Stack-based buffer overflow in WatchGuard Fireware OS enables authenticated privileged users to execute arbitrary code by sending specially crafted CLI commands to the certificate request functionality. Affected versions span two distinct branches: 12.0 through 12.5.12+701324 and 12.6 through 12.11.2. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; EPSS of 0.04% (13th percentile) signals very low observed exploitation activity, though the high-privilege requirement significantly constrains the realistic threat population.
A security vulnerability in password reset mechanism for the Pivot client application (CVSS 7.5) that allows an attacker. High severity vulnerability requiring prompt remediation.
A security vulnerability in Fulcio (CVSS 7.5). High severity vulnerability requiring prompt remediation. Vendor patch is available.
Denial of service in the Linux kernel SCTP subsystem allows remote attackers to crash affected systems via a NULL pointer dereference triggered when an SCTP chunk arrives without a data buffer. The flaw stems from dereferencing chunk->skb inside a code path that assumes it is NULL, and is fixed across multiple stable trees (5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, 6.18). No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), indicating minimal real-world exploitation likelihood despite the network-reachable vector.
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps.
In the Linux kernel, the following vulnerability has been resolved: devlink: rate: Unset parent pointer in devl_rate_nodes_destroy The function devl_rate_nodes_destroy is documented to "Unset parent for all rate objects". However, it was only calling the driver-specific `rate_leaf_parent_set` or `rate_node_parent_set` ops and decrementing the parent's refcount, without actually setting the `devlink_rate->parent` pointer to NULL. This leaves a dangling pointer in the `devlink_rate` struct, which cause refcount error in netdevsim[1] and mlx5[2]. In addition, this is inconsistent with the behavior of `devlink_nl_rate_parent_node_set`, where the parent pointer is correctly cleared. This patch fixes the issue by explicitly setting `devlink_rate->parent` to NULL after notifying the driver, thus fulfilling the function's documented behavior for all rate objects. [1] repro steps: echo 1 > /sys/bus/netdevsim/new_device devlink dev eswitch set netdevsim/netdevsim1 mode switchdev echo 1 > /sys/bus/netdevsim/devices/netdevsim1/sriov_numvfs devlink port function rate add netdevsim/netdevsim1/test_node devlink port function rate set netdevsim/netdevsim1/128 parent test_node echo 1 > /sys/bus/netdevsim/del_device dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 8 PID: 1530 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 8 UID: 0 PID: 1530 Comm: bash Not tainted 6.18.0-rc4+ #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 __nsim_dev_port_del+0x6c/0x70 [netdevsim] nsim_dev_reload_destroy+0x11c/0x140 [netdevsim] nsim_drv_remove+0x2b/0xb0 [netdevsim] device_release_driver_internal+0x194/0x1f0 bus_remove_device+0xc6/0x130 device_del+0x159/0x3c0 device_unregister+0x1a/0x60 del_device_store+0x111/0x170 [netdevsim] kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x55/0x10f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 [2] devlink dev eswitch set pci/0000:08:00.0 mode switchdev devlink port add pci/0000:08:00.0 flavour pcisf pfnum 0 sfnum 1000 devlink port function rate add pci/0000:08:00.0/group1 devlink port function rate set pci/0000:08:00.0/32768 parent group1 modprobe -r mlx5_ib mlx5_fwctl mlx5_core dmesg: refcount_t: decrement hit 0; leaking memory. WARNING: CPU: 7 PID: 16151 at lib/refcount.c:31 refcount_warn_saturate+0x42/0xe0 CPU: 7 UID: 0 PID: 16151 Comm: bash Not tainted 6.17.0-rc7_for_upstream_min_debug_2025_10_02_12_44 #1 NONE Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x42/0xe0 Call Trace: <TASK> devl_rate_leaf_destroy+0x8d/0x90 mlx5_esw_offloads_devlink_port_unregister+0x33/0x60 [mlx5_core] mlx5_esw_offloads_unload_rep+0x3f/0x50 [mlx5_core] mlx5_eswitch_unload_sf_vport+0x40/0x90 [mlx5_core] mlx5_sf_esw_event+0xc4/0x120 [mlx5_core] notifier_call_chain+0x33/0xa0 blocking_notifier_call_chain+0x3b/0x50 mlx5_eswitch_disable_locked+0x50/0x110 [mlx5_core] mlx5_eswitch_disable+0x63/0x90 [mlx5_core] mlx5_unload+0x1d/0x170 [mlx5_core] mlx5_uninit_one+0xa2/0x130 [mlx5_core] remove_one+0x78/0xd0 [mlx5_core] pci_device_remove+0x39/0xa0 device_release_driver_internal+0x194/0x1f0 unbind_store+0x99/0xa0 kernfs_fop_write_iter+0x12e/0x1e0 vfs_write+0x215/0x3d0 ksys_write+0x5f/0xd0 do_syscall_64+0x53/0x1f0 entry_SYSCALL_64_after_hwframe+0x4b/0x53
auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.
The web interface of the Silicon Labs Simplicity Device Manager is exposed publicly and can be used to extract the NTLMv2 hash which an attacker could use to crack the user's domain password.
SysReptor is a fully customizable pentest reporting platform. Prior to 2025.102, there is a Stored Cross-Site Scripting (XSS) vulnerability allows authenticated users to execute malicious JavaScript in the context of other logged-in users by uploading malicious JavaScript files in the web UI. This vulnerability is fixed in 2025.102.
An issue was discovered in the Thermo Fisher Torrent Suite Django application 5.18.1. A remote code execution vulnerability exists in the network configuration functionality, stemming from insufficient input validation when processing network configuration parameters through administrative endpoints. The application allows administrators to modify the server's network configuration through the Django application. This configuration is processed by Bash scripts (TSsetnoproxy and TSsetproxy) that write user-controlled data directly to environment variables without proper sanitization. After updating environment variables, the scripts execute a source command on /etc/environment; if an attacker injects malicious data into environment variables, this command can enable arbitrary command execution. The vulnerability begins with the /admin/network endpoint, which passes user-supplied form data as arguments to subprocess.Popen calls. The user-supplied input is then used to update environment variables in TSsetnoproxy and TSsetproxy, and finally source $environment is executed.
The Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the sync() function in all versions up to, and including, 1.3.65 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
A vulnerability in portenable cgi allows remote authenticated users to get the status of installed packages.
A security vulnerability in DCIM dcTrack (CVSS 7.2) that allows an attacker. High severity vulnerability requiring prompt remediation.
Kernel memory corruption in the Linux kernel's GFS2 clustered filesystem stems from a use-after-free race in gdlm_put_lock(), where a small window exists after the DFL_UNMOUNT flag is set but before the DLM lockspace is released. During that window the DLM callbacks gdlm_ast() and gdlm_bast() can still fire and dereference already-freed glock objects, potentially crashing the kernel or corrupting memory on systems using GFS2. The issue carries a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L), has an EPSS of only 0.03%, is not in CISA KEV, and has no public exploit identified at time of analysis; it is patched upstream and shipped by Ubuntu and Debian.
Boot-time system integrity check bypass in WatchGuard Fireware OS allows a local, high-privileged attacker to circumvent the appliance's startup integrity verification and suppress the protective shutdown that should trigger upon detecting a compromised state. Affected versions span Fireware OS 12.8.1 through 12.11.4 and 2025.1 through 2025.1.2, covering a broad range of Firebox appliance deployments. No public exploit has been identified and the EPSS score of 0.02% reflects very low exploitation activity; however, successful exploitation enables a tampered device to continue operating undetected, undermining the appliance's trust posture.
DCIM dcTrack platforms utilize default and hard-coded credentials for access. An attacker could use these credentials to administer the database, escalate privileges on the platform or execute system commands on the host.
Cross-site scripting (XSS) vulnerability in a reachable files_pdfviewer example directory in Nextcloud with versions before 22.2.10.33, 23.0.12.29, 24.0.12.28, 25.0.13.23, 26.0.13.20, 27.1.11.20, 28.0.14.11, 29.0.16.8, 30.0.17, 31.0.10, and 32.0.1...
A vulnerability in Synology Mail Server allows remote authenticated attackers to read and write non-sensitive settings, and disable some non-critical functions.
The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.