Use-after-free in the Linux kernel's procfs directory-reading path (proc_readdir_de() in fs/proc) allows a local user to trigger a race between directory traversal and concurrent removal of proc entries, corrupting kernel memory. The bug arises because a proc_dir_entry is erased from the subdir red-black tree without clearing the node, so pde_subdir_next() can return a freed node; it was found via stress-ng running getdents against /proc/<pid>/net/dev_snmp6/ while network devices (tun interfaces) are unregistered. Publicly available exploit code exists and a vendor patch is available, but the CVE is not listed in CISA KEV and carries a very low EPSS score (0.05%), indicating no evidence of widespread exploitation.
A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Executing manipulation of the argument pools can lead to buffer overflow. The attack may be performed from remote. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This vulnerability affects the function RE2000v2Repeater_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. This affects the function AP_get_wired_clientlist_setClientsName of the file mod_form.so. The manipulation of the argument clientsname_0 leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was determined in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this issue is the function RE2000v2Repeater_get_wireless_clientlist_setClientsName of the file mod_form.so. Executing manipulation of the argument clientsname_0 can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was found in Linksys RE6500, RE6250, RE6300, RE6350, RE7000 and RE9000 1.0.013.001/1.0.04.001/1.0.04.002/1.1.05.003/1.2.07.001. Affected by this vulnerability is the function AP_get_wireless_clientlist_setClientsName of the file mod_form.so. Performing manipulation of the argument clientsname_0 results in stack-based buffer overflow. The attack can be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Local privilege escalation via kernel memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with network-admin capability to trigger a use-after-free in tipc_mon_reinit_self(). The flaw stems from tipc_net_finalize_work() iterating the RTNL-protected monitors[] array from a workqueue without holding the RTNL lock, letting freed monitor structures be accessed. Reported by syzbot with no public exploit and a very low EPSS (0.05%); it is not in CISA KEV, and a vendor fix is available across all supported stable branches.
The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the resolve_import_directory() function in versions 4.5.4 to 4.5.7. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
The Starter Templates plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 4.4.41. This is due to insufficient file type validation detecting WXR files, allowing double extension files to bypass sanitization while being accepted as a valid WXR file. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Kernel panic (BUG) in the Linux kernel's Bluetooth 6LoWPAN subsystem (net/bluetooth/6lowpan.c) allows an adjacent attacker to crash the host by sending uncompressed IPv6 frames over a Bluetooth 6LoWPAN link. Because the 6lowpan netdev registers header_ops but never reset the MAC/link-local header on the uncompressed IPv6 RX path, delivery to a listener such as an AF_PACKET SOCK_RAW socket triggers a fatal skb_reset_mac_header assertion (kernel BUG at net/core/skbuff.c:212). Tagged as Denial of Service; EPSS is 0.05% (16th percentile), no KEV listing, and no public exploit identified at time of analysis.
Denial of service and kernel memory corruption in the Linux kernel NFS server (nfsd) allows an NFS client to trigger a linked-list corruption and kernel oops by exploiting improper cleanup of COPY_NOTIFY stateids. When a client performs OPEN then COPY_NOTIFY on the resulting parent stateid, then reboots and forces state expiry via CREATE_SESSION, nfs4_free_ol_stateid() frees the parent without releasing the associated copynotify stateid, so the laundromat worker later corrupts the list and crashes. Carries CVSS 8.8; EPSS is very low (0.05%, 16th percentile) and there is no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's ALSA USB-audio driver (snd-usb-audio) arises because PCM transfer packet sizes are computed solely from the sample rate and packets-per-second without validating against the endpoint's wMaxPacketSize limit, allowing a crafted or malformed USB audio descriptor to overflow the URB packet buffer. An attacker with local access and the ability to attach a malicious USB device (or a compromised low-privileged context reaching the audio stack) can trigger heap buffer overflow, as originally reported by syzbot. There is no public exploit identified at time of analysis, and EPSS is low (0.16%), but the CVSS 7.8 reflects high impact to confidentiality, integrity, and availability once triggered.
Local privilege escalation and memory corruption in the Linux kernel's Bluetooth btusb USB driver arises from a use-after-free in btusb_disconnect(), where the interface's btusb data is freed by usb_driver_release_interface() and then dereferenced later in the same function. Affected systems run vulnerable stable kernels (5.4/5.10/5.15/6.1/6.6/6.12/6.17 branches and 6.18 pre-release) with a Bluetooth USB adapter; a local attacker able to influence USB device teardown could corrupt kernel slab memory, potentially yielding code execution or a crash. There is no public exploit identified at time of analysis and EPSS is very low (0.05%), so this is a patch-hygiene item rather than an urgent, actively-exploited threat.
Out-of-bounds memory access in the Linux kernel's DRM vmwgfx (VMware SVGA/virtual GPU) driver allows a local, low-privileged user to trigger buffer over-reads or over-writes by submitting a command with an unvalidated header size. The driver failed to validate the userspace-supplied command header size against SVGA_CMD_MAX_DATASIZE before using it in buffer offset calculations, enabling an overflow that leads to out-of-bounds access with high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and with an EPSS of 0.05% (16th percentile) the vulnerability is not currently listed in CISA KEV.
Local privilege-boundary instability in the Linux kernel's secret memory subsystem (mm/secretmem) stems from a use-after-free race in the page-fault handler for files created via memfd_secret(2). When two tasks fault the same secret-memory page concurrently, the losing task frees its folio before restoring the page to the kernel direct map, briefly returning a not-present page to the allocator; a subsequent allocation and kernel access triggers a supervisor not-present page fault. Affects long-lived kernel branches (5.14 through 6.18-rc) with no public exploit identified at time of analysis and a low EPSS score (0.05%, 16th percentile).
Local privilege-boundary memory corruption in the Linux kernel Bluetooth Management (MGMT) subsystem allows a local low-privileged user to trigger a slab-use-after-free when a Bluetooth HCI device (hdev) is removed while the mesh_send_done timer is still pending. Because the timer was never canceled during hdev teardown, it can fire against freed memory (device_release path), causing a KASAN slab-use-after-free that typically crashes the kernel (denial of service), with a theoretical path to further corruption. EPSS is very low (0.04%, 11th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV; a vendor patch is available.
Local privilege-boundary memory corruption in the Linux kernel's swap subsystem (memory management) allows a race between swapoff on one device and swapin on another to trigger a use-after-free of a swap device structure during VMA (page-table-walking) swap readahead. Introduced by commit 78524b05f1a3 which removed redundant swap device pinning in __read_swap_cache_async, the flaw affects kernels from 6.15 up to the fixed releases; there is no public exploit identified at time of analysis and EPSS is negligible at 0.03%. Impact is scoped to systems with swap enabled across multiple swap devices where the readahead path can encounter entries belonging to a device it does not hold a reference to.
Local memory corruption in the Linux kernel's KVM guest_memfd subsystem (introduced in 6.8) lets a local user with KVM VM-management access trigger a slab use-after-free by racing memslot deletion against release of a dying guest_memfd file. When a memslot is freed before its guest_memfd file is fully released, kvm_gmem_release() writes to already-freed memory, as confirmed by a syzbot/KASAN report. There is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 6th percentile), reflecting a narrow race rather than a broadly weaponizable flaw.
A vulnerability in Apigee-X allowed an attacker to gain unauthorized read and write access to Apigee Analytics (AX) data and access logs belonging to other Apigee customer organizations. Apigee-X was found to be vulnerable. This vulnerability was patched in version 1-16-0-apigee-3. No user action is required for this.
Denial of service in the Linux kernel's in-kernel SMB3 server (ksmbd) arises from a reference-count leak in smb2_sess_setup() that is not released along the session-reconnect path. Remote attackers reaching an exposed ksmbd service can repeatedly drive session setups requiring reconnect to leak ksmbd_session references, progressively exhausting kernel memory and impacting availability (CVSS 7.5, A:H only). No public exploit is identified at time of analysis and EPSS is very low (0.04%), but vendor-released patches are already shipping across stable branches.
Hard-coded credentials in TOZED ZLT M30S and ZLT M30S PRO routers allow local network attackers to bypass authentication and gain full administrative control of the device. The vendor is unresponsive, no patch is available, and a public proof-of-concept exploit has been disclosed. Exploitation requires adjacent network access, and no active exploitation or KEV listing is reported; EPSS (0.03%) indicates very low likelihood of widespread attacks.
Information disclosure and memory corruption in the Linux kernel's drm/panthor GPU driver (ARM Mali CSF GPUs, kernel 6.10 through the 6.17.x series) arises because the driver maps freshly allocated shmem-backed GPU buffers as CPU-uncached without flushing the cached zeroing writes performed by the shmem layer, leaving dirty cachelines that can leak previously freed data or asynchronously corrupt buffer contents when those lines are later evicted. A local low-privileged user with access to the panthor GPU device can trigger the condition through normal buffer allocation. This carries CVSS 7.3; there is no public exploit identified at time of analysis and the EPSS score is very low (0.03%, 9th percentile).
The Widgets for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 13.2.4 due to insufficient input sanitization and output escaping on Google Reviews data imported by the plugin. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that will execute in the admin panel (and potentially on the frontend) whenever a user accesses imported reviews, granted they can add a malicious review to a Google Place that is connected to the vulnerable site.
The Rich Shortcodes for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the contents of a Google Review in all versions up to, and including, 6.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. NOTE: This vulnerability was partially patched in version 6.6.2.