Local File Inclusion in the Hub Core WordPress plugin (LiquidThemes, versions through 5.0.8) allows an authenticated network attacker with low privileges to supply a crafted filename parameter that is passed unsanitized to a PHP include/require statement, enabling inclusion of arbitrary server-side files. Successful exploitation can expose sensitive configuration data (wp-config.php, credentials) or, under favorable server conditions such as log poisoning, escalate to remote code execution and full site compromise. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at 0.08%, reflecting low current exploitation activity.
Local file inclusion in ThemeMove EduMall WordPress theme up to version 4.4.7 allows authenticated attackers to read arbitrary files on the server. Exploitation requires low-privilege access and high attack complexity, with no user interaction needed; CVSS base score is 7.5. No active exploitation reported; EPSS probability is very low at 0.08%.
Information disclosure in Menulux Mobile App versions prior to 9.5.8 allows remote unauthenticated attackers to access other users' data by manipulating trusted identifiers (IDOR-style flaw). The vulnerability falls under CWE-639 (Authorization Bypass Through User-Controlled Key) and was reported by Turkey's national CERT (USOM). There is no public exploit identified at time of analysis, and EPSS scoring places exploitation probability at just 0.04% (13th percentile).
Denial of service in the Linux kernel's NXP ENETC Ethernet driver (enetc) on Layerscape LS1028A platforms allows the CPU to hang under normal network load, causing RCU stalls on PREEMPT_RT kernels. The flaw stems from recursive acquisition of the read-side enetc_mdio_lock in the enetc_poll NAPI path, which deadlocks when a higher-priority writer is queued between two reader acquisitions. No public exploit identified at time of analysis; EPSS is very low (0.03%, 8th percentile) and it is not CISA KEV listed, consistent with a reliability/self-triggered availability bug rather than an attacker-weaponized flaw.
Local file inclusion in PenciDesign Soledad WordPress theme versions through 8.7.0 allows authenticated attackers with low privileges to include and execute arbitrary PHP files via improper filename control in include/require statements. Attack complexity is high (AC:H), requiring specific server configuration or authenticated access to exploit. No active exploitation confirmed at time of analysis, but vulnerability class (CWE-98) is commonly targeted once POC becomes available. EPSS data not provided; exploitation status unknown beyond vendor disclosure.
Broken AFBC (Arm Frame Buffer Compression) handling in the Linux kernel's Mediatek DRM driver on MT8188 (Genio 700) SoCs causes constant vblank timeouts and garbled display output when the 32x8/split/sparse AFBC modifier is used, which Mesa v25.0+ enables by default. A local user with GPU/display access can trigger a hung display pipeline (denial of service) and rendering of stale/garbled framebuffer contents (limited information disclosure). No public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hardware-specific reliability bug rather than a widely weaponizable flaw.
Out-of-bounds read in the Linux kernel's staging rtl8723bs Realtek Wi-Fi driver allows an adjacent attacker to trigger a kernel panic by broadcasting a malformed 802.11 beacon frame. The OnBeacon handler parses an Extended Supported Rates (ESR) information element positioned at the end of the received frame buffer without bounds validation, reading past the buffer. No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.17%), but the flaw is remotely reachable over the air against any device using this driver.
Out-of-bounds memory access in the Linux kernel's AMD CPU microcode-matching logic affects systems running on AMD Zen5 processors, where the zen5_rdseed_microcode revision table lacks a terminating sentinel entry. When x86_match_min_microcode_rev() iterates this array during CPU initialization on a Zen5 part, it reads past the array bounds, tripping KASAN and potentially disclosing adjacent kernel memory or causing instability. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 6th percentile).
Weakened cryptographic randomness affects the Linux kernel on AMD Zen5 processors, where the RDSEED instruction's 16-bit and 32-bit register variants can return a zero value while falsely reporting success (CF=1), tracked upstream as AMD-SB-7055. Kernel and userspace consumers that rely on RDSEED for entropy can silently receive predictable seed material, undermining key generation and other cryptographic operations. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile); the kernel resolves this by adding a microcode-revision check that works around the faulty hardware behavior.
Out-of-bounds memory access in the RISC-V stack unwinder (walk_stackframe) of the Linux kernel lets KASAN trip and read past a task's kernel stack boundary when unwinding a task other than the current one. The defect mirrors a previously fixed x86 issue (commit 84936118bdf3) and is reached through normal task-introspection paths on RISC-V builds. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.03%, 7th percentile), and it is not in CISA KEV; the fix disables KASAN checks for non-current tasks.
Improper resource cleanup in the Linux kernel's Intel ice Ethernet driver leaves PTP (Precision Time Protocol) resources leaked when driver probe, PTP initialization, or PTP restart hits an error path. On subsequent driver removal the leaked PF PTP state and un-deinitialized 'ps_lock' mutex trigger a kernel WARNING in ice_adapter_put, and the PTP clock is left registered. No public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and there is no CISA KEV listing; this is a robustness/error-handling defect requiring local privileged access to the NIC driver.
Client-identity confusion in the Linux kernel's NFS client allows a low-privileged local user to have an NFS mount silently reuse an existing RPC connection established under a different TLS X.509 client certificate. Because nfs_match_client() failed to compare the cert_serial and privkey_serial fields that define the client's presented identity, a mount intended to use one certificate could be bound to a connection authenticated with another, enabling access to data under the wrong identity. This is an information-disclosure/identity-mismatch flaw (CVSS 7.0); it is not in CISA KEV, has no public exploit identified at time of analysis, and carries a very low EPSS score of 0.10% (1st percentile).