Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.
Memory corruption in the Linux kernel's asymmetric_keys crypto subsystem allows a local low-privileged user to trigger a heap buffer overflow by supplying a crafted X.509 certificate. The flaw lives in asymmetric_key_generate_id(), where the sizes of attacker-controlled binary blobs (such as arbitrarily large ASN.1 INTEGER serial numbers and issuer names) are added to the size of an asymmetric_key_id structure without overflow checking, so an integer overflow yields an undersized allocation and a subsequent out-of-bounds copy. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.
Memory corruption in the Linux kernel's qla2xxx QLogic Fibre Channel HBA driver arises from an error-handling path in qla2xxx_process_purls_iocb() that calls kfree() on a purex item which may have originated from a per-adapter pre-allocated pool rather than kzalloc(). Freeing a pool-backed object with kfree() can corrupt kernel heap state. The fix routes deallocation through qla24xx_free_purex_item(), which correctly distinguishes dynamically allocated from pooled items; no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Kernel-side memory corruption in the Linux kernel's crypto AEAD framework arises because AEAD algorithms began populating the generic cra_reqsize field (added by commit afddce13ce81d) without the framework being updated to translate it into a proper per-request size via crypto_aead_set_reqsize(). As a result, request buffers for affected AEAD transforms are undersized, producing out-of-bounds memory writes and kernel crashes when the algorithm is used. This is tracked as a Denial-of-Service class issue; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
SQL injection in code-projects Student Information System 1.0's search functionality enables remote, unauthenticated attackers to execute malicious SQL statements via the searchbox parameter. Successful exploitation could compromise the confidentiality, integrity, or availability of the underlying database. While a public proof-of-concept exists, the EPSS exploitation probability is low (0.06%).
Unauthenticated SQL injection in Online Frozen Foods Ordering System 1.0 via the Name field in /contact_us.php enables remote attackers to exfiltrate or manipulate the underlying database. A public exploit is available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
Open redirect vulnerability in Scott Paterson Accept Donations with PayPal & Stripe WordPress plugin (versions <= 1.5.2) enables attackers to craft malicious URLs that redirect users to untrusted sites, facilitating phishing attacks. The vulnerability requires user interaction (UI:R) but affects the plugin's core donation handling, allowing an unauthenticated attacker to chain this with social engineering to compromise user credentials or distribute malware through redirects to fraudulent payment pages.
Remote code execution in Specto CM versions before 17032025 allows authenticated attackers to upload files with dangerous types, leading to arbitrary code inclusion on the server. The flaw, tracked as CVE-2025-2155 and reported by Turkey's USOM CERT, carries a high CVSS score of 8.8 and stems from missing validation on uploaded file types. No public exploit identified at time of analysis, and the EPSS exploitation probability remains low at 0.07%.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
An open redirect vulnerability in Jeff Starr's User Submitted Posts WordPress plugin allows attackers to craft malicious URLs that redirect victims to untrusted websites for phishing. All plugin versions up to and including 20251121 are affected, requiring user interaction to trigger. Public exploit code is available
Blind SQL injection in BeRocket Brands for WooCommerce plugin versions up to and including 3.8.6.3 allows authenticated WordPress users with low privileges to exfiltrate sensitive data from the site's database. The vulnerability has a CVSS base score of 8.5, but no active exploitation or public exploit has been identified, and EPSS indicates
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
Blind SQL injection in CRM Perks Integration for Contact Form 7 HubSpot plugin up to version 1.4.2 allows authenticated, high-privilege attackers to extract sensitive database content. The vulnerability is not currently listed in CISA KEV and no public exploit code has been identified. With an EPSS score of 0.05%, the probability of exploitation is very low, though the CVSS 7.6 rating indicates high potential impact if an attacker already has administrator access.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Missing authorization in the Userpro WordPress plugin versions up to 5.1.9 allows unauthenticated attackers to modify plugin settings or user data via a crafted HTTP request. The vulnerability arises from incorrectly configured access control security levels, with integrity impact only. No public exploit or active exploitation has been identified at time of analysis.
Authorization bypass in WP Swings Membership For WooCommerce up to 3.0.3 allows unauthenticated attackers to manipulate membership features via user-controlled keys, resulting in service disruption. The flaw does not expose or modify data but can cause a high availability impact. No active exploitation or public exploit code has been confirmed at the time of analysis, and EPSS probability is low (0.04%).
Privilege escalation in Eclipse BlueChi, the multi-node systemd service controller used in Red Hat In-Vehicle Operating System (RHIVOS), allows a user holding root on a managed quality-managed (qm) node to write or override systemd service unit files that execute on the controlling host node. Because BlueChi did not deny cross-node proxy/dependency requests by default, a compromised lower-trust node could pivot to the host, leading to unauthorized service execution and full host compromise (CWE-863, Incorrect Authorization). Red Hat scored it 7.2 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP object injection in Icegram Express Pro (WordPress email marketing plugin) through version 5.9.13 enables unauthenticated remote attackers to execute arbitrary code via unsafe deserialization of user-controlled data. With CVSS 9.8 (critical severity) and network-accessible attack vector requiring no authentication or user interaction, this represents a severe pre-authentication RCE risk. EPSS score of 0.06% (19th percentile) suggests low immediate exploitation probability, and no public exploit or CISA KEV listing identified at time of analysis, though Patchstack disclosure increases attacker awareness.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).
Broken access control in WP Time Slots Booking Form plugin (≤1.2.39) allows authenticated attackers with low-level privileges to escalate permissions and execute unauthorized administrative actions. The vulnerability stems from missing authorization checks (CWE-862), enabling privilege escalation to access, modify, or delete sensitive booking data and configuration settings. While CVSS scores 8.8 (High), real-world risk appears moderate with EPSS at 0.06% (18th percentile) and no public exploit identified at time of analysis.
Missing authorization in Gutenverse Form plugin for WordPress allows authenticated attackers with low privileges to bypass access controls and perform unauthorized actions, resulting in a high availability impact. Versions up to and including 2.3.1 are affected, and no active exploitation has been reported.
Stored XSS in PickPlugins Post Grid and Gutenberg Blocks WordPress plugin (versions <= 2.3.23) allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user data. The vulnerability requires user interaction (viewing a page with the injected content) and affects the site's security context (SameSite:Changed per CVSS:3.1/S:C). EPSS score of 0.04% indicates low real-world exploitation probability despite CVE publication.
Stored cross-site scripting vulnerability in the WordPress YouTube Embed plugin through version 5.4 allows authenticated low-privileged users (e.g., subscribers) to inject arbitrary web scripts via a malicious YouTube embed. When a victim (such as an administrator) views a page containing the injected embed, the script executes in their browser, potentially enabling session hijacking, defacement, or other client-side attacks. No public exploit or active exploitation has been reported, and EPSS indicates very low exploitation likelihood.
Stored cross-site scripting (XSS) in Live Composer page builder plugin for WordPress (versions through 2.1.11) allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages. An attacker with contributor or editor access can store XSS payloads that persist in the database and execute when administrators or other site visitors interact with the affected content, potentially leading to session hijacking, credential theft, or malware distribution.
Stored cross-site scripting (XSS) in BlueGlass Interactive AG Jobs for WordPress plugin versions 2.8.1 and earlier allows authenticated users with low privileges to inject malicious scripts into job postings that execute in the browsers of other site visitors. The vulnerability requires user interaction (clicking a crafted link) and affects website visitors with cross-site request forgery capabilities, resulting in limited confidentiality and integrity impact but no availability impact. The issue has a low exploitation probability (EPSS 0.04%) despite publicly disclosed details.
Stored cross-site scripting in HasThemes WC Builder WordPress plugin up to version 1.2.0 allows authenticated attackers with low privileges to inject arbitrary web scripts into pages created with the plugin. When victims view the crafted page, the script executes in their browser, leading to potential data theft or session hijacking.
Stored cross-site scripting in ModelTheme Addons for WPBakery and Elementor plugin for WordPress through version 1.5.5 allows authenticated attackers with contributor-level or higher privileges to inject arbitrary web scripts. When a victim, such as an administrator, views the affected page, the injected script executes in their browser, leading to potential session hijacking, credential theft, or site defacement. No active exploitation or public exploit code is known at this time, and EPSS probability is very low (0.04%).
Stored cross-site scripting in the WPFactory Free Shipping Bar plugin for WooCommerce version 2.4.9 and earlier allows authenticated attackers to inject malicious scripts into pages viewed by other users, potentially leading to data theft or session hijacking. The vulnerability requires contributor-level or higher privileges and user interaction to trigger. No active exploitation or public exploit is known at this time.
Stored cross-site scripting in the Academy LMS WordPress plugin up to version 3.4.0 allows authenticated attackers with low privileges to inject JavaScript into web pages viewed by other users. No evidence of active exploitation or public exploit code exists; EPSS indicates a very low exploitation probability (0.04%).
Stored cross-site scripting in the Bold Timeline Lite plugin for WordPress allows authenticated attackers to inject arbitrary web scripts. Versions up to and including 1.2.7 are affected, enabling an attacker with low privileges to store a payload that executes when a victim views an infected timeline page. The CVSS 6.5 rating reflects medium severity, but the very low EPSS exploitation probability (0.04%) suggests minimal real-world threat; no public exploit or active exploitation is known.