Memory corruption in the Linux kernel's asymmetric_keys crypto subsystem allows a local low-privileged user to trigger a heap buffer overflow by supplying a crafted X.509 certificate. The flaw lives in asymmetric_key_generate_id(), where the sizes of attacker-controlled binary blobs (such as arbitrarily large ASN.1 INTEGER serial numbers and issuer names) are added to the size of an asymmetric_key_id structure without overflow checking, so an integer overflow yields an undersized allocation and a subsequent out-of-bounds copy. No public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile).
Denial of service in the Linux kernel's NFSv4/pNFS client allows a null-pointer dereference and system crash during inode writeback, affecting hosts mounting parallel-NFS (pNFS) exports. The flaw occurs because NFS_INO_LAYOUTCOMMIT was not cleared in pnfs_mark_layout_stateid_invalid, so the write_inode → nfs4_write_inode → pnfs_layoutcommit_inode path may dereference a layout that has already been freed. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%) indicates minimal observed exploitation interest despite the CVSS 7.5 rating.
Remote code execution in Specto CM versions before 17032025 allows authenticated attackers to upload files with dangerous types, leading to arbitrary code inclusion on the server. The flaw, tracked as CVE-2025-2155 and reported by Turkey's USOM CERT, carries a high CVSS score of 8.8 and stems from missing validation on uploaded file types. No public exploit identified at time of analysis, and the EPSS exploitation probability remains low at 0.07%.
Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).
Blind SQL injection in BeRocket Brands for WooCommerce plugin versions up to and including 3.8.6.3 allows authenticated WordPress users with low privileges to exfiltrate sensitive data from the site's database. The vulnerability has a CVSS base score of 8.5, but no active exploitation or public exploit has been identified, and EPSS indicates
Denial of service in the Linux kernel's mt76 wireless driver (MT7996 WiFi 7 support) allows the kernel to crash (NULL/invalid pointer dereference) when hardware-accelerated flow offloading runs on a secondary Wireless Ethernet Dispatch instance (wed_hif2, e.g. a 6GHz link). The mt76 WED callbacks unconditionally referenced the primary wed device, so tearing down or disabling offload on wed_hif2 dereferences an invalid address and triggers a kernel Oops. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and it is not in CISA KEV; impact is availability loss (system crash), not code execution.
Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).
Local memory corruption in the Linux kernel's ALSA firewire-motu driver allows a user to trigger a buffer overflow when reading DSP events from the hwdep interface with an undersized buffer. The hwdep_read() path copied the full 8-byte DSP event header regardless of the caller-supplied buffer length, writing past the end of the user-provided buffer; the fix clamps the copy with min_t(). There is no public exploit identified at time of analysis, and EPSS is low (0.20%), consistent with a niche driver requiring MOTU FireWire audio hardware.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Local denial of service in the Linux kernel's software RDMA driver (RDMA/rxe, rdma_rxe module) allows a user with access to an rxe device to crash the host via a NULL pointer dereference. When ibv_modify_srq() is called to resize a shared receive queue and rxe_queue_resize() fails, rxe_srq_from_attr() leaves srq->rq.queue set to NULL; a subsequent modify call dereferences srq->rq.queue->buf->index_mask in rxe_srq_chk_attr() and panics. No public exploit identified at time of analysis, and the EPSS score is low (0.16%, 6th percentile).
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.
Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.
Local privilege escalation via a use-after-free in the Linux kernel's drm/panthor driver (the DRM driver for newer Arm Mali CSF-based GPUs) allows a local user with GPU render-node access to free and reuse a group object during creation. The GROUP_CREATE ioctl stored a group pointer in an Xarray and then continued to dereference it, letting a second thread call GROUP_DESTROY on a guessed handle to trigger the UAF. No public exploit or CISA KEV listing has been identified; the fix adds an Xarray entry mark so a group cannot be destroyed until GROUP_CREATE has fully returned.
Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.
Blind SQL injection in CRM Perks Integration for Contact Form 7 HubSpot plugin up to version 1.4.2 allows authenticated, high-privilege attackers to extract sensitive database content. The vulnerability is not currently listed in CISA KEV and no public exploit code has been identified. With an EPSS score of 0.05%, the probability of exploitation is very low, though the CVSS 7.6 rating indicates high potential impact if an attacker already has administrator access.
Authenticated blind SQL injection in the Captivate Sync WordPress plugin (versions ≤ 3.2.2) allows high-privileged attackers to silently extract sensitive data from the site’s database without affecting data integrity. While no public exploits or active exploitation have been observed and EPSS indicates a 0.05% probability of exploitation, the high CVSS score reflects the potential for complete confidentiality loss under a compromised administrator account.
Blind SQL injection in User Feedback WordPress plugin (versions ≤1.10.0) allows unauthenticated remote attackers to extract database contents, modify data, or execute administrative commands. The vulnerability carries a critical CVSS score of 9.8 due to network-based exploitation requiring no privileges or user interaction. While EPSS probability is low (0.05%, 14th percentile) and no active exploitation is confirmed at time of analysis, the severity and unauthenticated attack vector make this a priority for WordPress administrators using this plugin. Patchstack security audit identified this flaw as CWE-89 SQL injection stemming from improper input sanitization.
Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.
Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.
Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.
Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.
Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.
Missing authorization in the Userpro WordPress plugin versions up to 5.1.9 allows unauthenticated attackers to modify plugin settings or user data via a crafted HTTP request. The vulnerability arises from incorrectly configured access control security levels, with integrity impact only. No public exploit or active exploitation has been identified at time of analysis.
Authorization bypass in WP Swings Membership For WooCommerce up to 3.0.3 allows unauthenticated attackers to manipulate membership features via user-controlled keys, resulting in service disruption. The flaw does not expose or modify data but can cause a high availability impact. No active exploitation or public exploit code has been confirmed at the time of analysis, and EPSS probability is low (0.04%).
Privilege escalation in Eclipse BlueChi, the multi-node systemd service controller used in Red Hat In-Vehicle Operating System (RHIVOS), allows a user holding root on a managed quality-managed (qm) node to write or override systemd service unit files that execute on the controlling host node. Because BlueChi did not deny cross-node proxy/dependency requests by default, a compromised lower-trust node could pivot to the host, leading to unauthorized service execution and full host compromise (CWE-863, Incorrect Authorization). Red Hat scored it 7.2 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
PHP object injection in Icegram Express Pro (WordPress email marketing plugin) through version 5.9.13 enables unauthenticated remote attackers to execute arbitrary code via unsafe deserialization of user-controlled data. With CVSS 9.8 (critical severity) and network-accessible attack vector requiring no authentication or user interaction, this represents a severe pre-authentication RCE risk. EPSS score of 0.06% (19th percentile) suggests low immediate exploitation probability, and no public exploit or CISA KEV listing identified at time of analysis, though Patchstack disclosure increases attacker awareness.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Cross-Site Request Forgery in the WordPress Evergreen Post Tweeter plugin (<=1.8.9) allows stored XSS when a logged-in administrator is tricked into clicking a malicious link. Attackers can exploit this to inject persistent scripts that execute in the browsers of other site visitors, potentially leading to session hijacking or site defacement. No active exploitation or public exploit code has been identified, and the EPSS score is very low (0.02%).