Local privilege-level extent tree corruption in the Linux kernel's Btrfs filesystem (versions 6.10 through the 6.18/6.19/7.0 development lines) arises because lookup_extent_data_ref() returns 0 (success) instead of -ENOENT after crossing to a new leaf whose first key does not match, causing callers to operate on the wrong extent tree item. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%), indicating negligible likelihood of opportunistic exploitation; this is a reliability/data-integrity defect rather than a remotely reachable RCE. CVSS 7.8 (AV:L/PR:L) reflects local access requirements, not network exposure.
Race condition in Linux kernel memory management allows local attackers with low privileges to corrupt kernel page state, potentially achieving high-impact denial of service, data corruption, or privilege escalation. The vulnerability affects kernel versions 6.6.x through 7.0-rc3, with patches confirmed released for stable branches 6.6.135, 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS exploitation probability is low (0.02%, 5th percentile), and no public exploit code or active exploitation has been identified at time of analysis. The CVSS vector (AV:L/AC:L/PR:L/UI:N) indicates local access with low attack complexity, while the specific race condition requires precise timing between file mapping and inode size modification operations.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Buffer overflow in Linux kernel's s3c24xx I2C driver allows local authenticated attackers to achieve arbitrary code execution with high privileges through malformed SMBUS block read messages. The driver fails to validate message length against I2C_SMBUS_BLOCK_MAX before processing, enabling out-of-bounds memory access. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low observed exploitation activity, with no CISA KEV listing indicating targeted rather than widespread attacks. Attack requires local access and low-level user privileges (CVSS AV:L/PR:L), limiting practical exploitability compared to the high CVSS 7.8 base score.
Memory access violation in Linux kernel ALSA ctxfi driver allows local authenticated users to trigger kernel page faults and potential privilege escalation. The flaw affects CT20K2 audio hardware drivers (snd_ctxfi module) where virtual memory mapping logic incorrectly accesses beyond allocated page table pages when aggregate memory allocations exceed 2MB on AMD64 systems. EPSS exploitation probability is very low (0.02%, 5th percentile) and no public exploit or active exploitation is confirmed. Vendor-released patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel q6apm audio driver allows local authenticated attackers with low privileges to achieve arbitrary code execution, denial of service, or information disclosure with high impact to confidentiality, integrity, and availability. The flaw affects Qualcomm ASoC q6apm component registration code used in devices like Lenovo 21N2ZC5PUS laptops. Vendor-released patches are available across multiple kernel version branches (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low probability of mass exploitation despite high CVSS 7.8, with no confirmed active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel blk-cgroup subsystem allows local authenticated users to potentially execute arbitrary code, escalate privileges, or crash the system. The vulnerability occurs in cgwb_release_workfn() when releasing cgroup writeback structures, where a CSS reference is dropped before subsequent dereference, creating a race condition. Meta reports sporadic crashes in production across multiple kernel versions. Patches available for stable branches 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low widespread exploitation probability, and no active exploitation or public POC identified at time of analysis.
Use-after-free in Linux kernel MediaTek video encoder allows local authenticated users to corrupt memory and potentially execute arbitrary code. The flaw affects the vcodec driver's encoder release path where ctx memory is freed before canceling scheduled workqueue tasks, enabling race conditions between cleanup and worker threads that may dereference freed memory. KASAN-confirmed exploitation requires local access with low privileges (CVSS AV:L/PR:L). Patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates very low probability of automated exploitation, with no public exploit identified at time of analysis.
Local privilege escalation and denial of service in the Linux kernel's em28xx USB media driver arises from a use-after-free (CWE-416) in em28xx_v4l2_open(), which reads dev->v4l2 without holding dev->lock. A local attacker who can open the V4L2 device node during a race with the driver's init error path or teardown can trigger a use-after-free on the embedded video_device (via v4l2_fh_init accessing vdev->ctrl_handler) or a NULL dereference in em28xx_resolution_set(). No public exploit identified at time of analysis, and EPSS is very low (0.02%), consistent with a hard-to-win kernel race requiring physical/local USB device presence.
Local privilege-relevant memory corruption in the Linux kernel's powerz hwmon driver (ChargerLAB POWER-Z USB power monitor) allows a local user to trigger a use-after-free by racing a sysfs read against USB device disconnect, dereferencing a freed URB pointer. The bug affects kernels prior to the stable fixes (7.0.1, 6.19.14, 6.18.24, 6.12.83) and carries CVSS 7.8, but with EPSS at just 0.02% (5th percentile) and no public exploit identified at time of analysis, real-world exploitation risk is low. It is not listed in CISA KEV.
Local privilege escalation and denial of service in the Linux kernel's bcache subsystem stems from a use-after-free of the cached_dev.sb_bio structure; if a cached backing device is stopped while a superblock write is in flight, the freed bio is dereferenced at I/O completion (endio), corrupting kernel memory. Affected systems are those running bcache-backed block devices (observed crashing via librbd/libceph rbd workloads), where a local user with the ability to trigger device teardown during superblock activity can crash the host or potentially corrupt kernel memory. This carries no public exploit identified at time of analysis and an EPSS of just 0.02%, consistent with a hard-to-time race rather than a readily weaponized flaw.
Use-after-free and double-free in the Linux kernel's as102 DVB-T USB media driver (drivers/media/usb/as102) allows a local user to corrupt kernel memory by racing an open() of the device node against an error path in as102_usb_probe(). Because the probe error path frees the as102_dev_t structure immediately after usb_register_dev()/usb_deregister_dev() while a userspace file descriptor may still hold a reference, the later .release() path re-accesses and re-frees that structure. CVSS is 7.8 (local, low-privilege); EPSS is negligible (0.02%), no public exploit is identified, and it is not in CISA KEV.
Local privilege escalation and kernel memory corruption in the Linux kernel's HackRF Software-Defined Radio media (V4L2) driver arises from a use-after-free and double-free in the hackrf_probe() error path. When probe fails after v4l2_device_register() has already exposed the device node, the driver frees the hackrf_dev structure directly with kfree() while an already-open file descriptor still holds a reference, so subsequent ioctl() or close() calls dereference and re-free freed memory. There is no public exploit identified at time of analysis; EPSS is 0.02% (5th percentile) and it is not listed in CISA KEV.
Use-after-free in Linux kernel futex subsystem allows local authenticated attackers to achieve code execution, privilege escalation, or denial of service via sys_futex_requeue() with mismatched flags. Discovered through automated LLM analysis by Nicholas, this affects kernel versions 6.7 through 6.19.x, with patches available in 6.12.80, 6.18.21, 6.19.11, and 7.0. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC has been identified. The vulnerability requires local access with low-privilege authenticated user credentials (PR:L), making it a post-compromise escalation vector rather than a remote entry point.
Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Heap buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via crafted RxGK tokens. Exploitable through unprivileged add_key() system call when raw key/ticket lengths >= 0xfffffffd cause integer wraparound in round_up(), bypassing bounds checks while memcpy() copies up to 4 GiB into zero-sized heap allocation. Vendor patches available for stable branches 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite local privilege escalation potential with CVSS 7.8.
Buffer overflow in Linux kernel's AF_RXRPC procfs address formatting allows local authenticated users to corrupt memory and potentially escalate privileges. The vulnerability affects rxrpc proc handlers that write IPv6 socket addresses into 50-byte stack buffers, but ISATAP-format IPv6 addresses with ports can require 51 bytes, causing single-byte overflow. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.23, 6.19.13, and mainline 7.0. No active exploitation confirmed (not in CISA KEV), and CVSS 7.8 reflects local-only attack vector requiring authenticated access.
Use-after-free in Linux kernel tracing subsystem allows local authenticated attackers to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when deleting tracing instances with copy_trace_marker enabled, where improper RCU synchronization leaves freed memory accessible. Exploitation requires local access with low privileges to manipulate kernel tracing facilities. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability. Vendor patches available across multiple stable kernel versions (6.18.20, 6.19.10, 7.0).
Local privilege escalation in Deskflow (all versions up to 1.20.0 stable and 1.26.0.134 continuous) allows any low-privilege Windows user to execute arbitrary commands as SYSTEM by accessing an unauthenticated IPC named pipe. The daemon runs with SYSTEM privileges and processes commands without validating caller identity due to WorldAccessOption configuration. No public exploit identified at time of analysis, but the attack vector is straightforward for local users with basic Windows IPC knowledge.
Authentication bypass in Traefik's ForwardAuth middleware allows remote attackers to spoof the X-Forwarded-Prefix header and gain unauthorized access to protected backend routes when deployed behind trusted upstream proxies. Despite trustForwardHeader=false configuration, Traefik fails to sanitize attacker-controlled X-Forwarded-Prefix values in authentication subrequests, enabling attackers to impersonate trusted path prefixes (e.g., /admin) and bypass authorization checks in the authentication service. The vulnerability affects Traefik v2.x and v3.x series and is confirmed patched in versions 2.11.43, 3.6.14, and 3.7.0-rc.2. No KEV listing or EPSS data available at time of analysis, but a detailed proof-of-concept with complete Docker reproduction environment is publicly available in the GitHub advisory, significantly lowering exploitation complexity for attackers.
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Claude Code's trust bypass vulnerability allows execution of malicious hooks through manipulated git worktree configuration files. Attackers who can trick victims into cloning a crafted repository can bypass the folder trust dialog by pointing the `commondir` file to a previously-trusted path, enabling immediate execution of arbitrary code via `.claude/settings.json` hooks. The attack requires the attacker to know or correctly guess a path the victim has already trusted, limiting exploitation to targeted scenarios. Auto-update users have already received the patch; manual installation users should upgrade immediately.
Arbitrary file read in Roxy-WI versions before 8.2.6.4 allows unauthenticated remote attackers to access sensitive files on the server via path traversal in the oldconfig parameter of the haproxy_section_save interface. This CVSS:4.0 vector indicates zero attack complexity and no prerequisites, enabling trivial exploitation to exfiltrate configuration files, credentials, or private keys. GitHub Security Advisory confirms the vulnerability with proof-of-concept exploitation status (E:P), representing immediate risk for exposed Roxy-WI management interfaces.
A type assertion bug in Kyverno's forEach mutation handler crashes the cluster-wide background controller into CrashLoopBackOff and blocks admission controller operations, causing denial of service for policy-matched resources. Any authenticated user with Policy or ClusterPolicy creation permissions can trigger the crash by creating a malformed policy. The vulnerability affects Kyverno versions prior to 1.17.2 and 1.16.4, is limited to the legacy policy engine (CEL-based policies unaffected), and persists until the malicious policy is deleted. Vendor-released patches available with confirmed fix commits on GitHub.
Cross-namespace privilege escalation in Kyverno 1.17.x allows authenticated namespace administrators to bypass RBAC controls and read ConfigMaps from any Kubernetes namespace. The vulnerability exploits unvalidated `configMap.namespace` field in Kyverno's ConfigMap context loader, enabling attackers to leverage Kyverno's privileged service account permissions. This is a regression following incomplete fix for CVE-2026-22039, which addressed the same issue in `apiCall` context but missed the ConfigMap loader. Patch available in version 1.17.2. CVSS 7.7 with Changed Scope indicates significant multi-tenant cluster risk; EPSS data not available but the regression nature and RBAC bypass impact warrant immediate patching in multi-tenant environments.
SQL injection in Xibo CMS versions 1.7 through 4.4.0 allows authenticated users with DataSet or Layout access privileges to extract and modify arbitrary database contents via crafted API filter parameters. The vulnerability affects a widely-deployed open source digital signage platform and has been addressed in version 4.4.1, with patches retroactively provided for out-of-support versions (3.3, 2.3, 1.8) indicating vendor awareness of active deployments on legacy versions. EPSS data not available, but the low attack complexity (AC:L) and network vector (AV:N) combined with the broad version range (nearly 7 years of releases) suggest significant exposure across installations.
Path traversal in 4ga Boards before 3.3.5 allows authenticated users with board import privileges to force the server to read and expose arbitrary local files as board attachments during BOARDS archive import. Attackers can then download sensitive host files (configuration files, credentials, application source code) through the normal download interface. CVSS score of 7.6 reflects high confidentiality impact with low integrity/availability impact. No public exploit code or active exploitation confirmed at time of analysis, though the attack technique is straightforward for authenticated insiders.
Integer overflow in OP-TEE OS RSA signature encoding crashes the Trusted Execution Environment on platforms with RSA hardware acceleration. Affects versions 3.8.0 through 4.10 when attackers supply cryptographic operations with deliberately undersized RSA moduli, causing memset() to overwrite memory until the TEE crashes. This denial-of-service attack requires no authentication and can be triggered remotely (CVSS AV:N/PR:N), completely disabling the secure-world environment that protects cryptographic keys, biometric data, and DRM operations on affected Arm TrustZone systems. EPSS data not available; no active exploitation confirmed at time of analysis.
Integer overflow in Zserio serialization framework versions before 2.18.1 enables remote denial of service via network-accessible deserialization endpoints. Attackers can send crafted serialized data that triggers arithmetic overflow in BitStreamReader's setBitPosition() bounds check, causing the parser to read 512 MB from a buffer only a few bytes long and crash the process with segmentation fault. EPSS data not available, no active exploitation confirmed, but remote unauthenticated attack vector (CVSS AV:N/PR:N) makes this immediately exploitable against any application accepting untrusted Zserio-serialized input over network interfaces.
Unbounded memory allocation in Eclipse zserio serialization framework allows remote attackers to trigger system crashes via crafted payloads as small as 4-5 bytes, forcing allocations up to 16 GB and causing out-of-memory errors. Affects both C++ and Java runtimes used in Navigation Data Standard (NDS) implementations deployed across millions of vehicles from Toyota, BMW, Volkswagen, Mercedes-Benz, and 39 other automotive manufacturers. Vendor-released patch available in zserio v2.18.1, addressing unchecked length parameters in Array.h, BitStreamReader.h, and Java runtime equivalents. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial remote exploitation without authentication.
Denial of service in basic-ftp for Node.js allows remote malicious FTP servers to crash client applications via unbounded memory consumption during directory listing operations. Attackers controlling or compromising an FTP server can send infinite or extremely large listing responses to Client.list() calls, exhausting client memory until process termination. Unauthenticated network attack with low complexity (CVSS:3.1 AV:N/AC:L/PR:N). No public exploit identified at time of analysis, though attack concept is straightforward for anyone operating a malicious FTP server.
Denial of service in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a duplicate or stale GRP_ACK_MSG to underflow the u16 bc_ackers counter to 65535, permanently wedging group broadcast on the affected socket until the TIPC group is torn down and recreated. The flaw affects the tipc_group_proto_rcv() handler across a wide range of kernel branches (4.15 through the 7.0 series). It is a pure availability issue (CVSS A:H, C:N/I:N); there is no public exploit identified at time of analysis and EPSS probability is negligible (0.02%).
Memory management flaw in Linux kernel's Cadence macb network driver causes kernel warning and potential denial of service. Specifically affects the macb Ethernet driver on ARM64 ZynqMP platforms (kernel versions 6.1+ containing commit 6bc8a5098bf4). The vulnerability stems from calling napi_consume_skb() with IRQs disabled during TX packet cleanup, violating kernel API contracts and potentially causing system instability under network load. EPSS exploitation probability is very low (0.02%, 7th percentile) with vendor-released patches available across all stable kernel branches (6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0). No active exploitation or public exploit code identified at time of analysis.
Denial of service via CPU soft lockup in Linux kernel's wlcore Wi-Fi driver (versions 5.10 through 7.0) occurs when memory allocation fails during wireless frame transmission. Incorrect error code return (-EAGAIN instead of -ENOMEM) triggers infinite retry loop while holding critical mutex, causing system unresponsiveness. Vendor-released patches available across all affected stable kernel branches (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, 7.0). CVSS 7.5 (High) reflects network attack vector with no authentication required, though EPSS score of 0.02% (7th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV); no public exploit identified at time of analysis.
Null pointer dereference in Linux kernel rxrpc subsystem allows remote network attackers to crash the system by sending malformed packets to a client-side connection after a call has been torn down. The flaw affects Linux kernel versions 6.2 onward where the rxrpc client code unconditionally releases a call reference that was never acquired, converting a protocol error into a kernel panic. Vendor patches are available across stable branches (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 5th percentile) and no public exploit has been identified at time of analysis.
Information disclosure in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to leak uninitialized heap memory via malformed SMB2 requests. The vulnerability exists in smb2_get_ea() which fails to validate EaNameLength from client requests before using it in strncmp(), enabling heap content extraction. With EPSS score of 0.02% and no KEV listing, exploitation likelihood remains low despite CVSS 7.5 rating. Patches available across kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Kernel deadlock in Linux OCFS2 filesystem allows remote denial of service through lock ordering violation between unlink and direct I/O operations. OCFS2's orphan directory locking in ocfs2_unlink and ocfs2_dio_end_io_write acquire ip_alloc_sem and inode_lock in opposite orders (ABBA pattern), enabling concurrent operations to deadlock the system. Affects mainline Linux kernel through 6.19.14 with patches available in 6.12.83, 6.18.24, 7.0.1, and 6.19.14. EPSS score of 0.02% suggests minimal real-world exploitation likelihood despite CVSS 7.5 score, and no active exploitation or public POC identified.
A workqueue deadlock in Linux kernel NVMe-over-Fabrics target (nvmet) allows remote denial of service via recursive locking during controller disconnect. The nvmet subsystem's async event handler can trigger reentrant workqueue completion when nvmet_ctrl_free() flushes work on the same queue (nvmet-wq) that invoked it, causing a lockdep-detected recursive lock scenario. EPSS score of 0.02% indicates very low probability of exploitation in the wild. Patches available for kernel versions 6.12.80, 6.18.21, 6.19.11, and mainline 7.0 via upstream commits.
Linux kernel rxrpc subsystem allows remote denial of service via malformed RESP challenge packets due to incorrect serial number comparison logic. The rxrpc_post_response() function compares challenge serial numbers from the wrong packet structure, causing response queue corruption that can crash the kernel networking stack. This affects Linux kernel versions containing commit 5800b1cf3fd8 through the 6.16-6.19 and 7.0 series. Patches are available from kernel.org for affected stable branches. EPSS exploitation probability is very low (0.02%, 4th percentile) and no public exploits or active exploitation have been identified, suggesting limited real-world risk despite the network-accessible attack vector.
Remote denial of service in Linux kernel rxrpc subsystem allows unauthenticated network attackers to trigger kernel crash via malformed rxgk RESPONSE packets. An inverted length check in rxgk_verify_response() accepts oversized authenticators, causing skb_to_sgvec() to hit BUG_ON() and panic the kernel. EPSS exploitation probability is very low (0.02%, 4th percentile), no active exploitation confirmed, and patches are available across stable kernel branches 6.18.23, 6.19.13, and 7.0.
Race condition in Linux kernel SMB Direct receive credit management allows remote denial of service against SMB3 network storage services. The flaw enables remote unauthenticated attackers to exhaust receive buffer credits through timing exploitation of the gap between hardware packet reception and completion processing, causing service disruption. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.x, 6.19.x, and 7.0. This affects only systems using SMB Direct (RDMA-enabled SMB3), not standard SMB implementations.
Denial of service in Linux kernel SMB server (ksmbd) affects versions 6.18 through 7.0-rc via race condition in SMBDirect receive credit management. Remote unauthenticated attackers can trigger resource exhaustion through crafted SMB packets exploiting the window between hardware reception and completion processing. Vendor patches released for stable branches 6.18.11, 6.19.1, and mainline 7.0. Low EPSS score (0.02%) indicates limited exploitation interest despite network attack vector and no authentication requirement.
Denial of service in Grafana Tempo allows unauthenticated remote attackers to exhaust server memory by sending trace queries with excessively large result limits. The vulnerability causes unbounded memory allocation during query processing, degrading or halting service availability depending on deployment resources. EPSS data not available; no CISA KEV listing or public exploit identified at time of analysis. Mitigation available through configuration change rather than software patch.
Kernel panic in Linux arm64 memory management causes system crash when handling invalid large leaf page table mappings during DMA bounce buffer operations. ARM64 systems running Linux 7.0-rc4 and earlier (specifically kernels with commit a166563e7ec37 that introduced large block mapping support) crash with translation faults when components like SWIOTLB, secretmem, kfence, or realm DMA attempt to invalidate large leaf mappings. Exploitation requires no special privileges as this is triggered by normal kernel operations during boot or DMA activity. Vendor patches available across stable branches (6.18.24, 6.19.14, 7.0.1). EPSS score is 1st percentile (0.01%) indicating extremely low observed exploitation probability, consistent with this being an availability issue requiring specific ARM64 hardware configurations rather than a remotely exploitable vulnerability.
Apache NiFi TinkerpopClientService allows authenticated high-privilege users to execute arbitrary code without proper permission validation. The service fails to enforce required Execute Code permissions, enabling privilege escalation within the NiFi environment. While CVSS scores this at 7.5 (High), real-world risk requires authenticated high-privilege access (PR:H), significantly limiting the attack surface to compromised admin accounts or malicious insiders. No public exploit code has been identified, and CISA KEV does not list this vulnerability, suggesting no confirmed active exploitation at time of disclosure.
Command injection in Roxy-WI versions prior to 8.2.6.4 enables authenticated attackers to execute arbitrary OS commands with sudo privileges on managed servers. The vulnerability stems from unsanitized input in the /config/<service>/find-in-config endpoint that breaks out of grep command context during remote SSH execution. A proof-of-concept exploit exists (CVSS E:P), and the CVSS 4.0 score of 7.4 reflects network-based attack with low complexity requiring only low-privilege authentication. Vendor-released patch 8.2.6.4 available via GitHub commit 02f147d.
Out-of-bounds memory read in Deskflow's clipboard deserialization allows authenticated remote peers to crash the application or potentially leak memory contents. The vulnerability affects versions prior to 1.26.0.138 and stems from insufficient validation of clipboard data structure during network transfer between connected machines. A malicious peer on the shared keyboard/mouse network can exploit this by sending specially crafted clipboard updates. CVSS 7.4 reflects network-based attack with low complexity requiring authenticated peer connection. No public exploit identified at time of analysis, though proof-of-concept code exists (CVSS E:P).