Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to crash Node.js processes by sending requests with deeply nested object structures that trigger unbounded recursion in the toFormData function. The vulnerability affects both browser and Node.js environments but is exploitable in server-side Node.js deployments where attacker-controlled data is passed to toFormData without depth validation.
Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error responses via pollution of Object.prototype.validateStatus, causing authentication failures and server errors to be silently treated as successful responses. The vulnerability requires high attack complexity (prototype pollution gadget chain) but enables complete bypass of application-level authentication and error handling without user interaction.
Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.
Improper session lifetime enforcement in SenseLive X3050's web management interface allows attackers with access to a previously authenticated session to maintain administrative access without re-authentication, potentially enabling unauthorized configuration changes or information disclosure. The vulnerability affects the product's session management mechanism, permitting extended session validity beyond legitimate user activity windows. CVSS 6.9 indicates moderate risk; exploitation requires prior session compromise but no special configuration.
Information disclosure in Canon production printers and office/small office multifunction printers allows authenticated administrators to access sensitive device information through crafted requests to the browser-based remote management interface. The vulnerability affects multiple printer models and requires high-privilege administrative access; no active exploitation has been confirmed at time of analysis, though the remote network vector and low attack complexity indicate practical exploitability by privileged internal users.
Axios versions prior to 1.15.1 and 0.31.1 fail to properly bypass proxy configurations when no_proxy=localhost is set, allowing attackers to route requests to loopback addresses (127.0.0.1 and [::1]) through proxy servers instead of bypassing them. This Server-Side Request Forgery (SSRF) vulnerability arises because the shouldBypassProxy() function performs only string matching without resolving IP aliases or loopback equivalents, potentially exposing internal services to proxy interception or manipulation with a CVSS score of 6.8 (high confidentiality impact over changed scope).
Out-of-bounds read in PJSIP pjproject 2.16 and earlier exposes SIP endpoints to remote crash and limited memory integrity corruption via a malformed Content-ID URI in a SIP multipart message body. The vulnerability requires no authentication and no user interaction, making it automatable per SSVC analysis, though exploitation probability remains very low (EPSS 0.04%, 11th percentile) with no public exploit or active exploitation recorded. The primary risk is availability - a crafted SIP multipart packet can crash the parsing component - with a secondary low-severity integrity signal per the CVSS 4.0 vector (VI:L); confidentiality impact is assessed as none.
Command injection in Vim's tag file processing allows local attackers to execute arbitrary shell commands with user privileges when resolving tags containing backtick syntax. Versions prior to 9.2.0357 are affected. The vulnerability requires user interaction (opening a crafted tags file or navigating to a tag), but once triggered, grants full command execution capability in the context of the Vim process.
Frappe Press `create_api_secret` endpoint accepts GET requests despite performing database writes, enabling Cross-Site Request Forgery (CSRF)-like attacks where unauthenticated remote attackers can create API secrets by tricking authenticated users into visiting a malicious URL. No public exploit code or active exploitation has been confirmed at the time of analysis.
Heap over-read in OVN's ICMP error response generation allows remote attackers to leak sensitive memory contents, causing information disclosure and potential denial of service. The vulnerability affects OVN versions prior to the 2026 security update, exploitable over the network without authentication or user interaction via crafted ICMP packets. No public exploit code has been identified, but the attack vector is network-accessible with high complexity requirements.
Infinite recursion in LiquidJS template engine crashes Node.js processes via out-of-memory condition when attackers submit templates with circular block references. Unauthenticated remote attackers can consume ~4GB RAM and terminate any application accepting user-provided Liquid templates by nesting identically-named blocks within `{% layout %}` / `{% block %}` tags. Vendor patch available via GitHub commit e2311df. CVSS 7.5 (High) reflects network-accessible, low-complexity attack requiring no privileges or user interaction, causing complete availability loss.
SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.
STARTTLS response injection in MailKit prior to version 4.16.0 allows man-in-the-middle attackers to downgrade SASL authentication mechanisms by injecting malicious protocol responses before TLS negotiation completes. The vulnerability stems from failure to flush the internal read buffer when upgrading from plaintext to encrypted connections, enabling attackers to force weaker authentication (e.g., PLAIN instead of SCRAM-SHA-256) on affected SMTP, IMAP, and POP3 connections. User interaction is required (establishing a mail connection through the client), and exploitation requires network position to intercept and modify STARTTLS exchanges. Vendor-released patch version 4.16.0 addresses the issue.
Stored XSS in Apache ActiveMQ and Apache ActiveMQ Web allows authenticated attackers to inject malicious HTML into JMS selector fields, which displays when other users browse queues in the web console. Affects ActiveMQ versions before 5.19.6 and 6.0.0 through 6.2.4; ActiveMQ Web before 5.19.6 and 6.0.0 through 6.2.4. The vulnerability requires valid authentication but no user interaction beyond normal queue browsing, and EPSS indicates very low exploitation probability (0.02%) despite the accessible attack vector.
Broken access control in ClassroomIO v0.1.13 allows authenticated low-privileged students to disclose sensitive course information including other students' details, tutor/admin profiles, and internal metadata by modifying API requests from POST to GET against the PostgREST endpoint. The vulnerability requires valid student account credentials but no special privileges, enabling unauthorized horizontal and vertical access escalation within course contexts.
Stored Cross-Site Scripting in ITERAS WordPress plugin version 1.8.2 and earlier allows authenticated attackers with Contributor-level privileges to inject arbitrary JavaScript code via shortcode attributes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) due to insufficient input sanitization in the combine_attributes() function. When a user accesses a page containing the malicious shortcode, the injected script executes in their browser context, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Xibo CMS versions prior to 4.4.1 allows authenticated users with notification creation privileges to inject arbitrary JavaScript into notification bodies that executes automatically in targeted users' browsers upon login without requiring user interaction. This vulnerability affects the notification interrupt feature and requires the attacker to possess both notification centre access and notification creation permissions, which are restricted to administrative roles by default.
Stored cross-site scripting in Royal Elementor Addons plugin for WordPress up to version 1.7.1056 allows authenticated attackers with Author-level access to inject arbitrary JavaScript via image alt attributes in the Image Grid/Slider/Carousel widget. The vulnerability results from insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for HTML attribute context. Malicious scripts execute in the browsers of any user viewing pages containing the compromised image widget, potentially enabling session hijacking, credential theft, or plugin/theme manipulation.
Unsafe deserialization in Apache DolphinScheduler RPC module (versions 3.2.0 to 3.3.0) allows authenticated network attackers to achieve remote code execution by injecting malicious class types into StandardRpcRequest messages sent to Master or Worker nodes. The vulnerability requires network access and valid credentials but carries moderate CVSS (6.3) with very low EPSS exploitation probability (0.02%), suggesting limited real-world weaponization despite the dangerous vulnerability class.
Traefik's BasicAuth middleware contains a timing side-channel vulnerability that allows attackers to enumerate valid usernames through response-time analysis. A map key/value confusion in the constant-time comparison fallback causes the `notFoundSecret` variable to always resolve to an empty string, causing authentication checks against non-existent users to complete in microseconds (~0.48ms) instead of performing full bcrypt evaluation (~62ms), creating a 130x timing oracle. Attackers can distinguish existing users from non-existent ones by measuring HTTP response times, enabling account enumeration without credentials.
PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Trees, allowing cross-site scripting (XSS) attacks when user-submitted CSS is embedded in HTML `<style>` tags. An attacker can inject CSS containing `</style>` sequences in property values to break out of the style context and execute arbitrary JavaScript in the victim's browser. This requires user interaction (UI:R) and affects applications that parse untrusted CSS and re-stringify it for embedding in HTML documents.
Unauthenticated attackers can inject malicious HTML into user-controlled template placeholders in pretalx prior to 2026.1.0, enabling arbitrary HTML-rendered emails to be sent from the conference organizer's legitimate sender address. By registering an account with a crafted display name containing HTML or markdown link syntax and triggering a password reset, an attacker can deliver convincing phishing emails that pass SPF/DKIM/DMARC validation, with user interaction (victim clicking password-reset link) required. This vulnerability is fixed in version 2026.1.0.
Stored cross-site scripting (XSS) in Mahara before 25.04.2 and 24.04.11 allows unauthenticated remote attackers to inject malicious JavaScript via unsanitized search query parameters in the 'search site' feature when the Elasticsearch7 search plugin is enabled. The vulnerability has a CVSS score of 6.1 (moderate) with network attack vector and user interaction required (clicking a crafted search link), resulting in partial confidentiality and integrity impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code is documented at the time of analysis.
Invalid memory access in Open vSwitch conntrack FTP application-level gateway allows remote attackers to trigger a denial of service via crafted FTP traffic, affecting versions prior to a security patch. The vulnerability requires high attack complexity but can be exploited without authentication over the network, resulting in service unavailability rather than data compromise.
Out-of-bounds read in libXpm's xpmNextWord() parser function can be triggered by a local attacker with low privileges, crashing any X11 application that processes a maliciously crafted XPM image file, resulting in a denial of service. The vulnerability was disclosed via the oss-security mailing list on 2026-04-21 by X.Org and is tracked under CWE-125. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score was not provided in available intelligence.
Memory leak in the Linux kernel ksmbd SMB server subsystem allows pre-authenticated remote clients to exhaust kernel memory by repeatedly sending malformed SPNEGO/ASN.1 BER blobs. The ksmbd_decode_negTokenInit() function allocates a mechToken buffer mid-parse via kmemdup_nul(), but if a subsequent element in the same blob is malformed (e.g., mechListMIC[3] overrunning its enclosing SEQUENCE), the decoder fails and clears use_spnego, causing the cleanup gate at smb2_sess_setup() to skip kfree() - leaking the allocation. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), consistent with a slow-burn DoS rather than an immediately weaponizable condition.
Memory leak in the Linux kernel's rt2x00usb WiFi driver allows a local low-privileged user to exhaust kernel memory on systems equipped with Ralink RT2x00-based USB WiFi adapters. The flaw - present since kernel 4.7 - results from USB anchor device-managed resources being incorrectly scoped to the parent USB device rather than the USB interface, so resources are not released when the driver unbinds without a physical device disconnection. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (7th percentile), marking this as a low-urgency stability fix rather than an emergency security response.
Uninitialized kernel memory leaks to userspace through the xfrm_user subsystem's build_report() function in the Linux kernel, exposing three bytes of alignment padding in struct xfrm_user_report via Netlink before it is copied to userspace. The flaw affects virtually all Linux kernel versions from initial commit through the recently issued stable-tree patches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0). No public exploit has been identified at time of analysis, EPSS sits at just 0.02% (7th percentile), and it is not listed in CISA KEV; however, the breadth of affected systems is enormous given the Linux kernel's ubiquitous deployment.
Local low-privileged users can exhaust system memory on Linux systems by generating unbounded rfkill events without consuming them from the rfkill file descriptor, resulting in a potential out-of-memory condition and system crash. Affected kernel versions span a wide range across multiple stable branches, with fixes backported to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit code or active exploitation has been identified; the EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation interest at time of analysis.
Kernel heap memory disclosure in the Linux kernel's xfrm (IPsec) subsystem exposes uninitialized heap bytes to local unprivileged users via netlink multicast. The `build_polexpire()` function omits the `memset_after()` call that its counterpart `build_expire()` correctly applies, leaving trailing padding bytes of `struct xfrm_user_polexpire` uninitialized before broadcasting the structure to XFRMNLGRP_EXPIRE listeners. Any local user able to subscribe to that netlink multicast group on a system running IPsec with expiring policies can capture these notifications and read arbitrary kernel heap contents. No public exploit has been identified at time of analysis, and EPSS is extremely low at 0.02% (7th percentile), indicating negligible automated exploitation activity.
Memory mismanagement in the Linux kernel brcmsmac WiFi driver causes a kernel availability impact through a size mismatch between DMA allocation and deallocation. The brcmsmac driver incorrectly calls dma_free_coherent() with the original requested size rather than the aligned size stored in 'alloced' by dma_alloc_consistent(), which may have grown the allocation during alignment. This affects Linux from version 3.2 (commit 5b435de0) through multiple stable branches, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low exploitation probability.
NULL dereference in the Linux kernel's pn533 NFC driver (pn532_receive_buf) can crash the kernel when a socket buffer allocation fails after bytes have already been consumed from the serial receive stream. Systems running affected kernel versions with PN532/PN533 NFC hardware attached over serial are exposed to a local denial-of-service (kernel panic). No public exploit code exists, EPSS probability is negligible (0.02%, 7th percentile), and this vulnerability is not in the CISA KEV catalog - indicating no confirmed active exploitation.
Memory leak in the Linux kernel's Altera Triple Speed Ethernet (altera-tse) driver allows a local low-privileged user on affected hardware to exhaust kernel memory over time. The flaw in tse_start_xmit() incorrectly signals successful packet transmission to the network stack when DMA mapping fails, preventing socket buffer (skb) cleanup and causing a per-failure memory leak that can escalate to availability loss. No public exploit exists and EPSS at 0.02% (7th percentile) confirms negligible exploitation interest; this is a maintenance-tier fix relevant only to specialized embedded Linux deployments on Altera/Intel FPGA hardware.
NULL pointer dereference in the Linux kernel vub300 USB MMC driver allows a local authenticated attacker to crash the kernel by disconnecting a VUB300-based USB MMC adapter while the driver is active. The disconnect handler releases the driver data reference before deregistering the MMC controller, creating a window for NULL dereference or use-after-free that results in a kernel panic and denial of service. No active exploitation has been confirmed - EPSS is 0.02% (7th percentile) and the vulnerability is absent from the CISA KEV catalog.
Reference count leak in the Linux kernel's rxrpc subsystem (`rxrpc_server_keyring()`) causes progressive kernel resource exhaustion when `rx->securities` is already initialized and the extra reference is not decremented. Affected kernels span from version 2.6.22 through multiple stable branches, with fixes backported to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit identified at time of analysis, and EPSS sits at 0.02% (7th percentile), reflecting niche real-world exploitation probability despite the kernel's ubiquitous deployment footprint.
Cross-thread information disclosure in the Linux kernel on AMD Zen1 processors allows a low-privileged local attacker to harvest partial floating-point division results belonging to a concurrently executing victim thread. Zen1's hardware FP divider fails to fully clear intermediate state between operations, creating a side-channel leakage path exploitable by any unprivileged thread sharing the same physical CPU core. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the vulnerability affects all Linux versions from inception through multiple stable branches, with patches now available across eight stable series (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0).
Deadlock in the Linux kernel's RDMA/irdma subsystem (CVE-2026-31565) causes an indefinite system hang when a netdev reset is performed on Intel ice Ethernet hardware while active RDMA/iWARP applications hold Queue Pair connections. The ice driver's removal of the irdma auxiliary driver triggers a circular dependency: uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference in iWARP mode, neither releasing first. No public exploit has been identified at time of analysis; an EPSS of 0.02% (7th percentile) and absence of CISA KEV listing confirm this is currently a low exploitation-priority issue concentrated in HPC and data center environments with Intel RDMA hardware.
Stale pointer dereference in the Linux kernel's futex Priority Inheritance lock path (futex_lock_pi(), kernel/futex/core.c) exposes systems running affected kernel versions to local denial of service by low-privileged users. The flaw manifests in a three-way race between a PI futex owner exiting, a concurrent FUTEX_LOCK_PI attempt, and a futex value modification - causing a freed task_struct pointer to be re-used on the retry path, violating the wait_for_owner_exiting() invariant and triggering WARN_ON_ONCE. No active exploitation is confirmed (EPSS 0.02% at 7th percentile, not in CISA KEV); vendor-released patches are available across all maintained stable LTS branches.
Race condition in the Linux kernel's mac80211 WiFi subsystem allows a local low-privileged attacker to trigger a static_branch_dec() integer underflow via concurrent writes to the AQL debugfs control file, causing a kernel WARNING and potential availability impact. Affected kernels span from the introduction of the aql_disable static key (v5.12) through multiple stable branches, with fixes backported to 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0. EPSS is 0.02% (7th percentile) and no active exploitation is recorded in CISA KEV, placing this firmly in the low-real-world-risk category despite its availability impact.
Insufficient ASB polling timeout in the Linux kernel's bcm2835-power pmdomain driver intermittently fails to complete the V3D AXI Slave Bridge handshake on BCM2711 hardware during runtime PM suspend, leaving the VideoCore 3D GPU in a broken power state. Systems running intensive V3D workloads on BCM2711 (e.g., Raspberry Pi 4) may subsequently experience bus faults or full system hangs on later GPU accesses. No public exploit code exists and EPSS is 0.02% (7th percentile), consistent with a hardware-specific reliability defect rather than a broadly exploitable security attack; the vulnerability is not in CISA KEV.
NULL pointer dereference in the Linux kernel's cp2615 i2c driver crashes the kernel when a USB device lacking a serial number string is probed, resulting in denial of service. The cp2615 driver unconditionally uses the USB serial string as the i2c adapter name without first verifying the pointer is non-NULL, a flaw exploitable by connecting a crafted or malformed CP2615 USB-to-I2C bridge device. No active exploitation is confirmed (not in CISA KEV) and the EPSS score of 0.02% at the 7th percentile reflects negligible exploitation interest; impact is limited to availability with no code execution or data exposure possible.
NULL pointer dereference in the Linux kernel bonding driver's RLB debug interface allows a local low-privileged user to crash the kernel, causing a denial of service. Specifically, bond_debug_rlb_hash_show in bond_debugfs.c dereferences client_info->slave without a NULL guard - a condition intentionally created by rlb_clear_slave when no replacement bonding slave is available - producing a BUG: kernel NULL pointer dereference at address 0x0. Affected across multiple stable kernel trees from 5.10.x through 7.0; no public exploit code exists and EPSS is 0.02%, consistent with low opportunistic risk, though Siemens PSIRT has issued downstream advisories (SSA-019113, SSA-082556) indicating industrial/embedded impact.
The NXP-NCI NFC driver in the Linux kernel triggers a kernel WARN_ON and fails to operate correctly when firmware and enable GPIOs are routed through I2C GPIO expanders, causing denial of service to NFC subsystem functionality on affected hardware. Systems running kernel versions from 5.4 through pre-patch releases across multiple stable branches are affected when using NXP NCI NFC chipsets with I2C-connected GPIO expanders. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit code identified at time of analysis, this is a low-risk operational reliability defect relevant primarily to embedded and IoT deployments.
A null pointer dereference in the i915 GPU driver's graphics translation table (GT) submission logic causes kernel panic and denial of service when the i915 firmware binaries are absent and the system attempts to suspend. Local authenticated attackers with normal user privileges can trigger this crash by initiating system suspend on affected Intel graphics systems without required firmware, resulting in denial of service. No public exploit code identified at time of analysis; EPSS score of 0.02% indicates low exploitation probability in practice.
Resource leak in the Linux kernel rtw88 USB WiFi driver allows a local attacker with low privileges to cause system availability degradation by triggering repeated probe failures that leave unreleased USB device references. The driver increments the USB device reference count during probe but fails to decrement it on all error exit paths - specifically when descriptor parsing fails - resulting in CWE-401 reference leaks that accumulate over time. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible exploitation probability; the real-world impact is constrained to systems with Realtek rtw88 USB WiFi adapters.
Null pointer dereference in the Linux kernel's LoongArch architecture code can crash the kernel during early boot when kstrdup() fails to allocate memory while parsing CPU model strings from the device tree. Affected systems running unpatched kernels on LoongArch hardware may experience a kernel oops and complete system unavailability if memory is exhausted at boot time. No public exploit exists and EPSS is 0.02% (6th percentile), reflecting very low exploitation probability; this is not listed in CISA KEV.
Memory exhaustion in the Linux kernel's rxrpc subsystem allows a local low-privileged user to degrade system availability by repeatedly triggering a key parsing error path that leaks kernel memory. The flaw exists in rxrpc_preparse_xdr_yfs_rxgk(), where allocations for token->rxgk are not freed on certain error branches before jumping to reject_token. With EPSS at 0.02% (5th percentile) and no CISA KEV listing, real-world exploitation is assessed as low-probability and operationally constrained to systems actively using AFS/YFS rxrpc authentication.
System hang exposure in the Linux kernel's i.MX 8MP (imx8mp-blk-ctrl) power management domain driver allows a local attacker with low privileges to trigger a kernel hang on affected NXP i.MX 8M Plus-based systems. The root cause is the NOC_HDCP clock being incorrectly allowed to power down, which causes the NoC ADB400 port power-down handshake to deadlock, resulting in a complete loss of system availability. No public exploit code exists and EPSS is 0.02%, indicating this is a stability defect with low opportunistic exploitation probability, though it carries meaningful availability risk on affected embedded hardware.
Memory leak in the Linux kernel's __mmap_region() function allows a local low-privileged user to incrementally exhaust kernel slab memory, potentially causing denial of service. Introduced as a regression by commit 605f6586ecf7, the bug leaves a shmem file object unreferenced when mmap() on /dev/zero with MAP_SHARED fails mid-way through VMA setup - the replacement file allocated by shmem_zero_setup_desc() is never released via fput(). No public exploit exists and EPSS sits at 0.02%, making this a low-urgency but genuine availability risk for affected kernel versions; patched upstream in stable commits 61fc8eaf and 894f99eb.
Denial of service via kernel panic in the Linux kernel idpf NIC driver arises from invalid spinlock nesting in the async virtchannel message handler, most critically on PREEMPT_RT-enabled kernels. The idpf_mac_filter_async_handler acquires a BH spinlock while the workqueue thread already holds the raw spinlock embedded in the completion primitive of idpf_vc_xn, violating PREEMPT_RT lock context rules and triggering a kernel BUG that crashes the system. No public exploit identified at time of analysis; EPSS is 0.02%, indicating negligible observed exploitation interest for this narrow driver-level locking defect.