Remote authentication bypass in note-mark backend allows unauthenticated attackers to hijack OIDC user accounts by submitting the password 'null' to the internal login endpoint. Affected deployments running default configuration (EnableInternalLogin=true) with OIDC enabled permit complete account takeover of any OIDC-registered user. Attackers gain full access to private notebooks, markdown content, and uploaded assets, plus can persist access by overwriting the victim's password. Vendor patch available in commit dea5530c. CVSS 9.4 (AV:N/AC:L/PR:N/UI:N) reflects the zero-interaction remote attack against default installations. No EPSS or KEV data available, but the detailed POC script in the advisory significantly lowers exploitation barrier.
Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).
Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).