Remote authenticated attackers can execute arbitrary code on Tenda HG10 routers (firmware HG7_HG9_HG10re_300001138_en_xpon) by sending a malformed 'nextHop' parameter to the /boaform/formRouting endpoint in the Boa web service. This buffer overflow vulnerability has publicly available exploit code on GitHub and is rated 8.8 (High) with low attack complexity. EPSS data unavailable; not currently listed in CISA KEV. Successful exploitation requires only low-privilege authentication and grants full device compromise (confidentiality, integrity, and availability impact).
Privilege escalation in bubblewrap 0.11.x when installed setuid root allows local attackers to escape sandbox isolation via ptrace attachment during low-privileged setup phases. The vendor confirmed active exploitation risk by releasing emergency v0.11.2 patch and immediately deprecating setuid mode entirely. CVSS 8.7 severity reflects high integrity impact from sandbox breakout, though exploitation requires local access to a setuid-configured bubblewrap binary (non-default in most distributions).
Remote code execution in simple-git before 3.36.0 allows unauthenticated attackers to execute arbitrary commands via incomplete sanitization of command-line options. The vulnerability bypasses the prior CVE-2022-25912 fix by accepting --config instead of the blocked -c flag, enabling protocol.ext.allow=always configuration and malicious ext:: URLs. Publicly available exploit code exists (POC confirmed), with EPSS score of 0.08% indicating low current exploitation probability despite the theoretical severity. SSVC framework classifies this as automatable with total technical impact.
WireGuard private keys leak through Cilium debugging tools in deployments using transparent encryption. Cilium's cilium-bugtool and cilium sysdump command expose the node-to-node WireGuard encryption private key (cilium_wg0.key) in output archives. Attackers with high-privilege local access to these diagnostic outputs can decrypt past and future inter-node traffic. Affects all Cilium versions prior to v1.17.15, v1.18.0-v1.18.8, and v1.19.0-v1.19.2. Patches released in v1.17.15, v1.18.9, and v1.19.3. No public exploit identified at time of analysis, but exploitation requires only access to previously shared bugtool/sysdump archives.
Local privilege escalation and memory corruption in the Linux kernel's batman-adv mesh networking module allows a low-privileged attacker to trigger an skb_put buffer overflow by exploiting a race in OGM (Originator Message) aggregation. When aggregation is toggled at runtime, a forwarded packet allocated with only packet_len bytes can later be selected for aggregation, causing an append past the socket buffer's tailroom. CVSS 7.8 (High); EPSS is very low at 0.02% (7th percentile) and there is no public exploit identified at time of analysis and no CISA KEV listing.
Use-after-free in the Linux kernel IPv6 flowlabel subsystem lets a local user crash the system by racing a read of /proc/net/ip6_flowlabel against the early free of an exclusive flowlabel's option block. When fl_release() drops fl->users to zero it immediately kfree()s fl->opt, while the enclosing struct ip6_flowlabel stays visible in the global hash until later RCU garbage collection, so a concurrent ip6fl_seq_show() reader dereferences freed memory. There is no public exploit identified at time of analysis, and EPSS is 0.02% (7th percentile), consistent with a low-value local denial-of-service bug rather than a widely exploited flaw.
Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).
Out-of-bounds kernel memory access in the Linux kernel's network emulation scheduler (sch_netem) allows a local, privileged user to corrupt kernel memory and likely panic the system. When a netem qdisc has packet corruption enabled and an AF_PACKET TX_RING transmits fully non-linear packets over an IPIP tunnel, skb_headlen(skb) is 0, causing get_random_u32_below(0) to return an unconstrained 32-bit offset that indexes past the linear skb->data area. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not on CISA KEV; it is a locally-triggerable memory-safety bug rather than a remotely exploitable one.
Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.
OS command injection in Linksys MR9600 router firmware 2.0.6.206937 allows authenticated administrators to execute arbitrary system commands via crafted 'pin' parameter to the BTRequestGetSmartConnectStatus JNAP action handler. Publicly available exploit code exists (CVSS E:P), enabling remote compromise of router with full system-level access. Vendor notified but unresponsive, leaving users without confirmed patch. EPSS data not available; CVSS 7.3 severity reflects high impact limited by high privilege requirement (PR:H).
Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.
Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).