Heap use-after-free in GPAC MP4Box 2.5-DEV-rev1593-gfe88c3545-master crashes the application when a local authenticated user processes a specially crafted MPEG-2 TS or MP4 file. The defect resides in `gf_filter_pid_inst_swap_delete_task()` within `filter_core/filter_pid.c`, where PID instance cleanup dereferences already-freed objects during a swap/delete operation, causing a heap corruption and denial of service. No public exploit has triggered active exploitation per CISA KEV, but a proof-of-concept is publicly available; EPSS sits at 0.18% (7th percentile), consistent with limited real-world targeting.
Use-after-free in GPAC MP4Box before version 26.02.0 allows a local attacker to crash the application by supplying a crafted media file, resulting in Denial of Service. The flaw resides in the filter PID lifecycle management within filter_pid.c, where a PID instance could be freed prematurely while a pending reconfiguration task still held a reference to it. Publicly available exploit code exists, though the attack requires user interaction to process the malicious file and exploitation is limited to DoS with no confidentiality or integrity impact.
Stored Cross-Site Scripting in the AI Share & Summarize WordPress plugin (all versions before 2.0.4) allows any user holding a Contributor role or above to inject persistent malicious JavaScript via unsanitized shortcode attributes rendered on pages. When a higher-privileged user such as an Administrator subsequently views the affected page, the payload executes in their browser, enabling session hijacking, credential theft, or unauthorized privileged actions. A publicly available proof-of-concept exploit exists per WPScan, and a vendor-released patch is available in version 2.0.4.
Unvalidated `ot_`-prefixed argument injection in OliveTin allows any authenticated user with action-trigger access to bypass input filtering, inject arbitrary environment variables into action execution contexts, and pollute Go template rendering data. All OliveTin versions prior to commit `ebffd9f040f7` (Go pseudo-version `< 0.0.0-20260531214440-ebffd9f040f7`) are affected. While direct standalone RCE is not confirmed, a public proof-of-concept exists in GHSA-prj9-97mp-mwh2 and secondary command injection is achievable wherever triggered action scripts consume `OT_`-prefixed environment variables in shell-unsafe ways.
Authentication bypass in the Crawl4AI Docker API server before 0.8.7 exposes all monitor router endpoints - including the destructive /monitor/actions/cleanup action - to unauthenticated remote attackers due to missing token dependency injection on the monitor router. Any attacker with network access to the Docker API port can invoke cleanup operations and manipulate monitoring state, causing service disruption without credentials. No active exploitation (CISA KEV) or public POC has been identified at time of analysis; the CVSS 4.0 vector of AV:N/AC:L/AT:N/PR:N/UI:N confirms trivial remote unauthenticated access with no special conditions required.
Server-Side Request Forgery in Pentestify 1.0.0's PDF generation endpoint enables remote attackers (PR:N per CVSS 4.0 vector) to coerce the server into issuing outbound HTTP requests to arbitrary internal or external targets, including cloud metadata services such as the AWS Instance Metadata Service at 169.254.169.254, by supplying a crafted HTTP Host header. The rendered PDF is returned to the caller, potentially leaking internal service responses or IAM role credentials. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the vulnerability is patched in version 1.1.0.
Denial of service in Capgo's /auth/v1/otp endpoint blocks email-based 2FA enrollment for authenticated users in all versions before 12.128.2. The backend captcha validation subsystem fails to handle exceptions gracefully, consistently returning HTTP 500 errors and preventing users from completing two-factor authentication setup. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the impact is security-control degradation: users cannot activate 2FA, leaving accounts with only single-factor protection.
Unauthenticated app enumeration in Capgo before 12.128.2 allows remote attackers to determine whether specific app_ids exist across all tenants by querying the exposed exist_app_v2 RPC endpoint without credentials. The root cause is a PostgreSQL SECURITY DEFINER function that executes with elevated owner privileges, bypassing row-level security policies and enabling cross-tenant information disclosure via the PostgREST API at POST /rest/v1/rpc/exist_app_v2. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified at time of analysis, though the attack requires no authentication and trivial HTTP tooling.
Unauthenticated remote attackers can read, insert, and delete stored app icons in Capgo (all versions before 12.128.2) due to a Supabase images bucket entirely lacking row-level security (RLS) controls. Exploitation leaks sensitive app IDs and user IDs embedded in bucket metadata, and enables full icon deletion causing visual degradation of hosted applications. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 12.128.2.
Rocket.Chat's Omnichannel visitors.info API endpoint exposes visitor session tokens in response payloads, enabling a privileged caller to capture and reuse those tokens for authentication bypass against LiveChat visitor identities. Affected deployments span multiple 7.x and 8.x release branches, with vendor-confirmed fixes across seven patch releases. No public exploit code and no CISA KEV listing exist at time of analysis; however, the CWE-285 (Improper Authorization) classification and 'Authentication Bypass' tag confirm meaningful post-exploitation potential for session impersonation.
Arbitrary file deletion via directory traversal in ATEN Unizon's uploadSSL method allows authenticated remote attackers with high-privilege credentials to delete files anywhere on the underlying filesystem. All versions are indicated as affected by the wildcard CPE. Exploitation can be used to destroy configuration or system files, inducing a denial-of-service condition; no confirmed active exploitation or public exploit code has been identified at time of analysis.
Arbitrary file deletion in ATEN Unizon exposes all installations to destructive denial-of-service attacks via a path traversal flaw in the updateLicense method, reachable over the network by any authenticated high-privilege user. The CVSS PR:H constraint confirms exploitation requires high-privilege credentials, limiting opportunistic mass exploitation, but a motivated insider or attacker with stolen admin credentials can delete critical system files and render the host inoperable. No public exploit or CISA KEV listing has been identified at time of analysis, but the straightforward AC:L nature of the flaw means exploitation is trivial once credentials are obtained.
Wrong connection reuse across different services in curl/libcurl up to 8.20.0 allows curl's connection pool to incorrectly match and reuse an existing connection when the target service differs from the one originally used to establish that connection. This is part of a coordinated batch of 19 CVEs fixed in curl 8.21.0, released June 24, 2026. No public exploit or active exploitation has been identified; the curl project rates this LOW severity, consistent with limited real-world attack surface requiring specific multi-service usage patterns.
Cross-origin data leakage in Google Chrome's Autofill implementation allows a remote attacker who has already achieved renderer process compromise to exfiltrate sensitive cross-origin data via a specially crafted HTML page. Affected versions include all Chrome releases prior to 149.0.7827.197; the flaw was reported by the Chrome security team and rated High severity by Chromium. No public exploit code has been identified and no active exploitation is confirmed, though the vulnerability chains onto a renderer compromise making real-world exploitation a two-stage attack.
Linked-Data Signature normalization in Mastodon allows unauthenticated remote attackers to remove JSON entries from valid signed ActivityPub activities, effectively spoofing or distorting federated content attributed to legitimate third-party actors. All Mastodon instances prior to versions 4.5.10, 4.4.17, and 4.3.23 are affected across all maintained release branches. The CVSS vector (AV:N/AC:L/PR:N/UI:N) reflects low-complexity network exploitation with no authentication required; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Out-of-bounds heap read and integer underflow in libslirp's TCP urgent data handler (sosendoob) exposes gigabytes of host process heap memory to a privileged guest VM attacker. All libslirp releases before v4.9.2, as embedded in hypervisors such as QEMU, are affected when guest workloads hold root or CAP_NET_RAW privileges. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the cross-VM-boundary scope change (S:C) and high confidentiality impact make this a material risk in multi-tenant or shared virtualization environments.
KubeVirt's virt-handler domain notify server allows a compromised virt-launcher process to forge lifecycle events for any other VMI scheduled on the same Kubernetes node, causing virt-handler to corrupt that VMI's state and disrupt its lifecycle management. The root cause is that gRPC handlers for HandleDomainEvent and HandleK8SEvent accept VMI namespace/name exclusively from the request body, never cross-checking against the per-VMI pipe socket the connection arrived on. With CVSS 6.5 (AV:L/S:C), the attack requires local access via a compromised container but can impact multiple VMIs across tenants on the same node; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Xpro Addons plugin for WordPress (versions ≤1.7.2) allows authenticated attackers holding author-level or higher roles to permanently embed arbitrary JavaScript via the `custom_attributes` parameter across at least 12 distinct Elementor widget frontend templates. The injected payload executes in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or administrative account takeover without further attacker interaction. No public exploit identified at time of analysis, though Wordfence has published source-code-level vulnerability locations across multiple widget layout files.
Server-Side Request Forgery in the WP Meta SEO WordPress plugin (all versions through 4.5.18) enables authenticated contributors to coerce the web server into issuing arbitrary outbound HTTP requests via the `new_link` parameter, with the response status code reflected back through the AJAX JSON response as `status_code`. This status-code oracle allows methodical enumeration of internal network hosts and cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), making it particularly dangerous in cloud-hosted WordPress deployments. No public exploit identified at time of analysis, though the vulnerability is confirmed by Wordfence with direct source code references and the technique is well-understood.
Stored Cross-Site Scripting in the WP Latest Posts WordPress plugin (versions up to and including 5.0.11) allows authenticated attackers with author-level access to plant persistent JavaScript payloads by crafting malicious image src attributes in post content. The plugin's field() and loop() functions in wplp-front.inc.php extract raw src values via regex and reconstruct HTML img elements or CSS background-image declarations through direct string concatenation, entirely bypassing WordPress's built-in kses sanitization. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the scope change to the victim's browser context enables session hijacking or credential theft against any user who visits an injected page.
Stored Cross-Site Scripting in Avalon23 Products Filter for WooCommerce (≤1.1.6) allows authenticated Contributors to inject persistent JavaScript via the `avalon23_qr` shortcode's `title` and `fixed_link` attributes, which are concatenated unsanitized into single-quoted HTML attributes by `AVALON23_HELPER::draw_html_item()`. The payload is stored in the WordPress database and executes in the browser of any user who subsequently visits an injected page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Mir Blocks and Shortcodes WordPress plugin (versions up to and including 1.0.0) allows authenticated attackers with contributor-level access to permanently inject arbitrary JavaScript into pages via unsanitized shortcode attributes - specifically the 'title' and 'ready_animation_text' parameters of the msc_stats() rendering function. Any site visitor who loads an injected page executes the attacker's script in their browser, enabling session theft, credential harvesting, or in-page content manipulation. No public exploit or CISA KEV listing is confirmed at time of analysis, but the low privilege requirement (contributor) makes this accessible to a broad class of registered WordPress users.
Memory exhaustion via unfreed heap allocations in ImageMagick before 7.1.2-15 enables remote denial of service against services that process untrusted images through the affected raw-pixel-data coders. The flaw (CWE-401) causes 160-byte objects to accumulate on the heap with each crafted image processed, progressively starving the host process of memory. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects network reachability offset by high attack complexity and partial attack requirements, limiting realistic mass exploitation.
Unauthorized configuration modification in OpenText Access Manager before 5.1.3 allows a remote unauthenticated attacker to alter system configuration via API calls that lack proper authorization enforcement, classified under CWE-648 (Incorrect Use of Privileged APIs). Affected deployments expose privileged API endpoints without adequate access control, enabling integrity impact across both the vulnerable system and subsequent systems relying on it for identity and access decisions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stack-based buffer overflow (CWE-121) in the GV-Cloud component of GeoVision GV-VMS V20 20.0.2 enables a remote attacker with a network-intercept position to crash the video management system, causing high-impact denial of service against physical security infrastructure. Exploitation requires impersonating the legitimate GV-Cloud server - achieved via MitM techniques - and delivering a specially crafted network payload that corrupts stack memory in the GV-Cloud client handler. Reported by Cisco Talos (TALOS-2026-2411); no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Reflected Cross-Site Scripting in the EntreDroppers WordPress plugin (all versions through 1.1.2) allows unauthenticated attackers to inject arbitrary JavaScript into victim browsers by embedding script payloads in the URL path-info segment, which PHP reflects unsanitized through the PHP_SELF server variable into the form action attribute at EntreDroppers.php line 223. Successful exploitation requires tricking an authenticated WordPress administrator into clicking a crafted link pointing to the /wp-admin/ context, making this a social-engineering-dependent attack. No public exploit code or active exploitation has been identified at time of analysis; no patch has been confirmed from available data.
Reflected Cross-Site Scripting in the Image Sizes on Demand WordPress plugin (versions ≤ 1.3) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized PHP_SELF server variable in settings.php. Successful exploitation requires social engineering an administrator into clicking a crafted link, after which the injected script executes within the admin's authenticated browser session - enabling session hijacking or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-Site Request Forgery in the Osiris Signature Banner WordPress plugin (all versions ≤ 0.5) enables unauthenticated attackers to update plugin settings and inject stored XSS payloads by tricking an authenticated administrator into triggering a forged request. Missing nonce validation across at least four functions (lines 107, 118, 139, and 189 of osiris-signature-banner.php) means any forged cross-origin form submission executed in an active admin session bypasses all server-side origin checks. No public exploit identified at time of analysis and no KEV listing is present, but the stored XSS secondary impact elevates real-world risk above a typical CSRF-only finding.
Symlink-based workspace boundary bypass in chrome-devtools-mcp (versions 0.24.0 through before 1.1.0) allows a local low-privileged actor - including an AI coding agent itself - to read or overwrite files outside the configured workspace root. The McpContext.validatePath() function performs only a lexical prefix check on the resolved path and never canonicalizes symbolic links, so an in-root symlink whose target lies outside the root passes validation and causes downstream file operations to act on the real out-of-workspace target. No public exploit has been identified and the CVE is not listed in CISA KEV; a vendor-released patch is available in version 1.1.0.
SiYuan's personal knowledge management system prior to 3.7.0 exposes all user note content to unauthenticated database exfiltration through a deliberately auth-excluded API endpoint. The `/api/icon/getDynamicIcon` endpoint, when invoked with `type=8` and a valid block ID, renders a Go template that executes arbitrary SELECT queries against SiYuan's SQLite backend via `querySQL` and `queryBlocks` functions - functions designed for note querying but reachable without any credential check. An attacker with network adjacency who possesses a valid block ID can read the entire database: note content, tags, asset references, and block attributes. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H rating reflects the block ID prerequisite. A fix is available in version 3.7.0.
Server-side request forgery (SSRF) filter bypass in Ghost CMS 6.0.9 through 6.21.0 allows remote unauthenticated attackers to direct the application to reach internal network services by supplying IPv6 literals that map to private IPv4 addresses, circumventing Ghost's outbound IP blocklist. The root cause is CWE-184 (Incomplete List of Disallowed Inputs): the filter validates against RFC 1918 private ranges but does not normalize IPv6-mapped IPv4 notation before comparison. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists; Ghost 6.21.1 resolves the issue.
Stored XSS in Jellyfin's administrative dashboard allows a low-privileged user to execute arbitrary JavaScript in the browser context of a logged-in administrator. The `Client` header supplied during an `AuthenticateByName` API request is stored without sanitization and rendered unescaped when an administrator visits the Access tab of that user's profile in the dashboard. Affecting all versions prior to 10.11.9, successful exploitation could enable admin session hijacking, credential exfiltration, or unauthorized administrative actions; no public exploit or CISA KEV listing has been identified at time of analysis.
Flowise versions up to and including 3.0.12 hash passwords using bcrypt with a default cost factor of 5 rounds - yielding only 32 iterations versus the OWASP-recommended minimum of 1,024 at 10 rounds - making stored password hashes approximately 30 times faster to crack with modern GPU hardware. All deployments where the PASSWORD_SALT_HASH_ROUNDS environment variable has not been manually overridden to 10 or higher are affected, which represents the majority of real-world installs since defaults predominate. In a database breach scenario, an attacker who obtains the hash table can leverage GPU-accelerated tools to recover plaintext passwords at roughly 300,000 attempts per second versus ~10,000 at the recommended work factor; no public exploit identified at time of analysis.
Unauthorized file attribute modification in the Linux kernel's ksmbd SMB server allows authenticated SMB clients to invoke FSCTL_SET_SPARSE and alter a file's sparse xattr without required permissions, bypassing both share-level and per-handle access controls. Two distinct authorization gaps exist: clients on read-only shares can issue the control code because fsctl_set_sparse() omits the KSMBD_TREE_CONN_FLAG_WRITABLE check that other FSCTL write operations enforce, and clients on writable shares with insufficient handle rights (lacking FILE_WRITE_DATA or FILE_WRITE_ATTRIBUTES) can modify the attribute because per-handle checks are entirely absent. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS of 0.22% (12th percentile) - but the exposure surface is any network-reachable ksmbd deployment serving untrusted SMB clients.
Ceph filesystem client in the Linux kernel panics with a BUG_ON assertion in __ceph_build_xattrs_blob() due to a race condition that leaves a pre-calculated xattr blob size stale, introduced by an earlier commit that restructured size computation order. All kernels from Linux 6.0 onward running a CephFS mount are affected, with fixed releases available at 6.12.91, 6.18.33, 7.0.10, and 7.1. A local low-privileged user with access to a Ceph-mounted filesystem can trigger a kernel panic causing complete system denial of service; no public exploit code or CISA KEV listing exists at time of analysis.
Heap buffer overflow in the Linux kernel EFI capsule loader arises from an incorrect sizeof operand in a krealloc() call inside __efi_capsule_setup_info(), allocating half the required space on 32-bit PAE systems where phys_addr_t is 64-bit but pointers are 32-bit. When physical addresses are subsequently written via page_to_phys(), the undersized heap buffer is overflowed, corrupting kernel heap metadata and causing a system crash. Exploitation is architecturally constrained to 32-bit PAE kernels; 64-bit systems are unaffected because sizeof(phys_addr_t) equals sizeof(phys_addr_t*). No public exploit exists, EPSS is 0.19% (9th percentile), and no active exploitation has been recorded.
Resource exhaustion in the Linux kernel ksmbd SMB server allows a low-privileged authenticated SMB client to leak kernel file descriptor references by sending repeated SMB2 CREATE requests with a DURABLE_HANDLE_REQUEST_V2 context that produces a CreateGuid hit but a ClientGUID mismatch. Each such request increments the refcount on a ksmbd_file via ksmbd_fp_get() in ksmbd_lookup_fd_cguid() but the mismatch code path never calls the matching release, causing global_ft entries to be pinned indefinitely. Over time this defeats the durable file scavenger and causes long-lived kernel resource leaks that can degrade or deny availability. No public exploit has been identified at time of analysis and EPSS is 0.19% (9th percentile), indicating low opportunistic exploitation probability.
Kernel availability impact in the Linux DRM PRIME buffer-sharing subsystem results from a pointer replacement logic error introduced by commit 5e28b7b94408, where the new IDR object pointer fails to overwrite the original handle's pointer at the correct location during the 'change handle' flow. Local users with low privileges holding access to a DRM device node can trigger a kernel WARNING assertion failure in drm_prime_destroy_file_private (drm_prime.c:224) upon file close, destabilizing the system. No public exploit exists and EPSS sits at 0.19% (8th percentile), indicating low real-world exploitation probability; the vendor patch is available in Linux stable trees at 7.0.10 and 6.18.33.
NULL pointer dereference in the Linux kernel nexthop routing subsystem allows a local privileged attacker to crash the kernel (denial of service) by exploiting a stale address-family flag state. The `has_v4` flag in nexthop groups is not updated when an IPv6 nexthop is replaced with an IPv4 one, letting a corrupt group bypass `fib6_check_nexthop` validation and attach to an IPv6 route; subsequent traffic through that route calls `nexthop_fib6_nh()`, which returns NULL for the AF_INET member, triggering the panic. No public exploit identified at time of analysis, though the CVE disclosure itself includes a functional step-by-step reproducer using standard `ip nexthop` and `ip route` commands, and the EPSS score of 0.18% (8th percentile) reflects low current real-world exploitation pressure.
Integer overflow in the Linux kernel i2c character device driver allows a local low-privileged user to corrupt the SMBus controller state machine and cause a persistent Denial of Service. By supplying a crafted large timeout value (e.g., 429496729) to the I2C_TIMEOUT ioctl that passes the INT_MAX bounds check but overflows to a negative integer after multiplication by 10, an attacker forces wait_for_completion_timeout() to receive a sign-extended negative 64-bit value, triggering schedule_timeout kernel warnings and leaving the SMBus adapter in an unrecoverable state. No public exploit has been identified at time of analysis and EPSS is 0.18% (8th percentile), reflecting low mass-exploitation risk; however, the flaw is mechanically straightforward on any system granting unprivileged access to /dev/i2c-* nodes.
Memory leak in the Linux kernel dm-cache metadata subsystem can be triggered by local users with low privileges to gradually exhaust kernel memory, causing system availability degradation. The flaw resides in dm_cache_metadata_abort, where a temporary block_manager object allocated before acquiring root_lock is not freed when the lock acquisition fails due to a read-only block manager - a condition reproducible by reloading a dm-cache table during metadata error states. No public exploit code and no CISA KEV listing have been identified; EPSS of 0.18% (8th percentile) confirms very low current exploitation probability.
Unbounded queue growth in the Linux kernel's netem (Network Emulator) traffic control subsystem allows a local low-privileged user to exhaust kernel memory and trigger a denial of service. The flaw exists because netem_enqueue() enforces queue depth limits using only q->t_len (packets in the internal tfifo), while packets placed into sch->q via the reorder path (__qdisc_enqueue_head) are silently excluded from that count, allowing total queue occupancy to grow beyond sch->limit without bound. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) places this in the lowest exploitation-probability tier; however, the vulnerability affects a wide range of active stable kernel branches and patched versions are available.
Reference count exhaustion in the Linux kernel's netfilter nft_ct subsystem allows a local low-privileged user to trigger a denial-of-service condition by repeatedly invoking nftables rules that use the ct expect object type. The function nft_ct_expect_obj_eval() allocates a connection tracking expectation and may call nf_ct_expect_related(), but never releases the local reference via nf_ct_expect_put() before returning, causing an unbounded accumulation of unreleased kernel memory references. No public exploit exists and EPSS probability stands at 0.18% (8th percentile), with no CISA KEV listing - consistent with a low real-world exploitation risk despite the High availability impact assigned by CVSS.
Out-of-bounds read in the Linux kernel's ALSA USB MIDI subsystem (`snd_usbmidi_get_ms_info()`) allows a local attacker to trigger a kernel panic and denial of service by presenting a crafted USB MIDI device with a malformed endpoint descriptor `bLength` field. The descriptor walker fails to verify that `bLength` stays within the remaining endpoint-extra scan bytes, leaving flexible-array reads of `baAssocJackID[]` potentially unbounded by the actual buffer limit. No public exploit is identified at time of analysis, and EPSS places exploitation probability at 0.18% (8th percentile), consistent with the local attack vector.
Arbitrary file write in TortoiseGit's TortoiseGitBlame component is triggered when a user opens a malicious git repository and invokes blame history on a file whose historical filenames contain argument injection payloads. The injected arguments are passed unsanitized to underlying git subprocess calls, allowing an attacker-controlled repository to write files to arbitrary paths on the victim's Windows filesystem. No public exploit has been identified at time of analysis, and no KEV listing exists; however, a fix commit is available upstream.
Kernel panic via RCU locking imbalance in the DRBD subsystem's drbd_adm_dump_devices() function affects Linux kernel versions from the introduction of commit a55bbd375d18 through multiple stable branches. A locally authenticated low-privilege user who can invoke DRBD administrative operations may trigger a kernel crash by exploiting the unbalanced rcu_read_unlock() call - called without a preceding rcu_read_lock() - leading to a denial-of-service via kernel instability. No public exploit exists and EPSS probability is 0.18% (8th percentile), indicating very low real-world exploitation activity.
Write operation hang in the Linux kernel dm-cache subsystem's passthrough mode allows a local user with low privileges to stall I/O indefinitely on affected block devices. The defect lies in `invalidate_remove()`, which configures a remapped bio for submission to the cache origin but discards it without dispatching, leaving write operations permanently pending. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and a strictly local attack vector place this firmly in the operational-bug category rather than an active threat.
Instability and system crash vulnerability in the Linux kernel's Qualcomm DRM/MSM Display Processing Unit (DPU) driver allows a local low-privileged attacker to trigger a voltage-clock mismatch that causes the MMCX power rail to fall to MIN_SVS while the DPU core clock remains at its maximum frequency. This race condition between power management and clock control during runtime suspend/resume can leave the hardware in an unsustainable electrical state, leading to display subsystem failure or kernel panic. No public exploit identified at time of analysis; EPSS of 0.18% reflects the hardware-specific, local-only nature of this flaw.
Null pointer dereference in the Linux kernel's BPF sockmap subsystem allows a local low-privileged user to crash the system via a race condition between AF_UNIX socket connection and sockmap proto update. The flaw exists because unix_stream_connect() sets sk_state to TCP_ESTABLISHED before assigning the peer pointer, creating a window where unix_stream_bpf_update_proto() dereferences unix_peer(sk) while it is still NULL. No public exploit exists and EPSS sits at the 8th percentile; this is not in CISA KEV, and the narrow race window constrains practical exploitation.
Integer overflow in the Linux kernel's AF_ALG socket interface (crypto/af_alg.c) lets a local user supply an oversized AEAD associated-data length that wraps during TX buffer size arithmetic, corrupting size checks; the fix caps AD length to 0x80000000. Carrying CVSS 7.0 (AV:L/AC:H/PR:L), it affects any kernel exposing the algif AEAD interface and threatens confidentiality, integrity, and availability through resulting memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), consistent with a local-only, high-complexity issue.