Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
HTML injection via Matrix and XMPP chat in Mozilla Thunderbird allows remote network-accessible attackers to inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI without any authentication. All Thunderbird versions prior to 152.0.1 and 140.12.1 ESR are affected. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), but SSVC flags the attack as automatable with partial technical impact, making it a realistic phishing and UI-deception vehicle for anyone reachable via federated Matrix or XMPP.
DOM-Based XSS in the Shortcodes and extra features for Phlox theme WordPress plugin (all versions through 2.17.16) permits a low-privileged authenticated attacker to inject malicious JavaScript that executes in victims' browsers via unsanitized shortcode input. Exploitation requires an attacker with at least contributor-level WordPress access and a privileged user to view the crafted page, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit identified at time of analysis; vulnerability was disclosed by Patchstack and is not listed in CISA KEV.
Stored Cross-Site Scripting in the Kali Forms WordPress plugin (versions up to and including 2.4.13) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'meta[kaliforms_field_components]' parameter. Any WordPress user who subsequently visits a page containing the injected form will execute the attacker's script in their browser, making session hijacking, credential theft, and admin account takeover realistic outcomes. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the low privilege bar (contributor) makes this a realistic risk on multi-author WordPress sites.
Stored Cross-Site Scripting in GiveWP versions up to and including 4.16.0 allows authenticated attackers with author-level WordPress access to inject persistent JavaScript payloads via the 'block_id' attribute of the 'givewp_campaign_comments' shortcode. The flaw originates in two code paths - CampaignCommentsShortcode::parseAttributes() and BlockRenderController::render() - where the blockId value is interpolated directly into a single-quoted HTML attribute without WordPress's esc_attr() sanitization function. Any visitor loading an injected page will have the malicious script execute in their browser context. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the WordPress Download Manager plugin (all versions through 3.3.60) allows authenticated contributors to persistently inject arbitrary JavaScript via the `no_data_msg` shortcode attribute, executing in any subsequent visitor's browser context. The vulnerability exploits a bypass in WordPress's `wp_kses_post` sanitization: the filter strips disallowed HTML tokens at save time but does not neutralize C-style escape sequences embedded in shortcode attribute values, which are silently reconstructed into raw `<script>` tags at render time. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the deliberate evasion technique elevates risk on multi-contributor WordPress deployments.
Stored Cross-Site Scripting in Tutor LMS (WordPress plugin by Themeum) versions through 3.9.13 allows authenticated attackers holding author-level or higher WordPress roles to inject persistent malicious scripts via the Lesson Attachment Title field. The injected payload is stored in the WordPress database and executes in the browser of any user who subsequently accesses a course page rendering the attachment - achieving a scope change from the plugin's context into the victim's browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Wordfence disclosure includes direct source-code references to the vulnerable rendering path, lowering the barrier to exploitation.
Stored Cross-Site Scripting in FV Flowplayer Video Player (all WordPress plugin versions up to and including 7.5.51.7212) allows authenticated contributors to permanently inject arbitrary JavaScript via the unsanitized `align` attribute of the `[video_player]` shortcode. The payload persists in the WordPress database and executes in the browser of every user who subsequently visits any page containing the injected shortcode, enabling session hijacking, credential harvesting, or further site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the stored nature of this XSS amplifies real-world risk relative to reflected variants.
Stored Cross-Site Scripting in the LearnPress WordPress LMS plugin (versions up to and including 4.4.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the unescaped 'class_wrapper_form' shortcode attribute. The payload persists in the database and executes in the browser of any visitor - including administrators - who loads the affected page, enabling session hijacking, credential harvesting, or privilege escalation through forged admin actions. No CISA KEV listing or public exploit code has been identified at time of analysis, but the Wordfence advisory includes precise code-level references that substantially lower the bar for independent reproduction.
Stored cross-site scripting in JetWidgets For Elementor (versions up to and including 1.0.21) allows authenticated WordPress users holding author-level access or higher to plant persistent JavaScript payloads by supplying unsanitized input to the Animated Box widget's animation_effect parameter, which is written directly into an HTML class attribute without output escaping or server-side validation. Any site visitor who loads an injected page triggers the payload, enabling session hijacking, credential theft, or administrative account takeover through privilege escalation within the victim's browser context. No public exploit has been identified at time of analysis and the CVE does not appear in CISA KEV; however, a fix has been committed to the WordPress plugin repository.
Stored Cross-Site Scripting in the Event Organiser WordPress plugin (all versions through 3.12.9) allows an authenticated attacker with Contributor-level access or higher to inject arbitrary JavaScript via the unescaped 'no_events' parameter of the 'eo_events' shortcode. The payload persists server-side and executes in any visitor's browser when they load a page containing the injected shortcode with no matching events. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the low authentication bar (Contributor) makes this a meaningful risk on multi-author WordPress sites.
Local privilege escalation in Cato Client on macOS allows an authenticated low-privileged user to gain root by chaining two flaws in the PrivilegedHelperTool XPC service: improper certificate validation (CWE-295) that accepts self-signed certificates to bypass XPC caller verification, and a TOCTOU race condition exploitable via symlink swap during package installation. All Cato Client (SDP Client) versions prior to 5.13.1 on macOS are affected. A proof-of-concept exists per the CVSS 4.0 supplemental metric E:P, and the AU:Y (Automatable) tag indicates the exploit chain can be scripted - elevating practical urgency despite the absence of a CISA KEV listing.
Stored cross-site scripting in DivvyDrive (versions 4.8.2.23 through before 4.8.3.1) allows authenticated low-privilege attackers to inject persistent malicious scripts that execute in the browsers of other users who view affected pages. The CVSS scope change (S:C) reflects that injected scripts operate outside the application's security boundary, enabling session hijacking or credential theft against higher-privileged victims such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the low attack complexity and cross-scope impact make this a meaningful lateral escalation risk within DivvyDrive deployments.
Stored Cross-Site Scripting in WP Photo Album Plus (WordPress plugin, all versions through 9.1.13.005) allows contributor-level authenticated attackers to inject persistent JavaScript payloads via the unsanitized 'subtext' parameter of the [photo] shortcode. The CVSS scope change (S:C) is the critical amplifier: a low-privileged contributor can embed malicious shortcodes in posts submitted for editorial review, causing the stored payload to execute in administrator browser sessions when the content is previewed - enabling session hijacking and potential full site takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and common WordPress contributor registration practices make this a realistic threat on affected installations.
Remote denial of service in pion/dtls (Go's DTLS implementation) versions prior to 3.1.4 allows an unauthenticated network attacker to crash any application built on this library by sending a crafted ECDHE_PSK ServerKeyExchange message during the DTLS handshake. The CWE-125 out-of-bounds read triggers a Go runtime panic, immediately terminating the host process. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch exists in version 3.1.4.
Prototype Pollution in Jodit Editor (versions prior to 4.12.18) allows network-reachable attackers to mutate Object.prototype by supplying crafted configuration payloads to Jodit.configure(), exploiting unfiltered merging in the internal ConfigMerge and ConfigProto helpers. Specifically, keys such as __proto__ or constructor nested inside legitimate option namespaces like controls can propagate to the global JavaScript prototype chain, corrupting runtime behavior for all JavaScript executing in the same environment. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV; however, exploitation is contingent on the host application forwarding user-controlled input into Jodit.configure(), a pattern common in configurable WYSIWYG deployments.
Account denial-of-service in MyComplianceOffice MCO 25.3.3.1 enables a remote attacker to permanently lock a targeted user out of their account by repeatedly triggering password resets. MCO's reset mechanism invalidates all previously set passwords and temporary credentials on every reset cycle, and imposes no rate limit on how frequently resets can be initiated - so once an attacker supplies the victim's email and a valid security question answer, they can sustain the lockout indefinitely. No public exploit has been identified at time of analysis, and active exploitation is not confirmed, but the attack is conceptually simple and requires no authentication beyond the security question hurdle.
Null pointer dereference in MPC-BE's MP4 parsing layer crashes the application when a crafted MP4 file is opened, resulting in a Denial of Service. The defect resides in AP4_TkhdAtom::GetTrackId() - a function inherited from the Bento4 media library used internally by MPC-BE - and is fixed in commit 4341cb3. No active exploitation is recorded (EPSS 0.15%, 5th percentile; not in CISA KEV), and SSVC assesses technical impact as only partial with no automatable exploitation path.
Reflected Cross-Site Scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress (all versions through 1.8.12) allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by tricking them into clicking a crafted URL. The vulnerable `layoutstyle` parameter is insufficiently sanitized before being rendered in the roomslist view template, enabling session hijacking, credential theft, or malicious redirects against authenticated site users such as hotel administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, and a patched version (1.8.13) is available per plugin Trac references.
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleaved read/write operations on fragmented volumes. The condition `fp->sect - sect < cc` in f_read() and f_write() uses unsigned arithmetic - when `sect` exceeds `fp->sect`, the subtraction wraps to a large unsigned value, bypassing the required cache flush and leaving stale or inconsistent data on disk. A proof-of-concept exists per SSVC assessment, and technical impact is rated Total, though physical access is required per the CVSS vector. No confirmed active exploitation (not in CISA KEV).
Sandbox allow-list bypass in the Twig PHP templating engine lets attacker-supplied filters, tags, and functions run unchecked when a shared Environment mixes sandboxed and non-sandboxed renders. The filter/tag/function SecurityPolicy check was computed once in the Template constructor and cached in $loadedTemplates, so any later sandbox state change or a pre-warmed template left a stale (typically empty) verdict, defeating the sandbox. Fixed in Twig 3.27.0; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored XSS in Craft CMS 5.0.0-RC1 through 5.9.22 allows an author-level control panel user to execute arbitrary JavaScript in the session of an admin or any privileged user with saveEntries permission on the same Structure section. The vulnerability arises from an HTML encode/decode mismatch: the server safely escapes an entry title into a data-title attribute, but jQuery's .data() method re-decodes the value before it is concatenated back into HTML without re-escaping, bypassing the initial sanitization. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the vendor shipped a fix in version 5.9.23.
Deserialization of untrusted data in MediaWiki's wiki import subsystem and logging infrastructure exposes installations to PHP object injection, with high integrity impact on affected systems. Specifically, the WikiImporter, WikiRevision, and LogEntryBase components process attacker-controlled serialized data without sufficient validation, allowing a high-privileged authenticated user to trigger unintended object instantiation or code execution paths. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; however, vendor-confirmed patches are available in releases 1.43.9, 1.44.6, 1.45.4, and 1.46.0.
Download-limit enforcement in goshs (Go Simple HTTP Server) v2.0.9 and earlier can be bypassed by racing concurrent HTTP requests against a limited-use share token, allowing a single token to be redeemed more times than the operator configured. The TOCTOU flaw in `ShareHandler` means every concurrent goroutine observes the same pre-increment `Downloaded` counter, each passes the limit check, and each is served the file - completely defeating one-shot or low-count share-link controls. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-j48m-h7xq-2xpj) with 5/5 consistent reproductions; no active exploitation is confirmed in CISA KEV.
Heap buffer overflow in ImageMagick's MVG decoder allows remote unauthenticated attackers to trigger an out-of-bounds write by supplying a specially crafted image file, resulting in denial of service. Affected are all ImageMagick deployments prior to versions 6.9.13-51 (legacy v6 branch) and 7.1.2-26 (current v7 branch). No public exploit code or active exploitation has been identified at time of analysis; however, the network-accessible vector and zero-privilege requirement make this relevant for any service that accepts and processes user-supplied images.
Cross-user attribute structure leakage in API Platform Core's JSON:API and HAL serializers exposes the schema layout of security-gated properties to lower-privileged users through improper cache reuse. Versions from 2.6.0 up to 4.1.29, 4.2.26, and 4.3.12 are affected across the core, hal, and json-api packages. The component structure computed for a higher-privileged user's request can be served from cache to a subsequent lower-privileged user's request, bypassing the per-request evaluation of #[ApiProperty(security: ...)] predicates. No public exploit identified at time of analysis; vendor-released patches are available.
Session identifier generation in CGI::Session::ID::md5 versions prior to 4.49 for Perl is cryptographically weak, enabling remote attackers with sufficient effort to predict valid session tokens and impersonate authenticated users. The generate_id method combines three deterministic or low-entropy sources - process ID, Unix epoch timestamp, and Perl's non-cryptographic rand() - before hashing with MD5, leaving the session ID space practically enumerable given approximate knowledge of server state. No public exploit has been identified at time of analysis; SSVC assigns Exploitation: none and EPSS places this at the 8th percentile, indicating low real-world exploitation probability despite the C:H confidentiality impact.
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Stored cross-site scripting in the ShortPixel Enable Media Replace WordPress plugin (all versions through 4.2.1) allows an authenticated attacker with high-level privileges to inject persistent malicious scripts via the media replacement workflow, which then execute in the browser context of any WordPress user who subsequently views the affected content. The scope change confirmed by the CVSS vector (S:C) means a compromised editor-level account could be leveraged to target administrator sessions, enabling privilege escalation within the WordPress admin interface. No public exploit code or CISA KEV listing has been identified at time of analysis; the Patchstack advisory is the primary confirmed intelligence source.
Weak password hash storage in BMC Control-M/Enterprise Manager exposes account credentials to offline recovery attacks if an attacker gains access to the credential database. Affected are unsupported versions 9.0.20.x and potentially earlier legacy releases, meaning no vendor patch will be issued for these branches - upgrade to a supported release is the only vendor-endorsed remediation. The CVSS 4.0 vector (AV:L/PR:H/AT:P) confirms exploitation requires local, high-privilege access and specific attack conditions, significantly constraining real-world risk; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Deadlock vulnerability in the Linux kernel's Qualcomm SLIMbus NGD controller driver (slimbus/qcom-ngd-ctrl) causes complete system availability loss through an ABBA lock-ordering inversion between tx_lock and ctrl->lock. Systems running affected kernel versions on Qualcomm SLIMbus-equipped hardware are vulnerable to kernel hangs when SSR/PDR (Subsystem Restart/Process Domain Restart) events race with ongoing DMA TX transactions. EPSS is 0.17% (7th percentile), no public exploit has been identified, and this vulnerability is not listed in CISA KEV.
Kernel crash in the Linux slimbus qcom-ngd-ctrl driver affects Qualcomm SoC-based systems from kernel 4.19 onward due to a race condition where SSR and PDR callbacks are registered before the NGD platform device is fully initialized. When the remoteproc subsystem starts concurrently with NGD driver probe - or is already running at PDR lookup registration time - callbacks fire on uninitialized kernel memory, producing a NULL pointer dereference in qcom_slim_ngd_ssr_pdr_notify() and crashing the kernel. No public exploit exists and EPSS is 0.17% (6th percentile); this vulnerability is not in CISA KEV.
Spurious WARN_ON in the Linux kernel's sched_ext cgroup migration path can trigger a kernel warning - and potentially a system panic when CONFIG_PANIC_ON_WARN is set - when systemd's user manager writes '+cpu +memory +pids' to its own subtree_control while a sched_ext BPF scheduler is loaded. The root cause is a mismatch between cgroup identity (used by scx_cgroup_can_attach) and CSS identity (used to drive migration), allowing scx_cgroup_move_task() to run against a task whose cgrp_moving_from was never initialized. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) confirms negligible exploitation interest.
NULL pointer dereference in the Linux kernel's DAMON LRU Sort subsystem crashes the kernel when damon_ctx allocation fails under memory pressure. Affected are Linux kernel versions through 6.18 and 7.0.x before 7.0.13, where damon_lru_sort_enabled_store() omits a NULL check before passing the allocation result to damon_commit_ctx(). A local attacker with low privileges can trigger a kernel panic, causing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.17% (6th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's DAMON_RECLAIM memory management subsystem crashes the kernel when a `damon_ctx` object allocation fails during initialization. Local users with low privileges can trigger this by enabling DAMON_RECLAIM via its sysfs interface while the system is under memory pressure, causing `damon_commit_ctx()` to dereference a NULL pointer and inducing a kernel panic. No active exploitation is identified; EPSS of 0.17% (6th percentile) and absence from CISA KEV confirm this remains a low-probability, theoretically triggerable denial-of-service condition.
Denial of service in the Linux kernel's debugobjects subsystem affects RT-enabled (PREEMPT_RT) kernel builds when fill_pool() is called while a task already has pi_blocked_on set. On real-time kernels, fill_pool() invokes rtlock_lock(), which triggers a kernel assertion failure because the priority inheritance chain cannot branch - a task can only be blocked on one lock simultaneously. Exploitation is local-only, requires low privilege, and is constrained to RT kernel configurations; no public exploit exists and EPSS is 0.17% (6th percentile). Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the technical description, which describes a kernel assertion crash - a denial-of-service condition.
Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.
NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.
NULL pointer dereference in the Linux kernel bonding subsystem crashes the kernel when a local user with CAP_NET_ADMIN invokes bond_do_ioctl() with a non-existent slave interface name. The slave_dbg() macro unconditionally dereferences slave_dev->name before the NULL guard is evaluated, producing a kernel oops and local denial-of-service. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), indicating very low observed exploitation activity; patches are available across all active stable branches.
NULL pointer dereference in the Linux kernel's ASoC wm_adsp driver crashes the kernel when firmware controls are removed without a prior NULL check on private control data. Systems running affected kernel versions (5.16 through multiple stable branches) with Wolfson/Cirrus Logic ADSP hardware are exposed to local denial-of-service via kernel panic. No active exploitation has been identified, EPSS sits at 0.16% (6th percentile), and patches have been backported to all active stable branches.
Dangling function pointer in the Linux kernel's netfilter connection tracking subsystem (nf_conntrack) causes a kernel oops when a NAT helper module is unloaded while live expectations referencing its text remain in the expectation table. Specifically, NAT helpers such as nf_nat_h323 store raw pointers to module code in exp->expectfn; nf_ct_helper_expectfn_unregister() unlinks the callback descriptor without purging matching expectations, so when the expected connection subsequently arrives, init_conntrack() dereferences freed module text and crashes the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with the local, high-privilege exploitation path required.
CVE-2026-53343 causes a deterministic boot-time kernel panic on ARMv5-class Linux systems (ARM926/VersatilePB) with KASAN VMAP stack instrumentation enabled. A word-sized `ldr` instruction introduced by commit 44e9a3bb76e5 accesses byte-granular KASAN shadow memory without guaranteed word alignment; ARMv5 strictly enforces aligned word loads and raises a data abort, crashing the kernel in __switch_to() before init is reached. No public exploit code exists and EPSS is 0.16% (6th percentile), consistent with the extremely narrow hardware and configuration footprint required.
Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.
Kernel panic in the Linux drm/virtio subsystem occurs during virtio-gpu driver removal or device unbinding when the kernel is compiled with KMS disabled, leaving DRM atomic and modesetting structures uninitialized. Teardown code unconditionally accesses these uninitialized structures (CWE-908), crashing the host kernel and causing a denial of service in virtualized guest environments. EPSS is 0.16% (5th percentile) and no public exploit or KEV listing exists, limiting practical risk to non-default kernel build configurations.
Memory leak in the Linux kernel KVM subsystem exposes x86 SEV-ES (Secure Encrypted Virtualization-Encrypted State) guest environments to resource exhaustion when userspace terminates a VM without calling KVM_RUN after a VM-Exit. KVM retains writable page mappings across exits to userspace for certain SEV-ES VM-Exits, and when vCPU destruction must release these mappings, the kernel incorrectly emits a WARN about dirtying memory without a running vCPU - masking the real defect and complicating the fix. No public exploit exists and EPSS is 0.16% (5th percentile), placing this firmly as a low-exploitation-probability availability defect; patches are confirmed across multiple stable kernel branches.
Infinite-loop hang in the Linux kernel's nvmem ONIE TLV layout driver causes a local denial-of-service when the EEPROM contains unknown or vendor-specific entry types. Affected kernels from the 6.4 series through multiple stable branches fail to advance the offset pointer when an unrecognized TLV type is encountered, leaving the parser stuck indefinitely. No public exploit or active exploitation (CISA KEV) has been identified; with an EPSS of 0.16% at the 5th percentile, real-world exploitation risk is very low and limited to systems with specific hardware configurations.
Denial of Service in Aleksoid1978 MPC-BE exploits an access violation in the BaseSplitterFile::Read function when parsing a crafted MP4 file, crashing the media player. Any user of MPC-BE prior to commit 4341cb3 who opens a malicious MP4 is affected, with no network exposure - the attack is entirely local and requires user interaction. EPSS is 0.15% (5th percentile), reflecting low widespread exploitation probability; SSVC flags a POC as existing, and no CISA KEV listing is present.
Missing pagetable destructor calls in the ARM64 memory management subsystem cause kernel instability and resource leaks during memory hot-remove operations. Since commit 5e8eb9aeeda3, ARM64 page-table allocation unconditionally invokes pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() teardown was never added to the hot-remove path (free_hotplug_pgtable_page()), leaving PGTY_table type flags set and potentially leaking PTL allocations. No public exploit has been identified and EPSS at 0.15% (5th percentile) reflects the narrow exploitation path, though availability impact on affected ARM64 systems is confirmed by kernel maintainers.