Clock and pinctrl state inconsistency in the Linux kernel's i2c-imx driver causes a system crash on NXP i.MX SoC platforms when runtime power management suspend fails mid-sequence. Specifically, if pinctrl_pm_select_sleep_state() returns an error after the I2C peripheral clock has already been disabled, the kernel leaves the clock off while aborting the suspend - any subsequent hardware access to the I2C controller then triggers a kernel panic, resulting in full system denial of service. No public exploit code exists and EPSS of 0.15% confirms negligible exploitation probability; this is a maintenance-priority patch for embedded Linux maintainers on i.MX hardware, not an enterprise emergency.
NULL pointer dereference in the Linux kernel's Airoha QDMA network driver crashes the kernel when a misconfigured Device Tree Source (DTS) causes `of_reserved_mem_lookup()` to return NULL without a guard check. Systems running the `net/airoha` driver with a DTS referencing a non-existent or removed `memory-region` node in the reserved memory table trigger a kernel panic during driver initialization at `airoha_qdma_init_hfwd_queues()`. The impact is exclusively a local denial-of-service (system crash); no confidentiality or integrity compromise is possible. No public exploit exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with the highly specific hardware and configuration prerequisites.
Incorrect guard ordering in the Linux kernel's mincore subsystem causes spurious kernel WARN events and false non-resident page reporting on kernels compiled without CONFIG_SWAP support. Affected are Linux 6.18.x (before 6.18.36) and 7.x (before 7.0.13/7.1) builds where CONFIG_SWAP is disabled but CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled - a configuration typical of embedded or specialized deployments. With EPSS at 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to niche build environments.
Division-by-zero in MPC-BE's CStreamSwitcherOutputPin::DecideBufferSize crashes the media player when a victim opens a specially crafted MP4 file, resulting in a Denial of Service. Affected builds are those compiled before commit 4341cb3 from the Aleksoid1978 MPC-BE GitHub repository. No public exploit is confirmed as actively exploited (no CISA KEV listing), but SSVC indicates proof-of-concept code exists; EPSS at 0.15% (5th percentile) reflects very low real-world exploitation probability, and impact is strictly limited to application availability.
Core dump handling in the Linux kernel's RISC-V ptrace subsystem emits a kernel warning and disrupts crash reporting due to REGSET_CFI missing USER_REGSET_NOTE_TYPE. Affected kernels (7.0 through pre-patch 7.1 on RISC-V) trigger the warning at fs/binfmt_elf.c:1771 whenever a process core dumps with CFI register state present. Any low-privileged local user on a RISC-V host can trigger this condition; no public exploit exists and EPSS sits at 0.14%, indicating no practical threat beyond the operational disruption of broken core dumps.
NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.
NULL pointer dereference in the Linux kernel's pinctrl mcp23s08 driver (MCP23S08 SPI GPIO expander) crashes the kernel during device probe on systems where mcp->dev and mcp->addr are accessed before initialization. Affected kernels include Linux 6.19 through the fix commits in stable series 7.0.13 and 7.1. A local attacker with low privileges on a system hosting MCP23S08 SPI hardware can trigger a kernel panic (denial of service) by causing driver probe to execute. No active exploitation confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific nature of the exposure.
Arbitrary HDF5 file read in Keras up to 3.13.2 enables information disclosure when a victim loads a crafted model file, representing an incomplete patch for the prior CVE-2026-1669. The flaw lies in two specific code paths - `H5IOStore._verify_dataset()` and `file_editor.py` - which omit the `dataset.is_virtual` check, allowing a malicious HDF5 Virtual Dataset (VDS) to silently redirect reads to attacker-specified paths on the local filesystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the attack surface is realistic in ML supply chain and model-sharing contexts.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Use-after-free in ImageMagick's 8BIM profile parser crashes the process when a specially crafted image is identified, affecting all releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch). The vulnerability is triggered by a specific format string embedded in the 8BIM metadata profile, causing memory corruption that results in a denial-of-service condition. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the intelligence feed.
Stack exhaustion via multiple unbounded alloca() calls in the PulseAudio protocol server on Red Hat Enterprise Linux 8, 9, and 10 allows a local low-privileged attacker to crash the audio daemon, resulting in denial of service. The root cause (CWE-770) is the absence of size validation on attacker-controlled protocol parameters before passing them to alloca(), a stack-based allocator with no OS-enforced ceiling. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis.
Policy bypass in ImageMagick's `-concatenate` operation allows local users to read from and write to filesystem paths that the configured security policy explicitly prohibits. All versions prior to 7.1.2-26 are affected. An attacker or unprivileged local user can invoke ImageMagick with `-concatenate` to circumvent path-based access controls defined in ImageMagick's policy.xml, effectively nullifying a primary hardening control relied upon in restricted or multi-tenant deployments. No public exploit code or CISA KEV listing is identified at time of analysis.
SurrealDB's automatic graph edge cleanup mechanism bypasses edge-table permission clauses, allowing authenticated low-privilege users to delete edge records and observe hidden edge contents they are not authorized to access. When a node is deleted, the `Document::purge_edges` routine fires with permissions explicitly disabled (`opt.clone().with_perms(false)`), meaning the edge table's `PERMISSIONS FOR delete` and `PERMISSIONS FOR select` clauses are never consulted. This is a confirmed authorization bypass (CWE-285) fixed in version 3.1.0; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Heap buffer overflow in UltraVNC Repeater through 1.8.2.2 stems from an integer overflow in the HTTP request logging function win_log(), where a malloc size calculation wraps around on 32-bit builds when processing oversized URIs, producing an undersized heap allocation followed by an unchecked strcpy. Remote unauthenticated attackers can trigger this path by sending a maximally-sized URI to the repeater HTTP port, with practical impact bounded by the 153,600-byte HTTP receive buffer and currently assessed at availability disruption rather than reliable code execution. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Cross-site scripting in Silverstripe Framework's 'Insert media from web' CMS feature allows a remote unauthenticated attacker to inject malicious JavaScript by supplying a specially crafted embed URL that a CMS editor then inserts into content. All Silverstripe Framework installations prior to version 6.2.2 are affected. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and network accessibility make it a credible risk for any deployment where CMS editors process externally sourced media.
Authentication API endpoints and Special pages in MediaWiki expose low-severity confidentiality and integrity weaknesses exploitable by unauthenticated remote attackers who can induce victim user interaction. Five files spanning account-linking and credential management operations - ApiChangeAuthenticationData, ApiLinkAccount, ApiRemoveAuthenticationData, SpecialLinkAccounts, and SpecialUnlinkAccounts - are affected across all MediaWiki releases prior to the fixed branches 1.43.9, 1.44.6, 1.45.4, and the forthcoming 1.46.0. No public exploit code and no active exploitation have been identified at time of analysis; real-world risk is constrained by the user-interaction prerequisite and the limited impact scope.
Memory exhaustion denial-of-service in Mailpit <= v1.30.0 allows unauthenticated remote attackers to consume excessive memory via unbounded JSON body on several API endpoints. An incomplete fix for a previous DoS leaves four sibling endpoints without size limits, enabling amplification of up to 28x RSS per request. Publicly available exploit code exists; EPSS indicates low exploitation probability (0.51%), but the vulnerability is easily exploited against default deployments.
Stored XSS in DivvyDrive versions v.4.8.2.23 through before v.4.8.3.1 enables an authenticated low-privilege user to inject persistent malicious scripts into application content that execute in the browsers of other users who subsequently view the affected page. The CVSS scope change indicator (S:C) reflects that the injected payload breaks out of the application's security boundary into the victim's browser context, enabling session hijacking or unauthorized actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the vulnerability was disclosed by TR-CERT with a corresponding patch available.
Cross-site scripting in MediaWiki's JavaScript API client layer (resources/src/mediawiki.Api/index.js) allows network-accessible, unauthenticated attackers to inject malicious scripts that execute in a victim's browser upon user interaction. All MediaWiki deployments prior to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected, covering a broad range of wiki installations worldwide. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of authentication requirement elevate concern for public-facing deployments.
Sensitive information exposure in MediaWiki's InfoAction.php allows unauthenticated remote actors to obtain restricted page metadata through the 'Info' action endpoint. All MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected across all deployment configurations. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and lack of authentication requirements make opportunistic discovery straightforward for any actor who can reach the wiki.
Cross-site scripting in the Wikimedia Foundation SyntaxHighlight_GeSHi MediaWiki extension allows authenticated users to inject unsanitized input via the syntax highlighting interface, with malicious script executing in victims' browsers upon page view. The flaw originates in includes/SyntaxHighlight.php and affects all versions prior to branch-specific fixes at 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 5.3 (Medium) reflects limited confidentiality impact scoped to the vulnerable system.
Sensitive abuse filter configuration data in Wikimedia Foundation's AbuseFilter MediaWiki extension is exposed to authenticated low-privilege users via the QueryAbuseFilters API endpoint (includes/Api/QueryAbuseFilters.php). Authenticated wiki users on affected installations (all versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9) can retrieve private or restricted filter rule details they should not be authorized to access. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept exploit is known at time of analysis, but the moderate CVSS 4.0 score of 5.3 reflects real risk to wikis relying on confidential filter logic for abuse prevention.
CRLF injection in WPForms plugin for WordPress (all versions up to and including 1.10.2) enables unauthenticated attackers to silently blind-copy all site notification emails to an attacker-controlled address. The flaw originates from `get_reply_to_address()` applying the wrong smart-tag expansion context, allowing CR/LF characters preserved by `wpforms_sanitize_textarea_field()` to pass unstripped into raw mail header concatenation. Exploitation requires a specific non-default site configuration but demands no authentication or elevated interaction beyond a standard form submission; no public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in GitHub Enterprise Server allows an attacker who has obtained a victim's user-to-server token - issued by a GitHub App installation - to perform write operations on any public repository, regardless of whether that installation was explicitly granted access to the target repository. Affected installations span all GHES versions prior to 3.22, with fixes backported to six supported release trains. The CVSS 4.0 score is 5.3 (medium); no public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthorized cross-volume asset deletion in Craft CMS versions 4.0.0-RC1 through 4.17.13 and 5.0.0-RC1 through 5.9.20 allows any authenticated user with file-replace permission in one volume to permanently delete assets from other volumes where they hold no delete permission. The flaw stems from a PHP ternary operator short-circuit in AssetsController::actionReplaceFile() that bypasses source-volume authorization when both assetId and sourceAssetId parameters are supplied together. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; however, the low complexity of the attack logic and the CMS's sequential asset IDs make exploitation straightforward for any low-privilege authenticated insider or compromised account.
Unrestricted file upload in MyComplianceOffice MCO version 25.3.3.1 allows an authenticated low-privileged attacker to upload files of arbitrary types by bypassing client-side-only validation controls. The CVSS 4.0 vector confirms network-accessible exploitation with low complexity, requiring only a valid low-privileged account and a web proxy to intercept and modify upload requests. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Insecure Direct Object Reference in MyComplianceOffice MCO version 25.3.3.1 allows authenticated users to retrieve trading document PDFs belonging to other customers by manipulating a user-supplied document identifier at the fetchPdfStatement API endpoint. The application performs no ownership or authorization check beyond confirming the user is logged in, enabling horizontal privilege escalation across customer accounts. No public exploit code or active exploitation has been identified at time of analysis, but predictable document ID patterns make automated enumeration feasible, raising real-world risk in financial compliance environments where trading statements contain sensitive regulatory and transactional data.
Broken access control in the WofficeIO Woffice WordPress theme (all versions before 5.4.33) permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, achieving low-impact unauthorized write actions without credentials or user interaction. Discovered and disclosed by Patchstack, the flaw stems from CWE-862 (Missing Authorization), where the theme fails to enforce proper capability checks on specific endpoints. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated and low-complexity attack vector broadens the exposure surface beyond what the medium CVSS score alone conveys.
Stack overflow in ImageMagick's MVG decoder prior to versions 6.9.13-51 and 7.1.2-26 allows remote unauthenticated attackers to crash image-processing services by submitting a crafted MVG image file. The root cause is a missing depth check in the MVG decoder (CWE-400), enabling unbounded recursion that exhausts stack memory. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the zero-friction attack surface - any application accepting image uploads with unpatched ImageMagick - makes patching a practical priority.
MCO's compliance management platform exposes administrator ACL tree structures to any authenticated low-privileged user via a missing authorization check on the `/customer/servlet/mco/webapi/admin-view-hierarchy/get-acl-tree-structure` web API endpoint. Confirmed by CERT-PL in version 25.3.3.1, the flaw allows low-privileged users to retrieve permission hierarchies and internal configuration details intended only for administrators. No active exploitation has been identified, no public exploit code exists, and vendor contact attempts were unsuccessful, leaving the patch timeline and full version impact unresolved.
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
Integer overflow in Chrome's ANGLE graphics abstraction layer on Windows enables a remote attacker, who has already compromised the renderer process, to read potentially sensitive data from process memory. The attack requires a user to visit a crafted HTML page, making this a second-stage component in a multi-step exploit chain rather than a standalone critical flaw. No public exploit code has been identified and CISA has not added this to the KEV catalog; Chrome 150.0.7871.46 resolves the issue.
Heap memory disclosure in ImageMagick's MNG decoder affects all versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch), allowing remote unauthenticated attackers to obtain partial heap contents by submitting a crafted MNG image file and retrieving the processed output. The root cause (CWE-908) is that pixel buffers are not fully initialized before output is written, leaving residual in-process heap data embedded in the resulting image. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication, network-accessible attack vector makes this a meaningful risk for any image-processing pipeline that accepts untrusted MNG input.
Out-of-bounds write in MediaTek modem firmware allows a network-adjacent attacker controlling a rogue cellular base station to remotely crash affected User Equipment (UE), resulting in denial of service. Thirty-three distinct MediaTek chipsets - spanning flagship mobile SoCs (MT6991, MT6989, MT6985) to tablet and IoT chipsets (MT8795T, MT8893) - contain the vulnerable modem component identified under Patch IDs MOLY01267281 and MOLY01318201. No public exploit code has been identified at time of analysis, and the attack is non-trivial due to the requirement for attacker-controlled cellular infrastructure, but the sheer deployment scale of affected chipsets across Android devices makes the aggregate exposure significant.
Remote denial of service in the MediaTek Modem firmware component affects approximately 60 chipset models via a null pointer dereference triggered when a target device connects to a rogue cellular base station. An attacker controlling a fake eNodeB or gNodeB can transmit crafted modem protocol messages that cause improper input validation to fail, crashing the modem and stripping affected devices of cellular connectivity. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation status as none, indicating this remains a theoretical but technically feasible threat for well-resourced actors.
Information disclosure in MediaTek modem firmware across 67+ chipset models enables a network-adjacent attacker operating a rogue cellular base station to extract sensitive data from a victim's User Equipment (UE) without any privileges or user interaction. The root cause is improper input validation (CWE-288) in the modem baseband stack, allowing a fake cell tower to elicit confidential data from connected devices. No active exploitation has been confirmed by CISA KEV, and SSVC assessment rates exploitation as 'none' at time of analysis, though the architecture of the attack closely resembles IMSI-catcher and stingray-type tradecraft used in targeted surveillance operations.
Remote denial-of-service in MediaTek modem firmware across 80+ chipset families allows an attacker operating a rogue cellular base station to crash affected devices by sending malformed input the modem fails to validate. The vulnerability (CWE-288) requires no privileges on the target device and no user interaction - a device that autonomously connects to the attacker's false base station is sufficient. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none, though the widespread chipset deployment across Android handsets and IoT hardware makes the affected attack surface extremely broad.
Incorrect Authorization (CWE-863) in Elastic Defend exposes response action data to low-privileged authenticated users who should not have access to it. The flaw, classified under CAPEC-1, arises because access controls on specific functionality are not properly enforced, allowing a user with minimal privileges to read security response action data belonging to other users or roles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the High confidentiality impact (CVSS C:H) means sensitive endpoint response data - such as isolation actions, process kills, or file retrieval outputs - could be disclosed.
Memory exhaustion denial-of-service in Mozilla Thunderbird's LDAP address-book autocomplete client allows a malicious or compromised LDAP server to crash the application by returning unbounded data payloads. Affected users are those explicitly configured to query an LDAP directory server for autocomplete, making this a targeted rather than opportunistic attack. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) alongside a CISA SSVC exploitation rating of 'none' confirms very low real-world urgency.
Missing authorization controls in the ApplyOnline WordPress plugin (versions through 2.6.7.6) by WP Reloaded allow unauthenticated remote attackers to perform unauthorized write-level actions by exploiting incorrectly configured access control security levels. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no user interaction against any network-accessible WordPress installation running this plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and zero-auth requirement make this straightforward to abuse.
Unauthenticated remote attackers can bypass access controls in the Webba Booking WordPress plugin (all versions through 6.4.13) due to missing server-side authorization checks on one or more booking-related endpoints, enabling unauthorized integrity-affecting actions such as creating, modifying, or canceling bookings. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-friction exploitation requiring no credentials or user interaction against any internet-facing WordPress site running the affected plugin. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Path traversal and path disclosure in MyComplianceOffice MCO's file handling functionality expose authenticated high-privilege users' ability to write files to arbitrary server locations and leak absolute server paths through error messages. Confirmed in version 25.3.3.1 via CERT-PL research, with other versions potentially affected given unsuccessful vendor contact. No public exploit code or active exploitation identified at time of analysis; the high privilege prerequisite (PR:H) substantially constrains real-world attack surface.
Information disclosure in MediaWiki's ApiUserrights.php exposes sensitive user rights data to authenticated actors who should not have access to it. All MediaWiki installations running versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected. The CVSS 4.0 score of 5.1 with low confidentiality impact (VC:L) reflects a bounded but real data leakage risk; no public exploit identified at time of analysis.
Helm credential exfiltration in Rancher Fleet allows an attacker with git push access to a Fleet-monitored repository to redirect configured Helm BasicAuth credentials to an attacker-controlled server by manipulating the `helm.repo` field inside a committed `fleet.yaml`. Affected deployments are those where `GitRepo` resources carry `helmSecretName` or `helmSecretNameForPaths` but lack a `helmRepoURLRegex` allowlist - the default state for most pre-patch installations across the v0.12, v0.13, v0.14, and v0.15 release lines. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog, but the low attack complexity and clear credential-theft path make this a meaningful supply-chain risk for organizations relying on private Helm repositories within Rancher-managed multi-cluster environments.
Elasticsearch's machine learning API contains an unbounded resource allocation flaw that allows an authenticated user with elevated privileges to crash an affected node by submitting a specially crafted ML request over the network. The absence of throttling or quota enforcement on ML request memory consumption (CWE-770) means the node's JVM heap can be exhausted, rendering it unavailable without any confidentiality or integrity exposure. No public exploit code has been identified at the time of analysis, and this vulnerability does not appear in the CISA KEV catalog.
Prototype pollution in @hey-api/openapi-ts affects all versions through 0.97.2, allowing remote unauthenticated attackers to substitute the prototype chain of the returned params slot object by passing a crafted key such as '$query___proto__' through any application that forwards user-supplied parameters to a generated SDK method. The flaw resides in a runtime template (dist/clients/core/params.ts) that is copied verbatim into every generated SDK, meaning every downstream npm package regenerated from this tool carries the vulnerable code - confirmed affected consumers include @opencode-ai/sdk and @trigger.dev/sdk. A functional proof-of-concept is publicly available; exploitation is not confirmed as actively exploited and is absent from CISA KEV.
Stored XSS in MyComplianceOffice MCO version 25.3.3.1 allows a privileged attacker with logo-upload rights to plant malicious JavaScript inside a crafted SVG file that executes in any user's browser when the application logo is rendered. Reported by CERT-PL, vendor contact was unsuccessful, leaving no official patch or advisory in place. No public exploit code has been identified at time of analysis, though the SVG-based XSS technique is well-documented and trivially replicable against unpatched instances.
Race condition in the Linux kernel signal subsystem allows a local low-privileged user to trigger a kernel warning and potential system instability by exploiting a timing window between SIGSTOP delivery and a concurrent execve() call in a multi-threaded process. The calling thread in zap_other_threads() retains stale JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME flags after the thread group is torn down, causing task_participate_group_stop() to decrement an already-zero group_stop_count and fire a kernel WARN_ON. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with a difficult-to-reliably-trigger race.
Uncontrolled resource consumption in ImageMagick (all versions prior to 6.9.13-51 and 7.1.2-26) allows a denial-of-service condition by supplying invalid arguments to the connected-components processing option, which causes an infinite loop that exhausts CPU resources indefinitely. The vulnerability requires local access, user interaction, and high attack complexity, confining realistic risk to environments where untrusted input can influence ImageMagick invocations - such as automated image-processing pipelines or web applications that expose connected-components functionality. Vendor-released patches exist for both the 6.x and 7.x branches; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unbounded mount-time loop in FatFs prior to R0.16 allows physical attackers to cause a denial of service by presenting a crafted GPT disk image with an arbitrarily large GPTH_PtNum partition count field. The flaw is present only in builds where the FF_LBA64 = 1 compile-time flag is set, enabling 64-bit LBA and GPT scanning support. A public proof-of-concept is available from runZero; no confirmed active exploitation (CISA KEV) has been observed, and SSVC categorizes technical impact as partial, limited to availability.