Reflected cross-site scripting in GeoNetwork lets a remote attacker run arbitrary JavaScript in a victim's authenticated session by luring them to a crafted service URL. Because the not-found/unauthorized error page is an AngularJS application, attacker-controlled request content reflected into that page is evaluated as a client-side template expression (AngularJS sandbox escape) rather than shown as inert text. No public exploit is identified at time of analysis, and the flaw is not on CISA KEV.
Heap overflow in the Linux kernel's AMD GPU display driver (drm/amd/display) arises because dal_vector_reserve() computes its allocation size as "capacity * struct_size" in 32-bit arithmetic, which can silently wrap to a small value and cause krealloc() to return an undersized buffer. A local, low-privileged user with access to the DRM/amdgpu device can trigger out-of-bounds heap writes on subsequent vector appends, potentially corrupting kernel memory. There is no public exploit identified at time of analysis, and the EPSS score is low (0.19%, 9th percentile); the issue is fixed and rated CVSS 7.0 (High).