Denial of service in the Linux kernel MANA (Microsoft Azure Network Adapter) Ethernet driver allows the port reset recovery path to trigger a NULL pointer dereference and kernel crash. The flaw occurs when mana_per_port_queue_reset_work_handler() runs after a prior detach succeeded but a subsequent attach failed, leaving apc->tx_qp and apc->rxqs freed; a second unconditional mana_detach() then dereferences NULL during queue teardown. No public exploit has been identified, EPSS is low (0.20%, 10th percentile), and the CVSS 3.1 score is 7.5 driven purely by availability impact.
Kernel panic (denial of service) in the Linux kernel's mm/vmalloc subsystem occurs because __get_vm_area_node() calls BUG_ON(in_interrupt()), and in_interrupt() also returns true when bottom halves (softirqs) are merely disabled rather than in a genuine interrupt context. A legitimate network-bridge path (br_fdb_add_local under spin_lock_bh) reaches vmalloc while BH is disabled, tripping the BUG() and crashing the kernel. NVD scores this A:H (availability only) with no public exploit identified at time of analysis; EPSS is low at 0.19% (9th percentile) and it is not in CISA KEV.
Denial of service in the Linux kernel's IPv6 In-situ OAM (IOAM) processing path allows remote attackers to crash the system via a NULL pointer dereference in ipv6_hop_ioam(). The function dereferences the result of __in6_dev_get(skb->dev) to read cnf.ioam6_enabled without checking for NULL, so a packet carrying an IOAM Hop-by-Hop option that arrives while addrconf_ifdown() concurrently clears dev->ip6_ptr via RCU can trigger a kernel panic. EPSS is low (0.18%), no public exploit or CISA KEV entry exists, and the fix ships in multiple stable kernel releases; the availability-only impact (CVSS 7.5, A:H) reflects a crash rather than code execution or data exposure.
Denial of service in the Linux kernel's NFS server (nfsd) ACL handling allows remote clients to leak kernel memory by sending SETACL requests that fail decoding partway through. When nfsaclsvc_decode_setaclargs() (NFSv2 ACL) or nfs3svc_decode_setaclargs() (NFSv3 ACL) successfully decodes the NFS_ACL entry but then fails on the NFS_DFACL entry, the already-allocated posix_acl is orphaned for the server's lifetime because the wired pc_release handlers only performed fh_put() and svc_process() skips the proc function (where cleanup lived) on decode failure. There is no public exploit identified at time of analysis and this is not in CISA KEV; the impact is gradual memory exhaustion rather than code execution or data disclosure.
Improper error handling in the Linux kernel's pds_core driver (AMD Pensando Distributed Services Card core driver) causes pdsc_devcmd_wait() to return stale success from the completion register when firmware crashes or a device command times out, instead of propagating -ENXIO or -ETIMEDOUT. Because the error path is bypassed, the driver fails to queue health_work recovery, leaving the device in an inconsistent state and producing an availability (denial-of-service) condition. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 7th percentile), and the issue is not on the CISA KEV list.
Remote denial of service in the Linux kernel's NFSv4/pNFS flexfiles client allows a malicious or compromised NFS metadata server to crash any mounted client by returning a GETDEVICEINFO response containing a zero-length r_addr or r_netid opaque. The decoder nfs4_decode_mp_ds_addr() only checks for negative lengths, so a zero-length value leaves the buffer pointer NULL and the subsequent strrchr(NULL, '.') triggers a kernel NULL-pointer dereference and panic. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile), consistent with a targeted server-side trust attack rather than mass exploitation.
Remote denial of service in the Linux kernel's SMC-D (Shared Memory Communications over ISM) client allows a malicious peer to crash the system via a null-pointer dereference during SMC-Dv2 connection setup. When a client sends an SMC-Dv2-only proposal and no SMC-Dv1 device is selected, a peer that replies with an ACCEPT containing CHID value 0 matches the reserved empty slot 0 of the ism_dev[] array, causing a null-ptr-deref on ism_dev[0]->lgr_lock in smc_conn_create(). No public exploit identified at time of analysis; EPSS is low (0.17%) and it is not listed in CISA KEV, but the fix is upstream in the kernel stable tree.
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Denial of service in the Linux kernel SCSI core allows a device removal process to hang when SCSI devices in a partially-removed state (SDEV_CANCEL) retain requeued requests that are never kicked. Because scsi_run_host_queues() relied on shost_for_each_device()/scsi_device_get(), which skips devices not in a runnable state, requests queued during host error recovery stayed stuck after recovery cleared. The fix broadens scsi_run_host_queues() to run queues for every device except those in SDEV_DEL or where a reference cannot be acquired. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile).
Denial of service in the Linux kernel's net/handshake (TLS handshake) subsystem allows a CPU-local deadlock on hosts acting as NVMe-over-TCP (nvmet_tcp) targets with in-kernel TLS. The nvmet_tcp_state_change() socket callback runs in softirq/BH context and reaches handshake_req_cancel(), which took hn->hn_lock with a plain spin_lock(); if a process-context thread on the same CPU already holds hn_lock when the softirq fires, the lock attempt deadlocks and hangs the CPU. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not on CISA KEV, so this is a stability/availability hardening fix rather than an actively exploited threat.
Memory exhaustion in the Linux kernel NFS server (nfsd) arises from a leak of a pre-allocated openowner structure in find_or_alloc_open_stateowner() when handling NFSv4.0 OPEN retries. When an unconfirmed owner is encountered, release_openowner() runs and control falls through the `if (oo)` cleanup guard, so a previously allocated `new` state-owner (slab object plus owner-name buffer) is silently overwritten and leaked. Remote clients that can reach the NFS service can, under a specific race, repeatedly trigger this leak to degrade or exhaust server memory. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; impact is availability-only (no data disclosure despite the mislabeled tag).
Remote denial-of-service in the Linux kernel NFSv4 flexfiles (pNFS) client allows a malicious or compromised NFS server to crash a mounting client via a malformed flexfiles layout that declares a zero filehandle-version count. The flaw stems from ff_layout_alloc_lseg() accepting fh_count == 0, which produces a ZERO_SIZE_PTR that is later dereferenced during layoutreturn encoding, triggering a null-pointer-deref and kernel panic. No public exploit identified at time of analysis, though the commit includes a QEMU/KASAN reproducer; CVSS 7.5 reflects availability-only impact (A:H) with no confidentiality or integrity effect.
Denial of service in the Linux kernel's Intel iwlwifi 'mld' Wi-Fi driver allows a firmware crash on Intel BE201/Wi-Fi 7 adapters to spiral into sustained resource exhaustion. Because iwl_mld_tx_from_txq() failed to check the in_hw_restart flag, TX frames kept being dequeued and pushed to dead firmware, each returning -EIO and being freed in a tight loop that burns CPU and churns skb allocations, causing slab fragmentation and memory pressure. There is no public exploit identified at time of analysis, EPSS risk is low (0.16%, 6th percentile), and the issue is not on CISA KEV; it is a reliability/availability bug that manifests under real load, not an attacker-driven remote exploit.
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Memory (kmalloc) leak in the Linux kernel's nvme-pci driver allows exhaustion of kernel memory over time on hosts using NVMe peer-to-peer (P2P) DMA. Because P2P memory is never unmapped, the driver has no need to track it, yet the dma_vec allocation used for tracking was never freed on I/O completion, leaking on every affected request. The flaw affects kernel 6.17 and is fixed in stable; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%).
Remote denial of service in the Linux kernel NFS server (nfsd) allows an NFSv4 client to leak kernel memory by sending CREATE requests that encode both a native NFSv4 ACL (FATTR4_WORD0_ACL) and POSIX default/access ACLs (FATTR4_WORD2) in the same fattr bitmap. A dead conflict-guard in nfsd4_create() fails to release the original posix_acl objects when nfsd4_acl_to_attr() overwrites them, leaking two posix_acl slab objects per request; repeated requests drive unbounded slab exhaustion. There is no public exploit identified at time of analysis, this is not on CISA KEV, and the impact is availability only (CVSS 7.5, A:H) despite the input tag labelling it 'Information Disclosure'.
Denial of service in the Linux kernel IPsec ESP stack (esp4/esp6) arises from a page fragment reference leak in esp_output_tail() when out-of-place crypto processing is used and the second skb_to_sgvec() call fails. On this error path the code jumps to error_free, freeing only the temporary scatterlist and the newly allocated page while leaking the original skb frag page references, allowing repeated failures to exhaust memory. No public exploit identified at time of analysis; EPSS is 0.14% (4th percentile), consistent with a low-likelihood, availability-only kernel bug fixed upstream in stable commits.
Cross-network-namespace information disclosure in the Linux kernel's XFRM/IPsec subsystem allows XFRM_MSG_MIGRATE (IKEv2 MOBIKE) notifications to leak between namespaces because xfrm_send_migrate() and pfkey_send_migrate() hardcode init_net for their multicast. An IKE daemon (e.g. strongSwan) listening on init_net's XFRMNLGRP_MIGRATE / pfkey BROADCAST_ALL groups receives migration events — including IPsec selectors and old/new endpoint addresses — that originated in other, isolated network namespaces. There is no public exploit identified at time of analysis and EPSS probability is low (0.21%); the fix is upstream in stable trees.
Information disclosure and buffer corruption in the Linux kernel's Qualcomm GENI serial driver (qcom_geni) allows leakage of stale TX buffer contents over the UART line when uart_flush_buffer() races a pending DMA-completion IRQ. On affected builds (6.3 through the fixed stable releases), a kfifo underflow drives kfifo->out past kfifo->in, so a subsequent start_tx_dma() transmits residual/stale buffer data rather than intended output. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and the flaw is local-only and timing-dependent.
Out-of-bounds slab read in the Linux kernel Bluetooth management (MGMT) subsystem lets a privileged local user leak adjacent kernel heap memory via the MGMT_OP_ADD_EXT_ADV_DATA command. The handler trusts attacker-supplied adv_data_len and scan_rsp_len fields without confirming those bytes actually fit within the received command payload, so a short command drives an out-of-bounds pointer into tlv_data_is_valid() and can copy past-the-buffer bytes into an advertising instance that the caller then reads back via MGMT_OP_GET_ADV_INSTANCE. Exploitation requires CAP_NET_ADMIN in the initial user namespace; no public exploit identified at time of analysis, and EPSS is low at 0.18%.
Improper handling of write streaming in the Linux kernel's netfs subsystem (network filesystem caching layer) allows a local, low-privileged user to trigger reads of stale, dirty-but-not-uptodate page cache data on network-backed filesystems. Introduced around kernel 6.8, the flaw stems from netfs caching dirty data in folios that are not marked uptodate; concurrent reads (e.g., via mmap or a separate read-only fd) could return incorrect or stale content, an information-disclosure/integrity concern (tagged 'Information Disclosure'). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is very low (0.11%, 2nd percentile), indicating negligible mass-exploitation likelihood.
Information disclosure (slab-out-of-bounds read) in the Linux kernel IPv6 datagram stack lets a local unprivileged attacker leak adjacent kernel slab memory and potentially crash the system. The flaw lives in ip6_datagram_recv_specific_ctl(), which trusts the on-wire extension-header length byte when building IPV6_HOPOPTS/DSTOPTS/RTHDR control messages; because nftables is reachable from an unprivileged user namespace, an attacker can rewrite that length after parse-time validation and force put_cmsg() to copy up to 2040 bytes from an 8-byte header. There is no public exploit and it is not in CISA KEV (EPSS 0.21%), so risk is credible but not yet demonstrated at scale.
Denial-of-service (and minor state corruption) in the Linux kernel's batman-adv (B.A.T.M.A.N. advanced mesh routing) bridge-loop-avoidance (BLA) subsystem allows an adjacent mesh participant to trigger a race condition in the bla.num_requests reference counter. Because the request_sent state check and the atomic increment/decrement of num_requests are not performed under a common lock, concurrent contexts (batadv_bla_send_request(), batadv_handle_announce(), backbone purge, and periodic work) can double-decrement the counter, corrupting BLA state and potentially crashing the kernel. There is no public exploit identified at time of analysis and EPSS risk is low (0.18%, 7th percentile); the fix serializes state and counter updates under a lock and adds a 'stopped' backbone_gw state.
Guest-to-host denial of service in the Linux kernel's x86 KVM ioeventfd datamatch handling allows a malicious VM to crash the hypervisor host via a reachable BUG_ON(). A guest that issues an unaligned store spanning a page boundary and hitting a datamatch-enabled ioeventfd at offset 0 of the second page triggers an alignment assertion in ioeventfd_write(), panicking the host kernel. The defect has existed since 2009 (kernel 2.6.32); EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis, though the commit message includes a working reproducer trace.
Local privilege/security-policy bypass in the Linux kernel's LSM (Linux Security Module) infrastructure arises because lsm_set_self_attr() failed to hold cred_guard_mutex before invoking the LSM hook, unlike the equivalent proc_pid_attr_write() path. On SELinux- or AppArmor-enforced systems, this allows a local low-privileged process to race the ptrace-based checks that gate a security-context transition, potentially performing a domain/type transition that policy would otherwise deny. EPSS is low (0.18%, 7th percentile) and there is no public exploit identified at time of analysis; the fix is already merged into stable kernels.
Slab out-of-bounds read in the Linux kernel IFB (Intermediate Functional Block) network driver exposes adjacent kernel memory and risks system instability when a local user with low privileges queries ethtool statistics on an asymmetrically configured IFB device. The root cause is a queue-count mismatch: ethtool stat callbacks size and walk per-queue data using real_num_rx_queues and real_num_tx_queues, while the underlying tx_private allocation is sized only to num_tx_queues - creating an over-read when RX queue count exceeds TX queue count. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), though patch availability across multiple stable branches confirms vendor acknowledgment and active remediation.
Kernel memory disclosure in the Linux kernel fbcon (framebuffer console) subsystem allows a local low-privileged attacker to trigger an out-of-bounds read by exploiting incomplete error-path rollback in fbcon_do_set_font(). When a font-set operation fails partway (e.g., vc_resize() allocation failure under memory pressure), the hi_font_mask and screen buffer are left desynchronized from the reverted 256-character font array, causing the VT subsystem to render character indices above 255 against undersized data. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available across multiple stable branches.
Out-of-bounds array read in the Linux kernel's IIO veml6075 UV light sensor driver allows a local low-privileged user reading the sensor's integration-time data to trigger access past the 5-element veml6075_it_ms lookup table. The VEML6075_CONF_IT register field can decode to index values 0-7, but only indices 0-4 are valid; a reserved value (5-7) drives the driver to read beyond the array. This is a hardening fix against faulty hardware, device misprogramming, or bus corruption rather than a directly attacker-controllable memory-corruption primitive; no public exploit identified at time of analysis and EPSS risk is low (0.17%, 6th percentile).
Denial of service in the Linux kernel's KVM/SVM AVIC (Advanced Virtual Interrupt Controller) IPI virtualization affects Hygon Family 18h hosts, where a hardware erratum (#1235, shared with AMD Zen1 Family 17h) lets the CPU read a stale IsRunning bit during ICR write emulation and skip the expected AVIC_IPI_FAILURE_TARGET_NOT_RUNNING VM-Exit. As a result KVM misses the wakeup of a blocking target vCPU, causing hung vCPUs and unbounded stalls in guest execution. EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis; the fix disables AVIC IPI virtualization on these CPUs so every non-self IPI is correctly emulated via VM-Exit.
Filesystem metadata corruption in the Linux kernel's F2FS (Flash-Friendly File System) driver arises from a race between f2fs_need_dentry_mark() reading nat_entry flags and the concurrent checkpoint path, so a node folio can be written with the DENT_BIT_SHIFT dentry-mark set even though the inode was already checkpointed. After a sudden power-off, fsck detects this inconsistent inode state. This is a local, low-privilege integrity/availability issue with no public exploit identified at time of analysis; EPSS is low at 0.17% and it is not listed in CISA KEV.
Local privilege escalation in the Linux kernel NTFS3 filesystem driver allows an unprivileged user with a file on a writable ntfs3 mount to set the reserved $LXUID, $LXGID, $LXMOD and $LXDEV WSL-permission xattrs directly via setxattr(), planting root ownership and the S_ISUID bit on their own file so it executes with euid 0. The empty-prefix xattr handler failed to block userspace writes to these internal metadata names, which ntfs_get_wsl_perm() reloads into i_uid/i_gid/i_mode on inode reload. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and the issue is not on CISA KEV, but the outcome is full local root.
Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).
Denial of service and an ACL enforcement flaw in the Linux kernel's NFSv4 server (nfsd) allow an authenticated NFS client to leak kernel memory and bypass RFC-mandated attribute validation. The nfsd4_create_file() path silently discards the return value of nfsd4_acl_to_attr(), so a CREATE supplying an unsupported/unconvertible ACL succeeds with NFS4_OK and no ACL applied, and a failing start_creating() (e.g. an over-length filename) leaks posix_acl allocations on every attempt. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; the fix has been merged upstream.
Sensitive API key credential exposure in django-tastypie up to 0.15.1 stems from the ApiKeyAuthentication class transmitting secrets via GET request query strings, making them visible in server access logs, proxy logs, browser history, and HTTP Referer headers. The flaw is a classic CWE-598 design error rooted in the authentication.py implementation and is remotely triggerable against any deployment using the ApiKeyAuthentication backend. No patch has been released; the project was notified via GitHub issue #1700 but has not yet responded. No public exploit code or CISA KEV listing exists at time of analysis, though the information disclosure risk is real in any environment where logs or network traffic are accessible to adversaries.
Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.
Code injection in zevorn rt-claw up to version 0.2.0 allows remote attackers to execute arbitrary code via the Telegram-to-AI Tool Execution Flow. The vulnerable function `tool_run_script_execute` in `claw/services/tools/script.c` fails to sanitize attacker-controlled input before passing it to script execution logic. A public proof-of-concept exploit has been released via GitHub issue #138, and the vendor has not yet responded to disclosure - no patch is available at time of analysis.
Path traversal in Croogo CMS up to version 4.0.7 allows remote authenticated attackers to escape the intended file management directory by supplying crafted path sequences to the Admin File Manager's FileManager::isEditable function in FileManager/src/Utility/FileManager.php. A public proof-of-concept exploit exists and has been disclosed via a researcher advisory, while the Croogo project has not responded to the responsible disclosure report and no patch has been released. The vulnerability carries a medium base score but the combination of a public PoC, unresponsive vendor, and no remediation path meaningfully elevates practical risk for any internet-exposed Croogo instance.
Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.
Out-of-bounds write in davenardella snap7 up to version 1.4.3 allows network-authenticated attackers to corrupt memory by supplying a crafted PDULength value during S7 protocol negotiation. The vulnerable function TSnap7Peer::NegotiatePDULength in src/core/s7_peer.cpp fails to enforce bounds on the PDULength argument, enabling writes beyond the allocated buffer boundary. A public proof-of-concept exploit is available on GitHub (issue #17), and the CVSS 4.0 E:P modifier confirms this - elevating practical risk above the medium base score, particularly in OT/ICS deployments where snap7 is commonly used to interface with Siemens S7 PLCs.
Authorization bypass in guohongze adminset 0.61 and earlier allows authenticated remote attackers to access or manipulate deployment resources belonging to other projects by substituting arbitrary project_id values in requests to the Delivery Deployment Endpoint (delivery/deli.py). This CWE-639 flaw - Authorization Bypass Through User-Controlled Key - is a classic IDOR pattern where the application accepts user-supplied object identifiers without verifying ownership. A public proof-of-concept exploit is available via GitHub issue #161, and the vendor has not responded to the responsible disclosure; no patch exists at time of analysis.
Authorization bypass in geex-arts django-jet up to version 1.0.8 allows remote low-privilege authenticated users to circumvent object-level access controls in the Dashboard Module's jet/dashboard/views.py via user-controlled key manipulation (CWE-639). An attacker with a valid Django session can substitute controlled identifiers in dashboard requests to access or modify resources belonging to other users beyond their intended authorization scope. A public proof-of-concept is available via GitHub issue #528, and no patch has been released - the project maintainer has not responded to the disclosure, leaving all users on affected versions permanently exposed.
Server-side request forgery in CordysCRM (1Panel-dev) up to version 1.4.1 allows authenticated remote attackers to coerce the application server into issuing outbound HTTP requests to arbitrary destinations by manipulating the `appSecret` parameter in the Third Party Edit Endpoint's `getSqlBotSrc` function. This can expose internal network services, cloud instance metadata endpoints, and other non-public resources to an attacker with only a low-privileged account. A public exploit has been disclosed (GitHub issue #2688), meaning exploitation requires minimal technical skill beyond valid credentials.
Server-side request forgery in CordysCRM (by 1Panel-dev) up to version 1.4.1 allows low-privileged remote attackers to manipulate the mkAddress parameter in the Third Party Endpoint's SSO token service, causing the application server to issue unauthorized HTTP requests to attacker-controlled destinations. The affected component is TokenService.java within the CRM's SSO integration layer, meaning exploitation could expose internal network topology or interact with internal services unreachable from the public internet. A public proof-of-concept exploit exists; the project vendor closed the issue report without acknowledging it as a valid security vulnerability, leaving no official remediation path confirmed.
Improper authorization in nextlevelbuilder GoClaw up to version 3.13.3-beta.3 allows low-privileged remote attackers to bypass access controls via manipulation of the ExecTool.Execute function in credentialed_exec.go. The CVSS 4.0 vector confirms network-accessible exploitation requiring only low-privilege credentials, with limited but confirmed confidentiality, integrity, and availability impact on the vulnerable system. A publicly available proof-of-concept exploit exists (tracked in GitHub issue #1215), though the overall CVSS 4.0 base score of 2.1 reflects constrained real-world impact.
Cross-site request forgery in the OAuth Handler component of geex-arts django-jet (versions up to 1.0.8) allows remote attackers to perform unauthorized actions on behalf of authenticated users. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms this is remotely exploitable with no privileges but requires a victim to interact with an attacker-controlled resource. A publicly available proof-of-concept exists (GitHub issue #528), and the vendor has not responded to the coordinated disclosure, meaning no patch is available at time of analysis.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.
Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.
Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.
NULL pointer dereference in the Linux kernel's batman-adv Bridge Loop Avoidance (BLA) subsystem crashes the kernel when a hard interface is concurrently decoupled from its mesh interface during ARP processing. Local users with low privileges on systems running batman-adv mesh networking can trigger a kernel panic, causing a full denial of service. No public exploit exists and EPSS stands at 0.21% (11th percentile), marking this as a low-urgency stability fix rather than an active threat.
Null pointer dereference in the Linux kernel's virtual console screen (vc_screen) subsystem causes a local denial-of-service via kernel panic. The flaw exists in vcs_write(), where a race condition between concurrent writes and virtual console deallocation leaves a stale vc_data pointer that is subsequently dereferenced in the notifier chain. An authenticated local user with write access to /dev/vcs* devices can trigger this to crash the kernel. No public exploit exists and EPSS is very low at 0.19% (9th percentile), though the fix is confirmed available across multiple stable kernel branches.