Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service vulnerability in Apache Thrift Rust bindings prior to 0.24.0 allows remote attackers to exhaust memory by sending crafted binary protocol messages that lack a string size limit when the non-strict path is used. Successful exploitation can crash the affected service. No active exploitation or public exploit code is currently reported.
Denial of service in Apache Thrift through an integer overflow in the TProtocol::checkReadBytesAvailable() function affects C++ and c_glib bindings before 0.24.0. Attackers can send crafted messages to crash the service. No known active exploitation or public exploit code.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
Denial of service vulnerability in Apache Thrift's TCompactProtocol implementation allows remote attackers to trigger infinite loops when processing malformed varint input, affecting Python, Go, PHP, and Java bindings before version 0.24.0. Exploitation can exhaust CPU resources, making the service unresponsive; no active exploitation or public exploit code is known at this time.
Remote code execution and credential exfiltration in Snowflake libsnowflakeclient versions before 2.9.2 stem from three distinct flaws in the C client library: a stack-based buffer overflow (CWE-121) and an out-of-bounds write in the file-download path, plus improper validation of connection parameters. A lower-privileged principal sharing an internal stage can plant a file with crafted encryption metadata that corrupts memory in a higher-privileged victim process, while the connection-parameter flaw can redirect outbound authentication requests carrying credentials and tokens to an attacker endpoint. There is no public exploit identified at time of analysis and the CVE is not in CISA KEV; the vendor fixed all issues in 2.9.2, which users must manually install.
Authenticated users with variable write permission on Devolutions PowerShell Universal 2026.2.2 and earlier can execute arbitrary PowerShell code on the server by injecting malicious variable values that are not escaped in the configuration file. No public exploit or active exploitation is known (EPSS 0.29%, SSVC exploitation: none), but the vulnerability has a critical CVSS score and the vendor has released a patch in version 2026.2.3.
Code injection in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with schedule creation permission to inject malicious PowerShell code. By crafting parameter names that are unsafe concatenated into a script invocation, an attacker can execute arbitrary commands on the underlying host. No public exploit or active exploitation is currently known, and EPSS indicates low exploit probability (0.29%).
Memory corruption in Apache NimBLE BASS service allows a nearby, paired attacker to exploit an integer underflow during parsing of Add Source or Modify Source PDUs, leading to a stack buffer overflow or arbitrary out-of-bounds read. This can result in full device compromise. No active exploitation or public exploit is known, and EPSS indicates low exploitation probability, but a vendor patch is available.
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Denial of Service in React Router 7.x (Framework Mode) allows unauthenticated attackers to send crafted requests to the manifest endpoint, causing heavy server load and degraded response times. This is a follow-up CWE-400 vulnerability to GHSA-8x6r-g9mw-2r78, affecting only Framework Mode applications using react-router versions 7.0.0 through 7.17.x. A patch is available in version 7.18.0.
We need to produce a JSON object with specific fields based on the provided CVE data. The user wants a multi-source synthesis. We have the CVE description, CVSS vector (CVSS 4.0), EPSS, patch info, CPE, tags, references, etc. Let's extract relevant details: CVE ID: CVE-2026-66040 Description: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. Remote attackers can supply a crafted PNG image with a malicious eXIf chunk. Attackers craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution. CVSS Score: 8.7, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (with other fields as X). So base score 8.7, high impact, user interaction required (UI:P). Attack vector network, low complexity, no privileges required. CWE: CWE-122 (Heap-based Buffer Overflow) EPSS: 0.55% (43rd percentile) – relatively low exploitation probability. Patch: Available from vendor (commit b506faf). Also EUVD says patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc Reported by: VulnCheck CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (all versions prior to fix) Tags: Heap Overflow, Buffer Overflow, RCE, Canonical, Ffmpeg ENISA EUVD ID: EUVD-2026-48742, affected versions: FFmpeg 0 ≤8.1.2, patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc References: pull request, commit, VulnCheck advisory, vuldb advisory. Now we need to fill each field. product_name: "FFmpeg" (primary product, 1-3 words) summary: Start with impact verb and product. Impact: heap out-of-bounds write in PNG/APNG encoder, leading to heap corruption, crash, potential RCE. Affected: FFmpeg through
Heap-based buffer overflow in FFmpeg versions up to 8.1.2 via a crafted CAF file can allow remote code execution. Exploitation requires user interaction (opening a malicious file). No known active exploitation or public exploit exists, but the vulnerability carries a critical severity score (CVSS 8.8).
CPU exhaustion in bandit 1.11.0 to 1.12.0 allows unauthenticated remote denial-of-service via WebSocket fragment reassembly. An attacker can send millions of tiny continuation frames per connection, triggering quadratic (O(n²)) buffer length recalculation that pins a CPU core for minutes to hours without requiring any authentication. No active exploitation has been confirmed (KEV), but a public proof-of-concept exists, and the EPSS score is low (0.39%).
Client-side denial-of-service in libssh2 through 1.11.1 allows a malicious SSH server to crash any connecting client before authentication by triggering an integer underflow during AES-GCM cipher negotiation, causing an out-of-bounds read and a near-SIZE_MAX memcpy that immediately terminates the process.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
We need to produce a JSON with the specified fields. Data: CVE-2026-12496: Stored XSS in OPC XML-DA server statistics in multiple Loytec products through 8.4.16 on LINX-A64. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. EPSS 0.36% (low). CISA KEV not mentioned, no POC data explicitly? Input has no KEV status, Tags: XSS, etc. SSVC: Exploitation none, Automatable no, Technical Impact total. Affected versions: 0 <= 8.4.16 for all products. References: loytec advisory and NVD. No patch version given. Description says "through 8.4.16", so maybe 8.4.16 is the vulnerable ending version, but no fixed version. No exact fix version. Also, note: the CVE says "on LINX-A64", but the products are different. Probably these are Loytec building automation products. The vulnerability: unauthenticated remote attacker can inject stored XSS via User-Agent header in POST /da request, which executes in admin browser. So condition: OPC XML-DA server statistics accessed by admin. Possibly requires admin viewing the stats page. CVSS 4.0: UI:P (user interaction required to trigger), so the attack requires an admin to view the malicious data. AV:N, AC:L, PR:N, UI:P. So it's unauthenticated but requires user interaction (the admin viewing the page). Also, EPSS low, no active exploitation, no KEV. We need to construct all fields accordingly. No KEV, so "no public exploit identified at time of analysis" (since POC not mentioned either). No explicit POC data, so "no public exploit identified at time of analysis" (I'll use that). EPSS 0.36% is very low, so risk is low despite high impact. But stored XSS could lead to admin compromise, so high impact. product_name: Loytec LW-series? Actually products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. They are all Loytec building automation devices. I'll pick a representative, maybe "Loytec L-INX" or "Loytec L-GATE"? The CPE list includes lip-me20xc, l-inx, l-gate, etc. So product_name: "Loytec L-INX" (one of
We need to extract from the provided information and synthesize into the required JSON fields. Let's go through each field. Product name: The affected product is primarily the Loytec LIP-ME201C, but the vulnerability affects many products: LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD. The description says "through 8.4.18 on LINX-A64". So the primary product might be LIP-ME201C or the whole family. Which to pick? "Loytec LIP-ME201C" seems specific. But it might be better to use "Loytec LIP-ME201C" as the main product? Or the family "Loytec LINX-A64" as in the description. The description mentions "Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.18 on LINX-A64". So it's a range of products that share the same underlying software. The product name could be "Loytec BACnet Devices". But the instruction says 1-3 words only. I can use "Loytec LIP-ME201C" as the first listed, or "Loytec LINX-A64". I'll go with "Loytec LIP-ME201C" as it's the first in the list and a specific product. Or "Loytec BACnet Devices" is 3 words. But they want the specific product name, not a vulnerability type. So I'll use "Loytec LIP-ME201C". Actually the description says "on LINX-A64", which is the platform. So maybe the product is "Loytec LINX-A64"? But the CPE list includes many products like l-inx, l-gate, etc. So it's a group of products. I could say "Loytec Automation Devices" but that's generic. I'll choose "Loytec LIP-ME201C" to be specific. 1-3 words: "Loytec LIP-ME201C" (3 words). That's fine. Summary: Must be 2-3 sentences, original synthesis. Start with impact verb and product. E.g., "Denial of service in Loytec LIP-ME201C and related building automation devices allows..." The impact: crash linx_a64.exe and reboot device. So it's a DoS that forces device reboot. WHO: unauthenticated remote attacker via malformed BACnet TimeSynchronization or UTC-TimeSynchronization packet with invalid month value. So "Denial of service in Loytec LI
Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
We need to produce a JSON with the specified fields. Let's analyze the input. CVE ID: CVE-2026-17107 Description: A flaw in cluster-proxy service-proxy component used in RHACM and MCE. The service-proxy appends impersonation group headers to proxied requests without first removing caller-supplied values, and the spoke ServiceAccount holds unrestricted impersonation permissions. An authenticated hub principal can inject an Impersonate-Group header to escalate to cluster-admin on every managed cluster. CVSS: 8.5, vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-441 (Unintended Proxy or Intermediary ('Confused Deputy')). Actually CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')? Wait, description: "The software fails to properly de-identify or sanitize caller-supplied data when acting as a proxy, relay, or other intermediary." That fits. EPSS: 0.23%, percentile 14% (low). KEV: not mentioned, so no active exploitation. POC: not mentioned. Tags: Kubernetes, Red Hat, Privilege Escalation, Multicluster Engine For Kubernetes. SSVC: Exploitation: none, Automatable: no, Technical Impact: total. References: access.redhat.com security page, bugzilla, vuldb, RHSA-2026:46885 (likely an errata with fix). Also CPE: cpe:2.3:a:red_hat:multicluster_engine_for_kubernetes:*:*:*:*:*:*:*:* - all versions, so no specific version range given. It mentions RHACM and MCE. So product name: Red Hat Advanced Cluster Management for Kubernetes (RHACM) and multicluster-engine (MCE). The CPE given is for MCE. Primary product: Could be "Red Hat MCE" or "Red Hat Advanced Cluster Management". We'll pick the main one as "Red Hat Advanced Cluster Management for Kubernetes" or combine? "Red Hat Advanced Cluster Management" probably. I'll pick "Red Hat Advanced Cluster Management" as product_name, since that's the parent product. But the vulnerability is in cluster-proxy service-proxy component that is part of both. I'll use "Red Hat Advanced Cluster Management for Kubernetes (R
We are tasked with synthesizing data from multiple sources about CVE-2026-10610 into a comprehensive analysis in JSON format. The output must be a JSON object with the specified fields, all strings, and no arrays or objects. Let's extract relevant data: - CVE ID: CVE-2026-10610 - Description: "Local privilege escalation potentially allowed an attacker to execute arbitrary code as a privileged user." - CVSS Score: 8.5 (CVSS 4.0 score, base score 8.5) - CVSS Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CWE: CWE-269 (Improper Privilege Management) - EPSS Score: 0.14% (percentile 4%) - Reported by: ESET - CPE: cpe:2.3:a:eset_spol._s.r.o.:eset_endpoint_security_for_macos:*:*:*:*:*:*:*:*, cpe:2.3:a:eset_spol._s.r.o.:eset_cyber_security_for_macos:*:*:*:*:*:*:*:* - Tags: RCE, Privilege Escalation, Eset Endpoint Security For Macos, Eset Cyber Security For Macos - SSVC: Exploitation: none, Automatable: no, Technical Impact: total - ENISA EUVD ID: EUVD-2026-48558 - Affected versions (EUVD): - ESET Endpoint Security for macOS 0 ≤8.0.7200.0 - ESET Endpoint Security for macOS 9.0 ≤9.0.5400.0 - ESET Endpoint Security for macOS 8.1 ≤8.1.200.0 - ESET Cyber Security for macOS 0 ≤9.0.5300.0 - ESET Endpoint Security for macOS 9.1 ≤9.1.2500.0 - References: - [cveorg] (None) https://support.eset.com/en/ca8977-eset-customer-advisory-local-privilege-escalation-vulnerability-in-eset-security-applications-for-macos-fixed - [vuldb] (advisory) https://vuldb.com/vuln/382896 - [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-10610 We also have "Reported by: ESET" likely meaning the vulnerability was reported by ESET, and the product is ESET's own software. Now, we need to produce fields. Let's go through each: 1. product_name: "1-3 words ONLY. The specific product or service name affected. Examples: 'Apache Tomcat', 'WordPre
Local privilege escalation in ESET Endpoint Security and Cyber Security for macOS allows a low-privileged local attacker to write arbitrary files with controlled content as root, leading to full system compromise. The vulnerability affects multiple versions of the macOS security applications and is addressed in a vendor patch. No active exploitation has been reported, and the EPSS score is low at 0.12%, but exploitation would give an attacker complete control over the system.
We need to produce a JSON with various fields. We'll synthesize from data: CVE-2026-64247. The vulnerability is in Linux kernel, KVM x86 Hyper-V, a bounds check missing for sparse bank index, leading to out-of-bounds read (KASAN: use-after-free). Technical: KVM (Kernel-based Virtual Machine) with Hyper-V emulation, specifically the paravirtual TLB flush for L2 guests via enlightened VMCS. VP ID is copied verbatim without bounds check. With a large VP ID (>= 4096), it causes out-of-bounds read on sparse bank bitmask (max 64 banks of 64 vCPUs each = 4096). Impact: possible unnecessary TLB flush, but the KASAN splat shows use-after-free? Actually the bug is out-of-bounds read of a bitmask, which KASAN logs as use-after-free? Let's see: "KASAN: use-after-free in hv_is_vp_in_sparse_set" but description says out-of-bounds read. Probably the address is bogus. It might lead to information disclosure (H high confidentiality impact) or denial of service (A high) but AV:L, PR:L (needs local access to guest to trigger the hypercall? Actually the attacker is a guest VM user triggering hypercalls via CPUID? The description: "When handling a paravirtual TLB flush for L2, the VP ID is copied verbatim from the enlightened VMCS, without bounds check." The bug is in KVM code handling a hypercall from the guest. The attacker would be a malicious guest (L2) that can execute hypercalls. So the access vector is local (from guest VM) with low privileges (normal user in guest). Scope changed? CVSS says S:C, meaning the vulnerable component is the host/KVM and the impact is to the host (confidentiality high, availability high). So an out-of-bounds read could leak host memory, and could crash host. That's plausible. So the assessed CVSS might be similar. Already provided: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:H. We'll use that but need to confirm independence? The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploi
We are tasked with producing a comprehensive analysis of CVE-2026-12504 in JSON format. We have description, CVSS 4.0 vector, CWE, EPSS, CPEs, tags, SSVC, affected versions from EUVD, and references. No KEV status mentioned, so not in KEV. EPSS is low. The description says: Improper Authentication due to PAM configuration allows local attacker to authenticate as uid=0 without password and get root shell via /etc/passwd entry with empty password. So this is a local privilege escalation via a misconfigured PAM allowing passwordless root login if there is a root entry with empty password. The vulnerability is in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, L-PAD through 8.4.16 on LINX-A64. So it's a very specific product line, likely industrial or building automation devices. CVSS 4.0: AV:L, AC:L, AT:N, PR:H, UI:N, VC:H, VI:H, VA:H, SC:N, SI:N, SA:N. So local attack, low complexity, requires high privileges (PR:H), no user interaction. That matches concept: to add an entry to /etc/passwd, you need high privileges, then you can get root. So the vulnerability is that if a root entry with empty password exists, you can log in as root without password. This is improper authentication in PAM config. SSVC: exploitation none, automatable no, technical impact total. So no active exploitation, not automatically exploitable, total impact if exploited. EPSS 0.13% (low). No POC mentioned. So low risk. No KEV. We must synthesize data from multiple intel sources: we have NVD description, EPSS, CWE, CPEs, tags, SSVC, EUVD affected versions, references. We'll write fields as paragraphs. Use all data to add value. We'll cross-reference. We'll note that the vulnerability is in PAM configuration, likely a default configuration that permits empty password for root, conflicting with security expectations. Affected are many Loytec building automation products running on LINX-A64 architecture. The attacker must already have high privileges (probably root) to add such an en
A local privilege escalation flaw in the ltsudo binary on Loytec LIP-ME201C and related L-Series building automation controllers allows an attacker with superadmin group membership to reset the password of any LARM user, including the larmapp service account, via the set-passwd subcommand. This can lead to full compromise of LINX-A64-based devices running firmware up to version 8.4.16. Exploitation requires local access and high privileges; no active exploitation or public exploit code is currently known, and EPSS indicates a very low probability of exploitation.
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
Una
We need to produce a JSON object with the specified fields. Let's analyze the data. CVE ID: CVE-2026-64223 Description: In the Linux kernel, wifi: mac80211: consume only present negotiated TTLM maps. It's an out-of-bounds read due to parsing error in negotiated TTLM elements. The vulnerability is in mac80211 (Linux kernel wireless subsystem). Specifically, ieee80211_parse_neg_ttlm() advances cursor for every TID, even if presence bit is clear, leading to reading past validated element for later present TIDs. The bad bytes land in neg_ttlm->{up,down}link[tid] but gated by valid_links, so a peer cannot turn it into policy change. Under KUnit + KASAN, OOB read reported as slab-out-of-bounds. In production, depends on allocator state. So from the description: It's an out-of-bounds read. Affected product: Linux kernel (specifically mac80211 subcomponent). CVSS score 8.1, vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -> Adjacent network (WiFi range?), low complexity, no privileges, no user interaction, scope unchanged, high confidentiality and availability impact, no integrity. So it's a read and potentially crash/A impact. EPSS: 0.17% (6th percentile) very low. Patch: Available from vendor (Linux). CPE strings: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (generic), no version specified in CPE, but EUVD provides affected versions: Linux commits from 8f500fbc6c... up to various fix commits. EUVD versions: Linux 8f500fbc6c... < a6e6ccd5bd... (6.12.92?), etc. Patches: "Linux patch: 6.18.34", "6.12.92", 0, 7.1, 7.0.11? Those look odd: maybe patch versions for stable trees. Anyway, the vulnerability is in mac80211, which is part of the Linux kernel. The affected versions likely include kernels where this commit 8f500fbc... (introduced) until fix commit a6e6ccd5bd..., which appears in various stable trees. I need to synthesize. Product_name: "Linux Kernel" (1-3 words). Actually the specific product is "mac80211" which is part of the Linux kernel's wireless stack. So "Linux Kernel mac80
Denial of service in the Linux kernel's x86/ftrace dynamic trampoline mechanism causes a kernel panic when CONFIG_CALL_DEPTH_TRACKING is enabled on retbleed-affected platforms (e.g., Skylake) using retbleed=stuff. An attacker with local privileged access to configure ftrace can trigger a crash by setting up a kprobe event and invoking the traced function. No active exploitation or public exploit has been reported, and the EPSS probability is 0.16% (5th percentile), indicating low real-world risk.
We need to produce a comprehensive analysis for CVE-2026-54342. We have multiple sources: the description, CVSS vector, CWE, EPSS, patch, CPE, tags, references, etc. We'll synthesize into the required JSON fields. First, identify product_name: the description says "epa4all", a product by med-united. So product_name: "epa4all". Keep 1-3 words. Summary: Synthesize original, don't copy description. Start with specific impact verb and product. It's about a TLS certificate validation issue on network path between epa4all and backends. Impact: attacker on network path can present self-signed certificate and intercept connection. For non-VAU connections, direct read and modify traffic including smartcard and OIDC. For ePA backend, it's transport-level enabler for another vulnerability (GHSA-vvh7-x6c7-46gh). Patch in version 2026-05-20. Mention if actively exploited? No KEV. EPSS low (0.12%). POC status? Not mentioned. We'll craft a summary like: "Man-in-the-middle interception in epa4all prior to 2026-05-20 allows network-path attackers to bypass TLS validation by presenting a self-signed certificate, enabling traffic decryption, modification, and injection for backend connections (Konnektor, IDP) and enabling a VAU MITM for ePA backend. Attacker can read and modify smartcard operations and OIDC authentication exchanges." Avoid "A vulnerability". Technical_context: Explain underlying tech: TLS, certificate validation, CWE-295 Improper Certificate Validation. Use CPE to identify affected: cpe:2.3:a:med-united:epa4all:*:*:*:*:*:*:*:*. So it's the epa4all application. Specifically, the TLS verification is disabled for certain connections, allowing self-signed certificates. Attacker on network path (adjacent network). Reference the CWE. So: "The vulnerability arises from improper certificate validation (CWE-295) in epa4all's TLS implementation for connections to backend services (Konnektor, IDP, ePA backend). The application does not verify the server certificate, allowing any self-signed certificate to be accepted, which enables a man-in-the-middle attack. For non-VAU connections, this results in cleartext exposure of authentication and smartcard data; for the ePA backend, it disables transport security, acting as an enabler for a separate VAU bypass (GHSA-vvh7-x6c7-46gh)." Risk_assessment: Use CVSS vector AV:A (adjacent network), AC:L, PR:N, UI:N, S:U, C:H, I:H, A:N. EPSS 0.12% (very low). KEV: not listed. POC: not mentioned, but advisory implies potential exploitation if on network path. So real-world risk: exploitability limited to network-path attackers (adjacent). Adjacent network typically means same local network segment, so not remotely exploitable over internet. Combined with low EPSS, it's likely low immediate risk, but severity is high impact. The CVSS base score is 8.1 (High) but AV:A reduces reachability. SSVC: exploitation status: no public exploit identified, automatable: likely yes (once on network), technical impact: high. So risk: high severity but limited attack vector; not a priority for internet-facing but important for internal networks in healthcare. We'll state: "CVSS 8.1 indicates high confidentiality and integrity impact with adjacent network attack vector, requiring attacker to be on the same network segment. EPSS score 0.12% suggests low likelihood of widespread exploitation. No known active exploitation or public exploit code. The attack vector limits exploitability to local network adversaries, reducing overall real-world risk for internet-facing deployments but critical for healthcare environments handling sensitive patient data." Compare signals. No conflicting info. All from CVSS and description. Affected_products: "epa4all versions prior to 2026-05-20 (CPE: cpe:2.3:a:med-united:epa4all:*:*:*:*:*:*:*:*) as per EUVD advisory. Vendor patch released in version 2026-05-20, available at https://github.com/med-united/epa4all/releases/tag/2026-05-20. References: GHSA-296w-v8f6-3rf7, GHSA-vvh7-x6c7-46gh, and machinespirits.com advisory b98b02." Remediation: Actionable: Upgrade to version 2026-05-20 or later. The patch is available from vendor. The advisory references the release. No specific workarounds mentioned. If no patch is possible, compensating controls: "If immediate upgrade not possible, restrict network access to epa4all's backend communication to trusted segments, enforce mutual TLS with pinned certificates, and monitor for unauthorized certificates. Note that this does not fully mitigate the risk as the underlying TLS verification bypass remains, but can reduce the attack surface." But since patch exists, primary recommendation is upgrade. We'll mention "Upgrade epa4all to version 2026-05-20, which properly validates TLS certificates. Advisory: GHSA-296w-v8f6-3rf7. No additional workarounds provided by vendor." I'll keep it focused. Exploit_scenario: Realistic: "An attacker positioned on the same network segment as the epa4all instance performs a man-in-the-middle attack by presenting a self-signed TLS certificate to the epa4all client when it connects to the Konnektor or IDP backend. The attacker then intercepts smartcard operations and OIDC authentication tokens, enabling unauthorized access to patient health records." If POC exists, note that; none mentioned. Exploitation_conditions: Specific prerequisites: The attacker must be positioned on the network path between epa4all and the backend services (Konnektor, IDP, TSS, or ePA Aktensystem). For non-VAU connections (Konnektor, IDP), exploitation requires no further conditions beyond network adjacency. For the ePA backend, the disabled TLS verification is an enabler for the VAU MITM described in the referenced GHSA, meaning that another vulnerability or configuration (VAU bypass) is needed to fully exploit the ePA connection. So condition: network adjacency, and for ePA backend exploitation requires combined with the VAU MITM vulnerability. Importantly, the description says "For non-VAU connections ... this allows direct read and modification of the inner traffic". So no special configuration needed for those backends. It just works by default? It says "disabled TLS verification is the transport-level enabler for the VAU MITM", so for ePA backend the actual MITM requires VAU vulnerability. So exploitation condition: Attacker must be on the same network segment as epa4all or a network path to the backends. No user interaction or authentication required. Affects all versions prior to 2026-05-20 in default configuration (no TLS verification). For ePA backend, combined with GHSA-vvh7-x6c7-46gh to achieve full compromise. Attack_chain: 3-7 steps. AV:A, so network adjacency. Steps: Attacker gains network adjacency (e.g., compromised host on same LAN) → Attacker positions as man-in-the-middle (ARP spoofing, etc.) → Intercept TLS handshake and present self-signed certificate → epa4all accepts certificate without validation → Decrypt and read/modify application data. For IDP/Konnektor: inject commands, steal OIDC tokens. For ePA backend: combined with VAU bypass to access plaintext health data. So 5-step: Access (gain LAN access) → Delivery (MITM setup like ARP spoof) → Exploit (TLS bypass) → Execution (decrypt traffic) → Impact (modify smartcard operations, credential theft). That's 5 steps. I'll craft: "Gain network adjacency to epa4all host → Perform ARP spoofing to intercept traffic between epa4all and backend → Present self-signed TLS certificate during handshake → epa4all accepts certificate without validation → Decrypt and modify OIDC authentication tokens and smartcard operations." Confidence_notes: "Vulnerability confirmed by vendor advisory (GHSA-296w-v8f6-3rf7) and patched in version 2026-05-20. CVSS vector provided by NVD. No evidence of active exploitation or public exploit code. Attack vector limited to adjacent network as per CVSS, consistent with description. CPE data indicates all versions before 2026-05-20 are affected." So we can say that. Prevalence: epa4all is a tool for the German ePA (electronic patient record) system, used in healthcare. Not as widespread as general-purpose software. Likely low or medium. It's niche: healthcare sector in Germany. So prevalence ~ low. "low". Prevalence_basis: "German healthcare ePA middleware, limited deployment outside Germany." Rationale. Now, assessed_cvss_vector: We will reassess based on our analysis. CVSS from input is AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This seems accurate. Attack vector adjacent, no privileges, no user interaction, unchanged scope, high confidentiality and integrity, no availability impact. So we can output that same vector but it's our independent assessment, not copying. So we'll output "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" and rationale "Adjacent network attack, no privileges or interaction needed, high data exposure and modification without availability impact." CVSS 4.0 vector: Map to 4.0. AV:A (adjacent network) -> AV:A. AC:L -> AC:L. AT: none specific, so AT:N. PR:N, UI:N. VC:H, VI:H, VA:N (no availability). Scope unchanged, so SC:N, SI:N, SA:N. So "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N". Rationale: same as 3.1. Now put into JSON. All fields plain text strings, no arrays. So we'll write a single paragraph for each. No bullet points, no JSON inside. Summary: make it 2-3 sentences, start with "TLS certificate validation bypass in epa4all..." That's what it is: a man-in-the-middle due to disabled TLS verification. Actually, the vulnerability is that it doesn't verify certificates, so it's a bypass. So "TLS certificate validation bypass in epa4all versions prior to 2026-05-20 allows network-adjacent attackers to intercept backend connections by presenting a self-signed TLS certificate, enabling decryption and modification of traffic including smartcard operations and OIDC authentication exchanges." That's one sentence, we need 2-3. I'll make it two: "TLS certificate validation bypass in epa4all versions prior to 2026-05-20 allows network-adjacent attackers to intercept backend connections by presenting a self-signed TLS certificate. Attackers can decrypt and modify smartcard operations, OIDC exchanges on non-VAU connections, and for the ePA backend, this enables a VAU man-in-the-middle (GHSA-vvh7-x6c7-46gh)." That's good. Technical context: "The flaw stems from improper certificate validation (CWE-295) in the TLS client implementation of epa4all (cpe:2.3:a:med-united:epa4all). When connecting to backend services like Konnektor, IDP, or ePA Aktensystem, the application fails to verify the server’s certificate, accepting any self-signed certificate presented by a man-in-the-middle. This violates the trust model expected for healthcare data exchange, exposing patient-sensitive OIDC tokens and smartcard operations to interception and tampering without any user interaction or authentication requirement." Risk assessment: "CVSS 8.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) indicates high confidentiality and integrity impact but requires adjacent network access, limiting exploitation to internal network segments. EPSS score of 0.12% suggests very low probability of widespread exploitation. No active exploitation or public proof-of-concept is currently known. While the vulnerability could critically compromise healthcare data within a localized network, the attack vector constraint and low EPSS reduce overall immediate risk for internet-facing environments, but it remains a high priority for healthcare providers using epa4all." Affected products: "epa4all versions prior to 2026-05-20 (identified by CPE cpe:2.3:a:med-united:epa4all) are affected. The vendor has released a patch in version 2026-05-20, detailed in the release notes at https://github.com/med-united/epa4all/releases/tag/2026
Privilege escalation in the Wpify Woo WordPress plugin (versions ≤ 5.4.16) lets authenticated Shop Manager users overwrite arbitrary WordPress options and promote themselves to Administrator. The vulnerable SettingsApi::save_option() REST route (POST /wp-json/wpify-woo/v1/option) forwards attacker-controlled 'option' and 'data' values straight into update_option() with no allowlist or sanitization, gated only by the manage_woocommerce capability. Reported by Wordfence with a CVSS of 8.0; no public exploit identified at time of analysis and not listed in CISA KEV.
Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The `cgx_speed_mbps` array holds 13 entries (indices 0-12) but the `RESP_LINKSTAT_SPEED` firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
We need to output a JSON object with the specified fields. Let's synthesize data. First, CVE ID: CVE-2026-64217. Description: "In the Linux kernel, the following vulnerability has been resolved: netfs: Fix overrun check in netfs_extract_user_iter() Fix netfs_extract_user_iter() so that if iov_iter_extract_pages() overfills pages[], then those pages don't get included in the iterator constructed at the end of the function. If there was an overfill, memory corruption has already happened." Given data: CVSS: 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H EPSS 0.17%, percentile 6% Patch: Available from vendor Reported by: Linux CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (multiple, all same pattern) Tags: Buffer Overflow, Linux ENISA EUVD ID: EUVD-2026-48625 Affected versions (EUVD): "Linux patch: 7.0.11", "Linux patch: 7.1", "Linux 85dd2c8ff368b1446be9febde84afe1d7aec4261 <afeb32d9bf9aaeea51d0f723a19f14afb73bd94d", "Linux 6.3", "Linux 85dd2c8ff368b1446be9febde84afe1d7aec4261 <00efe58bbdcc93272d579ca24bfc912563f4a204", "Linux 85dd2c8ff368b1446be9febde84afe1d7aec4261 <0ef37eef83fad3542ee06db2940433ae1a92b39d", "Linux patch: 6.6.142", "Linux patch: 0", "Linux patch: 6.12.92", "Linux 85dd2c8ff368b1446be9febde84afe1d7aec4261 <f48b9157f0f611fa436c360648603d5ded719b12", "Linux 85dd2c8ff368b1446be9febde84afe1d7aec4261 <96cc3beb2390ba9f9c128c5733c0ccfe450dd4f9", "Linux patch: 6.18.34". These version strings are messy. The vulnerability is in the Linux kernel's netfs subsystem, specifically netfs_extract_user_iter() function. The issue: iov_iter_extract_pages() can overfill the pages array, leading to memory corruption. The fix ensures that if overfill occurs, those pages aren't included in the iterator. So it's a bounds checking / buffer overflow type issue. The tags include Buffer Overflow. The CVSS vector: AV:L, AC:L, PR:L, UI:N, S:U, C:H, I:H, A:H. So local attack, low privileges required, no user interaction, high impact on confidentiality, integrity, availability. Scor
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafted commands that trigger out-of-bounds memory writes beyond the guest's virtualized GPU boundaries. Affected versions include 26.1 RTM1, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, and 25.1 RTM2 through 25.3 RTM. No active exploitation or public exploit has been observed; EPSS probability is 0.14% (very low) and CISA SSVC indicates neither exploitation nor automatable attack patterns, suggesting low real-world risk despite a high CVSS score of 7.8.
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands via its kernel-mode driver, triggering memory corruption that escapes virtualization boundaries. Affected versions include 24.2, 25.1 through 25.3, 1.18, and 23.2 RTM2 releases. No public exploit code or active exploitation has been identified; EPSS probability is very low at 0.14%.
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
License setting overwrite in ProfileGrid WordPress plugin versions before 5.9.9.7 allows authenticated users with Subscriber-level access or higher to overwrite premium license settings due to a missing capability check. Publicly available exploit code exists but active exploitation has not been confirmed. The flaw stems from relying solely on a nonce exposed to any logged‑in user, bypassing proper authorization.