Directory traversal in Exim before 4.99.5 enables low-privileged local users to escape the mail spool directory boundary and read or manipulate arbitrary files on the host filesystem, ultimately achieving privilege escalation. The flaw is rooted in improper validation of queue-name arguments (CWE-24), affecting Exim from version 4.88 through 4.99.4. No public exploit has been identified at time of analysis, and EPSS at 0.27% (19th percentile) reflects limited exploitation activity, though SSVC assesses the technical impact as total given successful exploitation yields full system compromise.
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Out-of-bounds array access in the Linux kernel's OcteonTX2 CGX network driver exposes kernel memory to read or corruption when hardware firmware returns an unexpected link speed index value. The `cgx_speed_mbps` array holds 13 entries (indices 0-12) but the `RESP_LINKSTAT_SPEED` firmware response field can produce values 0-15, causing indices 13-15 to access memory beyond the array boundary. No public exploit has been identified at time of analysis; EPSS sits at 0.18% (7th percentile) with no CISA KEV listing, though patches are now available across multiple stable kernel branches.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Out-of-bounds write in the Linux kernel's netfs subsystem enables a local, low-privileged attacker to corrupt kernel memory by crafting network filesystem I/O operations that cause iov_iter_extract_pages() to overfill the pages[] array in netfs_extract_user_iter(). The memory corruption occurs before any bounds guard is applied, making this a CWE-787 write-past-end condition with kernel privilege escalation potential. No public exploit code exists and the CVE is absent from the CISA KEV catalog; EPSS is 0.17% (6th percentile), consistent with no observed active exploitation.
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Privilege escalation in Imagination Technologies Graphics DDK allows a malicious guest VM with GPU access to send crafted commands that trigger out-of-bounds memory writes beyond the guest's virtualized GPU boundaries. Affected versions include 26.1 RTM1, 1.18 RTM2, 23.2 RTM2, 24.2 RTM2, and 25.1 RTM2 through 25.3 RTM. No active exploitation or public exploit has been observed; EPSS probability is 0.14% (very low) and CISA SSVC indicates neither exploitation nor automatable attack patterns, suggesting low real-world risk despite a high CVSS score of 7.8.
Out-of-bounds write in Imagination Technologies Graphics DDK allows a malicious guest VM to issue improper GPU commands via its kernel-mode driver, triggering memory corruption that escapes virtualization boundaries. Affected versions include 24.2, 25.1 through 25.3, 1.18, and 23.2 RTM2 releases. No public exploit code or active exploitation has been identified; EPSS probability is very low at 0.14%.
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
Local privilege escalation in Rapid7 InsightVM, Nexpose, and the Insight Agent allows a low-privileged user to gain elevated code execution by planting an executable in a location the scanner discovers and runs during an authenticated assessment. Because the products execute discovered executables without validating file ownership (CWE-250), the planted code runs as the scan credential on Scan Engine or as root/SYSTEM under the Insight Agent, yielding full local compromise. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the vendor-confirmed root/SYSTEM outcome makes this a meaningful escalation path.
Privilege escalation in Exim versions 4.82 through 4.99.4 permits local users with shell access to execute arbitrary commands with elevated mail delivery privileges by crafting a malicious ~/.forward file that exploits mishandled force_command logic in the pipe transport. The affected deployment window is substantial - covering a wide span of Exim releases present across Debian, Ubuntu, and other Linux distributions. No confirmed active exploitation or public exploit code has been identified at the time of analysis; SSVC rates this as non-automatable with no observed exploitation, though technical impact is assessed as total given full CIA compromise upon success.
...
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
Pre-authentication remote code execution in libssh2 1.11.1 and earlier allows a malicious SSH server to compromise any connecting client. A heap buffer overflow in the Encrypt-then-MAC (ETM) cipher negotiation path overwrites heap metadata, enabling tcache bin confusion and function pointer control before user authentication. No active exploitation is known, and EPSS is low (0.32%), but the client-side impact is severe if a victim can be lured to an attacker-controlled server.
Heap-based buffer overflow in the vf_hqdn3d denoising filter of FFmpeg versions up to 8.1.2 allows remote attackers to execute arbitrary code by tricking a user into processing a crafted video with filter graph reinitialization explicitly disabled (-reinit_filter 0). Exploitation requires the vulnerable filter to be applied to input where frame width increases after the initial frame, causing an undersized buffer allocation and subsequent out-of-bounds write. No active exploitation or public proof-of-concept is known at time of analysis; EPSS score is low (0.29%).
Memory corruption in libssh2's publickey response parser allows a malicious SSH server to leak heap pointers and corrupt the heap, potentially leading to remote code execution. The issue affects libssh2 versions up to 1.11.1 and is triggered when a client connects to an attacker-controlled SSH server and fetches public keys, with no authentication required on the server side. A patch is available in commit a13bb6c, though no tagged release includes the fix yet; no active exploitation or public exploit code is currently reported.
Denial of service in Apache Thrift Ruby bindings before 0.24.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed data. No active exploitation or public exploit code has been observed at time of analysis. Upgrading to version 0.24.0 resolves the vulnerability.
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
Information disclosure in Microsoft Azure Portal allows a remote, unauthenticated attacker to access sensitive data they are not authorized to view by exploiting an improper authorization check (CWE-285) reachable over the network. The flaw affects the cloud-hosted Azure management console and, per its CVSS vector, requires no privileges or user interaction while yielding high confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and CISA SSVC records exploitation status as none, though the issue is assessed as automatable; the EPSS probability is modest at 1.03%.
Denial of service in Apache NimBLE 1.9.0 and earlier allows a remote attacker to crash the BLE host stack via a crafted ATT Read Multiple Variable Response. The vulnerability is triggered when a vulnerable device, acting as a BLE Central, sends a Read Multiple Variable Request and receives a malicious response that causes an assertion failure in the ATT parser. Exploitation is not known to be active in the wild, and a patch is available in version 1.10.0.
Denial of service in Apache Neethi versions before 3.2.3 allows unauthenticated remote attackers to bypass a limit on normalized policy alternatives using crafted WS-Policy documents, causing resource exhaustion. The flaw was introduced with the limit in version 3.2.2 and has a CVSS of 7.5 but very low EPSS probability (0.33%), with no active exploitation or public exploit code reported. Upgrading to version 3.2.3 fully resolves the issue.
Denial of service via memory exhaustion in Apache Neethi versions prior to 3.2.3 allows remote unauthenticated attackers to crash services by supplying crafted policies with deep nesting or missing Policy Ids. No public exploit or active exploitation is known; EPSS score (0.33%) indicates low current exploitation probability. Users should upgrade to version 3.2.3.
A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.
Unlocked concurrent writes to the mlx5e ICOSQ (Internal Completion Queue Send Queue) in the Linux kernel's AF_XDP path allow a race condition during CPU affinity changes to corrupt work-queue state, producing bad CQEs and kernel warnings observed in production on Mellanox/NVIDIA ConnectX interfaces. Two distinct races exist: mlx5e_trigger_irq() racing with mlx5e_xsk_alloc_rx_mpwqe() across CPUs after NAPI completion, and mlx5e_trigger_irq() racing with mlx5e_trigger_napi_icosq() on the same path. The vulnerability manifests as an availability impact - corrupt ICOSQ entries trigger hardware-level error CQEs - with no public exploit code and EPSS at 0.15% (5th percentile), reflecting its operational rather than adversarial trigger.
Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).
Privilege escalation via authorization bypass in EventON Action User for WordPress allows unauthenticated attackers to grant management and file-upload capabilities to any non-administrator role or user. The same endpoint also leaks user IDs, display names, capability states, and nonces, and lets attackers tamper with event-to-user assignments. No public exploit or active exploitation has been identified, but the vulnerability is trivially automatable.
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Stored cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts through the 'vbfX' custom field via the publicly accessible saveorder task. Affected versions up to 1.8.13 enable code execution in the context of any user viewing the injected page, with potential for cookie theft or session hijacking. No known exploitation in the wild; EPSS indicates low probability of exploitation.
Remote code execution in Microsoft Azure API Management (APIM) allows an authorized network attacker to achieve full system compromise via improper access control. The vulnerability (CWE-284) is tagged 'Authentication Bypass,' suggesting that despite requiring high privileges for initial entry, the flaw may allow an attacker to circumvent authorization boundaries within APIM and escalate to code execution. No public exploit has been identified at time of analysis, and SSVC confirms no current exploitation; however, the total technical impact (C:H/I:H/A:H) makes patching a priority for any organization running Azure API Management workloads.
Arbitrary OS command execution in OpenStack Ironic Python Agent (IPA) through version 11.6.0 lets a project-scoped user holding the manager role run attacker-chosen commands on a running IPA ramdisk by supplying a crafted ntp_server value that is passed unsanitized to a shell. Because IPA drives bare-metal provisioning, code execution occurs in the privileged provisioning agent context, enabling full compromise of the node being managed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
Privilege escalation and unauthorized data modification in the Grafana IRM cloud service allowed authenticated low-privilege users to perform operations on behalf of other users due to broken access controls, potentially leading to account takeover. The vulnerability affected cloud-only deployments of versions 1.0.0 through 1.164.0 and has been automatically resolved; self-hosted environments are not impacted. The EPSS exploitation probability is low (0.29%) and no active exploitation is known.
Uncontrolled memory allocation in FFmpeg through 8.1.2 allows a remote attacker to exhaust process memory by supplying a crafted IAMF media file as small as 17 bytes. The IAMF demuxer's mix_presentation_obu() function calls av_calloc() with an attacker‑controlled count_label value before validating input data, causing an amplification of approximately 126 million bytes per input byte. Although the CVSS 4.0 score is 7.1 and no active exploitation has been observed (EPSS 0.28%), the vulnerability can be triggered with minimal user interaction, making it a credible denial‑of‑service risk in media processing pipelines.
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.
Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.
Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.
A stack buffer overflow in the AMD display driver (dc_process_dmub_aux_transfer_async) within the Linux kernel allows a local authenticated attacker with low privileges to potentially execute arbitrary code or crash the system. The flaw arises from missing bounds checks on payload length and link_index, impacting all kernels before the patched versions. While no active exploitation or public proof-of-concept is reported, the issue affects a wide range of systems with AMD GPUs.
Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or
Denial-of-service in Apache NimBLE up to version 1.9.0 allows remote attackers to crash the BLE host by causing a NULL pointer dereference in the LE Long Term Key Request event handler. Exploitation requires the host to be built with assertions disabled and a bogus or misbehaving BLE controller. No active exploitation or public exploit code has been identified; the vendor rates severity as low.
Denial of service in Apache Neethi versions before 3.2.3 allows remote attackers to exhaust resources by manually retrieving an oversized remote policy via the API. The vulnerability is unauthenticated and network exploitable, but no active exploitation has been reported. A patch is available in version 3.2.3, which enforces a maximum size on remote policy references.
Buffer overflow in Apache NimBLE's HCI socket transport (through version 1.9.0) allows an adjacent attacker with a malicious or compromised Bluetooth controller to execute arbitrary code on the host by sending an oversized HCI event. Exploitation requires either a misconfigured event pool size or control of the controller on the HCI link, not over-the-air Bluetooth access. No active exploitation or public exploit code is known, and the real-world risk is low despite a CVSS 7.5 rating.