Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Stack buffer address truncation in the MIPS DEC 64-bit Linux kernel platform layer causes kernel panics when the initial console handler is invoked from a non-initial kernel thread. The buffer resides on a stack allocated in the XKPHYS 64-bit memory segment, whose address is silently truncated by legacy 32-bit DEC firmware, producing an invalid pointer dereference and a fatal kernel exception. No public exploit identified at time of analysis and no active exploitation is confirmed; patches are available across multiple stable kernel branches including 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, and 7.2-rc1.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.
Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.
MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
NULL pointer dereference in the Linux kernel's `copy_process()` function allows a local low-privileged user to crash the host kernel via a denial-of-service condition. During `fork()`, the child process inherits the `PF_BLOCK_TS` process flag from the parent while the child's `blk_plug` pointer is simultaneously reset to NULL, breaking the invariant that `PF_BLOCK_TS` set implies `current->plug != NULL`. Any downstream block I/O subsystem code path that dereferences `current->plug` without a NULL guard in the child will trigger a kernel panic. No public exploit is identified at time of analysis, and EPSS at 0.16% (5th percentile) reflects minimal observed exploitation interest.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Order fulfillment fraud in the Payment Plugins for Stripe WooCommerce WordPress plugin allows unauthenticated network attackers to mark arbitrary pending WooCommerce orders as paid without actual payment. Any store running version 4.0.7 or earlier with the default blank webhook secret is exposed to fraudulent goods acquisition, as the plugin's webhook endpoint accepts and processes forged Stripe charge events without signature verification. No public exploit has been identified at time of analysis, but the attack requires no credentials, targets the default installation state, and is trivially automatable.
Unauthorized content disclosure in the Kirki - Freeform Page Builder plugin for WordPress (all versions ≤ 6.0.14) allows unauthenticated remote attackers to read the full title, body, and excerpt of any WordPress post by supplying an arbitrary post ID via the unvalidated `context` parameter in the plugin's frontend REST API. Affected content includes drafts, pending posts, privately published posts, password-protected posts, and trashed posts - bypassing all native WordPress visibility controls. No active exploitation confirmed (not in CISA KEV), and no public POC is identified at time of analysis, but the attack requires zero authentication and low complexity per the CVSS vector.
A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.
Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.
Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.
Denial of service via memory exhaustion affects the webtransport-go library versions 0.11.0 and earlier. A remote attacker can send a crafted WebTransport capsule with a large payload to a vulnerable client or server using HTTP/3, causing excessive memory allocation and potential crash. No active exploitation has been reported, and the vulnerability is patched in version 0.11.1.
DOM-based cross-site scripting in Milkdown's @milkdown/plugin-emoji before version 7.21.3 allows unauthenticated attackers to execute arbitrary JavaScript in the origin of applications embedding Milkdown when a victim pastes attacker-controlled content. The flaw stems from unsanitized innerHTML stored during HTML-to-markdown parsing and later assigned directly to a live DOM element, bypassing DOMPurify sanitization in the rendering path. No active exploitation or public exploit is known, and the EPSS score is low (0.25%).
Improper access control in Octopus Deploy allows an authenticated attacker with high privileges to trigger deployments without proper authorization. Affected versions include Octopus Server 2023.0.0 through 2026.1.x before 2026.1.11587 and 2026.2.0 before 2026.2.13190. No active exploitation or public exploit code is known; EPSS indicates low exploitation probability.
Stored cross-site scripting in Milkdown before version 7.21.3 allows an attacker with document write access to inject JavaScript via malicious Markdown links. The parseMarkdown runner fails to validate URL schemes, and ineffective DOMPurify sanitization causes javascript: payloads to reach anchor elements in read‑only mode and link‑tooltip previews. When any user opens the document or interacts with the rendered link, arbitrary JavaScript executes in their browser.
DOMPurify before 3.4.12 fails to invoke the afterSanitizeElements hook for custom elements permitted via CUSTOM_ELEMENT_HANDLING.tagNameCheck, enabling attackers to retain
Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with the Reader role to execute automation tests and modify workflow properties due to missing server-side authorization checks. This results in privilege escalation to perform restricted operations, though the EPSS exploitation probability is low (0.15%) and no active
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Information disclosure through SQL injection in Ninja Forms for WordPress versions 3.14.9 and earlier enables authenticated administrators to extract sensitive database data. The vulnerability originates from unsanitized keys in the 'settings' object when importing form files, allowing SQL payload injection via two distinct sinks. No active exploitation is confirmed, and EPSS indicates low exploitation probability.
Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).
Authentication bypass in OpenStack Zaqar through version 22.0.0 allows network-reachable attackers without credentials to circumvent access controls by supplying a crafted EXTRA-SPEC HTTP header paired with a known queue UUID. The root cause is CWE-306 (Missing Authentication for Critical Function), meaning the service fails to enforce credential validation on certain request paths when this header is present. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the network-accessible nature of Zaqar's REST API makes this a meaningful risk for deployments where queue UUIDs may be discoverable through logs or enumeration.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
Denial of service in Zephyr RTOS versions before 4.5.0 occurs when mounting a crafted ext2 filesystem with zero values in superblock fields s_blocks_per_group or s_inodes_per_group. An attacker with physical access via removable media can trigger a division-by-zero fault on ARM Cortex-M targets, causing a system crash. No other impact beyond availability; no active exploitation or public exploit is known.
Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.
Directory traversal in the Nexter Blocks WordPress plugin (all versions through 5.0.0) allows authenticated attackers holding only subscriber-level accounts to delete arbitrary JavaScript and CSS files on the server by manipulating the unsanitized 'plus_name' parameter. Successful exploitation can destroy plugin and theme asset files, causing denial of service or permanent visual breakage of affected WordPress sites. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the low authentication bar (subscriber-level) meaningfully elevates real-world risk for multi-tenant or open-registration WordPress deployments.
Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source
Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.
Metadata leakage in Cloudreve single-file shares allows an authenticated recipient to observe file activity (rename, create, delete) of unshared siblings in the owner's parent folder via the event stream endpoint, exposing file names and operation types but not file contents.