Unauthenticated remote administrator takeover in SiYuan before v3.7.2 via missing authorization on the /mcp kernel endpoint. When the Publish server is in anonymous mode, a remote attacker can invoke 31 MCP tools—including full file-system read, write, and delete—to exfiltrate secrets from conf/conf.json and plant a malicious plugin that runs with elevated desktop privileges. While no active exploitation has been confirmed by CISA KEV, detailed exploit information is publicly available, and the vulnerability carries a maximum CVSS severity.
Remote code execution in Catalyst::View::Wkhtmltopdf before 0.6.1 allows unauthenticated attackers to inject arbitrary shell commands via unsanitized PDF render options such as page_size, orientation, or margins. The incomplete fix in 0.6.0 still permits injection. CVSS 9.8, EPSS 0.67% (moderate probability), CISA SSVC indicates automatable and total impact, but no active exploitation reported.
Use-after-free vulnerability in the Linux kernel's fsl-lpspi SPI driver can lead to memory corruption or arbitrary code execution with kernel privileges. A local attacker with high privileges on systems using the affected driver can trigger this flaw, potentially causing a kernel panic or full system compromise. At time of analysis, no public exploit or active exploitation is identified, and EPSS indicates low exploitation probability (0.22%).
Out-of-bounds write in the Linux kernel's siw RDMA driver allows a remote attacker on an established iWARP connection to cause memory corruption and potential code execution by sending a crafted sequence of Read Response segments that exceed the read request's buffer length. Affects all Linux kernel versions with the siw driver since 5.3. No public exploit is known, and EPSS score is low (0.22%), but the CVSS rating is Critical (9.8).
Improper authorization in the Linux kernel's ksmbd (in-kernel SMB3 server) lets an authenticated SMB client overwrite destination file data it should not be able to write. The FSCTL_DUPLICATE_EXTENTS_TO_FILE branch of smb2_ioctl() performs a server-side block clone via vfs_clone_file_range() but omits the share-level writable check and the per-handle access check that every other write-bearing ioctl arm enforces, so data can be overwritten on a read-only share or through a handle opened with only FILE_WRITE_ATTRIBUTES. This is an integrity/authorization bug (not memory corruption); there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free vulnerability in the Linux kernel's ksmbd SMB server allows remote attackers to execute arbitrary code. All kernel versions with ksmbd enabled from early commits up to the patched releases are affected, and the issue can be triggered by concurrent QUERY_DIRECTORY requests on the same file handle. A fix is available via multiple stable kernel branches, no active exploitation is reported in KEV, and EPSS indicates a low probability of widespread exploitation (0.21%).
An out-of-bounds memory access in the Linux kernel's BPF devmap broadcast redirect for XDP frames, introduced in version 5.14, can be triggered by remote unauthenticated attackers sending specially crafted fragmented network packets. This could lead to kernel memory corruption and arbitrary code execution. Though CVSS rates this as critical (9.8), no public exploit or active exploitation has been identified, and EPSS indicates a low probability of exploitation (0.21%).
Unauthorized read/write of Alternate Data Streams in Linux ksmbd allows remote attackers to access or modify file extended attributes. The vulnerability, present in Linux kernel versions with ksmbd up to before patches 6.18.39, 6.12.96, 7.1.4
Double-free memory corruption in the Linux kernel SMB client when processing SMB2 QUERY_DIRECTORY responses. A remote attacker acting as a malicious SMB server can trigger the issue during directory enumeration, potentially leading to arbitrary code execution or denial of service on any unpatched Linux system that mounts an attacker-controlled share. The vulnerability is not known to be actively exploited, but patches are available across multiple stable kernel branches.
Double free in the Linux kernel's SMB client due to improper cleanup of response buffers when a reply error is replayed. An attacker controlling an SMB server can trigger memory corruption, potentially leading to code execution or a system crash, when a vulnerable client connects and processes a crafted response. Patches are available in multiple stable kernel branches, but no active exploitation or public exploit has been reported.
Double-free vulnerability in the Linux kernel's SMB client (cifs) allows remote code execution via crafted SMB2_ioctl replies. An attacker hosting a malicious SMB server can trigger a replay path memory double-free, leading to full system compromise. No active exploitation or public exploit has been identified at this time; EPSS score is low (0.21%).
Denial-of-service (kernel memory corruption) in the Linux kernel's cifs/smb client affects the SMB2 CHANGE_NOTIFY replay path. When a response-bearing notify attempt returns a replayable error and frees its response buffer, stale resp_buftype/rsp_iov bookkeeping is retained across attempts; if SMB2_notify_init() then fails before the next send, cleanup frees the already-freed response a second time (CWE-415 double-free). Exploitation requires a malicious or man-in-the-middle SMB server and winning a replay/retry-failure race, so real-world risk is DoS-leaning; no public exploit is identified and EPSS is low at 0.21%.
Double-free memory corruption in the Linux kernel's SMB client (cifs) affects the SMB2_flush() replay path across many stable branches prior to 6.6.145, 6.12.96, 6.18.39 and 7.1.4. When a mounted client receives a replayable flush response and the subsequent retry fails before cifs_send_recv() installs a replacement response, flush_exit frees the stale response buffer a second time, corrupting kernel slab memory and typically crashing the client. No public exploit is identified at time of analysis (EPSS 0.21%, 11th percentile) and it is not in CISA KEV; exploitation requires a malicious or man-in-the-middle SMB server plus a replay/retry timing race, making it primarily a denial-of-service concern despite the 9.8 rating.
Use-after-free in the Linux kernel net/handshake subsystem allows a struct socket to be torn down while the handshake netlink accept path still holds a pointer to it. The submit path only took a sock_hold(), which keeps struct sock alive via sk_refcnt but does not pin the struct socket (owned by sock->file); once the userspace handshake agent releases the last file reference, sock_release() destroys the socket, leaving handshake_nl_accept_doit() dereferencing freed memory. Fixed versions are available (6.12.93, 7.0.12, 7.1); EPSS is low at 0.21% and no public exploit is identified at time of analysis.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Use-after-free in the Linux kernel's crypto/krb5 helper library (introduced in 6.15) occurs when Kerberos AEAD encrypt/decrypt operations are backed by an asynchronous AEAD implementation. The synchronous helpers in rfc3961_simplified.c and rfc8009_aes2.c set a NULL completion callback and treat any negative return as terminal, so an async backend returning -EINPROGRESS causes the buffer to be freed with kfree_sensitive() while the backend worker still dereferences it. This is reachable through kernel consumers of krb5 crypto (rxrpc/rxgk, AFS cm_security, and Ceph), but only on systems where an async AEAD provider is bound to the krb5 enctype name; no public exploit identified at time of analysis and EPSS is low at 0.21%.
Insufficient validation in the Linux kernel's netfilter flowtable hardware offload for IPIP tunnels could allow a remote attacker to cause information disclosure or denial of service. The flaw exists because the kernel would attempt to enqueue hardware offload work for IPIP tunnels despite no driver supporting it, leading to an unspecified impact when the unsupported configuration is processed. The issue is fixed by adding an early check to skip unsupported offload setup. No public exploit code is
Unauthorized modification of push notification tokens in OpenRemote before 1.26.2 allows unauthenticated attackers to redirect or block push notifications to legitimate consoles. By supplying a known console asset identifier, an attacker can bypass authentication on the registration API to overwrite notification tokens and metadata, disrupting notification delivery. The issue is tracked as CVE-2026-66013; no public exploit is confirmed at time of analysis.
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
Out-of-bounds heap read in the Linux kernel's nvmet-auth module allows pre-authentication remote attackers to read up to 526 bytes of heap memory beyond a crafted DHCHAP_REPLY message. By sending an NVMe-oF authentication reply with a small transfer length but inflated hash and DH value length fields, an unauthenticated attacker can extract sensitive data or cause a denial-of-service. Patches are available in upstream stable kernels.
Out-of-bounds slab read in the Linux kernel TIPC (Transparent Inter-Process Communication) protocol lets a malicious TIPC neighbour trigger a heap over-read by sending a single crafted broadcast PROTOCOL/STATE_MSG carrying a Gap ACK blocks record. Affecting kernels 5.8 through the fixed stable releases, the broadcast path (tipc_bcast_sync_rcv → tipc_link_advance_transmq) fails to bound the Gap ACK record against the actual message data size, so kmemdup() copies up to 1024 bytes past a ~704-byte skb, corrupting/leaking adjacent slab memory and crashing the host (KASAN slab-out-of-bounds). No public exploit is identified at time of analysis and EPSS is low (0.22%), consistent with a niche, non-default kernel subsystem.
Filesystem permission bypass in the Linux kernel's in-kernel SMB server (ksmbd) allows an authenticated SMB client to delete base files and Alternate Data Stream (ADS) xattrs it should not be permitted to remove. When a delete-on-close is finalized during deferred or durable handle teardown - a code path with no associated request work - the unlink and ADS removal executed with the ksmbd worker's credentials rather than the opening user's, skipping the fsuid/fsgid/supplementary-group/capability checks. No public exploit is identified at time of analysis; EPSS is low (0.22%, 13th percentile) and it is not in CISA KEV.
Unauthorized file modification in the Linux kernel's ksmbd SMB server allows remote attackers to modify file data and attributes by exploiting a credential confusion in SMB2 SET_INFO handlers. The vulnerability arises because the VFS operations used after permission checks run with the ksmbd worker credentials rather than the opener's credentials, effectively bypassing ownership and permission restrictions. No public exploit is known and EPSS is low (0.21%), but the network-accessible, low-complexity nature makes critical
Host memory disclosure to a remote RDMA peer in the Linux kernel's RDMA/rtrs-srv (RTRS server) transport allows a connected peer to read beyond a mapped chunk buffer. When answering an RTRS READ, rdma_write_sg() set the outbound RDMA-Write source-SGE length directly from the attacker-controlled wire descriptor field desc[0].len, which was only rejected when zero, and used the PD-wide local_dma_lkey rather than the chunk's own MR, so the verbs layer never constrained the transfer to max_chunk_size. A peer advertising a length larger than the chunk can force the posted RDMA write to read past the chunk into adjacent host memory (disclosed back to the peer under passthrough/no-IOMMU configs) or trigger a translation fault that aborts the connection. No public exploit identified at time of analysis and EPSS is low (0.21%).
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.