Unauthenticated remote denial-of-service in Cisco IOS XE Software allows network-accessible attackers to crash IOS processes or force full device reloads by exploiting insufficient control flow management flaws (CWE-691), with a scope-changing availability impact rated CVSS 8.6. The vulnerabilities were discovered internally by Cisco's own engineering team as part of a proactive security review and addressed through software hardening releases - no active exploitation or public proof-of-concept has been identified at time of analysis. The affected version range is exceptionally broad, spanning IOS XE 16.6.x through 26.1.x, meaning virtually every Cisco IOS XE device on networks that has not been recently patched is likely running a vulnerable version.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Unauthenticated remote attackers can cause high availability impact with scope change on Cisco IOS XE Software through improper control of resources across their lifetime (CWE-664), affecting an exceptionally broad version range from 16.6.x through 26.1.x. The vulnerabilities were discovered proactively by Cisco's internal security engineering team and grouped as a software hardening release, meaning patches were prepared before external threat actor awareness. No public exploit exists and the CVE is absent from CISA KEV, but the AV:N/AC:L/PR:N/UI:N CVSS profile means exploitation requires no authentication or special conditions against any network-accessible IOS XE device.
Remote unauthenticated exploitation of improper memory buffer boundary handling in Cisco IOS XE Software can cause a complete denial of service with Changed scope (S:C), potentially cascading disruption to downstream network segments that depend on the affected routing or switching infrastructure. Affecting an extremely broad range of IOS XE release trains from 16.6.x through 26.1.x across hundreds of specific builds, this vulnerability was discovered and self-reported by Cisco's own engineering team during a proactive internal security hardening review - not in response to observed attacks. No public exploit code or CISA KEV listing has been identified at time of analysis, which moderates near-term opportunistic exploitation risk despite the high CVSS score of 8.6.
Missing authorization on the group DM recipient endpoint in Spacebar Server allows any authenticated user to add themselves or arbitrary third parties to private group DM channels without being a member. Versions prior to commit dcfd91035e3da42abf5f32d8d86a35219225b3d4 expose the unguarded PUT /channels/{channel_id}/recipients/{user_id} handler, granting attackers full read and write access to private conversation history. No public exploit code or active exploitation has been identified at time of analysis, but the commit diff and GHSA advisory are publicly available, lowering the bar for exploitation.
Memory corruption in nanoMODBUS through v1.23.0 allows a malicious or compromised Modbus server to crash or potentially execute arbitrary code on connecting clients by sending a crafted Read Device Identification response (FC 0x2B/MEI 0x0E) that triggers an out-of-bounds NUL byte write in recv_read_device_identification_res(). Any application embedding this library and invoking the Device Identification client function is exposed when connecting to an attacker-controlled server. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the off-by-one NUL write primitive into adjacent heap or stack memory represents a realistic path to both denial of service and, depending on allocator layout, code execution.
Untrusted JavaScript rendered in Livebook notebook outputs can escape the sandboxed cross-origin iframe and trigger session-wide keyboard shortcuts, causing forced execution of all notebook cells without user consent. Livebook versions 0.5.0-0.18.6 and 0.19.0-0.19.8 are affected; a user who merely opens a third-party or documentation-linked notebook can have its Elixir code automatically evaluated on their runtime. Because cell outputs are mirrored to every connected client, a single malicious notebook load can trigger the exploit simultaneously across all collaborators in the session. No public exploit or CISA KEV listing is identified at time of analysis, but the low-friction attack path - open a notebook, get code executed - represents a meaningful social-engineering risk.
Remote code execution in ESPHome through 2026.7.0-dev allows any attacker who can supply a crafted YAML configuration to execute arbitrary Python code on the machine that processes it. The vulnerability is an operator-precedence bug in the cv.url() validator: Python's 'and' binding tighter than 'or' causes any file:// URI to unconditionally pass validation, bypassing the intended network-URI-only restriction on the external_components git source URL field. ESPHome then invokes git clone against the attacker-supplied local path and loads the resulting repository into Python's import machinery, yielding full code execution with the privileges of the esphome process; no public exploit has been identified at time of analysis.
Remote code execution in Mistral Vibe before 2.23.3 allows any attacker who can deliver a crafted repository to a victim to execute arbitrary commands with the victim's full OS privileges. The mechanism is git's core.fsmonitor hook: Mistral Vibe calls git status --porcelain without suppressing hook execution, so a malicious fsmonitor entry embedded in a repository's .git/config is executed whenever any vibe command runs inside that repository. No public exploit or CISA KEV listing has been identified at time of analysis; however, the attack pattern is straightforward and the fix is confirmed at v2.23.3.
Remote authenticated attackers can bypass localhost-only access restrictions in IBM Langflow OSS 1.0.0 through 1.10.3 to write arbitrary MCP (Model Context Protocol) server configurations to IDE configuration files on the underlying host system. The CVSS scope change (S:C) confirms this escapes the Langflow application boundary, enabling persistent manipulation of developer IDE environments on the host. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Webhook URL validation bypass in Memos allows authenticated users to trigger Server-Side Request Forgery via the 0.0.0.0 address notation, causing the server to make outbound HTTP requests to its own loopback interface and exposing internal-only services, with a CVSS 8.5 score reflecting Changed Scope and High Confidentiality impact. The root cause is a code-divergence defect: isReservedIP() in internal/webhook/validate.go omits the 0.0.0.0/8 CIDR block and never calls ip.IsUnspecified(), while the correctly implemented sibling function isInternalIP() in internal/httpgetter/html_meta.go does both. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and standard SSRF-to-loopback technique make this a realistic risk on any Linux-hosted Memos instance with multi-user access.
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged users to bypass existing IMDS protection filters, causing the server to fetch cloud instance metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254). Successful exploitation yields temporary cloud IAM credentials, extending attacker reach to all cloud resources accessible by the host instance's IAM role. No public exploit code or CISA KEV listing has been identified at time of analysis; however, the Scope:Changed CVSS metric and credential-theft impact elevate operational priority significantly for cloud-hosted deployments.
Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.
Server-Side Request Forgery in Shiori's bookmark download function allows any authenticated user to force the server to issue HTTP requests to loopback addresses (127.0.0.1) and 0.0.0.0 - which Linux routes to the loopback interface - reaching cloud metadata endpoints, co-located databases, and internal-only APIs. The root cause is `DownloadBookmark()` in `internal/core/download.go` using a plain `http.Client` with no custom `DialContext` and no post-resolution IP validation (no `IsLoopback()`, `IsPrivate()`, `IsUnspecified()`, or `IsLinkLocalUnicast()` checks). No public exploit has been identified at time of analysis, but the attack path is trivially constructable given the well-documented SSRF pattern against Go's standard HTTP client.
DNS rebinding bypass of SSRF protection in Memos' webhook dispatcher allows a low-privileged authenticated attacker to reach internal network resources by exploiting a time-of-check/time-of-use race in hostname resolution. The `safeDialContext()` function in `internal/webhook/webhook.go` validates the resolved IP against reserved ranges but then re-dials using the original hostname, allowing the underlying `net.Dialer.DialContext()` to perform a second, independent DNS lookup that the attacker controls. By setting a short TTL on an attacker-controlled domain and swapping the DNS response between validation and dial, an attacker can cause Memos to connect to arbitrary internal addresses. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope change (S:C) and high confidentiality impact reflect the risk of internal service enumeration and data exfiltration.
Local privilege escalation in the NI-PAL kernel driver allows a low-privileged authenticated Windows user to escalate to SYSTEM-level and execute arbitrary code, as confirmed by the NI vendor advisory. Affected deployments include NI-PAL versions 26.3.1 and all prior releases running exclusively on Microsoft Windows. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, but the low access complexity (AC:L, AT:N in CVSS 4.0) means exploitation requires no special conditions beyond a local user session.
Privilege escalation to SYSTEM in NetKids iMark (all versions through V5.2.5.0) is achievable by authenticated local attackers exploiting an unquoted Windows service executable path. Because the service path contains spaces but lacks surrounding quotation marks, Windows' path resolution logic will execute an attacker-placed binary at an intermediate path before reaching the legitimate service binary. JPCERT/CC has issued an advisory (JVN#28045338) and the vendor has published remediation PDF guidance; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
SSRF protection bypass in Gitea prior to 1.27.0 exposes internal services, cloud instance-metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), and local files - including the application configuration containing database credentials and signing secrets - to authenticated attackers. Three HTTP fetch code paths in the migration and OAuth avatar subsystems use Go's raw http.Get() rather than the hardened hostmatcher.NewDialContext() transport used elsewhere, completely circumventing Gitea's built-in SSRF defenses. A publicly available proof-of-concept is included in the GHSA advisory; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Cross-company customer record access in Crater 6.0.6 exposes a multi-tenant authorization flaw where any authenticated tenant user can read, modify, or permanently delete customer records owned by other companies. The CustomerPolicy authorization class omits the company_id ownership check that all other resource policies (Invoice, Estimate, Payment, Expense) correctly enforce, and route-model-bound customer lookups use unscoped queries (self::find($id)) that return records regardless of company ownership. No public exploit has been identified at time of analysis; the CVSS 8.3 (High) score reflects straightforward network-reachable exploitation by any low-privilege authenticated user, with cascading destruction of financial records as the worst-case availability impact.
Cross-company note access in the Crater open-source invoice platform allows any authenticated user to read, modify, or delete notes belonging to an entirely different company by supplying a foreign note ID in the API. NotePolicy omits the company-ownership verification (hasCompany) that sibling policies such as InvoicePolicy correctly enforce, and NotesController's show(), update(), and destroy() actions call authorize() without passing the target Note model instance, meaning no per-resource ownership check ever executes. No public exploit has been identified at time of analysis, but the CVSS 8.3 rating reflects that the technique requires only sequential ID enumeration against a standard multi-tenant deployment - a low-effort, high-impact path to cross-tenant data exfiltration and tampering.
Privilege persistence in Shiori, the self-hosted bookmarks manager (go-shiori/shiori), allows a deleted or demoted owner to continue authenticating with full owner-level privileges for up to 30 days after account revocation. The root cause is that CheckToken in internal/domains/auth.go validates only the JWT HMAC signature and trusts the embedded claims without re-querying the database, and no token revocation or session store mechanism exists anywhere in the codebase. An attacker who previously held an owner-level account - such as a terminated employee - retains full read/write access to all bookmarks and administrative functions until the token's natural expiry. No active exploitation confirmed (no CISA KEV listing); no public exploit code identified at time of analysis.
Cross-site request forgery in the GDPR Cookie Compliance WordPress plugin before 5.1.0 allows an unauthenticated attacker to forcibly expire and delete any visitor's session cookies by luring them to a crafted link. The plugin exposes a cookie-expiration action that performs no nonce or request-origin validation, meaning a single malicious URL can silently trigger it in any logged-in user's browser context. Exploitation logs the targeted user out of the WordPress site. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.12% (2nd percentile) indicates exploitation remains rare in the wild; this is not in CISA KEV.
Unauthenticated payment hijacking in WPFormify - Stripe Payments with Form and Checkout (all versions ≤ 1.1.1) allows any remote attacker to overwrite or delete the site's Stripe API credentials with zero authentication. Two plugin functions registered on WordPress's `admin_init` hook are reachable via the publicly accessible `admin-post.php` endpoint because they perform no capability check and no nonce verification. An attacker exploiting this can silently redirect all customer payments to an attacker-controlled Stripe account, or disable payment processing entirely by erasing the stored credentials - with no public exploit identified at time of analysis but trivially low exploitation complexity.
Unauthorized information disclosure in the MLSImport: IDX Plugin & MLS Plugin for Real Estate Listings WordPress plugin (all versions before 7.0.4) exposes import log files and import-related post metadata to any authenticated user, including low-privilege subscribers. The flaw stems from a missing authorization and CSRF check on an AJAX action, meaning any logged-in WordPress user on an affected site can invoke the endpoint and read sensitive operational data. A publicly available proof-of-concept exists (reported by WPScan), though EPSS places exploitation probability at 0.10% and SSVC confirms no known active exploitation at time of analysis.
Unauthenticated remote write access in the toner-management PHP application allowed any attacker to invoke admin-tier database operations - INSERT, UPDATE, and DELETE - across inventory entities including toners, printers, consumers, tickets, and staff records. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no credentials, session token, or user interaction are required; the admin write handlers (add.php, edit.php, delete.php) were directly reachable over HTTP and processed SQL operations unconditionally. A fix has been merged via GitHub PR #1 adding session-based admin role validation to all affected handlers, but no formally tagged release version has been confirmed. No public exploit code and no CISA KEV listing are identified at time of analysis.
Arbitrary file deletion via path traversal in the Content Egg WordPress plugin (versions up to and including 11.3.0) enables authenticated attackers holding author-level access or higher to delete any file accessible to the PHP process on the server's filesystem. The root cause is that the `img_file` field within `cegg_data` post metadata is sanitized only with `wp_strip_all_tags()` - which removes HTML tags but leaves path traversal sequences intact - stored verbatim in post meta, then concatenated without normalization into a filesystem path inside `getFullImgPath()` (ImageHelper.php:L149) before being passed to PHP's `unlink()`. Deletion of critical WordPress files such as `wp-config.php` can cascade into remote code execution by triggering the WordPress reinstallation flow; no public exploit or CISA KEV listing identified at time of analysis.
Unauthenticated network access to WLED's GET /json/cfg endpoint exposes full device configuration - including network credentials, hardware layout, and LED setup - to any client on the same network, while a separate global-state authentication flaw in wled.h allows any attacker who submits the correct 4-digit PIN via POST /json to instantly grant full write access to all subsequent unauthenticated clients until the device reboots. The write-access window enables critical operations including OTA firmware flashing, WiFi reconfiguration, and factory reset. No public exploit code or CISA KEV listing has been identified at time of analysis, but the 10,000-combination PIN space with no described rate-limiting makes the authentication bypass trivially automatable against any network-reachable WLED instance.
Slab-out-of-bounds read in the Linux kernel's ksmbd SMB2 server allows remote unauthenticated attackers to crash the kernel or leak one byte of adjacent slab memory by sending a crafted compound SMB2 request. The vulnerable path in ksmbd_smb2_check_message() reads the 2-byte StructureSize2 field at offset 64 from each compound element without first confirming the element is at least 66 bytes, so a trailing element of exactly 64 bytes causes a one-byte overread beyond the receive buffer. No exploitation has been publicly confirmed (EPSS 0.16%, 5th percentile, not in CISA KEV), but the unauthenticated network attack vector (CVSS 8.2) makes any ksmbd-exposed host a realistic DoS target. Vendor-released patches are available across all maintained stable kernel series.
NULL pointer dereference in HDF5's H5Pget_fill_value function (all versions before 2.1.1) enables denial of service by processing a specially crafted HDF5 dataset file. The flaw arises when a fill value message (format version 1 or 2) carries the 'defined' flag alongside a negative size field - a malformed state the library fails to normalize to its internal 'undefined' sentinel - allowing a NULL datatype pointer to reach H5T_path_find and crash the process. No public exploit identified at time of analysis; the CVSS 4.0 score of 8.2 reflects high availability impact, but the local file-parsing vector and user interaction requirement meaningfully constrain real-world exposure.
Horizontal privilege escalation in Leantime through 3.6.2 allows any authenticated user to read live TOTP secrets or strip two-factor authentication from arbitrary accounts via unenforced JSON-RPC endpoints, fully defeating per-account 2FA protection. The four affected methods - getSetupData, saveSecret, verifyAndEnable, and disable2FA - accept a caller-supplied userId with no ownership check, session pinning, or permission gate, unlike other methods in the same RPC dispatcher. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the low exploitation complexity (authenticated, network-accessible, no user interaction) makes it a credible lateral-escalation risk in any multi-user Leantime deployment.
URI normalization bypass in Keycloak's Authorization Services PathMatcher allows authenticated low-privilege users to reach administrative or restricted endpoints by appending trailing slashes or matrix parameters to request URIs. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, Red Hat Data Grid 8, and Red Hat JBoss EAP Expansion Pack. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the high CVSS confidentiality and integrity impact scores reflect meaningful privilege escalation risk in production environments.
MailChimp Forms by MailMunch (WordPress plugin) versions up to and including 3.2.7 allows any authenticated subscriber-level user to silently hijack the site's MailMunch account integration, redirecting all captured lead data to an attacker-controlled account. The missing capability check on the `sign_in()` and `sign_up()` AJAX handlers (CWE-862) means a low-privilege WordPress account is sufficient to relink the plugin to an attacker's own MailMunch account - after which every form submission is delivered to the attacker and the site's forms and landing pages are served from the attacker's MailMunch workspace. No public exploit code has been identified at time of analysis, but the attack surface is trivially accessible to any authenticated user.
Privilege escalation in Keycloak's Dynamic Client Registration (DCR) component allows attackers with standard user accounts and limited Initial Access Tokens to forge administrative roles directly into their own access tokens. The underlying flaw is a missing claim-path validation in the default DCR policy for User Property mappers, which permits writing attacker-controlled values into sensitive internal claim locations that normally carry role and privilege assertions. Successful exploitation enables takeover of other registered OAuth clients, exfiltration of confidential client secrets, and full administrative control over the affected Keycloak realm. No confirmed active exploitation or public exploit code is identified at time of analysis.
Server-side template injection in DjangoCRM's massmail module allows authenticated users with mass-mail edit rights to execute arbitrary Django Template Language expressions by injecting syntax into EmlMessage subject and content fields, which are passed unsanitized to Django's Template() constructor across three separate code locations. Successful exploitation can disclose other users' account data and password hashes from Django request context variables, exfiltrate CSRF tokens enabling cross-site request forgery, and include arbitrary registered templates. No KEV listing or public exploit code has been identified at time of analysis, but the low attack complexity and high-confidence CVSS 8.1 rating indicate meaningful risk for deployments where mass-mail edit rights are granted to non-administrator users.
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, though the scope change (S:C) and high confidentiality and integrity impact in the CVSS vector underscore meaningful post-exploitation consequence within the MarkLogic environment.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Broken access control in IBM Langflow OSS 1.0.0-1.10.3 allows any authenticated user to inject arbitrary graph data into the shared execution cache for flows they do not own, via the deprecated POST /api/v1/build/{flow_id}/vertices endpoint. The endpoint performs no ownership validation, enabling cross-user cache pollution that can corrupt other users' workflow state, trigger unauthorized execution of foreign flows, or produce denial of service across a shared platform instance. No public exploit code exists and CISA KEV does not list this vulnerability; EPSS (0.20%, 10th percentile) and SSVC (exploitation: none, automatable: no) collectively indicate low immediate exploitation risk despite the high CVSS score.
Cross-site request forgery in the Search Analytics for WP WordPress plugin (all versions through 1.4.16) allows an unauthenticated remote attacker to permanently delete all search-term records and associated search-history rows by tricking an authenticated Administrator into clicking a crafted link. The root cause is a complete absence of nonce validation in the `process_bulk_action()` function of the `MWTSA_Stats_Table` class, meaning any forged HTTP request that reaches the endpoint during a valid admin session will execute destructive bulk-delete operations unchallenged. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and irreversible data-loss impact elevate practical risk for any WordPress deployment relying on this plugin's analytics data.
Unauthorized access to other users' personal data in SirenGPS Android Application 2.19.44 stems from the backend API failing to verify that a requesting user is authorized to act on the target user identifier supplied in API parameters. An authenticated attacker exploiting this horizontal privilege escalation can read and overwrite arbitrary users' personal information with only low-privilege access. No public exploit identified at time of analysis and EPSS is extremely low (0.15%, 5th percentile), but a detailed researcher advisory is publicly available on GitHub, lowering the bar for replication.
Remote code execution and arbitrary file deletion in Zigbee2MQTT stem from an unsanitized path.join() call in ExternalJSExtension.getFilePath() (lib/extension/externalJS.ts), allowing any MQTT client with publish access to escape the extensions directory via traversal sequences and write arbitrary files to the host filesystem. Once the malicious .js file is written, Zigbee2MQTT immediately imports it via Node.js import(), executing attacker-controlled code in the application process context. The same vulnerable code path also backs the extension-removal handler, yielding a second primitive for arbitrary file deletion. No public exploit or KEV listing was identified at time of analysis, but the exploitation path is mechanically straightforward given the detailed description.
OS command injection in @oblique/cli 15.4.0 allows arbitrary shell command execution on the local system when a developer invokes the project-creation feature with a crafted project name. The CLI passes user-supplied input directly into shell commands via string concatenation before calling Node.js execSync(), meaning shell metacharacters (semicolons, backticks, pipes) in the project-name argument are interpreted by the OS shell. The attack is limited to local execution contexts - an attacker must either control the project name passed to the CLI or socially engineer a developer into supplying a malicious string. No public exploit or CISA KEV listing has been identified at time of analysis, and a vendor patch (>=15.4.2) is available.
Incorrect buffer size calculation (CWE-131) in an unidentified Linux distribution package tracked by both Ubuntu and Red Hat enables local, user-interaction-triggered exploitation with high confidentiality, integrity, and availability impact, yielding a CVSS base score of 7.8. The local attack vector combined with a user-interaction requirement (AV:L/UI:R/PR:N) is consistent with a malicious file parsing scenario, where a user opens a crafted input triggering the buffer miscalculation. No public exploit has been identified at time of analysis, and no KEV listing is present; however, the full C:H/I:H/A:H impact triad indicates potential for memory corruption leading to arbitrary code execution.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem exposes systems running in WiFi 6 AP mode with FILS discovery configured to potential kernel heap corruption and privilege escalation. The flaw in ieee80211_set_fils_discovery() prematurely queues the old template for deferred freeing before confirming the new allocation succeeds; when kzalloc() fails, a stale pointer is retained and freed a second time upon AP teardown or reconfiguration. No public exploit identified at time of analysis; EPSS is 0.19% (8th percentile), consistent with the constrained exploitation prerequisites.
Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.
Double reference-count release (double netdev_put()) in the Linux kernel's IPv6 XFRM/IPsec policy subsystem allows a local low-privileged user to underflow a net_device refcount, producing kernel ref_tracker warnings and 'unregister_netdevice: waiting for <dev> to become free' hangs that can destabilize or crash the system and potentially enable privilege escalation through kernel memory corruption. The flaw exists in xfrm6_fill_dst() at net/ipv6/xfrm6_policy.c: on the error path where in6_dev_get(dev) returns NULL, netdev_put() is called but xdst->u.dst.dev is not cleared, so dst_destroy() later releases the same reference a second time. No public exploit and no CISA KEV listing have been identified at time of analysis; EPSS is 0.16% (5th percentile), indicating currently low automated exploitation probability.
Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.
Double-free memory corruption in the Linux kernel's mac80211 WiFi subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially leading to privilege escalation or denial of service. The flaw exists in ieee80211_set_unsol_bcast_probe_resp(), where kfree_rcu() is invoked on the old unsolicited broadcast probe response template before a new one is successfully allocated - if kzalloc() then fails, the stale pointer is re-queued for freeing during AP teardown or subsequent configuration updates, triggering a KASAN-detected double-free in softirq context. No public exploit exists and EPSS is extremely low (0.16%, 5th percentile), but the local PR:L CVSS vector and high C/I/A impact scores make this a meaningful kernel hardening target for multi-tenant or shared Linux environments.
Slab-out-of-bounds read in the Linux kernel btrfs free space cache loader allows a local attacker to trigger kernel memory corruption by supplying a crafted btrfs filesystem with an inflated num_entries value in the on-disk btrfs_free_space_header. All Linux kernel versions from commit 5b0e95bf607d through the patched stable releases across the 6.6, 6.12, 6.18, 7.1, and 7.2 series are affected. An attacker who can mount or cause the kernel to process such a crafted volume causes the io_ctl->index pointer to walk past the pages[] array boundary, with the overrun slot treated as a struct page and passed to crc32c(), culminating in a general protection fault with kernel code execution or information disclosure potential. No public exploit has been identified and this vulnerability is not in CISA KEV; EPSS places exploitation probability at the 5th percentile.
Double-release memory corruption in the Linux kernel's BPF TCP iterator (bpf_iter_tcp_batch) allows a local low-privileged user with BPF iterator access to trigger a kernel panic. When batch reallocation fails, the first bpf_iter_tcp_put_batch() call frees socket references and overwrites batch slots with socket cookies; if realloc then fails, the iterator's stop routine executes a second put_batch() and dereferences those cookie integer values as struct sock pointers, causing a KASAN-detected null-pointer dereference and kernel panic. No public exploit identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low current automated exploitation probability.
Double-free use-after-free in the Linux kernel's xfrm (IPsec) subsystem allows a low-privileged local user to corrupt kernel heap memory, potentially achieving privilege escalation. The race condition in xfrm_user_policy() between a non-atomic sk_dst_cache reset via setsockopt and the UDP fast-path's atomic xchg() reset causes both code paths to observe the same dst pointer and call dst_release() twice, freeing the xfrm_dst bundle while still in use. Critically, the description confirms this is reachable by an unprivileged user via user and network namespaces, making it exploitable on most modern Linux distributions where user namespaces are enabled by default. No public exploit exists and no KEV listing, but the KASAN-confirmed write-to-freed-memory primitive is a classic kernel privilege escalation vector.