Uncontrolled Recursion in Apache Lucy, a retired full-text search library, enables remote unauthenticated attackers to crash the service via a crafted input, resulting in a complete denial of availability across all versions ever released. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirms low-complexity, unauthenticated network exploitation with no confidentiality or integrity impact. No patch exists or will be issued by the Apache Software Foundation, as the project is officially retired; EPSS is low at 0.15% (5th percentile) and no active exploitation (CISA KEV) has been identified at time of analysis.
SQL injection in the ZTE Smart Life mobile app enables a local attacker with physical device access to execute UNION SELECT statements against the app's feedback.db SQLite database, extracting sensitive personal data including user account details, phone numbers, feedback content, and local debug log paths. Exploitation is severely constrained by the CVSS:3.1/AV:P/AC:H/PR:L/UI:R vector, requiring physical access to the device, a low-privilege authenticated session within the app, user interaction, and non-trivial attack complexity. No public exploit code or CISA KEV listing has been identified at time of analysis, and the vendor (ZTE PSIRT) has published a bulletin acknowledging the issue.
Out-of-bounds memory read in Electron's offscreen rendering pipeline allows a compromised GPU process to cause the browser/main process to read beyond a shared memory mapping boundary when producing `paint` event images, disclosing process memory or crashing the application. Exploitation requires two independent preconditions: the host application must enable `webPreferences.offscreen` (non-default) and an attacker must have already achieved code execution in the GPU process via a separate vulnerability. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Improper TLS hostname verification in IBM Business Automation Workflow exposes high-privilege sessions to man-in-the-middle interception by failing to validate that server certificates match the target hostname. Affected deployments span both containerized (Kubernetes/OpenShift) and traditional on-premises models across multiple release trains from 24.0.0 through 26.0.0. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is substantially bounded by the PR:H requirement - an attacker must already hold administrative credentials before exploitation is feasible.
CVE-2026-70437 is part of the Jenkins project's August 5, 2026 security advisory (jenkins.io/security/advisory/2026-08-05/), which addressed vulnerabilities across Jenkins core and at least ten plugins. The specific description for CVE-2026-70437 was not included in the provided data excerpt - the source text enumerates CVE-2026-70426 through CVE-2026-70435 before truncating. Based on sequential CVE assignment within this advisory, CVE-2026-70437 likely maps to one of the plugin fixes not yet accounted for: External Workspace Manager Plugin 1.4.2, SCM-Manager Plugin 1.12.1, or Webhook Secret Credentials Provider Plugin 32.v09c9b_522f0a_8, or to an unresolved issue in one of the eleven plugins named without fixes.
Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.
Unrestricted object instantiation in Jenkins 2.575 and earlier (LTS 2.568.1 and earlier) allows users holding Overall/Manage permission to instantiate arbitrary Java types through the project naming strategy configuration, including configuration objects intended exclusively for full administrators. This effectively breaks the permission boundary between Overall/Manage holders and full system administrators, enabling privilege escalation within the Jenkins controller. No public exploit has been identified at time of analysis, but fixed releases (Jenkins 2.576 and LTS 2.568.2) are available and should be applied promptly.
AES-GCM nonce exhaustion in Kong Event Gateway 1.0.0-1.1.1 and 1.2.0 allows an authorized consumer to recover partial message plaintext when the AWS IAM encryption feature is enabled and key rotation has not occurred. Because keys are only rotated on gateway reboot, a producer sustaining a high message rate can exhaust the NIST SP 800-38D-recommended random nonce limit (~2^32 encryptions), making nonce collisions statistically likely and enabling ciphertext XOR attacks. No public exploit exists and the vulnerability is not in CISA KEV; the CVSS 4.0 score of 2.3 reflects the narrow, condition-heavy exploitation path.
Integer underflow in the popt command-line option parsing library can crash any application that links against it when help text is rendered under specific terminal-width conditions. Affects local, low-privileged users on systems running popt-linked applications - a broad attack surface given popt's presence across Red Hat-derived Linux distributions. Impact is strictly denial of service against the affected application; no confidentiality or integrity loss is possible. No public exploit code or active exploitation has been identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
In the Linux kernel, the following vulnerability has been resolved: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest. prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFP_ATOMIC during reinsert. On failure the error path only WARN_ONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlist_del_rcu() dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab. Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail. Crash: Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrm_hash_rebuild RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190 RAX: dead000000000122 (LIST_POISON2 + offset) ... Call Trace: hlist_del_rcu (include/linux/rculist.h:599) xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: qca: fix NVM tag length underflow in TLV parser In the TLV_TYPE_NVM branch of qca_tlv_check_data() the tag loop bound is "while (idx < length - sizeof(struct tlv_type_nvm))". "length" is a signed int from the firmware TLV header and sizeof(struct tlv_type_nvm) is a size_t (12), so "length" is converted to size_t and any firmware-supplied "length" < 12 makes the subtraction wrap to a huge value. The loop body then reads a 12-byte struct tlv_type_nvm past the end of the short vmalloc'd firmware buffer (and the EDL_TAG_ID_* handlers can write past it). Rewrite the bound as "idx + sizeof(struct tlv_type_nvm) <= length"; both operands are non-negative, so it no longer underflows and a "length" too small for one record correctly skips the loop. BUG: KASAN: vmalloc-out-of-bounds in qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421) Read of size 2 at addr ffffc900000e5004 by task kworker/u9:0/52 Workqueue: hci0 hci_power_on Call Trace: ... kasan_report (mm/kasan/report.c:595) qca_download_firmware.isra.0 (drivers/bluetooth/btqca.c:421 drivers/bluetooth/btqca.c:617) qca_uart_setup (drivers/bluetooth/btqca.c:948) qca_setup (drivers/bluetooth/hci_qca.c:2029) hci_uart_setup (drivers/bluetooth/hci_ldisc.c:438) hci_dev_open_sync (net/bluetooth/hci_sync.c:5227) hci_power_on (net/bluetooth/hci_core.c:920) process_one_work (kernel/workqueue.c:3322) worker_thread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
In the Linux kernel, the following vulnerability has been resolved: wifi: p54: validate RX frame length in p54_rx_eeprom_readback() p54_rx_eeprom_readback() copies the requested EEPROM slice out of a device-supplied readback frame without checking that the skb actually holds that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in p54_rx_eeprom_readback()") closed the destination overflow by copying a fixed priv->eeprom_slice_size (and rejecting a mismatched advertised len), but the source side is still unbounded: nothing verifies the frame is long enough to supply that many bytes. A malicious USB device can send a short frame whose advertised len matches priv->eeprom_slice_size while the payload is truncated. The equality check passes and memcpy() reads past the end of the skb, leaking adjacent heap: BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) Read of size 1016 at addr ffff88800f077114 by task swapper/0/0 Call Trace: <IRQ> ... __asan_memcpy (mm/kasan/shadow.c:105) p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507) p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163) __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657) dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005) ... </IRQ> The buggy address belongs to the object at ffff88800f0770c0 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 84 bytes inside of allocated 704-byte region [ffff88800f0770c0, ffff88800f077380) Check that the slice fits in the skb before copying.
In the Linux kernel, the following vulnerability has been resolved: mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed attribute table itself instead of calling ip_valid_fib_dump_req(). The RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no RTA_OIF hits a NULL dereference. RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without CAP_NET_ADMIN, so an unprivileged user can trigger it. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189) Call Trace: mpls_dump_routes (net/mpls/af_mpls.c:2236) netlink_dump (net/netlink/af_netlink.c:2331) __netlink_dump_start (net/netlink/af_netlink.c:2446) rtnetlink_rcv_msg (net/core/rtnetlink.c:7033) netlink_rcv_skb (net/netlink/af_netlink.c:2556) netlink_unicast (net/netlink/af_netlink.c:1345) netlink_sendmsg (net/netlink/af_netlink.c:1900) __sock_sendmsg (net/socket.c:790) ____sys_sendmsg (net/socket.c:2684) ___sys_sendmsg (net/socket.c:2738) __sys_sendmsg (net/socket.c:2770) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Skip unset attributes, as ip_valid_fib_dump_req() does.
Untrusted pointer dereference in HDF5's h5dump utility (before version 2.1.1) causes a denial of service when processing specially crafted HDF5 files containing variable-length string datasets with more than one element rendered in binary mode. The stride calculation for per-element offsets becomes corrupted, causing subsequent elements to be read from misaligned memory addresses and dereferenced as pointers, crashing the tool. No public exploit code exists at time of analysis, and no active exploitation has been confirmed - the local attack vector and DoS-only impact make this a low operational priority for most environments.