Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
Integer truncation in the Linux kernel TIPC subsystem allows low-privileged local attackers - including unprivileged users leveraging user namespaces - to crash the kernel via division by zero or trigger link malfunction. Two independent netlink code paths (TIPC_NL_MEDIA_SET via tipc_udp_mtu_bad() and TIPC_NL_BEARER_SET via bearer.c:1160) accept MTU values above U16_MAX (65535) without enforcing an upper bound, causing silent truncation when the values are stored in u16 fields in tipc_link_create(). No exploit code is publicly known and the vulnerability is not listed in CISA KEV; EPSS at 0.17% (6th percentile) confirms very low observed exploitation probability.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Deadlock in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user with GPU queue access to hang or crash the kernel by triggering asynchronous GuC exec queue teardown at device removal time. Affected are kernel versions across the 6.10.14-6.12 stable series on systems with Intel Xe architecture GPUs (Arc, Lunar Lake). No public exploit has been identified and EPSS is at the 6th percentile, indicating low real-world exploitation probability; the risk is primarily an availability impact via kernel deadlock rather than code execution despite the high CVSS score.
NULL pointer dereference in the Linux kernel's Intel Xe GPU SR-IOV virtual function (VF) driver allows a local user to crash the kernel during buffer object (BO) teardown. The flaw is triggered when CCS (Color Compression Surface) read/write buffers are freed after the device is unbound but while the DRM structure remains live, causing `xe_sriov_vf_ccs_rw_update_bb_addr` to dereference a NULL device pointer during process exit. CVSS rates this 7.8 (C:H/I:H/A:H) reflecting worst-case kernel-level impact, though practical exploitation is constrained by hardware and configuration prerequisites; EPSS is 0.16% (6th percentile) and no active exploitation is confirmed.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Server-side request forgery in gabehf/Koito through v0.3.2 lets authenticated users coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the album image endpoint. The CVSS scope-change rating (S:C) reflects that exploitation reaches beyond the vulnerable component itself - an attacker can pivot through the server to probe cloud metadata services, internal APIs, or RFC-1918 hosts unreachable directly from the internet. No public exploit or active exploitation is identified at time of analysis, but the low attack complexity and lack of URL validation make this straightforward to abuse once authenticated.
Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated user holding the 'manage Flow' permission. The HTTP Request app's Custom Request action passes caller-supplied URLs directly to the backend HTTP client with no allowlist, blocklist, or redirect controls, enabling full response-body retrieval from cloud metadata endpoints, internal APIs, and private network hosts. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-changed, high-confidentiality CVSS vector reflects the severity of lateral access achievable through this single permission.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Path traversal in o1lab/xmysql (all versions) allows unauthenticated remote attackers to read and download arbitrary files from the host server via a crafted query parameter. The flaw exists in lib/xapi.js at lines 338 and 424, where the unsanitized req.query.name value is joined with the working directory and passed directly to res.download(), enabling ../ sequences to escape the application root. No patch has been released and all versions are confirmed affected, making every exposed instance immediately actionable for attackers with network access.
Path traversal in mustafaakin/cast-localvideo (all versions) exposes arbitrary server files to unauthenticated remote attackers with trivial effort. The Node.js HTTP handler in app.js at lines 151-153 passes the user-supplied `req.body.dir` parameter directly to `res.sendFile()` without any path sanitization, permitting `../` sequences or absolute paths to escape the intended directory. No patch has been identified at time of analysis, no public exploit has been confirmed, and the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector means any internet-facing deployment is trivially exploitable.
Heap out-of-bounds write in GStreamer's adpcmdec element allows a crafted WAV file containing malformed multi-channel IMA/DVI ADPCM audio to corrupt application memory, cause denial of service, or potentially achieve arbitrary code execution. Affected deployments include Red Hat Enterprise Linux 7 through 10, where the vulnerable gst-plugins-bad package is distributed. No confirmed active exploitation (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 7.6 reflects the realistic network-deliverable, user-interaction-dependent attack path.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.
OS command injection in NASA HyperCP's OBPGSession.py enables arbitrary code execution on a researcher's workstation when a network-adjacent attacker spoofs or intercepts responses from oceandata.sci.gsfc.nasa.gov. The vulnerable handler passes unsanitized server response header fields directly to subprocess calls, meaning a MitM-positioned attacker can achieve full compromise of the victim machine by injecting shell metacharacters into crafted HTTP response headers during any HyperCP data download operation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-adjacent attack vector combined with complete C/I/A impact makes this a critical threat for research institutions operating on untrusted or shared networks.
Denial of service in ml-metadata (MLMD), a core metadata tracking component of Red Hat OpenShift AI (RHOAI), stems from an outdated statically-linked gRPC stack that retains known HTTP/2 resource exhaustion weaknesses. An in-cluster adversary with network reachability to the MLMD pod can crash it by sending specially crafted HTTP/2 requests, halting all ML pipeline runs within the affected namespace. No public exploit has been identified at time of analysis, and exploitation is constrained to actors already operating inside the Kubernetes cluster.
Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.
Unauthenticated denial-of-service in Mastodon's admin statistics API allows any remote caller to exhaust server database resources by submitting crafted requests to the measures and retention endpoints before authorization is enforced. Mastodon instances on versions prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0-beta.1 are exposed; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial, authentication-free exploitation at network range. No public exploit code or CISA KEV listing has been identified, but the low attack complexity and broad API exposure make unpatched public-facing instances an easy target for service disruption.
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
Authentication bypass in opensignserver through 2.37.0 exposes all stored files to unauthenticated remote attackers by allowing them to mint MASTER_KEY-signed file access tokens via the getsignedurl Parse cloud function. The bypass requires no credentials and no prior knowledge of valid document records - supplying any arbitrary string as the docId parameter causes the function to skip its isAuthenticated check entirely and issue a fully trusted signed token. No public exploit code or CISA KEV listing exists at time of analysis, but the bypass condition is trivially reproducible from the CVE description alone, making this a realistic and immediate threat to any internet-exposed instance storing sensitive signed documents.
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitive traffic via man-in-the-middle attacks against all deployments running version 2.8.0 or earlier. The client fails to validate that a server's TLS certificate hostname matches the actual server being contacted (CWE-297), meaning a forged or mismatched certificate will be accepted silently. A vendor-released patch is available in version 2.9.0; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Credential derivation in Red Hat OpenShift AI's Data Science Pipelines Operator allows unauthenticated remote attackers to predict MariaDB root/user passwords and MinIO access/secret keys by exploiting a cryptographically weak PRNG (CWE-338). Any attacker who can reach the MinIO Route or MariaDB Service over the network can compute valid credentials without prior authentication, then access all pipeline artifacts and metadata stored in the system. No active exploitation is confirmed and no public exploit code has been identified at time of analysis, but the CVSS 7.5 High rating with AV:N and PR:N reflects a no-authentication-barrier condition against exposed services.
Unauthenticated access to complete historical sensor data is possible in FUXA through version 1.3.3 because the DAQ_QUERY Socket.IO event handler in server/runtime/index.js omits the isSocketAdminAuthorized() check that guards every other sensitive Socket.IO event. Remote attackers can exfiltrate all sensor history without credentials even on deployments where secureEnabled=true is configured, silently undermining an operator's assumption that authentication is fully enforced. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS AV:N/AC:L/PR:N vector confirms this is trivially exploitable by any network-reachable party.
NULL pointer dereference in fastschema through v0.15.1 enables an unauthenticated remote attacker to crash the entire server process with a single HTTP request targeting the password-recovery endpoint. The flaw originates in the sendOTPEmail function in pkg/auth/local.go, which dereferences a pointer from an unchecked error path without nil validation, triggering a fatal Go panic that terminates the server. No public exploit or CISA KEV listing has been identified at time of analysis, but the trivial exploitation path (no authentication, no special configuration, single request) makes this a high-priority availability risk for any internet-exposed fastschema deployment.