Zephyr RTOS versions 3.7.0 through 4.4.1 expose a remotely triggerable NULL pointer dereference in the UpdateHub OTA firmware-update agent that crashes and resets any affected device. The probe handler parses CoAP-delivered JSON metadata into a fixed nested-array struct but validates only the outer array length, leaving the inner sha256sum pointer NULL when the server returns an empty inner object array; a subsequent strlen() on that NULL pointer produces a fatal CPU fault. A malicious or compromised UpdateHub server - or a network man-in-the-middle when DTLS is disabled - can trigger this unconditionally. No public exploit is identified at time of analysis; a vendor patch is available in version 4.4.2.
Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.
GitHub App provider injection in Dokploy PaaS (prior to v0.29.13) allows unauthenticated remote attackers to insert attacker-controlled GitHub App credentials - including client_secret, webhook_secret, and PEM private key material - into any target organization's configuration by forging the state parameter in the GitHub OAuth callback route. The route /api/providers/github/setup performed no session authentication (CWE-306), blindly trusting organizationId and userId values supplied by the caller in the state query parameter. No public exploit identified at time of analysis; a vendor-released patch is confirmed available as v0.29.13.
Authenticated regular users on Mastodon instances running 4.6.0-beta.1 through 4.6.3 can access personally identifying information - specifically the email address and last-used IP address - belonging to any other local user by invoking the admin collections controller show action, which incorrectly resolved to the general collection policy instead of the admin-scoped policy. The root cause is a single missing namespace argument in a Pundit authorize call (authorize @collection vs. authorize [:admin, @collection]), confirmed by commit diff and fixed in the 4.6.4 stable release. No public exploit code has been identified at time of analysis; notably, the NVD-assigned CVSS PR:N (unauthenticated) conflicts with the description's explicit requirement for a logged-in local user, overstating the raw score.
Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
Denial of service in Apache IoTDB's Thrift-based RPC service allows remote unauthenticated attackers to crash the database by sending a single crafted malformed frame. Improper validation of length fields (CWE-789) causes IoTDB to attempt arbitrarily large heap allocations, exhausting JVM memory and terminating the process with an OutOfMemoryError. Versions before 1.3.8 on the 1.x branch and 2.0.0 through 2.0.8 on the 2.0.x branch are affected; no public exploit code or CISA KEV listing has been identified at time of analysis.
Memory exhaustion in the Linux kernel TCP stack allows remote network-reachable attackers to trigger a reference leak in tcp_tw_bucket structures when PSP (Packet Security Protocol) policy lookup fails during packet processing in both IPv4 and IPv6 receive paths. TIME_WAIT socket references are not released on this failure path, causing a gradual accumulation of unreclaimable kernel memory. The CVSS score of 7.5 (High) reflects the network accessibility and potential for denial-of-service via memory exhaustion, though EPSS at 0.21% (11th percentile) and the absence from CISA KEV indicate no public exploit or confirmed active exploitation at time of analysis.
Null pointer dereference in the Linux kernel's libceph client crashes affected hosts processing malformed CRUSH map data from a Ceph cluster. Specifically, get_immediate_parent() during localized read selection fails to validate that a parent bucket's type has a corresponding entry in type_names before dereferencing type_cn, which may be NULL when the CRUSH map contains an incomplete hierarchy. Any Linux host acting as a Ceph client - including Kubernetes nodes with Ceph-backed persistent volumes and OpenStack compute nodes - is vulnerable to a kernel panic triggerable by a party controlling or compromising the upstream Ceph cluster. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.20% (10th percentile), but the network-accessible crash path and the wide deployment of Ceph in enterprise environments make patching a practical priority.
Kernel panic via crafted zero-monitor Ceph monmap in Linux libceph allows a network-reachable attacker to crash systems running the Ceph client. The libceph subsystem's ceph_monmap_decode() function fails to reject CEPH_MSG_MON_MAP messages advertising zero monitors - a logically impossible state, since no live monitor could emit such a map - accepting the corrupted payload as valid. Subsequent session establishment in __open_session() calls pick_new_mon(), where the hardcoded assertion BUG_ON(monc->monmap->num_mon < 1) triggers an immediate kernel panic. With EPSS at 0.20% (10th percentile) and no CISA KEV listing, large-scale exploitation is not currently observed, but the unauthenticated network-reachable CVSS vector makes this relevant for any environment running Ceph-attached Linux hosts.
Kernel panic via buffer overrun in the Linux kernel's drop_monitor subsystem when reporting packet drop events on 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS. The size calculation functions net_dm_packet_report_size() and net_dm_hw_packet_report_size() under-budget SKB allocation by up to 4 bytes, failing to account for the alignment padding that nla_put_u64_64bit() inserts on affected architectures, resulting in skb_over_panic() and a full kernel crash. No public exploit is known, and EPSS at 0.20% (10th percentile) reflects low exploitation probability consistent with the architecture-specific trigger condition.
Recursive locking deadlock in the Linux kernel audit subsystem causes a complete, unrecoverable kernel hang when a file matching an executable audit rule is renamed. Affected kernels from 4.3 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc1 are vulnerable. Any local user able to rename a file that matches an active exe= audit rule can trigger the deadlock, forcing a hard reboot; no public exploit exists and EPSS is 0.18%, consistent with the specific preconditions required.
NULL pointer dereference in the Linux kernel's af_iucv network subsystem allows a remote attacker to crash a vulnerable kernel via a crafted SYN packet under low-memory conditions, resulting in a denial of service. The flaw resides in afiucv_hs_callback_syn(), where an unconditional call to iucv_sock_kill(nsk) is made even when nsk is NULL following a failed GFP_ATOMIC socket allocation, causing an immediate kernel panic. No public exploit is identified at time of analysis, and EPSS sits at 0.18% (7th percentile), reflecting low probability of widespread exploitation; however, the mainframe-specific HiperSockets network path reduces the realistic attacker pool significantly.
Kernel crash via assertion failure in the RBD (RADOS Block Device) subsystem of the Linux kernel allows a denial-of-service condition when a crafted or corrupted OSD reply message with a positive result code is received during an object map update. Affected kernels from 5.3 onward lack the positive-result-code reset in `rbd_object_map_callback()` that already exists in `rbd_osd_req_callback()`, causing `rbd_assert(*result < 0)` in `__rbd_obj_handle_request()` to trigger and crash the kernel. No public exploit has been identified at time of analysis, and EPSS stands at 0.18% (7th percentile), indicating low observed exploitation probability.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Kernel panic via integer overflow in the SCTP stream-reset path allows an unauthenticated remote peer to crash Linux systems running SCTP on interfaces with MTU exceeding 65535 bytes. sctp_process_strreset_inreq() fails to validate that the RESET_OUT_REQUEST constructed in response to a peer's RESET_IN_REQUEST would stay within SCTP_MAX_CHUNK_LEN, causing a __u16 overflow in sctp_make_strreset_req() that produces an undersized socket buffer and a fatal kernel BUG. No public exploit has been identified and EPSS is 0.17% (6th percentile), but the impact is total denial of service on affected hosts.
Kernel panic (denial of service) in the Linux kernel vmxnet3 driver affects VMware-hosted Linux guests receiving Geneve-encapsulated network traffic. The vmxnet3_get_hdr_len() function contains unguarded BUG_ON() assertions that assume hardware completion descriptor flags always describe outer headers; when the VMware VMXNET3 hardware signals inner-header processing of a Geneve tunnel packet via the VMXNET3_RCD_HDR_INNER_SHIFT bit, these assertions fire against the wrong protocol fields, crashing the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (6th percentile), reflecting very low current exploitation interest despite the elevated CVSS 7.5 base score.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
Use-after-free in the Linux kernel cfg80211 WiFi subsystem exposes systems with wireless adapters to potential kernel memory corruption via a race condition between scheduled scan result processing and WiFi device unregistration. All Linux kernel versions from approximately 3.0 (commit 807f8a8c) through stable releases prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6 are affected wherever cfg80211-based WiFi drivers are in use. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low current exploitation probability despite the kernel-level C:H/I:H/A:H impact potential.
Remote unauthenticated account takeover in fastschema through v0.15.1 is enabled by a TOCTOU race condition in the OTP-based account recovery flow. The verifyOTPSession function in pkg/auth/local.go reads and increments the attempt counter in separate non-atomic operations, allowing concurrent HTTP requests to race past the attempt limit before any counter update is committed. With no effective limit enforced on a 6-digit OTP (1,000,000 possible values), an attacker can brute-force valid codes; no public exploit is identified at time of analysis and this CVE is not in CISA KEV.
Hard-coded credentials embedded in the Zyxel WAH7601 mobile Wi-Fi hotspot firmware expose sensitive constants within the device executable, enabling adjacent-network attackers without any prior privileges to bypass authentication and achieve high-impact confidentiality and integrity compromise. All WAH7601 firmware versions through 20.07.2026 are confirmed affected per TR-CERT advisory TR-26-0799 and NVD. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity characteristic of CWE-798 makes this a credible near-term risk in environments where adjacent access is not tightly controlled.
Buffer overflow in the Linux kernel's Amlogic C3 ISP driver allows a local low-privileged attacker to trigger out-of-bounds memory access via crafted camera parameter configurations, with potential for kernel memory disclosure and system crash. Affected functions c3_isp_params_awb_wt() and c3_isp_params_ae_wt() in drivers/media/platform/amlogic/c3/isp/c3-isp-params.c fail to validate zones_num against the fixed-size zone_weight array bounds (768 entries for AWB, 255 for AE). Patched upstream in kernel versions 6.18.42, 7.1.6, and 7.2-rc1; EPSS is 0.21% with no public exploit or CISA KEV listing, indicating low active exploitation pressure.
Out-of-bounds kernel memory access in the Linux drm/xe Intel GPU driver allows a local low-privileged user to read sensitive kernel memory, cause a kernel panic, or potentially corrupt kernel state. The flaw exists in the BO (buffer object) prefetch path of the Intel Xe GPU subsystem, where DRM_XE_CONSULT_MEM_ADVISE_PREF_LOC (value -1) is incorrectly used as an array index into region_to_mem_type[], accessing memory before the array's base address. Discovered via AI-assisted static analysis confirmed by Intel Product Security; no public exploit or CISA KEV listing identified at time of analysis.
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Heap buffer overflow in the Linux kernel's SCTP authentication subsystem allows a local low-privileged user to corrupt kernel memory by adding more than 16 authentication chunk types to an SCTP endpoint. The capacity mismatch between sctp_auth_ep_add_chunkid()'s limit of SCTP_NUM_CHUNK_TYPES (20 entries) and the destination struct sctp_cookie's SCTP_AUTH_MAX_CHUNKS (16 entries) causes sctp_association_init() to memcpy up to 4 bytes past the auth_chunks buffer boundary. No public exploit has been identified at time of analysis and EPSS sits at the 6th percentile, but the kernel-space memory corruption potential and CVSS score of 7.3 warrant timely patching on any system where untrusted local users have shell access.
Command injection in Kitty terminal emulator prior to v0.48.2 allows arbitrary shell command execution when a user views attacker-controlled terminal output. The @kitty-echo DCS handler writes printable shell command characters directly to the child shell's stdin without sanitization, while the @kitty-ssh handler emits a newline via get_ssh_data - chaining the two handlers delivers a complete command-plus-newline to the running shell, executing attacker-supplied code as the user. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in v0.48.2.
Incorrect default permissions in Samsung Bixby prior to version 4.0.86.0 allow a local attacker with low privileges to execute arbitrary commands within the Bixby process context. The flaw exists in the out-of-box permission configuration - no special user-triggered setup is required to be vulnerable. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, the local privilege escalation to Bixby's execution context presents meaningful risk for shared-device and enterprise fleet environments.
Privilege escalation in Red Hat OpenShift AI's Data Science Pipelines component allows authenticated tenants to bypass authorization controls in the setDefaultServiceAccount function by submitting a crafted CreateRun request that references a more privileged ServiceAccount than they are entitled to use. Successful exploitation enables the tenant's pipeline containers to run with elevated Kubernetes RBAC permissions, resulting in cross-namespace secret disclosure and the ability to execute commands inside other tenants' pods. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Full application database read in Metabase is achievable by any authenticated low-privileged user due to a missing authorization check (CWE-862). Any user with a valid account - regardless of their assigned role or permissions - can issue requests that return the entire contents of the Metabase backend database, potentially exposing database connection credentials, API keys, user account data, and sensitive query results. No public exploit has been identified at time of analysis, but the low exploitation complexity and broad attacker pool (any registered user) make this a high-priority remediation item.
Broken access control in ERPNext's accounts module permits authenticated low-privilege users to invoke privileged write operations across five functions - merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center - without any server-side permission enforcement. All v15 releases prior to 15.112.0 and all v16 releases prior to 16.22.0 are affected. An attacker with any valid ERPNext session can directly call these whitelisted API endpoints to corrupt financial accounts, payment reconciliation jobs, purchase invoices, and cost centers beyond their assigned role, with no public exploit identified at time of analysis.
Broken access control in ERPNext's Accounts Receivable and Payable report engine allows any authenticated user to read cross-company financial data they are not authorized to view. The `ReceivablePayableReport.prepare_conditions()` method fails to enforce Customer and Supplier user permissions against the Payment Ledger Entry dynamic-link party field, meaning permission boundaries set via Frappe's user permission system are silently bypassed for this report path. Fixed in versions 15.112.0 and 16.23.0; no public exploit identified at time of analysis.
Cross-tenant authorization bypass in Attendize through commit 9289acb permits an authenticated organizer to inject persistent, mandatory survey questions into a different organizer's events by supplying an arbitrary event_id to the POST /event/{event_id}/question/create endpoint. The postCreateEventQuestion method resolves the target event without applying tenant-isolation scoping, so the write succeeds across tenant boundaries; the injected question is then irremovable by the victim because the victim's account-scoped delete path cannot resolve a record owned by another tenant. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in the CISA KEV catalog.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
SQL injection in Discourse's Data Explorer plugin exposes the entire database to unauthorized reads by any user who can execute a shared parameterized query, including non-staff group members. The flaw stems from recursive parameter interpolation: a crafted parameter value could introduce additional parameters, and SQL comment syntax could be used to inject arbitrary statements. Queries execute in a read-only PostgreSQL transaction, so writes are blocked, but every database table - including private messages, user emails, hashed credentials, and API keys - is readable. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Out-of-bounds read in the Linux kernel Cedrus V4L2 stateless H.264 video decoder driver exposes kernel memory and can cause system instability when a local low-privileged user submits crafted H.264 decode requests with invalid DPB reference indices. The flaw exists in `_cedrus_write_ref_list()`, which uses userspace-supplied ref_pic_list0/ref_pic_list1 index values to index into the fixed `decode->dpb[]` array without bounds validation, accepting out-of-range sentinel values that are technically legal in the stateless H.264 API but were never guarded at the driver use site. No public exploit identified at time of analysis; EPSS of 0.20% at the 10th percentile reflects the niche hardware platform and local-only access requirement.
Premature device-live marking in the Linux kernel ublk subsystem causes stranded block I/O requests and indefinite fsync hangs on ext4 filesystems. The flaw exists in ublk's user-recovery state machine: if a ublk daemon sends END_USER_RECOVERY after START_USER_RECOVERY fails (e.g., with -EBUSY) and the error is silently ignored, a stale edge-triggered completion latch from a prior recovery cycle satisfies the kernel's readiness wait prematurely, marking the device LIVE while I/O cancellation flags are still set. Any local low-privileged user able to control or interact with a ublk server process can trigger this race, causing persistent uninterruptible-sleep hangs across all fsync calls and blocking kernel teardown - confirmed by a real report of lost PREFLUSH with ext4 on ublk after daemon crash recovery. No public exploit code and no KEV listing have been identified at time of analysis.
Kernel panic and unauthorized physical memory access are possible on arm64 Linux systems when huge_ptep_get() receives an unaligned virtual address during contiguous huge page table walks. On arm64 platforms configured with 16K page size - where CONT_PTES differs from CONT_PMDS - the kernel's find_num_contig() routine misidentifies a contpmd block as a contpte block, iterates past the valid PTE table boundary, and dereferences a garbage linear-map pointer, either crashing the kernel or touching physical memory not owned by the calling process. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS is 0.20% at the 10th percentile, reflecting very low real-world exploitation probability.
Buffer overflow in the Linux kernel's mlx5 network driver allows a local low-privileged attacker to crash the kernel or read out-of-bounds kernel memory when querying module EEPROM data via ethtool on systems equipped with Mellanox/NVIDIA ConnectX adapters that advertise the mcia_32dwords capability. The root cause is a struct size mismatch: mlx5_ifc_mcia_reg_bits defines only 12 dwords (48 bytes) of MCIA register storage while the hardware can return up to 32 dwords (128 bytes), causing mlx5_query_mcia() to memcpy beyond the allocated buffer. No public exploit has been identified at time of analysis and EPSS remains low at 0.18%, but the kernel BUG triggered by FORTIFY_SOURCE on patched builds confirms the overflow is reliably reproducible.
Out-of-bounds read in the Linux kernel's TAS2781 ASoC audio driver firmware parser exposes systems with TAS2781 audio hardware to kernel memory disclosure and availability loss. The parser invokes strlen() on variable-length description strings read directly from a firmware image without first verifying a NUL terminator exists within the buffer, allowing a malformed firmware blob to drive pointer arithmetic past the allocated buffer boundary before downstream size checks execute. Patches have been released across multiple stable kernel branches (6.12.101, 6.6.148, 6.18.42, 7.1.6, 7.2-rc5); no public exploit or CISA KEV listing exists at time of analysis, and an EPSS score of 0.18% at the 7th percentile reflects minimal observed exploitation interest.
Incorrect pointer arithmetic in the Linux kernel's drm/imagination (PowerVR GPU) driver exposes kernel memory to local users and can trigger availability failures. The `pvr_set_uobj_array()` function swaps the stride increments for the kernel and userspace pointers when copying object arrays, so with a larger userspace stride the kernel reads and forwards data from wrong kernel addresses (confidentiality breach), and with a smaller stride it writes copies at wrong userspace offsets (potential crash or memory corruption). Exploitation requires local, low-privileged access to a system running an affected kernel with an Imagination Technologies PowerVR GPU; no public exploit has been identified at time of analysis and EPSS is low at 0.18%.
Bounds validation is absent in the AMD KFD CRIU restore path of the Linux kernel, exposing local low-privilege users on AMD GPU systems to kernel memory disclosure and availability loss. The drm/amdkfd subsystem accepts user-controlled queue type and mqd_size values during CRIU restore without range checking, allowing crafted inputs to drive out-of-bounds kernel memory access. No public exploit has been identified, and vendor-released patches are confirmed in Linux 6.18.42 and 7.1.6.
Slab-out-of-bounds read in the Linux kernel's wifi cfg80211 subsystem exposes systems with WiFi interfaces to kernel crash or minor memory disclosure when parsing crafted 802.11 frames from a rogue access point. The flaw, located in cfg80211_is_element_inherited() within net/wireless/scan.c, is triggered during Multi-Link Element (MLE) per-STA profile parsing when a zero-length WLAN_EID_EXTENSION element is present in a (re)association response or non-transmitted BSS profile - causing the parser to read one byte past the end of the element buffer. No public exploit or KEV listing exists at time of analysis; EPSS at 0.17% (6th percentile) reflects low current exploitation probability, though the adjacent-network attack vector and zero-privilege requirement keep real-world risk elevated for WiFi-attached Linux endpoints.
Linux kernel's IB/mad subsystem exposes unauthenticated adjacent-network attackers to a kernel availability and integrity impact through premature RMPP reassembly state allocation. Systems with InfiniBand hardware running Linux 2.6.13 through multiple active stable branches are vulnerable: an attacker on the InfiniBand fabric can send unsolicited RMPP DATA responses routed to a kernel RMPP agent via crafted high TID bits, causing the kernel to allocate or extend RMPP receive state without any validated corresponding send request. EPSS exploitation probability is very low (0.16%, 6th percentile), no public exploit or CISA KEV listing exists, but the availability impact is rated High, making this a meaningful risk in HPC and data-center InfiniBand environments.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Stack-out-of-bounds read in the Linux kernel's XFRM/IPsec subsystem allows a local user with network policy configuration privileges to read out-of-bounds kernel stack memory and potentially crash the system by crafting an outbound XFRM policy using an optional IPTFS-mode template. The flaw is an incomplete fix: commit 3d776e31c841 blocked optional tunnel and BEET templates in outbound policies to prevent this exact class of bug, but the later-added IPTFS mode was never covered by that restriction. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.15%, and a functional reproducer is embedded in the upstream fix commit, lowering the barrier for any local attacker who discovers the configuration.
Arbitrary command execution in the goose AI agent's `goose review` command allows a malicious Git repository to run attacker-controlled code on the host before any model interaction occurs. The vulnerability exists in versions prior to 1.44.0 and stems from goose invoking the system `git` binary without suppressing the `core.fsmonitor` configuration key, meaning a repository's `.git/config` can nominate an arbitrary command that Git then executes during index refresh. Exploitation requires only that a user runs `goose review` inside a malicious repository, and the injected command inherits the user's full environment - including provider API keys and filesystem access. No public exploit has been identified at time of analysis, though the fix commit and advisory are public.
Improper access control in the Weaver component of Samsung Mobile devices allows a local attacker without elevated privileges to render the device inoperable, achieving high integrity and availability impact. All Samsung Mobile devices running Weaver prior to the SMR Aug-2026 Release 1 security update are affected. No public exploit code or active exploitation has been confirmed at time of analysis, but the low attack complexity and absence of privilege requirements lower the bar for abuse by a local threat actor.
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.
Unauthenticated access to Apache Ranger Download APIs on versions 2.8.0 and earlier exposes sensitive authorization policy data to any remote attacker with network connectivity. The missing authentication check (CWE-306) means no credentials or privileges are required to invoke these endpoints and retrieve their output. No public exploit code has been identified at time of analysis, but the low complexity and zero-authentication nature of the CVSS vector (AV:N/AC:L/PR:N/UI:N) makes this trivially exploitable by any attacker who can reach the Ranger Admin interface.