Out-of-bounds write and use-after-free in the Intel Xe GPU DRM driver (drm/xe/pt) allows a local low-privileged attacker to corrupt kernel heap memory and crash or potentially escalate privileges on systems running affected Linux kernel versions. The flaw exists in xe_pt_update_ops_init(), which fails to reset current_op, needs_svm_lock, and needs_invalidation before each pass, causing unbounded counter growth across drm_exec retry loops triggered by lock contention or OOM eviction. No public exploit code exists and EPSS is extremely low (0.18%), though the memory corruption primitive is structurally serious.
Integer overflow in the Linux kernel's drm/amdkfd subsystem allows a local low-privileged user on systems with multi-die AMD GPUs to trigger an undersized CWSR save-area allocation that AMD firmware subsequently overruns, enabling kernel heap corruption with full confidentiality, integrity, and availability impact. Affected stable branches include all kernel versions before 6.12.101, 6.18.42, and 7.1.6, with patches released across all trees. No public exploit code or active exploitation has been identified; EPSS at 0.18% (7th percentile) reflects very low near-term exploitation probability.
Buffer management failures in the Linux kernel msi2500 USB SDR driver allow a local low-privileged user to cause kernel memory corruption through improperly handled start_streaming() error paths. Five distinct failure paths in msi2500_start_streaming() - including USB disconnection, mutex interruption, USB ADC setup failure, isoc initialization failure, and CMD_START_STREAMING failure - neglect to return queued vb2 buffers to the framework before returning errors, and the worst path leaves submitted isochronous URBs with no consumer. Patched stable releases are available (6.6.148, 6.12.101, 6.18.42, 7.1.6), no public exploit exists, and EPSS is 0.18% (7th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver allows a local attacker to trigger kernel memory corruption or a system crash through a race condition introduced during AMT device removal. The flaw arises because amt_dev_stop() uses cancel_delayed_work_sync() to cancel req_wq and discovery_wq, but event_wq can re-schedule req_wq after that cancellation completes yet before the netdev is freed - leaving delayed work items that dereference the already-released amt_dev structure. Upstream patches are confirmed available in stable kernel releases 6.12.101, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Out-of-bounds kernel heap write in the Linux kernel iomap subsystem allows a local unprivileged user to corrupt kernel memory and potentially escalate privileges to root. The flaw resides in ifs_set_range_dirty() and ifs_set_range_uptodate(), where an unsigned integer underflow on a zero-length range argument produces a near-SIZE_MAX block count, causing bitmap_set() to write arbitrarily far beyond the ifs->state allocation. The reachable code path through __iomap_write_end() requires no special configuration and affects all iomap-backed filesystems (ext4, XFS, etc.). EPSS is low at 0.18% (7th percentile), no KEV listing, and no public exploit has been identified; however, the C:H/I:H/A:H CVSS impact profile reflects the severity of uncontrolled kernel heap corruption.
Race condition in the Linux kernel's SLIP (Serial Line Internet Protocol) driver allows a local attacker with low privileges to trigger an out-of-bounds write or use-after-free in kernel memory, potentially enabling privilege escalation. The `slip_receive_buf()` callback reads and writes the receive buffer `rbuff` without holding `sl->lock`, while `sl_realloc_bufs()` replaces that buffer under the lock during MTU changes - creating a classic TOCTOU window where an MTU shrink can cause writes beyond the new smaller buffer or into a freed allocation. No confirmed active exploitation exists (not in CISA KEV) and the EPSS score of 0.18% places this in the 7th percentile, though kernel memory corruption of this class carries inherent privilege escalation potential.
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
Out-of-bounds memory writes in the Linux kernel's ARM Firmware Framework for Armv8-A (FF-A) driver expose local low-privilege users to kernel memory corruption on affected ARM platforms. Two distinct write-past-end defects exist in ffa_setup_and_transmit(): one triggered when the FFA protocol version is below 1.2 due to a struct size mismatch causing writes beyond allocated memory, and another from missing size validation before writing constituents. Upstream kernel patches are available across multiple stable branches (6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation has been identified at time of analysis, and EPSS probability is very low at 0.17%.
Use-after-free in the Linux kernel's AMD XDNA accelerator driver (amdxdna) exposes systems with AMD NPU hardware to local privilege escalation, kernel memory corruption, or system crash. The flaw exists in the job scheduler path: amdxdna_cmd_submit() stores a raw pointer to the submitting process's mm_struct in job->mm without calling mmgrab() to hold a structural reference, while aie2_sched_job_run() later dereferences that pointer from the DRM worker thread - after the originating process may have exited and freed the mm_struct. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) is consistent with specialized hardware prerequisites and no active exploitation campaign.
Use-after-free in the Linux kernel's PPP-over-L2TP subsystem exposes a race condition between softirq RX processing and socket teardown, reachable by an unprivileged local user and capable of yielding full kernel memory corruption and privilege escalation. The pppol2tp_recv() function runs under rcu_read_lock() but dereferences an internal struct channel that close() can free with a plain kfree() when the channel was bound via PPPIOCGCHAN without a subsequent PPPIOCCONNECT, bypassing all RCU grace-period fences. Patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV.
Use-after-free in the Linux kernel's Bluetooth MGMT subsystem allows a local attacker with low-privilege Bluetooth Management socket access to corrupt kernel heap memory and potentially escalate privileges to root. The flaw exists in MGMT_OP_LOAD_CONN_PARAM handling, where a borrowed hci_conn_params pointer stored in a queued work item can be freed by a subsequent LOAD_CONN_PARAM call before hci_cmd_sync_work executes the callback - a race-driven use-after-free confirmed by KASAN. No public exploit or active exploitation has been identified at time of analysis; patches are available across stable kernel series 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4.
Use-after-free in the Linux kernel's Bluetooth management subsystem allows a local low-privileged attacker to corrupt kernel memory during unpair_device or disconnect_sync operations, potentially achieving full kernel compromise (High C/I/A). The flaw stems from dereferencing RCU-protected hci_conn pointers outside proper critical sections, enabling a concurrent free of the structure while it is still in use. Vendor-released patches are available across multiple stable branches (6.6.148, 6.12.101, 7.1.6, 6.18.42); no public exploit code is identified at time of analysis, and EPSS of 0.17% indicates low immediate exploitation probability.
Use-after-free and data race conditions in the Linux kernel Bluetooth management subsystem allow a local low-privileged attacker to corrupt kernel memory, potentially escalating privileges to root. Affected kernels fail to properly hold reference counts on hci_conn objects stored in mgmt_pending_cmd structures and fail to acquire hdev->lock before accessing conn->state, enabling RCU-protected pointers to be dereferenced after the underlying memory has been freed. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low observed exploitation pressure despite the high CVSS score.
Use-after-free race condition in the Linux kernel's TC act_tunnel_key subsystem allows a local low-privileged attacker to corrupt kernel heap memory, potentially escalating privileges or crashing the system. The flaw exists in tunnel_key_release_params(), which synchronously frees metadata_dst via dst_release() while concurrent RCU readers in tunnel_key_act() may still hold the old params pointer and attempt dst_clone() on the already-dead reference. A proof-of-concept was developed by Trend Micro ZDI (zdi-disclosures@trendmicro.com) and verified by kernel maintainers with KASAN confirming slab-use-after-free; no public exploit is available beyond that researcher-held POC, and no KEV listing exists at time of analysis.
Use-after-free race condition in Linux kernel USB core sysfs allows a local low-privileged user to trigger concurrent memory access on freed BOS descriptor data, potentially leading to kernel memory corruption, privilege escalation, or system crash. The vulnerability arises in bos_descriptors_read() within the USB sysfs subsystem, where udev->bos is accessed without a lock while usb_reset_and_verify_device() - called by numerous drivers across the kernel - can free that same memory simultaneously. No public exploit code exists and the vulnerability is not listed in CISA KEV; the EPSS score of 0.17% confirms low observed exploitation probability at time of analysis.
Linux Kernel's MCTP I3C driver leaves a dangling notifier and leaked bus objects when mctp_i3c_mod_init() encounters an error during i3c_driver_register(). Systems running Linux 6.7 through the unpatched stable branches are affected when the mctp_i3c module is loaded under specific failure conditions. No public exploit code has been identified and EPSS is 0.17%, but the theoretical impact includes kernel memory corruption via the stale notifier pointer if a subsequent I3C bus event fires against the freed module memory.
Integer truncation in the Linux kernel TIPC subsystem allows low-privileged local attackers - including unprivileged users leveraging user namespaces - to crash the kernel via division by zero or trigger link malfunction. Two independent netlink code paths (TIPC_NL_MEDIA_SET via tipc_udp_mtu_bad() and TIPC_NL_BEARER_SET via bearer.c:1160) accept MTU values above U16_MAX (65535) without enforcing an upper bound, causing silent truncation when the values are stored in u16 fields in tipc_link_create(). No exploit code is publicly known and the vulnerability is not listed in CISA KEV; EPSS at 0.17% (6th percentile) confirms very low observed exploitation probability.
Use-after-free in the Linux kernel's RDS TCP subsystem allows a local low-privileged attacker to corrupt kernel memory during network namespace teardown, potentially achieving full privilege escalation to root. The flaw exists across multiple stable kernel branches (6.12.x before 6.12.101, 6.18.x before 6.18.42, 7.1.x before 7.1.6), with exploitation limited to systems where the RDS TCP module is loaded - a non-default configuration primarily found in Oracle RAC and HPC environments. Kernel patches have been merged across all affected stable branches; no public exploit exists and EPSS sits at 0.17%, indicating low current exploitation probability.
Use-after-free via refcount underflow in the Linux kernel's DRM Imagination (PowerVR) GPU driver allows a local low-privileged user to corrupt kernel memory during GPU context teardown. The drm_sched_entity_fini() function is called twice on the same scheduling entity - once via pvr_context_kill_queues and again via pvr_context_destroy_queues - triggering a refcount_t underflow exposed by commit fd177135f0e6 which added GPU entity time accounting. No public exploit identified at time of analysis, and EPSS at 0.17% (6th percentile) reflects low exploitation probability; exploitation requires hardware with an Imagination/PowerVR GPU.
Double-free and use-after-free conditions in the Linux kernel's drm/amd/display subsystem expose systems with AMD GPU hardware to potential privilege escalation or kernel crash. The flaw resides in dm_update_crtc_state(), where the skip_modeset path releases a display stream reference without nullifying the pointer, leaving it dangling for a second release if a subsequent error - such as a color management failure - triggers the fail label. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc4); no public exploit exists and EPSS sits at 0.17% (6th percentile), but the kernel-level memory corruption class demands prioritized patching on AMD GPU deployments.
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Out-of-bounds write vulnerabilities in GIMP's PSD and PAA file format parsing plugins allow remote attackers to achieve code execution with the privileges of the local user by delivering a specially crafted image file. Affected deployments include GIMP packages shipped with Red Hat Enterprise Linux 6 through 9. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation status as none with the attack assessed as not automatable, though technical impact is rated total given the C:H/I:H/A:H CVSS profile.
Stale mode_callbacks pointer dereference in the Linux kernel xfrm IPTFS subsystem causes kernel panic when deferred garbage collection runs after the xfrm_iptfs module has been unloaded following a failed IPTFS state initialization. The xfrm subsystem's __xfrm_init_state() caches x->mode_cbs before IPTFS setup completes, but releases the temporary module reference immediately on failure - leaving a dangling callback table pointer that xfrm_state_gc_task later dereferences against an unloaded module. No public exploit code exists and EPSS is 0.17% (6th percentile), though the vendor-assigned CVSS of 7.8 reflects worst-case kernel memory impact if the race is won.
Incorrect offset calculation in the Linux kernel's arm_ffa firmware subsystem exposes local privilege escalation on systems using the Arm Firmware Framework for Armv8-A (FF-A). The flaw uses a hardcoded sizeof(struct ffa_mem_region) instead of the descriptor's ep_mem_offset field to locate the endpoint memory access array, violating the FF-A specification. A local user with low privileges could exploit this memory misinterpretation to achieve high confidentiality, integrity, and availability impact; no public exploit or active exploitation (KEV) has been identified at time of analysis.
Incomplete error-path cleanup in the Linux kernel's Intel Xe DRM GPU driver leaks kernel SVM and pagemap resources during GPU VM creation failures on systems equipped with Intel Xe-architecture hardware. The flaw, introduced when commit 9e9787414882 made xe_svm_init() unconditional without updating the matching teardown calls on the drm_gpuvm_resv_object_alloc() failure path, affects both fault-mode and non-fault-mode VMs running kernels between the introducing commit and the three stable-branch fixes. No public exploit code exists and no active exploitation is confirmed; EPSS sits at the 6th percentile, reflecting appropriately low short-term weaponization likelihood.
Use-after-free in the Linux kernel's GPU host1x subsystem (`host1x_bo_clear_cached_mappings`) exposes local low-privileged users to potential kernel heap corruption leading to privilege escalation, memory disclosure, or system crash. The flaw occurs because `__host1x_bo_unpin()` frees the mapping object, yet the caller continues dereferencing `mapping` instead of the surviving `cache` local variable. Patches are confirmed across multiple stable branches (6.6.148, 6.12.101, 6.18.42, 7.1.6, 7.2-rc4); no public exploit or active exploitation is identified at time of analysis, and EPSS sits at an extremely low 0.16% (6th percentile).
Remote memory access corruption in the Linux kernel's RDMA/irdma subsystem allows a local user with RDMA device access to trigger an invalid CQP (Control Queue Pair) command carrying a zero-initialized mkey by invoking rereg_mr on special QP/CQ/SRQ buffer registrations that were never intended for re-registration. Affected systems include Intel RDMA-capable hardware environments running Linux 6.6.x through 6.6.147, 6.7, and related stable branches prior to the fix commits. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.16% (6th percentile), indicating limited exploitation interest despite the 7.8 CVSS score.
Use-after-free in the Linux kernel BPF subsystem allows a local low-privileged attacker to corrupt or access freed kernel memory through a race condition in socket cloning. The flaw exists in sk_clone() where a shallow copy via sock_copy() leaves newsk->sk_bpf_storage pointing to the parent socket's BPF local storage; if an early bailout occurs before bpf_sk_storage_clone() runs, subsequent freeing of the cloned socket destroys the parent's storage, triggering a UAF. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), indicating low current exploitation probability.
Use-after-free in the Linux kernel's Intel Xe discrete GPU driver (DRM/xe) allows a local unprivileged user to access freed kernel memory via a dangling pointer in the GuC execution queue scheduler. The scheduler retains a pointer to an exec queue's name string (`q->name`) that is freed when the exec queue is destroyed, while scheduler fence timelines can still dereference it. Affected kernel versions span the 6.12, 6.15, and 6.16 stable series; no active exploitation has been identified (EPSS: 0.16%, not in CISA KEV), though the impact is rated High (CVSS 7.8) due to full kernel memory read/write/crash potential.
Deadlock in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user with GPU queue access to hang or crash the kernel by triggering asynchronous GuC exec queue teardown at device removal time. Affected are kernel versions across the 6.10.14-6.12 stable series on systems with Intel Xe architecture GPUs (Arc, Lunar Lake). No public exploit has been identified and EPSS is at the 6th percentile, indicating low real-world exploitation probability; the risk is primarily an availability impact via kernel deadlock rather than code execution despite the high CVSS score.
NULL pointer dereference in the Linux kernel's Intel Xe GPU SR-IOV virtual function (VF) driver allows a local user to crash the kernel during buffer object (BO) teardown. The flaw is triggered when CCS (Color Compression Surface) read/write buffers are freed after the device is unbound but while the DRM structure remains live, causing `xe_sriov_vf_ccs_rw_update_bb_addr` to dereference a NULL device pointer during process exit. CVSS rates this 7.8 (C:H/I:H/A:H) reflecting worst-case kernel-level impact, though practical exploitation is constrained by hardware and configuration prerequisites; EPSS is 0.16% (6th percentile) and no active exploitation is confirmed.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Race condition in the Linux kernel RDMA/siw (Software iWARP) subsystem exposes partially-constructed Queue Pair (QP) objects to concurrent lookups during QP creation. Affected kernels from 5.3 onward allow a local, low-privileged user on systems with the siw driver loaded to trigger a QPN lookup that resolves to a QP whose queues, CQ pointers, state, and device list entry have not yet been initialized. This can result in kernel memory corruption, information disclosure, or system availability loss - all three impact dimensions confirmed by the CVSS C:H/I:H/A:H rating. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16% at the 5th percentile.
Race condition in the Linux kernel's TIPC UDP bearer implementation allows a local low-privileged attacker to corrupt an RCU-protected peer list, triggering a kernel BUG and enabling potential privilege escalation to full system compromise. The flaw exists in the TIPC subsystem where tipc_udp_rcast_add() (running from a softirq) and cleanup_bearer() (running from a workqueue) both mutate ub->rcast.list without synchronization, and critically, TIPCv2 generic-netlink ops lack GENL_ADMIN_PERM, allowing the race to be triggered from an unprivileged user namespace. No public exploit is identified at time of analysis, and EPSS probability is very low at 0.15% (5th percentile).
Element size miscalculation in the Linux kernel's accel/ethosu driver (Arm Ethos-U NPU) allows a local low-privileged user on hardware-equipped systems to bypass command stream validation and trigger out-of-bounds kernel memory access. Two discrete arithmetic errors - an entirely missing element size multiplier in the NHWC format path, and a shifted bitfield decode for OFM precision (bits 1:2 vs. the correct IFM bits 2:3) - cause the validator to underestimate buffer sizes for 16-, 32-, and 64-bit element widths. No public exploit code has been identified at time of analysis, and the EPSS score of 0.15% (5th percentile) reflects minimal observed exploitation activity; upstream fixes are available in Linux 7.1.6 and 7.2-rc5.
Broken Object Level Authorization in the Booking for Appointments and Events Calendar WordPress plugin (versions 9.0 through 9.6) permits any authenticated employee (provider) to read and modify the stored personal data of arbitrary customers by incrementing sequential record identifiers in the Employee Panel. The plugin fails to verify that the requesting employee has a legitimate relationship with the customer being accessed, enabling horizontal privilege escalation across all customer records. A publicly available exploit exists per WPScan, though EPSS of 0.13% (3rd percentile) suggests exploitation has remained uncommon; no CISA KEV listing has been confirmed at time of analysis.
Privilege escalation in libvirt's `virFileChownFiles()` function allows a process confined to the `swtpm` system user to coerce the root-level libvirtd daemon into reassigning ownership of any arbitrary file on the host to the `swtpm` user. The attack exploits a symlink-following flaw (CWE-59) in directory traversal logic that runs with root privileges, affecting libvirt as packaged across Red Hat Enterprise Linux 6 through 10 and RHEL for Nvidia 26. No public exploit has been identified at time of analysis, but the attack complexity is low once `swtpm`-user execution is obtained.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.
Feast and feast-operator ship with a default 'no_auth' security configuration, leaving the feature-server, registry-server, and offline-server endpoints completely unauthenticated and accessible to any network-reachable attacker in Red Hat OpenShift AI (RHOAI) deployments. Exploitation enables three distinct high-impact outcomes: remote code execution via injection of a malicious User-Defined Function (UDF) onto the feature-server, denial of service by forcing full re-materialization of all tenant features, and unauthorized read access to cross-tenant feature data. No public exploit code has been identified at time of analysis and CISA KEV status is not confirmed, but the trivial exploitation conditions - no authentication, no interaction, default configuration - make this a realistic priority for any RHOAI operator.
Remote OS command execution in SPIP before 4.4.18 is achievable by any authenticated editor-level user on SQLite-backed installations via the navigation menu endpoint. Array-typed GET parameters submitted to /ecrire/?exec=navigation bypass the CMS sanitization layer and break out of an internal PHP string evaluation context, enabling arbitrary command execution in the web server process. MySQL-backed deployments are not affected; no public exploit has been identified at time of analysis.
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Server-side request forgery in gabehf/Koito through v0.3.2 lets authenticated users coerce the application server into issuing arbitrary HTTP requests to internal or external hosts via the album image endpoint. The CVSS scope-change rating (S:C) reflects that exploitation reaches beyond the vulnerable component itself - an attacker can pivot through the server to probe cloud metadata services, internal APIs, or RFC-1918 hosts unreachable directly from the internet. No public exploit or active exploitation is identified at time of analysis, but the low attack complexity and lack of URL validation make this straightforward to abuse once authenticated.
Server-side request forgery in Automatisch through commit 41f3c56 exposes internal network services to any authenticated user holding the 'manage Flow' permission. The HTTP Request app's Custom Request action passes caller-supplied URLs directly to the backend HTTP client with no allowlist, blocklist, or redirect controls, enabling full response-body retrieval from cloud metadata endpoints, internal APIs, and private network hosts. No public exploit or CISA KEV listing has been identified at time of analysis, but the scope-changed, high-confidentiality CVSS vector reflects the severity of lateral access achievable through this single permission.
Out-of-bounds read in the Linux kernel drm/virtio driver allows a malicious virtio-gpu backend to leak adjacent guest kernel memory by returning a crafted EDID response with an inflated size and extension block count. Guests running Linux 5.0 through multiple unpatched stable branches are affected wherever virtio-gpu is in use, covering the majority of QEMU/KVM-based cloud VM deployments. No public exploit code is identified at time of analysis, and EPSS at 0.21% (11th percentile) reflects the high-privilege prerequisite of backend control, though the risk is material in adversarial multi-tenant cloud environments.
Out-of-bounds read in the Linux kernel hwmon OCC (On-Chip Controller) driver exposes adjacent kernel memory and risks system availability on IBM POWER hardware running affected kernel versions. The poll response parser uses a static backing-array capacity as its parse boundary rather than the data_length field embedded in the firmware response, allowing a truncated OCC reply to cause the parser to read block headers or extents outside the valid response window. Vendor-released patches are available across multiple stable branches; no public exploit or CISA KEV listing exists at the time of analysis.
Payment amount validation bypass in the Accept PayPal & Stripe with Subscriptions for WooCommerce WordPress plugin (all versions through 3.1.0) enables any customer to complete a purchase by paying less than the full order total, with the order subsequently marked as fully paid by the merchant system. The flaw lies in the PayPal Data Transfer (PDT) return handler, which processes the post-payment callback without performing server-side reconciliation of the amount actually transferred against the stored order total. A publicly available exploit is documented by WPScan, though EPSS at 0.14% indicates exploitation has not yet scaled to widespread automated abuse; the real risk is deliberate buyer fraud rather than opportunistic scanning.
Privilege escalation in Red Hat Data Science Pipelines (DSP) allows an authenticated namespace editor to gain node-root access by submitting a crafted Argo Workflow via the V1 API path. The API server, acting as a confused deputy (CWE-266), creates pods with elevated privileges on the attacker's behalf, effectively breaking out of Kubernetes namespace isolation. Successful exploitation enables arbitrary code execution and full control over the underlying cluster node; no public exploit has been identified at time of analysis, and this is not listed in CISA KEV.