Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Privilege escalation in WPeMatico RSS Feed Fetcher (all versions through 2.8.24) allows any authenticated WordPress subscriber to gain full administrative access by invoking the unprotected wpematico_import_settings function. The missing capability check permits arbitrary WordPress site options to be overwritten, enabling attackers to enable user registration and set the default registration role to administrator - a two-stage takeover requiring only a valid subscriber account. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack chain is low-complexity and directly actionable by any authenticated user.
Stack-based buffer overflow in the Comfast CF-N1-S 2.6.0.1 web management interface enables remote code execution via the NTP timezone configuration CGI endpoint. The vulnerable function sub_41AD7C in /cgi-bin/mbox-config?method=SET§ion=ntp_timezone fails to validate the length of the timestr and ntp_client_enabled parameters before copying them to the stack. A publicly available proof-of-concept exploit exists, and the CVSS 4.0 score of 8.6 reflects high impact across both the vulnerable device and connected network infrastructure.
PasswordPusher v1.45.11 through v2.9.5 allows unauthenticated deletion of anonymous password pushes by exploiting a nil-equality logic flaw in the ownership authorization check. Any party who possesses a push's secret URL can permanently destroy that push - bypassing the creator's explicit `deletable_by_viewer=false` setting and any passphrase protection - because Ruby evaluates `nil == nil` as true, causing the ownership gate to pass spuriously for anonymously created pushes. No public exploit code has been identified at time of analysis, and the issue is fixed in v2.9.6.
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote unauthenticated attackers inject and execute arbitrary code by abusing the image element type, per its CVSS 4.0 base score of 10.0 (CWE-94). The flaw grants full compromise of the underlying Joomla host, with confidentiality, integrity, and availability impact on both the vulnerable application and subsequent systems. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers manipulate file paths through the image element to reach files outside the intended directory. The vendor's CVSS 4.0 score of 10.0 with PR:N indicates unauthenticated network exploitation, though there is no public exploit identified at time of analysis. The affected component is a form/data-application builder, so exploitation could expose or tamper with files on the Joomla host.
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik.
Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Full authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (versions up to and including 1.2.0) lets a remote unauthenticated attacker mint a valid session for any existing user, including administrators. Because one publicly reachable login handler performs no authentication, authorization, or nonce validation, an attacker can take over the site's original admin account in the default configuration without knowing any credentials. EPSS is low (0.19%, 9th percentile) and no public exploit is identified at time of analysis, but the CVSS 9.8 rating reflects trivial, high-impact site takeover.
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. Rated CVSS 9.8; no public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), indicating no widespread automated exploitation observed yet.
Authentication bypass in the WP Social Media Login WordPress plugin (versions through 1.0.6) lets unauthenticated attackers log in as any existing user, including administrators, simply by supplying that user's email address. The plugin trusts a claimed social-login identity without verifying that authentication actually completed with the identity provider, so no valid OAuth flow or credentials are needed. Reported by WPScan and rated CVSS 9.8; no public exploit or active exploitation has been identified, and EPSS remains low at 0.15%.
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of a heredoc terminator inside the 'calc' element and inject arbitrary PHP, made reachable because the onUpdateComment endpoint performs no access checks. Any remote actor able to reach the endpoint can trigger evaluation of attacker-controlled code, yielding full compromise of the Joomla application context (CWE-94). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixed in 4.7.3) lets remote attackers read the entire backing database. The flaw sits in getFilterQuery(), where the user-controlled list-filter 'condition' parameter is concatenated verbatim into a WHERE clause, so no authentication or user interaction is needed. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers inject SQL through the 'order' parameter of list models, which is passed into ORDER BY clauses without validation. Because the vector is exposed without authentication over the network, any anonymous visitor to a Fabrik-powered list can extract database contents. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Scope and grant-type escalation in the Punk::OAuth2::Server Perl module (through version 0.03) lets a registered OAuth2 client obtain correctly signed at+jwt access tokens carrying scopes and grant types it was never registered for. Because the token endpoint dispatches on the request-body grant_type and passes the requested scope straight to the token minter without checking it against the client's registration, and because authorize copies the query scope into the authorization-code record unchecked, any client can mint over-privileged tokens that a Punk::OAuth2::Checker resource server will accept and honour. There is no public exploit identified at time of analysis and EPSS risk is low (0.20%), but the flaw is authorization-model-breaking and remotely reachable.
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. No public exploit has been identified at time of analysis, and EPSS is low (0.20%, 10th percentile), but the CVSS base score is 9.1 and exploitation is trivial once the misconfiguration exists.
Remote code execution in NLTK's TransitionParser component allows arbitrary OS command execution when a victim loads a crafted transition-parser model file. The AllowlistUnpickler in NLTK before 3.10.3 validated only the module string during deserialization, not the global name - enabling attribute traversal via dotted names (e.g., resolving 'sklearn.os.system' through getattr chaining on an allowlisted 'sklearn' namespace) to reach callable sinks the allowlist never intended to expose. No public exploit has been identified at time of analysis, but the CVSS 4.0 score of 8.7 with no authentication prerequisite reflects significant risk for pipelines that ingest externally-sourced NLP models.
Buffer overflow and stale-memory disclosure in the Linux kernel's staging rtl8723bs WiFi driver allow a malicious access point within radio range to corrupt kernel memory or leak sensitive buffer contents before any association occurs. The flaw resides in OnAuthClient(), which copies a WLAN_EID_CHALLENGE element's attacker-controlled length - up to 255 bytes - into a fixed 128-byte chg_txt buffer via memcpy(), enabling an overflow of up to 127 bytes or an underfill that echoes stale kernel memory. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%, 18th percentile), but the adjacent-network unauthenticated attack vector and High impact across confidentiality, integrity, and availability make this a notable risk for any deployment relying on WEP shared-key authentication with this chipset.
Use-after-free in the Linux kernel VXLAN driver allows a local, low-privileged user to corrupt kernel memory, potentially escalating to full kernel compromise. The flaw exists in vxlan_changelink(), which arms age_timer without checking whether the device is up via netif_running(); when the device is subsequently deleted, free_netdev() releases the vxlan_dev struct - including the embedded timer - while that timer remains queued on a timer_base. Because the rtnl operations are netns-scoped, an unprivileged user can trigger the entire sequence inside a new user and network namespace without elevated system privileges. No public exploit or CISA KEV entry is identified at time of analysis; EPSS of 0.22% (13th percentile) reflects low current exploitation activity, though the local-user-namespace reachability makes this a meaningful local privilege escalation risk on any Linux system permitting user namespace creation.
Thunderbolt networking driver (tbnet) in the Linux kernel crashes the XDomain control channel due to an incorrect teardown ordering introduced since the driver was added in Linux 4.15, requiring a physical power cycle of the Thunderbolt controller to recover. Systems running Linux 4.15 through the pre-patch stable branches with active Thunderbolt peer-to-peer networking links (XDomain) are affected when a privileged user or process tears down the network interface. No public exploit exists and EPSS is 0.21% (12th percentile), consistent with a niche-deployment, privilege-required availability issue rather than opportunistic network attack; the NVD CVSS 8.8 with C:H/I:H appears overstated relative to the actual described impact.
TX DMA buffer mismanagement in the Linux kernel's Qualcomm GENI serial driver (qcom-geni) allows a local low-privileged user to hang the system indefinitely and potentially corrupt kernel memory on affected Qualcomm hardware. The driver's DMA-mode uart_ops lacks a flush_buffer callback, enabling in-flight DMA transfers to underflow the transmit kfifo and re-submit page-sized transfers indefinitely; a concurrent flaw in the stop path unmaps the DMA buffer while the serial engine is still reading it. No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), but the user-triggerable hang and DMA use-after-unmap represent a real availability and potential integrity risk on affected Qualcomm platforms.
The vhost-scsi subsystem in the Linux kernel allows a local attacker with low privileges on a KVM virtualization host to trigger a kernel BUG_ON assertion and crash the host by manipulating VIRTIO feature bits after SCSI endpoint setup. The flaw is that vhost_scsi_set_features() incorrectly accepted changes to VIRTIO_SCSI_F_T10_PI after an active endpoint was established, leaving per-command protection scatterlist arrays (prot_sgl) unallocated while the I/O path proceeded under the updated feature state; when a 129-page protection payload arrives, a BUG_ON(nents > SG_CHUNK_SIZE) fires in sg_pool_index(), panicking the host kernel. Patches are confirmed for stable branches 6.18.45 and 7.1.9 and mainline 7.2; no public exploit exists and no CISA KEV listing is present, with an EPSS of 0.21% (11th percentile).
Use-after-free and double-free memory corruption in the Linux kernel's net/dibs network subsystem allows an adjacent network attacker to trigger kernel memory corruption via a race condition between the dibs device interrupt handler and device teardown. The UAF arises because an active interrupt handler can continue accessing dmb_clientid_arr after dibs_dev_del() releases it; a separate double-free path exists when dibs_dev_add() fails during dibs_lo_dev_probe(). No public exploit has been identified at time of analysis, and EPSS is 0.21% (11th percentile), indicating low exploitation likelihood despite the high CVSS score.
Race conditions in the Linux kernel KVM/SVM subsystem allow local attackers with low privileges to corrupt the SEV mirror VM list or trigger incorrect reference counting in the hypervisor. Two distinct concurrency flaws exist: sev_migrate_from() modifies the owner's mirror_vms list without holding the owner lock, enabling list corruption when concurrent COPY or destroy operations race with a migration; and sev_vm_destroy() can read a stale enc_context_owner pointer after it changes via a concurrent KVM_CAP_VM_MOVE_ENC_CONTEXT_FROM ioctl, causing kvm_put_kvm() to be called on the wrong VM struct. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.21% (11th percentile) reflects the narrow exploitation conditions required.
Stored cross-site scripting in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3) allows unauthenticated remote attackers to inject persistent malicious JavaScript by exploiting missing authorization and nonce checks on two of the plugin's request handlers. The injected payload executes in two distinct contexts: within the WordPress admin area when an administrator views the plugin's settings, and on the public-facing frontend for any visitor loading a page that embeds a slider. This dual-execution surface elevates the impact beyond a typical admin-only XSS, as it enables both administrative session hijacking (leading to full site compromise) and broad visitor-side attacks. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.19% (8th percentile), indicating low observed exploitation activity at time of analysis.
StreamBackedCorpusView in NLTK before 3.10.0 allows arbitrary local file reads by calling Python's builtins.open() directly, fully bypassing the pathsec.ENFORCE security boundary regardless of how that control is configured. Web applications and services built on NLTK that pass externally controlled values to the fileid argument are at risk of having sensitive system files, credentials, and configuration data read by remote attackers. A vendor-released patch is available in NLTK 3.10.0; no public exploit has been identified at time of analysis.
Symlink-based path traversal in NLTK's FramenetCorpusReader before version 3.10.2 permits attackers with write access to a corpus subdirectory to read arbitrary XML files outside the intended corpus root. The flaw exists because path validation in frame_by_name(), _lu_file(), and doc() checks only for path separator characters in filenames but does not resolve symbolic links before access, allowing a separator-free symlink name to bypass the guard and dereference an out-of-root target. No public exploit code or CISA KEV listing has been identified; the provided CVSS 4.0 vector of PR:N/AV:N is inconsistent with the filesystem write prerequisite described and warrants verification with the vendor.