Arbitrary file read in NLTK before 3.10.0 stems from a logic defect in FileSystemPathPointer.open() where the sandbox path validation compares a normalized path against itself, rendering the security boundary permanently non-functional rather than conditionally bypassable. Authenticated attackers who can influence calls to nltk.data.load() - for example, via an application that accepts user-supplied resource identifiers - can supply file:// URLs to exfiltrate any file accessible to the process account, including credentials, environment files, and application configuration. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code is identified at time of analysis; however, the trivially exploitable nature of the tautological check warrants prompt patching.
Slab-out-of-bounds read in the Linux kernel's ATM subsystem `vcc_setsockopt()` exposes kernel heap memory and can crash the kernel for local low-privileged users. The defect stems from a short-circuited optlen validation - when the caller passes a mismatched `level` parameter, the length check is bypassed entirely, and a secondary path through cgroup BPF setsockopt filters can shrink optlen after a passing check, both leading to `copy_from_sockptr()` reading beyond the supplied buffer. No active exploitation is confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, reflecting low real-world exploitation probability against a legacy subsystem.
Kernel memory disclosure in the Linux bnxt_re RDMA driver (Broadcom NetXtreme RDMA) exposes 4092 bytes of stale kernel data to local users holding InfiniBand device access. The bnxt_re_alloc_ucontext() function allocates the user context shared page with __get_free_page(GFP_KERNEL), which does not zero memory, then maps the page into userspace - leaving all bytes beyond the 4-byte AVID write at offset 0x10 uninitialized and fully readable by the calling process. Exploitation requires only a single mmap() call after IB_USER_VERBS_CMD_GET_CONTEXT, making it trivially scriptable; no public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low observed exploitation activity.
Out-of-bounds read in the Linux kernel ptp_ocp driver exposes kernel memory and risks availability on systems equipped with OCP PTP time-synchronization hardware. The ptp: ocp driver reads a fixed 13-byte EEPROM board ID field without enforcing a NUL terminator before passing it to devlink_info_version_fixed_put(), causing the function to scan beyond the field boundary as a C string. An attacker with local, low-privilege access on an affected host could trigger this over-read by querying devlink device info, potentially leaking adjacent kernel memory (C:H) or inducing a kernel fault (A:H). No public exploit exists and EPSS is 0.21% (12th percentile), indicating low real-world exploitation activity; however, patches are available across multiple stable kernel branches.
Kernel panic in Linux kernel's vhost-scsi subsystem can be triggered by a malicious guest VM when T10 Protection Information (PI) is negotiated, crashing the host kernel and all co-hosted virtual machines. A guest sends a malformed SCSI request with protection byte lengths equal to or exceeding the payload, causing an integer underflow or zero-count scatterlist that hits an unconditional BUG_ON assertion in sg_alloc_table_chained(). With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public proof-of-concept identified at time of analysis, exploitation probability is currently low but the guest-to-host scope change makes this a meaningful availability risk in multi-tenant virtualized storage environments.
NULL pointer dereference in the Linux kernel's tap_get_user_xdp() function can be triggered by a local attacker or malicious guest VM to crash the host kernel. The flaw arises because skb->dev is not assigned before tun_vnet_hdr_to_skb() is called in the XDP path, while the parallel code path tap_get_user() had already received a fix for the identical ordering defect. Impact is limited to availability - host kernel panic - with no confidentiality or integrity compromise possible. No public exploit or CISA KEV listing has been identified; EPSS at 0.21% reflects negligible observed exploitation activity.
Authorization bypass in WWBN AVideo through commit 9c39d8c8b4c1f75540788d6b391740852ceb0732 allows any authenticated user to forge two-party affiliation consent records and subsequently hijack video ownership of arbitrary content on the platform. The Users_affiliations add.json.php endpoint accepts attacker-controlled counterparty agreement timestamps without verification, enabling creation of forged affiliation records with approved status that are then unconditionally trusted by the videoAddNew.json.php ownership-transfer endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis; however, only a low-privilege account is required, making this accessible to any registered user on a vulnerable instance.
Unbounded memory allocation in the Linux kernel's vhost_iotlb subsystem allows availability impact on the host system via exhaustion of kernel memory. The flaw exists in vhost_iotlb_add_range_ctx(), where non-retiring IOTLB tables bypass the configured entry limit and continue allocating entries indefinitely - including via guest-controlled or userspace requests to vhost, mlx5 vDPA, VDUSE, and vhost-vDPA subsystems. No public exploit code has been identified at time of analysis, and EPSS probability is very low (0.20%), but the CVSS scope-change metric (S:C) reflects that a guest workload can impact host kernel availability.
Cross-site request forgery in WWBN AVideo through commit 9c39d8c8 allows remote attackers to permanently publish embargoed videos by tricking an authenticated administrator into loading a malicious GET request targeting the releaseVideoNow.json.php endpoint. The endpoint accepts state-changing GET requests without any CSRF token or origin validation, relying solely on the browser's ambient session cookie. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified, though the GET-based CSRF pattern is trivially weaponizable via a one-pixel image tag or link.