Stack-based buffer overflow in the TRENDnet TEW-821DAP (firmware 2.2.01b05) wireless access point allows attackers reaching the /cgi-bin/apply_time.cgi NTP Timezone Configuration Handler to corrupt the stack via oversized values in the system.ntp.server, system.ntp.enable_server, cameo.time.time_zone, or cameo.cameo.syslog_server parameters, which flow unchecked into the uci_safe_get function. Publicly available exploit code exists (disclosed via VulDB and a GitHub write-up), though there is no public exploit identified as being used in active attacks. Successful exploitation can crash the device or potentially execute attacker-controlled code with the privileges of the web server process.
Remote code execution in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.2) lets remote unauthenticated attackers inject and execute arbitrary code by abusing the image element type, per its CVSS 4.0 base score of 10.0 (CWE-94). The flaw grants full compromise of the underlying Joomla host, with confidentiality, integrity, and availability impact on both the vulnerable application and subsequent systems. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2) allows unauthenticated attackers to run arbitrary PHP through the extension's PHP form element, which evaluates user-supplied code. Rated CVSS 10.0 with a network, no-privileges, no-interaction vector and full confidentiality/integrity/availability impact including scope change, this yields complete compromise of the underlying Joomla host. No public exploit identified at time of analysis, but the triviality of PHP-eval injection makes weaponization straightforward once details circulate.
Path traversal in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers manipulate file paths through the image element to reach files outside the intended directory. The vendor's CVSS 4.0 score of 10.0 with PR:N indicates unauthenticated network exploitation, though there is no public exploit identified at time of analysis. The affected component is a form/data-application builder, so exploitation could expose or tamper with files on the Joomla host.
Broken access control in the Fabrik application-builder extension for Joomla (all versions from 1.0.0 through releases prior to 4.7.3) exposes the download element without enforcing ACL checks, letting remote attackers retrieve files that should be restricted to privileged users. The flaw is remotely reachable over the network with no authentication or user interaction (CVSS vector PR:N/UI:N) and is tagged as an authentication bypass. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation path makes it high-priority for Joomla sites running Fabrik.
Use-after-free in the Linux kernel's UDP tunnel GSO segmentation path (__skb_udp_tunnel_segment()) occurs when the code dereferences a saved UDP header pointer after a skb_pull() reallocates skb->head, invalidating that pointer. The flaw affects hosts that software-segment UDP-encapsulated tunnel traffic (VXLAN/GENEVE/FoU), and can lead to a kernel crash or potential information disclosure. No public exploit is identified at time of analysis, EPSS is low (0.22%), and the issue is not on CISA KEV; the upstream fix reorders the header fetch to occur after the pull.
Kernel memory disclosure and crash in the Linux kernel's veth driver arises from broken skb length accounting after an XDP program adjusts packet fragments; veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len holding the stale fragment contribution, so skb_headlen() overstates the linear area. On the UDP receive path this caused __skb_datagram_iter() to copy 1024 bytes past the real linear tail into userspace - leaking skb_shared_info contents including nr_frags, xdp_frags_size, and a kernel pointer from frags[0] - while displacing and truncating real packet data. A related path via bpf_xdp_pull_data() leaves the skb non-linear and trips SKB_LINEAR_ASSERT(), crashing the kernel. There is no public exploit identified at time of analysis, and EPSS risk is low (0.21%).
PHP Object Injection in the WS Form LITE contact form plugin for WordPress (all versions through 1.10.80) lets unauthenticated attackers instantiate arbitrary PHP objects by supplying serialized data in form-submission meta values, which the plugin deserializes without validation. The plugin ships no exploitable POP (property-oriented programming) chain of its own, so on a default install the injection has no direct impact; real damage - arbitrary file deletion, sensitive-data disclosure, or code execution - occurs only when a separate plugin or theme on the same site provides a usable gadget chain. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so the headline 9.8 rating overstates practical risk for isolated installs.
Server-Side Request Forgery in the Mailgun for WordPress plugin (versions up to and including 2.2.0) lets unauthenticated attackers coerce the WordPress server into making authenticated requests to arbitrary Mailgun API endpoints using the site's own stored API key. Because the add_list() function trusts user-controlled array keys from $_POST['addresses'] and only runs them through sanitize_text_field(), an attacker can path-traverse to any Mailgun endpoint - notably creating inbound email-forwarding routes to intercept password-reset messages and take over the administrator account. Reported by Wordfence with a CVSS of 9.8; no public exploit identified at time of analysis and no CISA KEV listing.
A use-after-free in the Linux kernel's NFSv4 client can occur when a FREE_STATEID operation is delayed and the associated 'struct nfs_server' is torn down (for example on unmount) while the operation is still in flight, leaving the RPC referencing freed memory. The fix pins the nfs_server by bumping its refcount for the duration of the FREE_STATEID call. This is a client-side race condition, not a server-facing service bug; no public exploit identified at time of analysis, and EPSS is low (0.22%, 13th percentile).
Use-after-free in the Linux kernel's SCTP (Stream Control Transmission Protocol) subsystem allows a remote peer to trigger a dangling transport-pointer dereference on the control chunk queue. The flaw arises because sctp_make_heartbeat_ack() caches a destination transport in chunk->transport without holding a reference; when src_out_of_asoc_ok keeps a HEARTBEAT ACK queued and the peer transport is later torn down, the queued chunk retains a stale pointer that is dereferenced on eventual transmission. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is low at 0.22% (13th percentile). A vendor patch is available in multiple stable trees.
Stack out-of-bounds write in the Linux kernel IPVS (IP Virtual Server) subsystem lets a remote attacker corrupt the __icmp_send() stack when a director rebases ICMP errors for tunneled traffic. In ip_vs_in_icmp() the skb is rebased from the outer ICMP packet to the quoted original request, but IPCB(skb)->opt still describes the outer IPv4 header, so a stale timestamp-option offset points into the quoted transport header and __ip_options_echo() copies an attacker-influenced byte as an option length into fixed-size stack storage. There is no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile), consistent with a subsystem-specific memory-corruption bug rather than a mass-exploitation candidate.
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. Despite the assigned CVSS of 9.8, EPSS is low (0.22%, 13th percentile), there is no public exploit identified at time of analysis, and there is no CISA KEV listing.
Denial of service (and potential memory corruption) in the Linux kernel SCTP stack arises because __sctp_outq_flush_rtx() moves a gap-acked chunk onto another transport's transmitted list without updating chunk->transport, leaving a dangling pointer once the original transport is RCU-freed via an ASCONF Delete-IP peer removal. A subsequent SACK that reneges the TSN clears tsn_gap_acked, and the next SACK dereferences the freed transport in sctp_check_transmitted(), producing a KASAN-confirmed slab-use-after-free. The issue affects hosts actively using SCTP with dynamic address reconfiguration; it carries a published CVSS of 9.8 but low EPSS (0.22%, 13th percentile), and no public exploit has been identified at time of analysis.
Use-after-free and NULL-pointer dereference in the Linux kernel's SCTP stack allow a remote SCTP peer to corrupt kernel memory or crash the host by triggering association-restart handling that leaves the cached ASCONF chunk pointer (addip_last_asconf) dangling. A delayed authenticated ASCONF-ACK then reaches sctp_sf_do_asconf_ack() and operates on freed memory, causing a second release, while clearing the pointer exposes a companion NULL dereference via a racing T4 timer callback. There is no public exploit identified and EPSS is low (0.22%), consistent with a race-condition kernel bug rather than a turnkey remote exploit despite the 9.8 input score.
A remotely triggerable use-after-free in the Linux kernel's SCTP stack (net/sctp) lets an authenticated SCTP peer read freed transport memory in sctp_outq_select_transport(). By sending an ASCONF chunk that both adds a peer transport and then removes it via a wildcard DEL-IP, the newly added transport is freed while asoc->new_transport still points to it; a later HEARTBEAT and address-replacement sequence dereferences the dangling pointer. There is no public exploit identified at time of analysis, EPSS is low (0.22%), and the flaw is not in CISA KEV, though a reliable private reproducer is described.
Memory corruption in the Linux kernel's XDP (eXpress Data Path) broadcast-redirect path allows corruption of kernel skb_shared_info metadata when cloned XDP frames are converted back into socket buffers. xdpf_clone() packs broadcast copies into a single page with frame_sz set to PAGE_SIZE, but the existing bounds check fails to account for the shared-info tailroom, so a source frame from a larger allocation can extend into the clone's required shared-info area; build_skb_around() then writes skb_shared_info over live packet bytes. The issue is fixed and carries a vendor CVSS of 9.8, but with a low EPSS of 0.21% (12th percentile) and no public exploit identified at time of analysis, real-world risk is far narrower than the base score implies because a non-default XDP broadcast-redirect configuration is required.
Use-after-free in the Linux kernel CIFS/SMB client (cifs_try_adding_channels()) lets a race between SMB multichannel channel setup and an interface-list refresh free an 'iface' object that is then written to via weight_fulfilled, corrupting freed kernel memory. It affects systems that mount SMB shares with multichannel across many stable branches (6.1.x through 6.18.x and 7.x, fixed in 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, 7.2). This is a resolved upstream bug with a vendor patch available; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Use-after-free in the Linux kernel's ovpn (in-kernel OpenVPN data-channel offload) module lets a local privileged attacker corrupt kernel memory by racing peer-management operations. A time-of-check/time-of-use window between ovpn_peer_get_by_id() and acquisition of ovpn->lock allows a peer that was concurrently removed to be re-inserted into the rehash tables, resurrecting a peer userspace believes is gone and leaving embedded hash entries linked to memory later freed via call_rcu. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win kernel race rather than a mass-exploitable bug.
Kernel memory corruption in the Linux inet fragment (inet_frag) subsystem arises from a race in inet_frag_create(), which arms the fragment-queue timer before publishing the queue into the fqdir rhashtable. When a network namespace has a fragment timeout of zero or negative, the timer can fire on an unpublished queue, mark it complete, and drop an anticipated hash reference that is never restored, leaving a stale hash node and a use-after-free-style reference imbalance. No public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low (0.21%, 11th percentile), and exploitation depends on a non-default namespace configuration rather than default deployments.
Local privilege-relevant kernel memory corruption in the Linux kernel's net/x25 subsystem arises because X.25 socket timers are armed with mod_timer() and cancelled with timer_delete(), so a pending timer holds no reference on the socket. The x25_heartbeat_expiry() handler rearms unconditionally and can reinstall sk->sk_timer after __x25_destroy_socket() passes its cancel point, letting a subsequent expiry dereference the kmalloc-2k socket object already freed by close() - a use-after-free confirmed by KASAN. Exploitation requires the ability to create AF_X25 sockets on a host with X.25 support loaded; no active exploitation and no public exploit code have been identified, and EPSS probability is low (0.21%).
Improper initialization ordering in the Linux kernel's dibs (Direct Internal Buffer Sharing) subsystem leaves dibs->lock uninitialized during early ISM device probe, so a GID-event interrupt arriving between ism_dev_init()/request_irq() and dibs_dev_add() causes ism_handle_irq() to acquire an uninitialized spinlock. This affects s390 systems using ISM/SMC-D devices and can lead to undefined locking behavior and kernel instability. EPSS is low (0.21%), no public exploit is identified, and the issue is a robustness/race fix rather than a remotely triggerable flaw despite the input's 9.8 rating.
Improper handling of the receive-side message iterator in the Linux kernel's kernel-TLS (kTLS) subsystem lets a remote TLS peer cause recvmsg() to write decrypted bytes into the wrong offsets of a receiver's user-space iovec buffers. When the optimistic TLS 1.3 zero-copy path maps user pages and then falls back to a kernel skb, the iterator is left advanced, so bytes are written a second time past the length recvmsg() reports. Exploitation requires the receiver to have enabled the TLS_RX_EXPECT_NO_PAD socket option; there is no public exploit identified at time of analysis and EPSS is low (0.21%).
Memory corruption in the Linux kernel page cache (mm/filemap) arises when a race condition in __filemap_add_folio() stores a folio at an incorrect, intermediate rounded-down index after a concurrent thread resolves a conflict during the split-a-conflict retry loop. Affecting large-folio-capable kernels (6.15 onward), the flaw manifested in production as rare SIGILLs and SIGSEGVs with executable text landing a page away from its correct location, and tripped a !folio_contains() assertion under CONFIG_DEBUG_VM. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV; the upstream fix restores the original xas.xa_index before each retry.
Out-of-bounds read in the Linux kernel btrfs LZO decompression path allows a crafted btrfs filesystem image to trigger a slab-out-of-bounds (and potentially extent-buffer-boundary) read when an inline LZO-compressed file extent is read. The flaw affects the kernel's btrfs module from 2.6.38 onward and is fixed upstream; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.20%). Despite an input CVSS of 9.8 (network vector), the actual defect requires local mounting/reading of an attacker-crafted image, making it a local availability/disclosure issue rather than remote code execution.
Full authentication bypass in the Social Login & Sharing buttons with Analytics By SoClever WordPress plugin (versions up to and including 1.2.0) lets a remote unauthenticated attacker mint a valid session for any existing user, including administrators. Because one publicly reachable login handler performs no authentication, authorization, or nonce validation, an attacker can take over the site's original admin account in the default configuration without knowing any credentials. EPSS is low (0.19%, 9th percentile) and no public exploit is identified at time of analysis, but the CVSS 9.8 rating reflects trivial, high-impact site takeover.
Authentication bypass in the SmilePass Selfie Login WordPress plugin (all versions through 1.0.2) lets an unauthenticated attacker log in as any registered account, including administrators. The plugin trusts a client-supplied identity for its selfie-based login flow and performs no server-side verification, so a request simply asserting a target username is accepted. Rated CVSS 9.8; no public exploit identified at time of analysis, and EPSS is low (0.15%, 4th percentile), indicating no widespread automated exploitation observed yet.
Authentication bypass in the WP Social Media Login WordPress plugin (versions through 1.0.6) lets unauthenticated attackers log in as any existing user, including administrators, simply by supplying that user's email address. The plugin trusts a claimed social-login identity without verifying that authentication actually completed with the identity provider, so no valid OAuth flow or credentials are needed. Reported by WPScan and rated CVSS 9.8; no public exploit or active exploitation has been identified, and EPSS remains low at 0.15%.
Remote code execution in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows attackers to break out of a heredoc terminator inside the 'calc' element and inject arbitrary PHP, made reachable because the onUpdateComment endpoint performs no access checks. Any remote actor able to reach the endpoint can trigger evaluation of attacker-controlled code, yielding full compromise of the Joomla application context (CWE-94). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.
Unauthenticated SQL injection in the Fabrik application-builder extension for Joomla (versions 1.0.0 through 4.7.3, fixed in 4.7.3) lets remote attackers read the entire backing database. The flaw sits in getFilterQuery(), where the user-controlled list-filter 'condition' parameter is concatenated verbatim into a WHERE clause, so no authentication or user interaction is needed. No public exploit identified at time of analysis; not listed in CISA KEV, and no EPSS score was provided.
Unauthenticated SQL injection in the Fabrik extension for Joomla (all versions 1.0.0 through 4.7.2, fixed in 4.7.3) lets remote attackers inject SQL through the 'order' parameter of list models, which is passed into ORDER BY clauses without validation. Because the vector is exposed without authentication over the network, any anonymous visitor to a Fabrik-powered list can extract database contents. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Out-of-bounds kernel slab read in the Linux kernel's mlx5 vDPA driver (vdpa/mlx5) allows a local actor managing vDPA devices to trigger a 16-byte over-read in create_direct_keys(). The flaw stems from a mismatch between the computed input length (which includes the 'out' field) and the pointer passed to cmd_exec() (which skips 'out'), causing mlx5_copy_to_msg() to read past a 4384-byte allocation. No public exploit identified at time of analysis; EPSS is low (0.21%) and it is not in CISA KEV.
Kernel memory disclosure in the Linux kernel's generic XDP receive path allows leaking of adjacent kernel memory - including skb_shared_info contents and a raw kernel pointer from skb_shinfo(skb)->frags[0] - into userspace when an attached XDP program shrinks a packet's fragment area. The flaw stems from bpf_prog_run_generic_xdp() updating skb->data_len without adjusting skb->len, leaving skb_headlen() larger than the real linear area so datagram copies read past the linear tail. No public exploit is identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not CISA KEV-listed, so risk is confined to systems running generic XDP programs that adjust fragments.
Scope and grant-type escalation in the Punk::OAuth2::Server Perl module (through version 0.03) lets a registered OAuth2 client obtain correctly signed at+jwt access tokens carrying scopes and grant types it was never registered for. Because the token endpoint dispatches on the request-body grant_type and passes the requested scope straight to the token minter without checking it against the client's registration, and because authorize copies the query scope into the authorization-code record unchecked, any client can mint over-privileged tokens that a Punk::OAuth2::Checker resource server will accept and honour. There is no public exploit identified at time of analysis and EPSS risk is low (0.20%), but the flaw is authorization-model-breaking and remotely reachable.
Session cookie forgery in Punk before 0.18 (a Perl web framework by LNATION) lets remote unauthenticated attackers mint valid session cookies whenever an application declares a session without a secret. Because the cookie reader and write-back both default the HMAC-SHA256 key to an empty string, cookies are signed and verified with a zero-length key, so anyone who knows the cookie format can offline-forge a session carrying any user identifier or role. No public exploit has been identified at time of analysis, and EPSS is low (0.20%, 10th percentile), but the CVSS base score is 9.1 and exploitation is trivial once the misconfiguration exists.