Integer overflow and missing input validation flaws in the Linux kernel's s390/zcrypt subsystem allow a local low-privileged user to trigger kernel buffer overflows and uninitialized memory reads, yielding full confidentiality, integrity, and availability impact. The vulnerable function `xcrb_msg_to_type6cprb_msgx()` fails to validate CPRBX structure sizes before copying from userspace, performs signed integer arithmetic subject to overflow during alignment, and does not detect overflow when summing control and data block sizes. Upstream patches are confirmed in stable branches 7.1.10 and 7.2; no public exploit or CISA KEV listing is confirmed at time of analysis.
Multiple input validation failures in the Linux kernel s390/zcrypt driver's `xcrb_msg_to_type6_ep11cprb_msgx()` function allow a local unprivileged user on IBM Z/s390 systems with EP11 cryptographic coprocessors to trigger kernel-level buffer overflows. Three compounding weaknesses exist: missing minimum size validation before copying ep11_cprb structures from userspace, arithmetic overflow in CEIL4 alignment that can wrap around and bypass size checks, and unsafe C struct overlay on ASN.1-encoded payload without proper parsing. The official CVSS score of 7.8 (AV:L/AC:L/PR:L) reflects a realistic local privilege escalation path with full C/I/A impact. No public exploit has been identified at time of analysis, and patches are available in Linux 7.1.10 and 7.2.
Memory safety flaws in the Linux kernel s390/zcrypt EP11 CPRB domain handler allow a local low-privileged user on IBM Z mainframe systems to achieve full privilege escalation via crafted cryptographic request blocks. The vulnerable function zcrypt_msgtype6_send_ep11_cprb() uses struct overlays to access EP11 payload domain fields without performing ASN.1 validation or bounds checks at each parsing step, creating conditions for out-of-bounds memory access and incorrect domain field manipulation - the latter consistent with the intelligence-tagged 'Authentication Bypass' impact on EP11 coprocessor domain isolation. Vendor-released patches are available in Linux 7.1.10 and 7.2; no public exploit code or CISA KEV confirmation has been identified at time of analysis.
Slab-out-of-bounds write in the Linux kernel XFS real-time refcount B-tree (rtrefcountbt) subsystem allows a local attacker to trigger a kernel panic or potentially escalate privileges by mounting a crafted XFS filesystem image with the rtreflink feature set. The flaw is an off-by-one in on-disk root level validation - two check paths use '>' instead of '>=' - permitting an illegal bb_level that causes the cursor's bc_nlevels to exceed bc_maxlevels by one, indexing a 2-byte write 8 bytes past the end of a 216-byte slab object during the first B-tree operation. No public exploit or CISA KEV listing exists, but the guaranteed kernel panic and kernel heap write primitive make this a meaningful local risk on affected configurations.
Use-After-Free in the XFS filesystem online repair subsystem of the Linux kernel allows a local low-privileged user to potentially achieve full kernel memory corruption and privilege escalation to root. The flaw in `xrep_tempfile_create` leaves `sc->tempip` as a dangling pointer when tempfile creation fails partway through, enabling subsequent dereference of freed memory. No public exploit has been identified at time of analysis, but the AV:L/AC:L/PR:L/C:H/I:H/A:H CVSS vector indicates any authenticated local user on an XFS-backed system can attempt exploitation with low complexity.
Out-of-bounds write in the Linux kernel's Tegra hardware crypto driver affects AES-GCM decrypt operations on NVIDIA Tegra SoC-based systems running kernel 6.10 and later. When a caller skips invocation of tegra_gcm_setauthsize() - leaving ctx->authsize at zero - the rctx->cryptlen calculation in tegra_gcm_do_one_req() produces an inflated length that causes a subsequent decrypt operation to write beyond the rctx->dst_sg scatter-gather buffer. A local attacker with low-privilege access to the kernel crypto API on affected Tegra hardware could trigger this to achieve privilege escalation or a kernel crash. No public exploit code or CISA KEV listing has been identified at time of analysis.
Arbitrary file read via symlink traversal in Weblate's App store metadata ZIP download affects all versions prior to 2026.7, allowing project administrators to exfiltrate host files outside their repository boundary. The vulnerability is an incomplete fix for CVE-2026-34242 - the original patch blocked path traversal via '..' sequences but failed to prevent symlink-based traversal, leaving the arbitrary file read primitive intact. No public exploit has been identified at time of analysis; the CVSS score of 7.7 High reflects scope change due to cross-boundary file disclosure, while the project-administrator privilege requirement limits the exploitable population.
Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant with SFTP write access to a single server to exhaust the host node's entire physical disk. The flaw combines a stale, one-time cache check at file-handle open time with no per-write accounting, plus a logic gap that continues accepting SFTP writes to servers already stopped for quota violations. No public exploit has been identified at time of analysis, but exploitation requires only low-privilege SFTP credentials available to every legitimate tenant, making this a high-priority multi-tenant hosting risk.
Arbitrary file write and directory deletion in compliance-trestle's catalog-generate, profile-generate, and ssp-generate author commands exposes CI/CD pipelines to workspace-escape attacks when output arguments are derived from untrusted data. The affected commands construct output paths by joining a user-supplied argument onto the Trestle workspace root, but apply only a task-name-collision check rather than the PathSecurityValidator guard already used by the jinja command - allowing absolute paths or traversal sequences to escape the workspace entirely. With --force-overwrite, the primitive escalates to recursive deletion of an attacker-chosen directory tree followed by file creation, enabling indirect code execution by overwriting files (e.g., .github/workflows, .git/hooks, shell profile scripts) that a downstream pipeline subsequently executes. No public exploit is identified at time of analysis, though the GHSA advisory for the related jinja variant (GHSA-4q5v-7g7x-j79w) contains a detailed reproduction procedure.
SeaweedFS 4.39's TUS resumable-upload handler fails to re-validate JWT prefix scoping on HEAD, PATCH, and DELETE operations against existing sessions, enabling a low-privilege authenticated tenant to hijack cross-tenant upload sessions. An attacker holding a valid but restricted JWT token can PATCH arbitrary content into another tenant's in-progress upload by reusing the victim's session ID, causing the completed file to land at a filesystem path the attacker's token explicitly forbids. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 4.40.
Stored cross-site scripting in Penpot versions through 2.14.3 allows an authenticated team member to execute arbitrary JavaScript in collaborators' browsers by uploading a custom font whose family name contains HTML markup. The backend accepted arbitrary font-family strings and the frontend injected the resulting @font-face rule into the page via innerHTML without sanitization, enabling style-element breakout via a crafted closing tag. The attack is passive — any teammate who opens a file referencing the poisoned font silently triggers execution, enabling session cookie theft, unauthorized actions as the victim, and access to shared files. No public exploit has been identified at time of analysis; vendor-released patch is available in version 2.15.3.
Directory traversal in Formidable Charts (WordPress plugin, versions up to and including 2.0.1) allows unauthenticated network attackers to read arbitrary server-side files via the unsanitized `frm_graph` parameter, exposing sensitive data such as WordPress configuration credentials. Exploitation requires three co-active plugins and a pre-existing image-chart uploads directory, making this a targeted but credible risk for active users of the full Formidable Forms and Charts stack. No public exploit code or CISA KEV listing has been identified at time of analysis; fix version 2.0.2 is available per the official Formidable Forms changelog.
Indefinite process hang in the Linux kernel Ceph filesystem client allows a remote Ceph cluster participant to cause a denial of service by triggering MDS capability revocation on a victim client. The flaw in `__ceph_get_caps()` causes a reading process to sleep forever on `i_cap_wq` when stale `cap->mds_wanted` state prevents the client from reacquiring FILE_RD without an external wake-up. No public exploit code has been identified at time of analysis; patches are available across multiple Linux stable branches.
Time-based SQL injection in the WooCommerce Lottery WordPress plugin by WPGenie - all versions through 2.2.9 - allows unauthenticated remote attackers to extract arbitrary data from the WordPress database by appending malicious payloads to the 'orderby' and 'order' GET parameters on publicly accessible lottery entry list pages. The flaw originates in class-wc-lottery-entry-list-tables.php where sort parameters are passed into SQL ORDER BY clauses without proper escaping or whitelisting. No public exploit code has been identified at time of analysis, but the unauthenticated, low-complexity attack surface makes automated scanning and exploitation with tools like sqlmap straightforward.
Stack-based buffer overflow in Dell PowerProtect One versions 20.1.0.0 and below enables unauthenticated remote attackers to crash the service, resulting in denial of availability. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms exploitation requires no authentication and no special network positioning, making this trivially reachable in any environment where the product is exposed. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low attack complexity warrants prompt patching in environments relying on this platform for data protection.
Denial of service in Spring AI's PDF document ingestion crashes the processing thread when parsing a crafted PDF with a deeply nested or cyclic table of contents structure. Affected versions span the 1.0.x and 1.1.x release lines as well as the 2.0.0 release. An unauthenticated remote attacker who can supply a malicious PDF to an application's ingestion pipeline can trigger a StackOverflowError, halting document processing availability with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in TeamViewer Desktop Clients prior to version 15.81.5 allows an authenticated remote session participant to write files to arbitrary locations on the victim's local filesystem via the file transfer and virtual file clipboard features. The affected product family spans Full Client, Host, QuickSupport, and Portable editions across Windows, Linux, and macOS, covering the v13, v14, and current v15 release lines. Arbitrary file write can be chained to code execution at the privilege level of the user running TeamViewer; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Denial of service in Spring Reactor Core exposes reactive Java applications to an infinite-loop condition (CWE-835) when the Flux.bufferTimeout operator is used with fairBackpressure enabled. Affected branches span 3.7.x through 3.7.19 and 3.8.0 through 3.8.6, meaning applications on both supported and legacy release trains are vulnerable. No active exploitation has been identified (SSVC: none), and EPSS probability sits at 0.22%, but the network-accessible nature of reactive endpoints makes this a realistic denial-of-service vector for exposed services using the specific configuration.
Path traversal in UnPoller 2.33.0's password field enables unauthenticated remote attackers to read arbitrary files from the host filesystem and exfiltrate their contents over the network. The CVSS 7.5 (High) vector reflects a fully network-accessible, zero-authentication attack with high confidentiality impact against the affected version. A public exploit repository (github.com/SyntaxSaiyan/CVE-2026-36851) exists, though EPSS stands at just 0.22% (12th percentile) and no CISA KEV listing is present, indicating no public exploit identified at time of analysis as having been broadly weaponized.
Predictable ONNX model cache path creation in Spring AI enables a local attacker on a shared multi-user host to pre-create the cache location and substitute a malicious ONNX model before the application writes its legitimate copy. Affected versions span Spring AI 1.0.0-1.0.9, 1.1.0-1.1.8, and 2.0.0. No public exploit code or CISA KEV listing has been identified at time of analysis; critically, the supplied CVSS vector (AV:N/PR:N) is materially inconsistent with the description's local-access requirement, meaning the raw score of 7.5 substantially overstates the realistic attack surface.
Unauthenticated arbitrary file download in DocSys V2.02.80 exposes the entire server filesystem to remote attackers via the `downloadDocEx.do` endpoint. The `targetPath` parameter accepts arbitrary filesystem paths with no authentication gate, allowing any unauthenticated network attacker to retrieve sensitive files such as configuration files, credentials, or application data. No public exploit code has been identified at time of analysis, and EPSS at 0.17% (6th percentile) signals low current exploitation activity, though the attack is trivially simple to reproduce.
Null pointer dereference in Stomper (commit 5e2741e) allows any remote unauthenticated client to crash the STOMP server process by sending a SEND frame with the destination header omitted. The crash is deterministic and repeatable, making sustained denial-of-service trivially achievable without credentials or prior session state. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.15% (5th percentile) indicates low current exploitation probability, but the attack complexity is minimal for any attacker with network access to the service.
Heap use-after-free in Stomper (commit 5e2741e) allows any unauthenticated network client to reliably crash the broker process by repeatedly issuing SUBSCRIBE commands for the same destination on a single connection and then closing it. The broker's subscription cleanup logic leaves dangling pointers in internal structures that are dereferenced during StompClient destruction, causing a denial of service. A proof-of-concept bug report is publicly available; SSVC classifies exploitation as automatable, though EPSS sits at only 0.15% (5th percentile), consistent with a niche product not yet widely targeted.
Stomper at commit 5e2741e crashes its server process when a broker attempts to write data to a TCP socket already closed by the client peer, delivering a SIGPIPE signal that the process does not handle, causing immediate termination. Any unauthenticated remote client can reliably trigger this by closing the socket at the right moment during a broker-to-client transmission, making the denial-of-service condition automatable. No patch version has been confirmed; a publicly available proof-of-concept bug report exists, though EPSS places exploitation probability at only 0.15%.
Permanent resource exhaustion in the stomper STOMP broker (commit 5e2741e) allows any unauthenticated remote client to hang the broker's event loop by sending partial STOMP frames without completing them. The flaw exploits the interaction between edge-triggered epoll (EPOLLET) and a MSG_PEEK-based recv() pattern: because EPOLLET only fires on state transitions, a socket that holds partial data but never completes a frame stops generating new epoll events, trapping it in a permanent half-read state. As such connections accumulate, the broker's epoll_wait call never returns for those sockets, and the broker eventually stops processing all new messages. No public exploitation has been confirmed by CISA KEV; EPSS stands at 0.15% (5th percentile), suggesting low observed exploitation activity at time of analysis.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Unauthenticated information disclosure in Cohere North AI v1.1.5 exposes sensitive data through an improperly secured WebSocket endpoint. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact accessible without credentials or user interaction over a network. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% at the 4th percentile indicates negligible observed exploitation activity across the threat landscape.
Improper certificate validation in Dell PowerProtect One (versions below 20.3.0.0) enables a remote unauthenticated attacker to bypass TLS certificate checks, intercepting or decrypting protected communications between the appliance and connected systems. The CVSS 3.1 base score is 7.5 with high confidentiality impact, though EPSS sits at 0.14% (4th percentile) and SSVC records exploitation as 'none,' indicating no observed threat-actor activity. Vendor patch DSA-2026-369 is available and upgrade to 20.3.0.0 or later is the primary remediation.
Unauthenticated path traversal in yx-image-recognition v1.0 exposes arbitrary files on the host filesystem to remote attackers. Parameters `dir` and `filePath` are passed unsanitized directly to Java's `new File()` constructor, enabling directory traversal sequences (e.g., `../../`) to escape the intended working directory. No public exploit identified at time of analysis, and EPSS of 0.14% (4th percentile) indicates low observed exploitation probability, though a researcher-published report with technical detail exists on GitHub.
Replay attack vulnerability in the Acre Security (formerly Vanderbilt Industries) SPC5300.000 access-control panel allows a physically proximate attacker to cause a denial of service by injecting replayed application-layer payloads into an active TCP session handled by SPC Connect Pro software. Affected firmware is version 3.14.1 of the SPC5300.000 Main Board. No public exploit code has been identified at time of analysis, and EPSS probability is extremely low at 0.14% (4th percentile), but the target is life-safety physical security infrastructure where availability impacts carry elevated real-world consequences.
TCP connection teardown handling in the Vanderbilt/Acre Security SPC5300.000 Main Board firmware v.3.14.1 accepts spoofed TCP FIN packets without validating sequence or acknowledgment numbers, enabling an attacker in physical or network proximity to forcibly terminate active TCP sessions and cause a denial of service. The affected device is a physical access control security panel, meaning exploitation could disrupt building access control operations. No public exploit code has been identified at time of analysis, and EPSS remains at the 4th percentile, reflecting minimal observed exploitation activity.
Arbitrary file read via path traversal in DocSys-master V2.02.85 exposes the server filesystem to unauthenticated remote attackers through the downloadDocEx endpoint in DocController.java, which fails to sanitize user-supplied path parameters. Publicly available exploit code exists per SSVC poc status and the GitHub reference. Despite a CVSS 7.5 score with high confidentiality impact, EPSS of 0.14% (4th percentile) indicates very low observed exploitation activity, likely reflecting the product's obscure deployment footprint rather than low exploitability.
Denial of service in the Vanderbilt Industries / Acre Security SPC5300.000 Main Board running firmware v.3.14.1 allows a physically proximate attacker to crash the device by sending spoofed SYN packets, exploiting the panel's failure to bound resource consumption from crafted TCP traffic. The NVD-assigned CVSS vector uses AV:N (network), but the CVE description explicitly qualifies the attacker as physically proximate - a material, unresolved discrepancy that defenders must clarify with the vendor before assessing remote exploitability. No public exploit code and no active KEV-listed exploitation have been identified; EPSS probability is negligible at 0.14%.
Header-based identity forgery in AntFlow V2.0.0 allows unauthenticated remote attackers to impersonate any user by supplying an arbitrary userid value in the HTTP request header. The flaw exists because `JiMuMDCCommonsRequestLoggingFilter.java` treats a user-controlled request header as the authoritative identity token, implementing no cryptographic validation, signature check, or server-side session verification. With PR:N and AC:L confirmed by the CVSS vector, exploitation is trivially simple and results in full confidentiality breach of any targeted user account's sensitive data. EPSS is low (0.14%), and no KEV listing exists, but a public researcher write-up is available on GitHub, lowering the bar for exploitation.
Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.
Memory exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem allows unauthenticated remote attackers to drive forward-allocated memory growth without bound, resulting in kernel memory exhaustion and denial of service. The flaw is a regression introduced by commit 9db5b3cec4ec, which added forward-memory borrowing from MPTCP subflows but omitted the corresponding reclaim step when socket buffers are dropped before reaching the receive queue. Stable-branch patches have been released across the 6.18.x and 7.1.x series; no active exploitation or public exploit code has been identified.
NULL pointer dereference in the Linux kernel's in-kernel OpenVPN data-plane module (ovpn) allows a network-reachable peer to crash the kernel by triggering key removal against a crypto slot that is not populated. Affected kernels span the ovpn-enabled range from commit 89d3c0e4612afa1c6429ed68d298e35592fbe208 through versions prior to 6.18.46, 7.1.10, and 7.2. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation impact is full availability loss of the VPN gateway via kernel panic.
Unsafe sleeping in atomic context within the Linux kernel's ovpn module can crash affected systems during VPN key slot teardown. When AEAD crypto transforms are freed via a plain RCU callback, implementations backed by asynchronous or hardware crypto accelerators may block inside crypto_free_aead - an operation forbidden in softirq/atomic context - triggering a kernel BUG or panic and denying service to the host. Systems running Linux 6.16 or unpatched stable branches with the ovpn kernel module active and a non-synchronous AEAD backend are at risk; no public exploit has been identified and the flaw is absent from CISA KEV.
Deadlock vulnerability in the Linux kernel's bnxt (Broadcom NetXtreme) ethernet driver causes kernel hangs or crashes on systems with Broadcom bnxt NICs when an IRQ affinity notifier callback and the bnxt work-cancellation path simultaneously contend for the netdev instance lock. The affinity notifier callback acquires the lock to restart the queue while cancellation synchronously waits for that callback to finish - both paths block indefinitely, resulting in full availability loss for the affected network interface and potentially the host. No public exploit code exists and the vulnerability is absent from CISA KEV; the assigned CVSS vector (AV:N/PR:N) is inconsistent with the described kernel-local race and should be treated with skepticism.
Indefinite TX queue stall in the Linux kernel veth driver allows a denial-of-service condition against multi-queue virtual Ethernet interfaces running GRO without an XDP program attached. The root cause is that veth_poll() incorrectly uses rq->xdp_rxq.queue_index to determine which peer TX queue to wake - a field that is zero-initialized and only populated when XDP is active - causing all NAPI instances to wake peer TX queue 0 instead of the correct queue. In a multi-queue veth setup, a stopped TX queue (e.g., queue 1 halted due to ptr_ring saturation) is never woken, producing an indefinite transmit stall with no watchdog recovery because veth implements no ndo_tx_timeout. No public exploit is identified at time of analysis; reproduction scripts are publicly available from the reporter.
NULL pointer dereference in the Linux kernel ngbe (Wangxun) network driver crashes the kernel when the NIC operates in non-MSI-X interrupt mode (legacy INTx or single MSI). Systems running affected kernel versions with Wangxun WX1860-series NICs configured in non-MSI-X mode are exposed to a kernel panic, resulting in complete system availability loss. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, patch commits are available across multiple stable kernel branches.
LDAP Injection in Liderahenk, TÜBİTAK BİLGEM's centralized Linux management platform, enables unauthenticated remote attackers to manipulate LDAP queries and extract sensitive directory data - including user accounts, credentials, and organizational attributes - from the underlying directory service. Affected versions span 3.4.0 through 3.5.4. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the low-complexity unauthenticated attack vector makes this accessible to a wide range of threat actors targeting Turkish public sector infrastructure.
WebAuthn user verification bypass in Spring Security exposes applications to authentication circumvention when a distributed HTTP session store is in use. Affected versions span Spring Security 6.4.x through 7.1.0, meaning a broad range of enterprise Spring Boot applications leveraging passwordless/FIDO2 authentication are at risk. An unauthenticated remote attacker with the ability to manipulate the WebAuthn ceremony flow can bypass the user verification check - potentially authenticating as a legitimate user - with no public exploit identified at time of analysis.
Reflected Cross-Site Scripting in LimeSurvey Community Edition 7.0.5+260623 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by crafting a malicious URL targeting the user activation confirmation endpoint. The `action` query parameter is inserted unsanitized into a hidden HTML input attribute, enabling attribute context breakout and script injection. No public exploit has been identified at time of analysis; the issue was disclosed by Fluid Attacks.
OS command injection in Dell Cloud Disaster Recovery versions 20.2 and prior allows a high-privileged remote attacker to execute arbitrary operating system commands via the product's REST API, resulting in full system compromise. The vulnerability is rooted in insufficient sanitization of special characters within API inputs (CWE-78) and is reachable over the network without user interaction. No public exploit code or active exploitation has been identified at time of analysis; Dell has released a security advisory (DSA-2026-353) addressing the issue.
Privilege escalation in OpenZFS on Linux allows any unprivileged local user to perform root-restricted ZFS pool operations - including pool creation, import, destruction, event log access, and fault injection via zinject - by exploiting a flaw in ioctl authorization that incorrectly treats CAP_SYS_ADMIN held within a user-created unprivileged namespace as equivalent to real host-level root privilege. The vulnerability requires only that the user can open /dev/zfs and that the kernel permits unprivileged user namespace creation, a configuration that is enabled by default on most modern Linux distributions. No public exploit has been identified at time of analysis, and the OpenZFS project has released patched versions 2.2.11, 2.3.9, and 2.4.4 addressing all affected branches.
Out-of-bounds hardware I/O reads in the Linux kernel's fbdev framebuffer subsystem allow low-privileged local users to read memory beyond valid hardware bounds, with high confidentiality and availability impact. The flaw in fb_io_read() stems from pointer desynchronization after a partial copy_to_user() transfer: the hardware source pointer advances by the full original chunk size while count is only decremented by successfully copied bytes, causing subsequent loop iterations to read from incorrect, over-advanced offsets. No public exploit or CISA KEV listing exists at time of analysis; patches are available across multiple stable kernel branches.
Stored Cross-Site Scripting in WP Fastest Cache (WordPress plugin, all versions through 1.5.0) allows unauthenticated remote attackers to inject persistent JavaScript by supplying a crafted HTTP Host header that the plugin writes into shared page-cache files, which are then served to all subsequent visitors. Exploitation requires two co-present non-default conditions: the Polylang or Polylang Pro multilingual plugin must be installed and active, and the 'Combine JS' option must be enabled in WP Fastest Cache settings, both of which activate the vulnerable Host-header-to-URL code path in js-utilities.php. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.
Stored cross-site scripting in LimeSurvey Community Edition 7.0.5 allows an authenticated low-privileged user with survey creation rights to persist malicious JavaScript via the survey quota message field, which executes in the browser of any user who subsequently views that quota. The CVSS 4.0 score of 7.2 reflects high confidentiality and integrity impact on the vulnerable system (VC:H/VI:H), with realistic escalation to administrator-level session compromise if an admin reviews attacker-controlled quota messages. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.