JWT token disclosure in OpenMetadata's SAML and OIDC/OAuth2 authentication flows enables account takeover by exploiting an unvalidated open redirect that appends the victim's freshly issued JWT, email, and account name to an attacker-controlled URL. All 1.x releases are affected because neither SamlLoginServlet nor the OIDC/OAuth2 handler validates the caller-supplied redirect destination against any allowlist or registered callback set. An attacker who socially engineers a victim into clicking a crafted login URL can capture the full JWT upon successful authentication and immediately assume control of that account via the OpenMetadata API. No public exploit has been identified at time of analysis, and no CISA KEV listing is confirmed.
Stored XSS in LimeSurvey Community Edition 7.0.5 allows an authenticated user holding the global settings:read permission to plant a persistent JavaScript payload in the Survey Menu Entries administration page. The malicious value is written to the surveymenu_entries.data field and reflected unsanitized into a single-quoted HTML title attribute, creating a durable attack surface that fires against any higher-privileged administrator who subsequently browses that page. No public exploit or CISA KEV listing has been identified at time of analysis, but the stored nature of the vulnerability means a single write by a low-footprint attacker can target multiple privileged users over time.
Code injection through CorvusSKK's embedded Lua scripting engine permits arbitrary code execution on Windows systems running versions prior to 3.3.4. Vendor release notes for the fixed version explicitly confirm that dangerous Lua engine features were disabled to address this vulnerability (CWE-94). No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog, though CISA's SSVC framework rates the technical impact as total, reflecting full compromise of confidentiality, integrity, and availability on affected hosts.
Heap out-of-bounds write in the Linux kernel's XFS log recovery path allows an attacker supplying a crafted XFS filesystem image to corrupt adjacent kernel slab memory during mount-time log replay. The flaw resides in xlog_recover_do_reg_buffer(), where a memcpy() copying dirty buffer regions is bounded solely by an ASSERT() that compiles away on production kernels (CONFIG_XFS_DEBUG=n), leaving attacker-controlled offset and length values from the logged dirty bitmap completely unchecked against the buffer's actual allocated size. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified, though KASAN-confirmed slab-out-of-bounds writes demonstrate the primitive is real and reliable on unpatched kernels.
Heap buffer overflow in the Linux kernel's s390/qeth driver exposes IBM System z hosts to local kernel memory corruption via malformed SNMP and ARP query ioctl calls. Affected systems run Linux kernel versions from 2.6.26 through the last unfixed stable releases across eight stable branches, with patches available in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. An attacker supplying a zero or undersized udata_len value to qeth_snmp_command() or qeth_l3_arp_query() triggers a u32 integer underflow in the callback bounds check, allowing memcpy to write past the kernel heap allocation and potentially achieve kernel code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds kernel heap write in the Linux kernel's Focaltech touchpad input driver allows local attackers to corrupt kernel memory through a signed integer underflow in the finger index variable. The `focaltech_process_rel_packet` function incorrectly handles a packet reporting finger index 0: subtracting 1 from a signed variable produces -1 rather than wrapping to a large unsigned value, bypassing the FOC_MAX_FINGERS bounds check and writing to `state->fingers[-1]`. Affected kernel versions span multiple stable branches from Linux 4.0 through the pre-patch revisions of 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, and 7.2; no CISA KEV listing and no public proof-of-concept exploit exist at time of analysis.
Channel-pinning authorization bypass in one-api through v0.6.10 allows any holder of a valid API token to route requests through arbitrary operator-configured upstream provider channels they were never granted access to. The flaw exists because middleware/auth.go implements two channel-selection paths - a key-suffix path correctly gated by an admin role check, and a URL path parameter path (channelid) carrying no role check at all - so a low-privilege account can enumerate integer channel IDs and cause the server to forward requests bearing provider API keys (e.g., OpenAI, Anthropic) configured by the operator. The bypass defeats both per-group channel restrictions and per-channel model allowlists. No public exploit has been identified at time of analysis, but the integer-enumeration primitive is trivially reproducible from the description alone.
Improper job dependency handling in GitLab Enterprise Edition's Pipeline Execution Policy enforcement allows an authenticated developer-role user to influence the execution environment of policy enforcement jobs. Affected versions span the 19.1, 19.2, and 19.3 release trains prior to their respective patches. While CVSS rates this a moderate 4.3, a publicly available exploit exists via HackerOne, and the security significance is elevated because Pipeline Execution Policies are a deliberate administrative security control - undermining their enforcement environment erodes a defense-in-depth layer in CI/CD pipelines. No active exploitation has been confirmed (not in CISA KEV).
Insecure Direct Object Reference (IDOR) in the Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 allows any authenticated customer with a valid portal session to cancel, reactivate, or modify Stripe subscriptions belonging to other customers. The plugin's customer portal endpoints fail to verify that a subscription ID supplied in the request is actually owned by the authenticated session's bound customer, enabling horizontal privilege escalation across customer accounts. A publicly available proof-of-concept exists; exploitation probability is low per EPSS (0.16%, 5th percentile), but the business impact on affected merchants' subscription revenue could be significant despite the moderate CVSS score.
Broken object-level authorization in the Project Manager WordPress plugin before 4.0.7 allows any authenticated user - including low-privilege subscribers - to read arbitrary users' activity histories, email addresses, and details of projects they have no legitimate access to via an unguarded REST API route. Affected versions span 2.2.0 through 4.0.6, with a patch released at 4.0.7. A publicly available proof-of-concept is documented by WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS probability remains low at 0.16%.
Cleartext exposure of LoRaWAN cryptographic session keys via NFC interface in dozens of Milesight IoT sensor and controller models allows any physically proximate unauthenticated attacker to retrieve ABP NwkSKey, AppSKey, and D2D keys through a commodity NFC read operation. The stolen keys enable full compromise of LoRaWAN communications for the affected device, including decryption of captured traffic, forgery of uplink and downlink frames with valid message integrity codes, injection of falsified sensor data, issuance of device commands, and disruption of legitimate frame processing. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV, but the attack itself requires no technical sophistication once physical proximity is achieved.
Unconditional TLS certificate verification bypass in Netmaker's SMTP client (pro/email/smtp.go, v1.6.0) exposes sensitive email traffic to network-positioned adversaries. The hardcoded InsecureSkipVerify=true setting - present directly beneath a developer comment acknowledging it should be false in production - means Netmaker accepts any certificate its mail relay presents, including one supplied by an intercepting party. Password-reset tokens and enrollment links transiting that connection can be captured and replayed by the attacker before the legitimate recipient acts on them. No public exploit is identified at time of analysis, and the flaw is absent from the development branch but confirmed present in the latest release.
Cleartext exposure of LoRaWAN cryptographic session keys through the NFC interface of Milesight IoT sensor devices enables a physically proximate unauthenticated attacker to retrieve NwkSKey, AppSKey, and D2D keys from any affected device via a trivial NFC read operation. With these keys, an adversary can decrypt all ABP-mode LoRaWAN traffic for the compromised device, forge both uplink and downlink frames with valid session keys, inject falsified sensor readings into network servers, issue supported device commands, and cause legitimate frames to be rejected by consuming frame counters. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, but the attack requires no credentials and succeeds in seconds with commodity NFC hardware against any physically accessible affected device.
NSD's proxy protocol port fails to re-evaluate BLOCKED access control list entries on the second DNS query sent over a kept-open TCP or TLS connection, allowing a remote unauthenticated attacker to bypass ACL denials that should have blocked the request. NLnet Labs reported this against all NSD versions (CPE wildcard scope), classifying it under CWE-290 as an authentication bypass by spoofing. No public exploit code has been identified at time of analysis, but the bypass mechanic - sending a query twice on the same persistent connection - is mechanically trivial once the proxy protocol port is reachable.
NSD authoritative DNS server crashes serve child processes when receiving a crafted DNS message containing exactly 17 DNS Cookie options with a UDP payload size of 512 bytes, triggering a reachable assertion (CWE-617). This condition exists exclusively in debugging and non-release build types - standard production release builds are immune. Remote unauthenticated attackers can continuously respawn-crash serve children to severely degrade or fully deny DNS resolution service; no public exploit has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
IP range-based access control in NLnet Labs NSD is silently broken on little-endian systems due to an endianness mismatch in the range comparison logic. Both IPv4 and IPv6 addresses are compared as unsigned 32-bit integers using host byte order, while the actual stored values are in network byte order (big-endian), causing comparisons to produce incorrect results on the dominant x86/x86-64/ARM-LE server platforms. The practical consequence is a bidirectional access control bypass: operators relying on hyphen-range ACL syntax may inadvertently permit unauthorized IP addresses to access restricted DNS operations (such as zone transfers) while simultaneously denying legitimate clients. No public exploit has been identified at time of analysis, but the flaw is fully deterministic and requires no special attacker capability beyond network reachability.
Denial of service via HPACK bomb in http4s ember-core's HTTP/2 implementation allows unauthenticated remote attackers to exhaust JVM heap memory and crash affected servers or clients. The flaw resides in the Hpack wrapper (Hpack.scala:L54), where HEADERS and CONTINUATION frames are concatenated and decoded wholesale into a Scala List before any size limit is enforced; the existing maxHeaderSize guard is bypassed entirely because it does not account for indexed headers. Approximately five concurrent malicious connections against a 2 GB heap suffice to trigger OutOfMemoryError; no public exploit code or CISA KEV listing has been identified at time of analysis.
ReDoS in NLTK's tgrep module exposes applications to indefinite CPU saturation when user-controlled tgrep patterns containing /regex/ nodes reach the _tgrep_node_action function, which compiles and executes them via Python's re.search without validation or timeout. All NLTK versions before 3.10.3 are affected when tgrep_positions() or tgrep_compile() accept external input. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation is conditional on a non-default, externally-exposed API configuration.
Privilege escalation in Ubiquiti's UniFi Connect Application allows network-accessible unauthenticated attackers to elevate their access level within the application via an Improper Access Control flaw. The vulnerability, tagged as an authentication bypass, exposes access control management infrastructure to unauthorized privilege acquisition with no user interaction or prior credentials required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity network attack vector and PR:N classification make this a straightforward target for opportunistic exploitation.
Improper lock-aware cleanup in the s390/vfio_ccw subsystem of the Linux kernel exposes host systems to memory corruption when a virtualized channel device transitions to a non-operational state. The fsm_notoper() routine, invoked asynchronously upon device loss, performs private->cp resource cleanup while potentially holding the CIO subchannel lock, creating a lock inversion or use-after-free condition that crosses the VM-to-host boundary (CVSS S:C). The affected code path is specific to IBM Z (s390) architectures using vfio_ccw for channel I/O device passthrough to guests. No public exploit code has been identified at time of analysis, and vendor-released patches are available across multiple stable kernel branches.
Weblate's REST API failed to enforce permission scope on team (group) assignments in all versions prior to 2026.7, allowing any authenticated low-privilege user to assign unauthorized projects or workspaces to a team via the API. The root serializer field `defining_workspace` resolved primary keys against `Workspace.objects.all()` without filtering by the requesting user's permissions, enabling horizontal privilege escalation to private projects. Vendor-released patch 2026.7 is confirmed; no public exploit code or CISA KEV listing exists at time of analysis.
Incorrect path authorization in SeaweedFS SFTP server (versions 3.88-4.39) allows an authenticated low-privilege user to cross configured ACL boundaries and access or overwrite sibling tenants' files. The SFTP permission check used a bare string-prefix comparison, so a user scoped to /tenants/alice was also permitted access to any path beginning with those same characters - such as /tenants/alice-archive or /tenants/alice2 - without requiring a directory-component boundary. No public exploit code has been identified at time of analysis, though the public fix commit and advisory together fully document the vulnerable pattern, materially lowering exploitation difficulty for authenticated users.
Memory updated with the new marker. The analysis is clean and unmanipulated.
Time-of-check-time-of-use (TOCTOU) race condition in Spring Cloud Config Server's SVN backend allows unauthenticated network attackers to manipulate the basedir path between validation and use, achieving full compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). Affected are all branches of Spring Cloud Config through 5.0.4, 4.3.4, 4.2.8, and 3.1.14 and earlier, covering a broad range of enterprise Spring microservices deployments. No public exploit code has been identified and no active exploitation is confirmed; however, the vendor (VMware/Spring) has released patches across all affected branches.
Authentication bypass in the Classified Listing - Mobile Number Verification WordPress plugin (all versions through 1.6.0) allows unauthenticated network attackers to authenticate as any registered user - including site administrators - without a valid OTP. The root cause is the absence of server-side Firebase OTP token validation in the process_otp_login() function, which blindly trusts client-submitted OTP and UID values. No public exploit code has been identified at time of analysis, and it does not appear in the CISA KEV catalog, but the CVSS 8.1 score reflects the high impact of full account takeover if exploitation prerequisites are met.
Out-of-bounds read in the Linux kernel's s390/vfio_ccw subsystem exposes host kernel memory to guest VM users, caused by an off-by-one error in the CCW chain length validation loop within `ccwchain_calc_length()`. Affected versions span from Linux 4.12 across multiple stable branches, with vendor-released patches confirmed in 5.10.266, 5.15.217, 6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, and 7.2. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV; however, the guest-to-host scope change and high confidentiality impact warrant prioritized patching in any s390/IBM Z virtualization environment using vfio_ccw device passthrough.
Buffer overflow in FreeBSD's ppp(8) PPP daemon enables a local user with access to the ppp(8) command interface to crash the process or execute arbitrary code as root by supplying an oversized PSN endpoint value to the mp_SetEnddisc() function, which copies the input without length validation. FreeBSD 15.1-RELEASE (before p3), 15.0-RELEASE (before p13), and 14.4-RELEASE (before p9) are all confirmed affected per EUVD-2026-66248 and FreeBSD Security Advisory SA-26:60. No public exploit has been identified at time of analysis, and the low EPSS score (0.27%, 19th percentile) indicates limited exploitation interest despite the High CVSS rating.
Privilege escalation in FreeBSD's kernel audio subsystem allows an unprivileged local user on systems with multiple audio devices to exploit a use-after-free in the sync group ioctl locking path to achieve full kernel compromise. The race condition arises when the ioctl releases the sync group list lock to sleep during a blocking lock attempt, and a concurrent operation frees the sync group structure before the sleeping thread reawakens and dereferences it. Affected releases include FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.16% (6th percentile), reflecting low current threat activity.
Privilege escalation in FreeBSD 15.x unix socket implementation allows an unprivileged local user to achieve full system compromise via a use-after-free in the SOCK_STREAM receive path. Control messages are not fully detached from the socket buffer before error-path code frees the associated mbufs, leaving dangling references exploitable by a low-privileged attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and confirmed patch availability from the FreeBSD project make this a clear and immediate patching priority for affected deployments.
Privilege boundary violation in FreeBSD's hwpmc(4) hardware performance monitoring subsystem allows a low-privileged local user to continue observing a process via attached PMCs after that process elevates privileges by executing a setuid or setgid binary, directly contrary to the kernel's intended security policy. Affected versions span FreeBSD 14.4-RELEASE before p9, 15.0-RELEASE before p13, and 15.1-RELEASE before p3; vendor patches are available per FreeBSD Security Advisory SA-26:56. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), placing this as a low near-term exploitation priority despite the high vendor CVSS score.
Heap-based buffer overflow in the Dia diagram editor's WPG file importer allows arbitrary code execution or process crash when a user opens a crafted WPG file. The WPG color palette buffer is allocated for exactly 256 entries (768 bytes), but the COLORMAP record parser fails to validate that the supplied start index (i16) or total entry count (iNum16) stay within that bound, allowing a malicious file to drive fread() to write beyond the heap allocation. Affecting all Dia versions on the upstream master branch through at least 2026-08-21, no public exploit or patch version has been confirmed at time of analysis, though the description provides sufficient detail to construct proof-of-concept input.
Stack-based buffer overflow in GNOME Dia diagram editor (0.98.0 and earlier) permits stack exhaustion and potential return-address corruption when a victim opens a crafted .dia XML file containing a Bus object with an attacker-controlled bus_handles value and then moves a handle in the diagram. The root cause - an unbounded g_alloca() call driven by an unvalidated file attribute - is also present in objects/Misc/tree.c via Tree objects, widening the attack surface. No public exploit or CISA KEV listing exists at time of analysis, but the GitLab issue provides sufficient technical detail for proof-of-concept development.
Reference count corruption in the Linux kernel netfilter ipset subsystem allows a local low-privileged attacker to trigger a kernel panic via a race condition between list:set garbage collection and ip_set_swap(). The flaw exists because __ip_set_put_byindex() resolves a set index to a pointer under RCU but acquires ip_set_ref_lock only afterward to decrement the refcount, creating a window where ip_set_swap() can atomically reassign both the ip_set_list slot and the associated refcount before the lock is taken - causing the GC path to decrement a refcount that has already moved, hitting BUG_ON(set->ref == 0) and a fatal kernel panic. All Linux stable branches from 3.8 through pre-patch 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, and 7.2 are affected; no public exploit has been identified at time of analysis.
Slab-out-of-bounds read in the Linux kernel's cls_u32 traffic classifier allows a local user with networking privileges to corrupt kernel heap memory and escalate to root. The flaw exists in u32_bind_class(), which unconditionally casts all objects enumerated by u32_walk() as tc_u_knode structures, even when the object is a tc_u_hnode (hash table), which lacks the tcf_result member - causing an out-of-bounds access to res->classid. Patches have been released across multiple stable kernel branches (6.1.184, 6.6.153, 6.12.105, 6.18.46, 7.1.10, 7.2), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Traffic Control BPF classifier (cls_bpf) in the Linux kernel fails to validate that a hardware-offloaded SCHED_CLS program's bound network device matches the target TC classifier device, allowing a local attacker with CAP_NET_ADMIN to attach a program loaded for device A to device B via skip_sw. When device A is subsequently removed, the kernel destroys the program's offload state while it remains live on device B, producing a use-after-free condition that triggers a kernel WARN or panic (guaranteed denial of service with panic_on_warn=1, with potential for privilege escalation via the memory corruption primitive). Patches are available across multiple stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Heap buffer overflow in the Linux kernel synaptics-rmi4 driver allows local low-privileged users to overwrite kernel heap memory by exploiting stale state in the F54 diagnostics function. Affected systems must have Synaptics RMI4 touchpad hardware present and the driver loaded; exploitation involves manipulating V4L2 buffer sizes to trigger the overflow after an error condition leaves f54->report_size containing a stale value from a prior successful operation. Patches are available across all supported stable branches; no public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Privilege escalation in FreeBSD's POSIX shared memory subsystem allows an unprivileged local user to gain root-level access by exploiting a race condition in the FIOSSHMLPGCNF ioctl handler. The kernel's largepage shared memory page-size configuration check is performed without holding the rangelock, enabling two concurrent callers to each observe an unconfigured object and write conflicting page sizes, corrupting kernel object state in an exploitable way. No public exploit code or CISA KEV entry has been identified at time of analysis; EPSS is 0.13% (3rd percentile), indicating low current exploitation probability, though local privilege escalation primitives in OS kernels are high-value targets for post-compromise and container-escape scenarios.
Heap buffer overflow in the Linux kernel's synaptics-rmi4 driver allows a local low-privileged user to trigger memory corruption by issuing VIDIOC_S_INPUT while the V4L2 diagnostic queue is actively streaming. The F54 function allocates V4L2 buffers sized to the report type at stream start; switching the input mid-stream to a larger report type overflows those buffers, enabling potential privilege escalation to root. Patches have been released across all active stable kernel branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local privilege escalation in the Linux kernel's OpenRISC signal return path allows any unprivileged local user to disable the Data MMU and gain arbitrary physical memory read/write access. The flaw exists in restore_sigcontext() on the OpenRISC (or1k) architecture, which fails to filter privileged Supervision Register (SR) bits copied from a user-controlled signal frame on sigreturn. Patched stable releases are available across all maintained kernel branches (5.10 through 7.2); no public exploit identified at time of analysis, though a verification proof-of-concept is documented in the fix description.
Race condition and error-path corruption in the Linux kernel sur40 input driver allow a local low-privileged user with access to an attached Samsung SUR40 multi-touch device to crash the kernel or corrupt input core state. The driver registers the input device in sur40_probe() before V4L2 video and vb2_queue components are fully initialized; any userspace process opening the input node immediately after registration can trigger the sur40_poll() worker thread, which dereferences the still-uninitialized vb2_queue and causes a data race leading to a potential system crash. A secondary error-path bug calls input_free_device() on an already-registered device instead of input_unregister_device(), corrupting input subsystem state if V4L2 initialization subsequently fails. No public exploit is identified at time of analysis.
Local privilege escalation and kernel panic in the Linux kernel AMDGPU DRM subsystem allows a low-privileged local user to crash the system or potentially corrupt kernel memory by submitting a crafted GEM_CREATE ioctl with invalid domain flag combinations. The AMDGPU_GEM_CREATE ioctl validated individual domain bits against AMDGPU_GEM_DOMAIN_MASK but failed to reject illegal combinations of CPU, GTT, or VRAM domains mixed with special-purpose domains (DOORBELL, GDS, GWS, OA), causing amdgpu_bo_placement_from_domain() to write past the AMDGPU_BO_MAX_PLACEMENTS array boundary and trigger BUG_ON(), resulting in a kernel panic. No public exploit code or CISA KEV listing has been identified at time of analysis; patches are available across all active stable kernel branches.
Integer overflow in the amdgpu DRM subsystem's UVD (Unified Video Decoder) component exposes systems running AMD GPUs to local privilege escalation. The minimum image size calculation incorrectly references the image width rather than the pitch value, and fails to reject pitch values exceeding 4096, allowing arithmetic overflow that produces an artificially small size bound. A low-privileged local user can submit a crafted UVD decode request to corrupt kernel memory and achieve full system compromise with high confidentiality, integrity, and availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's IPVS subsystem allows a low-privileged local process to trigger kernel memory corruption via ip_vs_nat_icmp(). The flaw arises because the embedded IP header length field (ihl) is not revalidated after skb_ensure_writable() is called on ICMP packets processed through IPVS NAT, enabling a local process to supply a larger ihl value than was originally validated, causing ip_send_check() to access memory beyond intended bounds. With a CVSS score of 7.8 (AV:L/AC:L/PR:L/UI:N), this represents a credible local privilege escalation path on any Linux system running IPVS in NAT mode. No public exploit code has been identified at time of analysis.
Out-of-bounds array access in the Linux kernel's ASoC tas2562 audio driver allows local, low-privileged users to trigger kernel memory corruption by supplying unvalidated volume control values via the ALSA interface. The tas2562_volume_control_put() function accepts arbitrary userspace-supplied integers and uses them as unchecked array indices to look up a fixed-size table, potentially reading out-of-bounds kernel memory and writing that value to the TAS2562 hardware device over I2C. No public exploit code has been identified and the vulnerability is absent from CISA KEV; patched stable kernel releases are available across all affected branches.
Use-after-free in the Linux kernel perf subsystem allows a local low-privileged user to obtain a dangling pointer to a freed perf_event structure, enabling memory corruption with full confidentiality, integrity, and availability impact. Affected are stable kernel series 6.6.x, 6.12.x, 6.18.x (up to 6.18.46), and 7.1.x (up to 7.1.10). No public exploit code or CISA KEV listing exists at time of analysis, but the local privilege escalation primitive is significant on multi-tenant Linux systems.
Use-after-free race condition in the Linux kernel atmel-mci MMC/SD controller driver allows a local privileged user to corrupt freed kernel memory by racing module removal against queued bottom-half work items. Systems running Linux on Atmel AT91 or AVR32 SoC hardware with the atmel-mci driver loaded are exclusively affected; x86/x64 deployments are unaffected by design. Patch commits are confirmed available for stable branches 6.12.x, 6.18.x, 7.1.x, and 7.2, with no public exploit identified at time of analysis.
Persistent root escalation in Admin By Request (ABR) on macOS allows a low-privileged local user to inject malicious entries into the sudoers file during an ABR privilege elevation session, achieving root access that outlasts the session itself. The flaw is tracked under advisory ABR-MAC-26-02 and was flagged by Singapore's Cyber Security Agency (CSA). No public exploit or CISA KEV listing is present at time of analysis, but the nature of the impact - permanent, session-independent privilege escalation - makes this high priority for any enterprise fleet running ABR on macOS.
Out-of-bounds memory write in the Linux kernel's synaptics-rmi4 input driver allows a local attacker with access to a malicious or malfunctioning RMI4 touchpad device to corrupt kernel memory, potentially enabling privilege escalation or information disclosure. The root cause is a mismatch between the F54 report buffer allocation size (derived from F54 electrode counts) and the transfer size computed from F55 electrode counts - both sourced directly from device queries with no cross-validation. Vendor patches are confirmed across multiple stable kernel branches; no public exploit or CISA KEV listing has been identified at time of analysis.
Incorrect error-path logic in the Linux kernel's Qualcomm Crypto Engine (QCE) driver allows a local attacker with low privileges on Qualcomm SoC-based hardware to potentially trigger memory corruption via a use-after-free or improper resource release condition. The flaw resides in `devm_qce_register_algs`, where a failed `ops->register_algs()` call causes the cleanup loop to repeatedly invoke `ops->unregister_algs()` on the failed slot rather than iterating over previously successfully registered algorithm slots - leaving registered algorithms unreleased and potentially double-freeing or corrupting state. No public exploit identified at time of analysis, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog.
Use-after-free race condition in the Linux kernel's AF_UNIX garbage collector (GC) allows a local user with low privileges to corrupt kernel heap memory with potential for privilege escalation. The race occurs between concurrent send() and close() operations on a crafted set of Unix domain sockets forming a Strongly Connected Component (SCC), causing unix_walk_scc_fast() to dereference a freed scc_entry when a partially-freed SCC is walked during the next GC cycle. The vulnerability is not in CISA KEV and no public exploit code has been identified at time of analysis; however, the CVSS 7.8 score and C:H/I:H/A:H impact triad reflect realistic kernel memory corruption severity.