CORS misconfiguration in Rybbit before 2.7.0 allows any attacker-controlled website to issue credentialed cross-origin requests to the Rybbit analytics server, because the server unconditionally reflects the request's Origin header in Access-Control-Allow-Origin while simultaneously enabling Access-Control-Allow-Credentials. Authenticated victims who visit a malicious page expose their analytics data, account information, and permit the attacker's script to perform state-changing API operations on their behalf. No public exploit has been identified at time of analysis, but the underlying attack class requires only standard browser Fetch API usage and is trivial to implement.
Unauthenticated OS command injection in openNDS before 11.0.0 allows any adjacent-network attacker - such as an unprivileged user connected to a captive portal WiFi - to execute arbitrary shell commands on the host router by supplying a crafted `fas` query parameter to the `/opennds_preauth/` endpoint. The vulnerability originates in `libopennds.sh`, which processes the parameter without sanitizing shell metacharacters before passing it to OS-level commands. The fix, published in commit 8c03750, introduces strict base64-character allowlist validation that rejects any query string containing characters outside A-Za-z0-9+/=. No public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel panic vulnerability in the Linux kernel's IP fragment reassembly path allows an unprivileged user in their own user namespace to crash the host kernel by writing two specially crafted packets with GSO (Generic Segmentation Offload) metadata to a tun/tap device. The flaw exists because inet_frag_queue_insert() - shared by IPv4, IPv6, nf_conntrack_reasm, and 6lowpan reassembly - fails to strip GSO state from fragments before queuing, causing the reassembled skb to reach skb_segment() with SKB_GSO_DODGY state and trigger BUG_ON() assertions. The vulnerability is also reachable with CAP_NET_RAW in a netns where a defrag point precedes a GSO point, and from a guest VM whose VMM forwards virtio_net_hdr to a host tap; KEV status is unconfirmed and EPSS is low at 0.18% (7th percentile), though the CVE description contains a working reproducer.
Missing ownership validation across three Quivr chat API endpoints through version 0.0.322 enables any authenticated user to read, delete, or inject fabricated messages into other users' private conversations and associated knowledge base content. The vulnerable endpoints (GET /chat/{chat_id}/history, DELETE /chat/{chat_id}, POST /chat/{chat_id}/question/answer) accept user-supplied chat IDs without server-side authorization checks, a classic IDOR (CWE-639) pattern. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog at time of analysis, but the low-complexity, authenticated-only prerequisite makes exploitation trivially accessible to any malicious account holder in a multi-user deployment.
Insecure Direct Object Reference in VoltAgent through 2.1.20 allows any authenticated user to read, modify, or delete conversations belonging to other users by supplying arbitrary conversation identifiers to memory API endpoints. The server accepts caller-controlled identifiers without verifying ownership, enabling horizontal privilege escalation across all users of a shared deployment. No public exploit has been identified at time of analysis, but the IDOR pattern (CWE-639) is trivially exploitable by any account holder with basic API knowledge.
API authentication middleware in Gophish through 0.12.1 fails to enforce account lockout and mandatory password-change states, allowing any holder of a valid API key to retain full platform access regardless of administrative security actions taken on that account. Affected versions include all releases up to and including 0.12.1 per CPE cpe:2.3:a:gophish:gophish:*:*:*:*:*:*:*:*. An attacker who obtains or retains an API key - including a compromised insider or a key that was not rotated before an account was locked - can read and modify phishing campaign data, harvested credentials, and user configurations with high confidentiality and integrity impact. No public exploit or CISA KEV listing has been identified at time of analysis.
Privilege escalation in Budibase server before 3.41.3 allows an authenticated app-scoped builder to gain unauthorized builder access across all applications within the same tenant. By submitting crafted requests to the public user create or update API endpoints with manipulated builder.apps fields, the attacker bypasses the missing authorization check and self-assigns elevated builder privileges over unrelated applications. No public exploit code has been identified and no CISA KEV listing exists at time of analysis, but the network-accessible, low-complexity nature of the attack makes this a significant risk in any multi-tenant Budibase deployment.
Authorization bypass in Budibase Server before 3.41.3 allows any authenticated user holding the lowest-privilege BASIC role to perform unrestricted read, create, update, and delete operations against any application table via the POST /api/datasources/query endpoint. Per-table role restrictions enforced elsewhere in the application are entirely absent on this API path, rendering the access control model trivially circumventable with a standard API call. No public exploit has been identified at time of analysis, though the low attack complexity - requiring only valid BASIC credentials and a crafted HTTP request - makes this a genuine priority for externally-accessible or multi-tenant deployments.
SQL injection via identifier escaping failure in MongoDB Connector for BI allows a low-privileged MongoDB user to craft collection, field, or index names that break out of SQL quoted identifiers, embedding arbitrary SQL into the DDL output produced by SHOW CREATE statements. Any user with write access to a sampled MongoDB collection can plant the payload; the injected SQL executes only when an operator or automated pipeline later replays that generated DDL against a downstream SQL-compatible server, triggering execution with that session's privileges. No public exploit has been identified and this CVE is not listed in CISA KEV, though the attack requires only low privileges and exploits a plausible - and often automated - operational workflow in analytics environments.
SQL injection in WPBulky WordPress plugin (versions ≤ 1.2.2) is exploitable by any authenticated user holding a Contributor-level role, requiring no user interaction and no special configuration beyond plugin installation. The CVSS Scope:Changed flag combined with high confidentiality impact indicates the injection can reach beyond WordPress application data into the underlying MySQL database, enabling extraction of password hashes, private content, and any other data accessible to the database user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack vector makes this a realistic threat on sites with open user registration.
Out-of-bounds read in the Linux kernel's asus_atk0110 hardware monitoring driver allows a malformed ACPI GGRP firmware package to trigger kernel memory corruption. Systems running ASUS ATK0110-equipped hardware with a BIOS that returns zero-count sub-packages in its GGRP management group response are affected across a wide range of Long-Term Support and mainline kernel versions from 2.6.32 onward. Exploitation is contingent on a specific hardware/firmware defect condition rather than a direct user action, but the resulting out-of-bounds read in kernel space carries high potential impact across confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists; EPSS is 0.18% (7th percentile), reflecting the niche hardware prerequisite.
Race condition and error-handling flaws in the i2c-imx I2C controller driver allow a NULL pointer dereference via the kernel interrupt handler on NXP i.MX SoC-based systems. The vulnerability affects multiple stable kernel branches (5.15 through 7.x) and is triggered when I2C slave registration fails partway through a PM runtime resume, leaving a stale or NULL pointer that the shared IRQ handler can dereference concurrently. The realistic impact is a kernel panic causing system unavailability; no public exploit exists and EPSS is 0.17%, consistent with no observed active exploitation.
The Linux kernel ims-pcu USB driver exposes sysfs device attributes on the secondary data interface in addition to the intended primary control interface, allowing local users to trigger kernel crashes or undefined behavior by accessing those attributes on the data interface, which lacks the descriptors and internal state the driver requires. Affected systems must have an IMS Passenger Control Unit USB device physically connected and run a kernel version between commit 204d18a7a0c67352857dee1bbac517ed63f01d8e and the respective fix commits. No public exploit code exists, and the EPSS score of 0.17% (6th percentile) reflects the extreme hardware rarity required for exploitation; no CISA KEV listing exists.
Race condition in the Linux kernel's hisi_sas v3 hardware driver triggers a kernel WARNING and potential memory corruption when SAS phy link reset and driver removal (rmmod) execute simultaneously. Specifically, during SAS phy bring-up, device_links_driver_bound sets the link status to DL_STATE_AVAILABLE, and a concurrent rmmod then causes __device_links_no_driver() to encounter an inconsistent device-link state. No public exploit exists and EPSS sits at 0.17% (6th percentile), reflecting this is a hardware-specific, privilege-intensive, timing-dependent flaw with very low exploitation likelihood in practice.
Out-of-bounds memory write in the Linux kernel's device tree reserved memory subsystem allows an attacker with control over device tree content to corrupt kernel memory at boot time, with theoretical full kernel compromise (C:H/I:H/A:H). The fdt_scan_reserved_mem() function writes past the end of a fixed-size local array when a device tree blob defines more dynamically-placed /reserved-memory subnodes than MAX_RESERVED_REGIONS allows. Despite a CVSS score of 8.4, exploitation is heavily constrained by the requirement to modify device tree content before boot - a capability requiring privileged firmware access - and EPSS at 0.16% (5th percentile) reflects negligible observed exploitation probability. No public exploit has been identified and the vulnerability is absent from CISA KEV.
The spi-qpic-snand NAND flash driver in Linux kernel 6.18 and later contains a command-ordering defect that causes every SET_FEATURE write to apply the previous operation's value rather than the intended one, producing an off-by-one effect. On Qualcomm IPQ5018-based hardware (confirmed on TP-Link Archer AX55 v1 with ESMT F50L1G41LB flash), this defect became destructive in v6.18 when SPI-NAND OTP support was introduced: the 'disable OTP mode' call erroneously leaves CFG_OTP_ENABLE set permanently, causing all subsequent flash reads to return OTP area content and all writes to fail with -EIO, rendering the device unbootable. No public exploit identified at time of analysis; EPSS of 0.15% (5th percentile) correctly reflects that this is a driver logic defect rather than a traditionally attacker-controllable vulnerability.
Restriction bypass in the Linux kernel's io_uring subsystem allows a local low-privileged user to shed per-task io_uring security restrictions by executing exec(). When a task that has established io_uring restrictions calls exec(), the kernel's exec cancellation path invokes __io_uring_free(), which incorrectly frees both the task context and the per-task restriction simultaneously. Any io_uring ring created by the post-exec process is then entirely unrestricted, defeating sandbox and policy enforcement intended to constrain io_uring operations. No public exploit has been identified at time of analysis, but the CVSS score of 8.4 with Changed Scope (S:C) reflects that the bypass can expose confidentiality and integrity of resources guarded by the dropped restrictions.
SiYuan before v3.8.1 exposes a DNS rebinding SSRF vulnerability in its http_request and web_fetch agent tools, allowing network-accessible attackers who can influence processed URLs to bypass the built-in SSRF IP-blocklist defense and reach cloud instance metadata services or internal network hosts. The guard-time-only DNS resolution creates a TOCTOU race: the SSRF check sees a legitimate public IP, but the actual TCP connection lands on 169.254.169.254 or another private address. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS 4.0 score of 8.4 reflects high downstream confidentiality risk for cloud-hosted deployments where metadata credentials are accessible.
Command injection in oPanel's advanced/curl component allows authenticated attackers to execute arbitrary shell commands on the underlying server. The 'url' parameter accepted by the built-in curl tool is not sanitized, enabling shell metacharacter injection by any logged-in user. A public proof-of-concept is available at the linked GitHub repository, and SSVC rates the technical impact as total, meaning full system compromise is achievable post-authentication.
Open redirect in Pocket ID's OIDC /authorize page (versions 2.6.0-2.8.0) allows an unauthenticated network attacker to redirect any victim browser to an arbitrary external HTTPS URL by supplying a crafted authorization link with prompt=none and an unregistered redirect_uri. The SvelteKit frontend's onMount() handler issues window.location.href from the raw redirect_uri before the backend's allow-list validator is ever invoked, completely bypassing the per-client callback URL enforcement that protects the standard interactive flow. A public PoC is confirmed at code level (commit fc42f62) and the fix is released in v2.9.0; no active exploitation (CISA KEV) has been reported.
Missing authorization checks on three IAM REST API endpoints in Yamcs allow any authenticated low-privilege user to enumerate the server's complete privilege taxonomy and role-to-privilege mappings, directly enabling targeted privilege escalation reconnaissance. Affected are yamcs-core versions up to 5.12.7 and 5.13.0 through 5.13.1, used in production spacecraft operations and ground station environments. A proof-of-concept is confirmed in the GHSA advisory; no active exploitation (CISA KEV) has been identified, but the leaked data (including the ControlAccess and ChangeMissionDatabase privilege names) provides a precise roadmap for chained attacks including, per the advisory, algorithm-level remote code execution.
Server-side request forgery in Budibase Server before 3.41.3 allows authenticated builder-level users to supply arbitrary URLs to the datasource verify endpoint without SSRF validation, causing the server to make outbound requests to attacker-controlled infrastructure. The primary impact is credential leakage: internal CouchDB connection credentials are exposed in those outbound requests, granting an attacker direct, full administrative access to the backend database. This risk is amplified in cloud deployments where CouchDB serves as the primary data store. No public exploit code or CISA KEV listing is identified at time of analysis.
Schema-sampling denial-of-service in MongoDB Connector for BI allows a low-privileged database user to permanently halt the schema-refresh routine by creating a view in a sampled namespace that reliably fails on evaluation. The mongosqld process misclassifies the persistent failure as transient, exhausts its retry budget, then continues running with no valid schema - leaving all downstream SQL clients unable to retrieve results until an operator manually removes the offending view or excludes the namespace. No public exploit has been identified at time of analysis, but the low privilege requirement and network accessibility make this a credible insider or multi-tenant threat.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any authenticated Subscriber-level user to cancel a pending email change belonging to any other account - including site administrators. The flaw stems from the plugin's email-change cancellation handler accepting a user identifier supplied by the requester without verifying account ownership, a classic IDOR pattern. A publicly available exploit exists per WPScan; however, SSVC assessment lists exploitation as none and the attack is not automatable, indicating opportunistic rather than widespread active abuse.
Server-Side Request Forgery in Gitingest through 0.3.1 allows unauthenticated attackers to redirect outbound server connections to arbitrary attacker-controlled hosts by exploiting a prefix-only hostname validation bypass in the `_validate_host` function. Because Gitingest may carry GitHub personal access tokens as HTTP basic auth credentials on outbound git requests, any host whose name begins with `git.`, `gitlab.`, or `github.` passes validation and becomes a credential harvesting endpoint. No public exploit code is confirmed at time of analysis and no CISA KEV listing exists, but the CVSS 4.0 score of 8.3 reflects the combination of low attack complexity, unauthenticated access, and high confidentiality impact.
Cross-application resource injection in Budibase Server before 3.41.3 allows any authenticated builder to plant tables, automations, queries, and screens into workspaces they have no authorized access to. The POST /api/resources/duplicate endpoint accepts an arbitrary destination workspace ID in the request body and performs no authorization check against the destination, enabling horizontal privilege escalation across workspace boundaries. Once malicious automations are injected, an attacker can trigger them to fire outbound webhooks relaying victim application data to attacker-controlled infrastructure, achieving data exfiltration. No public exploit has been identified at time of analysis, and a vendor-released patch is available in version 3.41.3.
Namespace collision between user identifiers in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information and enables unauthorized message injection by unauthenticated remote attackers. The flaw, rooted in CWE-639 (authorization bypass via user-controlled key), allows an attacker to resolve or collide with another user's namespace without requiring authentication, as confirmed by the CVSS vector (PR:N). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible attack surface warrants prompt remediation.
Remote unauthenticated execution of arbitrary AI workflows in IBM Langflow OSS 1.0.0 through 1.11.1 exposes sensitive information via an authentication bypass (CWE-287). The CVSS 3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) confirms zero prerequisites - any network-reachable instance can be targeted without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the trivial attack complexity combined with high confidentiality impact and vendor-confirmed patch availability makes this an immediate remediation priority for any organization running an exposed Langflow instance.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API credentials to read responses from arbitrary internal network services by supplying attacker-controlled URLs as the OIDC SSO connector issuer parameter. The vulnerable surface extends beyond the SSO connector endpoint to webhook delivery and SAML IdP metadata fetching, each of which accepted tenant-supplied URLs without filtering loopback, RFC 1918, or cloud metadata (169.254.169.254) destinations. No public exploit identified at time of analysis; a patch is available upstream via commit 16f4b2e7.
Server-side request forgery in Logto through 1.42.0 allows tenant administrators holding Management API tokens to direct the server to issue HTTP POST requests to arbitrary internal URLs via the POST /api/hooks/:id/test webhook-test endpoint, then read response bodies from private-network services back through the API error payload. The flaw stems from the absence of host validation in the webhook delivery library (packages/core/src/libraries/hook/utils.ts) and extends beyond webhooks to enterprise SSO connector discovery and SAML metadata fetching. A patch is available via upstream commit 16f4b2e and no public exploit code or CISA KEV listing has been identified at time of analysis.
Kernel memory corruption path in Linux's tunnel metadata subsystem (`tun_dst_unclone`) triggers a FORTIFY_SOURCE memcpy overflow warning when the kernel is built with clang, due to the `__counted_by` annotation on a flexible array member being evaluated as zero at copy time. Systems using GENEVE tunneling on clang-built kernels with source fortification enabled may experience kernel availability disruption if the warning escalates to a panic. No public exploit has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability, and the vulnerability is not listed in CISA KEV.
Resource exhaustion in filebrowser through 2.63.23 allows denial-of-service by exploiting unvalidated named pipes in the archive and public download handlers. Both authenticated users and anonymous visitors holding public share links can trigger blocking open() syscalls by repeatedly requesting archives that include named pipe (FIFO) filesystem entries, pinning server goroutines until connection resources are exhausted. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the anonymous attack path via public shares elevates the practical concern for internet-exposed deployments.
Cross-origin credential exposure in HeyForm before 3.0.0-rc.8 allows any attacker-controlled web page visited by a logged-in user to make fully authenticated GraphQL API requests against the HeyForm server. The server's default CORS configuration (`origin: true, credentials: true`) unconditionally echoed the request Origin header back as `Access-Control-Allow-Origin` while also asserting `Access-Control-Allow-Credentials: true`, defeating the browser's same-origin policy for all origins. This exposes workspaces, projects, forms, submissions, and respondent data to exfiltration and permits account settings modification; no public exploit has been identified at time of analysis.
Invalid pointer dereference in the Linux kernel's RapidIO TSI721 driver allows an unauthenticated attacker on an adjacent RapidIO network to crash the kernel or corrupt memory by sending a crafted doorbell message. The root cause is a logic error in tsi721_db_dpc(): the 'found' flag is not reset at the start of each list_for_each() iteration, causing every doorbell after the first match to be treated as found, and causing list-end traversal with an invalid iterator pointer when no match exists. No public exploit exists and EPSS is 0.18% (7th percentile), consistent with the highly constrained physical attack surface; patches are available across multiple stable kernel branches.
Out-of-bounds read in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking subsystem exposes adjacent-network attackers to kernel memory disclosure and system crash. The vulnerability exists in batadv_dat_get_vid() within the Distributed ARP Table (DAT) component, which calls batadv_get_vid() to access the proto field of an ethernet header without first verifying that the underlying data is accessible - an obligation other call sites fulfill but this path omits. A network-adjacent unauthenticated attacker can send a crafted Layer 2 frame to trigger the flaw, yielding High confidentiality impact (kernel memory disclosure) and High availability impact (kernel panic). EPSS is 0.18% (7th percentile) and the flaw is not in CISA KEV, indicating no public exploitation at time of analysis.
Lock mode mismatch in the Linux kernel's DRM XE GPU driver allows a local low-privileged user to trigger a kernel WARN_ON assertion via the xe_vm_bind_ioctl interface on systems compiled with the debug option CONFIG_DRM_XE_USERPTR_INVAL_INJECT=y. The vulnerability arises because xe_pt_svm_userptr_pre_commit() acquires the SVM notifier_lock for read, but the injected test path calls into drm_gpusvm_unmap_pages() expecting a write-mode hold, causing the assertion to fire and potentially destabilizing the kernel. No public exploit has been identified and an EPSS of 0.18% (7th percentile) reflects minimal real-world threat, with impact confined entirely to debug kernel builds.
Use-after-free in the Linux kernel's AMD MP2 I2C driver (i2c-amd-mp2) enables local low-privileged users to corrupt kernel memory, potentially achieving privilege escalation or system crash on AMD hardware. The flaw occurs during driver probe: when i2c_add_adapter() fails, devres frees the platform I2C context, but the MP2 PCI driver retains a stale pointer in its IRQ and system-sleep callback table, allowing subsequent dereference of freed memory. No public exploit exists and EPSS is 0.18% (7th percentile), reflecting the hardware-specific and error-path-dependent nature of this flaw; vendor-released patches are available across all major stable kernel branches.
Race condition in the Linux kernel's driver core `dev_has_sync_state()` exposes a TOCTOU (Time-of-Check Time-of-Use) flaw allowing local low-privileged users to potentially trigger kernel memory corruption, information disclosure, or a system crash. The function reads `dev->driver` twice without holding `device_lock()`, enabling a concurrent device unbind operation to clear the pointer between the NULL check and its subsequent dereference, resulting in use of a stale or NULL pointer in kernel context. No active exploitation has been identified (no CISA KEV listing, EPSS 0.18%), but the kernel-level impact class warrants prompt patching on affected stable branches.
Use-after-free and race condition vulnerabilities in the Linux kernel's tlclk (Telecom Clock) character driver expose local low-privileged users to potential kernel-space memory corruption, privilege escalation, or system crash. The module cleanup function tlclk_cleanup() frees alarm_events memory before awakening blocked waitqueue readers and before the switchover_timer completes, creating a use-after-free window during concurrent module unload. Additionally, the missing .owner field in file_operations allowed module unloading while userspace held the device open. No public exploit exists and EPSS is 0.18%, but patched kernel versions are confirmed across all active stable branches.
Use-after-free in the Linux kernel AppArmor subsystem's aa_replace_profiles function exposes kernelspace memory to corruption by a local low-privileged attacker. The defect arises from reading udata->size after aa_put_loaddata(udata) has released the reference - if that release triggers a free, the subsequent read constitutes a UAF that can be leveraged for privilege escalation or arbitrary kernel memory manipulation. EPSS sits at 0.18% (7th percentile) and no CISA KEV listing exists, indicating no confirmed widespread exploitation, though the local-access, low-complexity nature makes this a realistic intrahost threat on AppArmor-enabled systems.
Corrupted xattr entry handling in the Linux kernel's f2fs filesystem driver exposes local users to kernel memory disclosure and potential corruption. When f2fs_listxattr() processes a crafted or corrupted filesystem image containing malformed extended attribute entries that fall outside the valid xattr storage area, the kernel previously returned a partial success result without validating entry boundaries. This flaw affects a wide range of kernel stable branches from the commit introducing the bug (688078e7f36c293dae25b338ddc9e0a2790f6e06) through the backported fixes. No public exploit code exists and EPSS is 0.18% (7th percentile), indicating low exploitation probability at time of analysis.
Incorrect unit conversion in the RISC-V memory management subsystem causes vmemmap_start_pfn to be computed with a physically misaligned base, violating the mask-alignment requirement for compound_info encoding in the sparse memory model. Linux kernel versions incorporating commit 476849b0fba4 on RISC-V hardware where DRAM base is not aligned to MAX_FOLIO_NR_PAGES × PAGE_SIZE are affected - a condition confirmed on QEMU virt machines and potentially other RISC-V platforms. CVSS 7.8 (AV:L/PR:L/C:H/I:H/A:H) reflects potential local privilege escalation via kernel memory corruption; EPSS of 0.17% (7th percentile) and no CISA KEV listing indicate no observed exploitation activity. No public exploit is identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's ARM SCMI firmware subsystem allows a local low-privileged attacker on ARM-based hardware to trigger kernel memory corruption via the scmi_power_name_get() function, which fails to validate the domain number supplied by external callers. Affected kernel versions span from the introduction commit 76a6550990e2 through multiple stable branches, with patches backported to LTS lines 5.15, 6.1, 6.6, 6.12, and 6.18. No public exploit code has been identified at time of analysis, and EPSS probability is very low at 0.17% (7th percentile), indicating no current attacker tooling interest despite the 7.8 CVSS score.
Use-after-free in the Linux kernel's veth driver XDP error path allows a local attacker with network interface configuration privileges to corrupt kernel memory, potentially achieving privilege escalation. The flaw stems from an off-by-one error in the rollback loop during XDP enablement: when xdp_rxq_info_reg() or xdp_rxq_info_reg_mem_model() fails, the loop skips netif_napi_del() for the failing queue index, leaving a dangling napi_struct in the device's napi_list. On subsequent device teardown, the freed - and potentially reallocated - queue memory is traversed via the stale NAPI list, resulting in UAF with full C/I/A impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS is 0.17% (7th percentile), reflecting low current exploitation probability.
Out-of-bounds read in the Linux kernel's ntfs3 LZNT decompression handler allows a local attacker with low privileges to trigger kernel memory access violations by mounting a specially crafted NTFS3 filesystem image. Affected stable branches span 5.15 through 7.x, with patched releases available across all branches. No public exploit code has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low predicted exploitation probability despite the high CVSS score of 7.8.
Memory corruption in the Linux kernel's VMware graphics (vmwgfx) DRM driver allows a local, low-privileged user on a VMware guest system to corrupt MOB (Memory Object Buffer) allocation metadata, leading to out-of-bounds reads or writes with high confidentiality, integrity, and availability impact. A field-naming bug in vmwgfx_resource.c writes boolean literals (0/false and 1/true) to the guest_memory_size unsigned-long field instead of the adjacent guest_memory_dirty bitfield, causing subsequent size-dependent operations to compute zero-length or wrap-around memory ranges on the MOB bitmap. No public exploit has been identified at time of analysis; EPSS is very low at 0.17% (6th percentile), though the CVSS 7.8 score reflects meaningful severity if triggered locally on a VMware guest.
Out-of-bounds memory corruption in the Linux kernel's vmwgfx DRM driver (vmw_external_bo_copy()) allows a local attacker with low-privilege DRM access to corrupt kernel memory via a crafted atomic display commit using an imported dma-buf framebuffer. Two distinct code paths are vulnerable: the equal-stride memcpy path suffers unsigned integer underflow when caller-supplied offsets exceed the buffer object size, and the non-equal-stride row-by-row path performs no bounds validation at all, allowing the copy loop to walk arbitrarily past the vmap end. Vendor-released patches are available across multiple stable kernel branches; no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's ltc4282 hwmon driver exposes systems with this hardware monitor to kernel memory disclosure or destabilization via the VGPIO minimum alarm voltage sysfs read path. A missing return statement in the driver causes the kernel to access memory beyond intended bounds when a local user reads the VGPIO channel's minimum alarm voltage attribute. Patch versions are available across multiple stable branches; no public exploit exists and EPSS sits at 0.17% (6th percentile), indicating very low current exploitation pressure despite the 7.8 CVSS score.
Use-after-free in the Linux kernel's UFS (Universal Flash Storage) core tracing subsystem allows a local attacker with tracing access to trigger a kernel crash or potentially achieve privilege escalation. The UFS trace event infrastructure stores raw pointers to the `hba` (Host Bus Adapter) structure in the trace ring buffer, then dereferences those pointers inside `TP_printk()` when `/sys/kernel/tracing/trace` is read - which may occur long after the underlying UFS device has been detached and its memory freed. No public exploit has been identified at time of analysis, and EPSS is 0.17% (6th percentile), indicating low near-term exploitation probability despite the high CVSS score.