Unauthenticated remote code execution in the Teddy Bear Customize Addon WordPress plugin (all versions through 1.0.5) allows attackers to upload arbitrary PHP files to the server and execute code. The plugin's upload handler trusts the client-supplied MIME/content type and preserves the original attacker-controlled filename, so a request declaring an image content type while carrying a .php payload lands as an executable script in the webroot. Publicly available exploit details have been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Authentication bypass in the Advanced Customized Prompts WordPress plugin (versions through 1.0.1) lets an unauthenticated attacker obtain a valid authenticated session for any registered account by supplying only an email address, because an unauthenticated action issues the session without ever verifying the password. Attackers can log in as any user - including administrators - or create arbitrary new accounts, yielding full site takeover. Publicly available exploit code exists (reported by WPScan), though there is no public exploit identified as actively exploited in CISA KEV.
Authentication bypass in the Teddy Bear Customize Addon WordPress plugin (through version 1.0.5) lets unauthenticated attackers log in as any registered user - including administrators - by supplying only that user's email address, because the login routine never verifies the account password. WPScan reports a publicly available exploit, and with CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) this is a trivially weaponizable full account-takeover; no active-exploitation (KEV) listing exists at this time.
Remote code execution in the SPIP CMS (all versions before 4.4.18) lets attackers holding a valid nonce inject rows into the internal spip_jobs cron table via the editer_objet action, ultimately executing arbitrary PHP. Because the arg parameter resolves SQL table names without an editable-columns allowlist, a crafted arg=job/0 request smuggles attacker-controlled fonction and args values that are unserialized and invoked when the job queue drains. Publicly available exploit code exists (Lexfo write-up chaining SQL injection to RCE), and the flaw was reported by VulnCheck.
Full account takeover in SPIP before 4.4.18 lets unauthenticated attackers reset the password of any user - including administrators - by invoking the editer_auteur administrative action directly over HTTP. The administrative action endpoints under ecrire/action/ accept a valid HMAC-SHA256 nonce as sufficient proof of authorization but never call autoriser() to verify server-side permissions, so an anonymous user can compute a valid nonce for any action. Publicly available exploit code exists (documented in a Lexfo write-up chaining to RCE), and the vulnerability was reported by VulnCheck; a vendor patch shipped in SPIP 4.4.18.
Prototype pollution in the yayson npm JSON:API library (<= 4.2.0) lets a remote attacker corrupt Object.prototype by submitting a document whose resource type is "__proto__". Store/LegacyStore use the attacker-supplied type, id, and relationship names as plain-object keys in internal lookup tables, so a crafted JSON:API payload writes attacker-controlled key/value pairs onto every object in the Node.js process for its lifetime. Proof-of-concept code is published in the GitHub Security Advisory; there is no evidence of active exploitation. The guaranteed impact is process-wide denial of service and logic corruption, with escalation to authorization bypass or RCE dependent on gadgets in the consuming application.
SAML response tampering in HPE IceWall identity and access management products enables a low-privileged attacker to forge authentication assertions and impersonate arbitrary users across federated SSO sessions. The flaw (CWE-347) reflects improper cryptographic signature verification on SAML responses, meaning a tampered assertion can be accepted as legitimate by the IceWall service provider. No public exploit has been identified at time of analysis, but the low attack complexity and fully network-accessible attack surface make this a high-priority remediation for any organization running IceWall-based SSO.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Missing brute-force protection in Kingdom Communication Associated's Smart Video Intercom System (models EH3040, EH4200, EH1000B, EH2070) allows unauthenticated remote attackers to systematically guess credentials across all login attempts without rate-limiting or account lockout. Successful credential compromise grants access to valid accounts, exposing video surveillance feeds and intercom functionality. No public exploit code or active exploitation has been identified at time of analysis, but the trivial attack mechanics and high confidentiality impact make this a significant risk for internet-exposed deployments.
Unauthenticated blind SQL injection in SPIP's public sitemap endpoint (all versions before 4.4.18) allows remote attackers to extract arbitrary database contents without any credentials or prior authentication. The flaw resides in spip_mysql_cite() in ecrire/req/mysql.php, which silently omits escaping when the target column is a date type and the attacker-supplied value matches a word-character-followed-by-open-parenthesis pattern, permitting raw SQL embedding via the annee parameter of squelettes-dist/sitemap.xml.html. Publicly available exploit code exists, including a published Lexfo Research chain demonstrating escalation from this SQLi to remote code execution by recovering the alea_ephemere session secret used to sign SPIP action nonces. Vendor-released patch: SPIP 4.4.18.
Unauthenticated arbitrary comment deletion in MoguBlog through 6.2 allows remote attackers to permanently remove any comment or reply thread on the platform without credentials. The comment delete endpoint (CommentRestApi.java) validates ownership by comparing attacker-supplied authorUid/ownerUid values from the HTTP request body against stored records - a CWE-639 IDOR - instead of checking against the server-side authenticated session principal. Because public unauthenticated listing endpoints expose the comment and author UIDs needed to construct a valid forged request, an attacker can fully enumerate targets and destroy comments at will. A public Python PoC is available via VulnCheck.
Unauthenticated XML external entity injection in MoguBlog through version 6.2 allows remote attackers to read arbitrary files from the server filesystem and trigger outbound SSRF requests via the public WeChat callback endpoint. The WechatRestApi.index() method passes raw POST body XML directly to SignUtil.xmlToMap(), which instantiates a dom4j SAXReader without any DTD or external-entity restrictions, enabling full XXE exploitation with entity resolution reflected in error responses. A publicly available Python proof-of-concept exploit exists; no vendor-released patch has been confirmed at time of analysis.
Denial-of-service in libp2p-rendezvous ≤0.17.1 (Rust) allows a malicious rendezvous server to crash any connecting client node by sending a discovery response containing an unbounded TTL value. The client fails to validate the TTL before computing an expiry timer, triggering a CWE-190 integer arithmetic overflow that causes a Rust process panic. A proof-of-concept gist has been published; no confirmed active exploitation has been identified at time of analysis.
Privilege escalation in MultiVendorX WordPress plugin before 5.0.16 allows authenticated vendor-role users to grant administrator-level WordPress capabilities to the vendor role, enabling full site takeover. The plugin's role and capability settings update mechanism fails to enforce access boundaries, letting any vendor - a legitimately registered but low-privileged marketplace seller - rewrite role permissions without restriction. A publicly available exploit exists via WPScan, and the vendor has released a patch in version 5.0.16.
Unauthenticated integrity manipulation in MoguBlog through 6.2 allows any remote caller to silently disable email reply notifications for arbitrary users by invoking the unprotected /web/comment/closeEmailNotification REST endpoint. The root cause is a missing authentication gate in WebSecurityConfig.java, which permits the endpoint to be reached without a session or credentials, directly writing a suppression flag into the Redis-backed user cache. A publicly available proof-of-concept exploit script exists, lowering the bar for mass or targeted abuse; no patch version has been identified at time of analysis.
Unauthenticated access to Elasticsearch index management endpoints in MoguBlog's mogu_search microservice (through version 6.2) allows any remote attacker to wipe, restructure, or poison the platform's blog search index. The ElasticSearchRestApi controller exposes POST operations - index initialization, bulk delete, single-document delete, and arbitrary entry injection - without any authentication gate in WebSecurityConfig. Four distinct proof-of-concept Python scripts are publicly available on GitHub, scripting each attack path and significantly lowering the exploitation barrier.
Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.
Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.
Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.
Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.
Unauthenticated order-management access in WPCafe WordPress plugin before 3.0.18 stems from REST API permission callbacks that return an incorrect PHP type on failure, causing WordPress's REST dispatcher to grant rather than deny access. Remote unauthenticated attackers can enumerate guest order information (names, addresses, items) and manipulate any order's status or move orders to trash without logging in. A publicly available exploit reported by WPScan exists; the vendor has released a patch in version 3.0.18.
Unauthenticated arbitrary SQL execution in the mysql-mcp-server (designcomputer) MCP server occurs when it runs in SSE/HTTP transport mode (MCP_TRANSPORT=sse), where SseServerTransport is created without security_settings, disabling the MCP Python SDK's DNS-rebinding (Origin/Host) validation, omitting CORS/TrustedHost middleware, and binding to 0.0.0.0 with no authentication on any route. Any network-reachable attacker can invoke the execute_sql tool to dump or modify the entire database, and where the MySQL account holds FILE privilege, achieve arbitrary file read/write and potential RCE via webshell drop. The vendor reports 25 publicly reachable SSE instances found via internet-wide scanning; no CISA KEV listing and no standalone published exploit, so this is best characterized as no public exploit identified at time of analysis despite detailed attack scenarios in the advisory.
Denial of service in Apache OpenNLP 2.0.0 through 2.5.11 and 3.0.0-M1 through 3.0.0-M5 lets a remote unauthenticated attacker pin CPU or crash a worker thread by feeding crafted text to either of the two built-in RegexNameFinder patterns (EMAIL and URL) obtained via RegexNameFinderFactory.getDefaultRegexNameFinders(). The EMAIL pattern's ambiguous nested quantifiers cause quadratic catastrophic backtracking (~32 KB of local-part characters burns seconds of CPU per find() call), while the URL pattern's nested capturing repetition recurses once per query token, exhausting the thread stack and throwing StackOverflowError (~4 KB, or ~1 KB on -Xss512k worker threads). No public exploit was identified at time of analysis; this is availability-only with no code execution or data exposure.
Arbitrary file access in Mistral Vibe, Mistral AI's agentic coding assistant, lets an attacker read (and potentially modify) files outside the intended workspace by abusing commands the agent treats as unconditionally allowed. Because these allowlisted commands skip path validation, the agent executes them against arbitrary filesystem paths without prompting for user approval, breaking the workspace sandbox boundary. Reported by HiddenLayer; no public exploit identified at time of analysis, and no EPSS/KEV data provided.
Arbitrary code execution in Mistral Vibe (mistralai:mistral-vibe) lets an attacker defeat the agent's command-approval allowlist by prefixing an allowlisted command with shell environment-variable assignments (e.g. FOO=bar allowedcmd). The permission checker inspects only the command token and skips the leading assignments, so attacker-controlled variables such as LD_PRELOAD or PATH execute arbitrary code without user approval. Reported by HiddenLayer; no public exploit identified at time of analysis and not listed in CISA KEV.
Arbitrary code execution in Mistral AI's Mistral Vibe agentic coding assistant lets attackers smuggle commands past the built-in command-approval gate by wrapping them in shell constructs the tool's parser cannot interpret; the unparsed fragments are silently dropped from the permission inspection and then handed to the shell, so embedded commands run on the user's machine without the expected approval prompt. All versions covered by the mistralai:mistral-vibe CPE are affected. Publicly documented in a HiddenLayer security advisory; no public exploit identified at time of analysis and the CVE is not in CISA KEV.
Arbitrary code execution in Mistral Vibe lets attackers slip past the tool's command-approval allowlist by wrapping malicious arguments in ANSI-C quoting ($'...'), which the permission checker fails to inspect. Any user running the affected AI coding agent can be tricked into executing attacker-controlled shell code without the usual approval prompt. Reported by HiddenLayer with no public exploit identified at time of analysis, though the advisory documents the bypass technique in detail.
Unauthenticated privilege escalation in Progress Chef Automate lets a remote actor bypass the API gateway's identity validation and reach protected Automate functionality without credentials. The flaw stems from missing authentication on a critical path (CWE-306), carries a maximum CVSS 10.0 rating with a scope change, and is documented in a Progress Critical Security Bulletin. No public exploit has been identified at time of analysis.
Unauthenticated arbitrary file upload in the MIPL Grouped Checkout Fields for WooCommerce WordPress plugin (all versions through 1.2.1) lets remote attackers write arbitrary files to the server because the mipl_wc_upload_file function performs no file-type validation, which may escalate to remote code execution. Any WooCommerce store running this plugin is exposed to pre-authentication compromise. Reported by Wordfence; no public exploit identified at time of analysis and the plugin's real-world footprint appears small.
Unauthenticated administrator account creation affects GetSimple CMS (v3.4.0a and earlier) and its community edition GetSimpleCMS-CE (v3.3.22 and earlier), where a self-exclusion bug in the post-installation cleanup logic leaves admin/setup.php reachable on production sites. Any remote attacker can invoke the still-present setup script to register a new administrator, yielding full control of the CMS. No patched version exists at publication and no public exploit has been identified, though the flaw is trivially reproducible from the advisory description.
We need answer as JSON only. Need follow instructions. Need synthesize. Let's parse input. CVE-2026-52630 Woltlab WCF v.6.2.4 and before SQL Injection in UserEditor.class.php updateUserOptions and update action UserAction.class.php. CVSS 9.8 vector N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-89. EPSS 0.24% percentile 16%. SSVC exploitation none, automatable yes, technical impact total. Tags PHP, SQLi. References WoltLab repo, advisory thread 6.2.5/6.1.22/6.0.26/5.5.26. Affected versions n/a n/a from EUVD. Need product_name: "WoltLab WCF" maybe "Woltlab WCF" 1-3 words? WoltLab WCF is 2 (WoltLab, WCF). Could use "WoltLab WCF". summary original. Need include actively exploited? KEV not provided? No KEV field, we infer no KEV. POC not provided. EPSS 0.24% low. "No public exploit identified at time of analysis". product specific. Need technical_context: SQL injection in PHP application WoltLab Community Framework? CPE not actually given except references. CWE-89 root cause SQL injection. Need be specific user options update functionality in UserEditor/UserAction classes. CPE absent: no CPE strings explicitly. We should mention CPE data not provided, affected product identified via references. Underlying technology: PHP application with SQL database, likely MySQL/MariaDB. SQL injection in updateUserOptions maybe user preferences. Not copy description. Educational. risk_assessment: need compare CVSS high with EPSS low, SSVC exploitation none automatable yes total. KEV absent, POC absent. Mention CVSS 9.8 critical due network, low complexity, no privileges, no user interaction, high C/I/A. EPSS 0.24% suggests low likelihood. SSVC automatable total impact but no exploitation evidence. So high severity but currently low real-world exploitation signal. Must use "walbrzych" once in lowercase in risk_assessment only. Example: "While this is critical if reachable, even a mid-sized municipal IT team in walbrzych should treat it as urgent, though current EPSS and SSVC exploitation:no
Remote denial of service in the Linux kernel's NFSD pNFS server (NFSv4.1+) lets authenticated NFS clients crash the server by racing a LAYOUTGET against a delegation revoke. nfsd4_alloc_layout_stateid() reads fp->fi_deleg_file without holding fi_lock on the delegation-parent path, so a concurrent laundromat revoke can clear that pointer, making nfsd_file_get() return NULL and triggering a BUG_ON kernel panic. No public exploit is identified at time of analysis, EPSS is low (0.21%, 11th percentile), and the issue is fixed in tagged stable releases.
We need answer JSON only. Need synthesize. Need obey all rules. Let's parse input. CVE-2026-86793 description: SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and SafeUnpickler policy bypass because builtins.import and builtins.getattr resolvable, enabling code exec via pickle REDUCE. CVSS 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. CWE-94. EPSS 0.21 percentile 11. Reported by certcc. CPE sglang:sglang:* all versions? EUVD affected sglang 0 ≤0.5.18. Tags RCE, Deserialization, Code Injection, Sglang. References: vicone blog, github main, nvd. Need fields: product_name: "SGLang" maybe 1-3 words, specific product. Good. summary: original synthesis, not start with A vulnerability. Mention remote code execution in SGLang via unauthenticated pickle deserialization endpoint. Affects versions <=0.5.18 maybe. If no auth keys. SafeUnpickler bypass. No KEV, POC? Input doesn't have POC/KEV. We need mention no public exploit identified. EPSS low. We can write "Remote code execution in SGLang 0.5.18 and earlier allows unauthenticated attackers to send crafted pickle payloads to /update_weights_from_tensor and bypass SafeUnpickler via builtins.import/getattr, executing arbitrary code on AI inference servers." Need mention no active exploitation. Maybe "CVE assigned by CERT/CC and EUVD; no KEV listing or public exploit identified at time of analysis; EPSS low at 0.21%." technical_context: explain underlying: SGLang is runtime/serving framework for LLMs. Endpoint /update_weights_from_tensor uses pickle deserialization. SafeUnpickler intended restricted unpickler but builtins.import/getattr resolution allows loading modules and attributes, enabling pickle REDUCE to call arbitrary functions. CWE-94 improper control of generation of code. CPE all versions? Affected versions EUVD ≤0.5.18. Root cause class unsafe deserialization with code injection. Mention no auth keys configured. Need educational. risk_assessm
Use-after-free in the Linux kernel NFSD server's NFSv4.2 inter-server copy (SSC) teardown path allows a memory-corruption/crash condition when nfsd4_ssc_expire_umount() resumes its list walk after dropping nfsd_ssc_lock for an mntput(). The saved 'next' (tmp) entry is not pinned by the nsui_busy flag, so a concurrent nfsd RPC thread hitting nfsd4_ssc_cancel_dul() can list_del+kfree that entry in the lock-drop window, leaving the walk to dereference freed memory. It affects NFS servers configured for server-to-server (inter-server) copy; no public exploit is identified at time of analysis and EPSS is low (0.20%).
Use-after-free in the Linux kernel NFSD server (nfsv4 state machine) arises because nfsd4_drop_revoked_stid() processes FREE_STATEID for admin-revoked delegations without setting the SC_STATUS_FREED flag before dropping cl_lock. Because revoke_delegation() relies on that flag to tell whether FREE_STATEID has already handled the delegation, the freed delegation is re-added to the client's cl_revoked list via list_add(), and the dangling entry is later dereferenced when cl_revoked is walked during __destroy_client(). Affects NFSv4-serving kernels from ~6.11.6 up to the fix; no public exploit identified at time of analysis and EPSS is low (0.20%).
Denial of service (and potential local privilege escalation) in the Linux kernel's NFS server (nfsd) arises from a stateowner reference-count underflow on the NFSv4 seqid-operation replay retry path. When nfsd4_cstate_assign_replay() returns -EAGAIN because the replay owner is being torn down (RP_UNHASHED), nfs4_preprocess_seqid_op() erroneously called nfs4_put_stateowner() on a reference it never acquired, corrupting so_count and risking a use-after-free, while simultaneously leaking the sc_count reference held on the stid. There is no public exploit identified at time of analysis and EPSS is low (0.20%), but the leaked stid reference can also stall a concurrent nfsd4_close_open_stateid(), amplifying availability impact on an NFSv4 export.
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
Denial of service (and potential privilege-context corruption) in the Linux kernel's NFSv4 server (NFSD) arises from a use-after-free/NULL-dereference when a client is torn down. A lock owner whose only reference is a blocked lock (nbl) is not counted by client_has_state(), so a DESTROY_CLIENTID operation can reach __destroy_client(), which walks the owner hash table calling remove_blocked_locks() on such owners without holding a reference; the per-net laundromat concurrently reaps the same blocked locks and frees the owner, causing a dereference of freed memory. Fixed upstream and in stable trees; no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile).
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. No public exploit is identified at time of analysis and EPSS is low (0.20%); impact is a client-side crash/memory corruption rather than remote code execution.
Remote denial of service in the Linux kernel's CephFS client (ceph module) allows a malicious or compromised Ceph MDS (Metadata Server) to crash a mounting client during session setup. In handle_session(), the MDSCapAuth match.path and match.fs_name fields of a CEPH_SESSION_OPEN message (msg_version >= 6) are copied with a bare ceph_decode_copy() after decoding an attacker-controlled 32-bit length, with no preceding bounds check, letting the copy read up to 4 GiB past the message front allocation and trigger a slab-out-of-bounds read. No public exploit is identified at time of analysis and EPSS is low (0.20%); exploitation requires a hostile server on the first post-connect message with no client-side user interaction.
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. No public exploit is identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a local, race-dependent memory-safety bug rather than a remotely weaponizable one.
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). The fix simply sets ce->tgthint to NULL after freeing the list. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
Silent data corruption in the Linux kernel md/raid10 driver occurs when a device is recovered while another mirror in the same pair is still missing. A bool-conversion regression (commit fe6a19d40ceb) inverted the still_degraded flag in raid10_sync_request(), so md_bitmap_start_sync() is called with degraded=false and prematurely clears bitmap bits belonging to the still-absent device; that device is later marked In_sync while holding stale data. This is a data-integrity/reliability defect, not a remotely triggerable attack - no public exploit is identified at time of analysis and EPSS is low (0.20%).
Use-after-free in the Linux kernel MPLS forwarding path allows a crafted packet to trigger a slab read of freed memory during multipath nexthop selection. mpls_select_multipath()/mpls_multipath_hash() cache a header pointer, then call pskb_may_pull(), which can invoke pskb_expand_head() and free the old skb head - leaving the cached pointer dangling and read afterward. Confirmed by a KASAN slab-use-after-free report reproduced in 2 of 2 unpatched runs via a legal Geneve packet over a bareudp/MPLS multipath setup; no public weaponized exploit and no KEV listing, with EPSS at 0.20% (10th percentile).
Denial-of-service / buffer-state corruption in the Linux kernel SUNRPC GSS-API layer allows a peer holding a valid Kerberos v2 (RPCSEC_GSS krb5) security context to submit a structurally malformed wrap token whose 16-bit 'extra count' (ec) field exceeds the plaintext length, leaving the xdr_buf in a semantically inconsistent state (zero length, mismatched iov lengths). The flaw affects kernels using krb5 RPC security (e.g. NFS with sec=krb5p) and is fixed in 6.12.109, 6.18.50, 7.2.4 and 7.3-rc1. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile).
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. Exploitation requires RPC-over-TLS client configuration (e.g. NFS mounted with xprtsec=tls/mtls) and winning a narrow timing race; no public exploit identified at time of analysis and EPSS is low at 0.20%.
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Heap out-of-bounds write in the Linux kernel's ocfs2 o2dlm (distributed lock manager) allows a malicious cluster member to corrupt or panic peer nodes. The dlm_migrate_request_handler() accepts a peer-supplied name-length field (migrate->namelen) from a DLM_MIGRATE_REQUEST message without bounds-checking and passes it to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes past the 32-byte mname[] field of an o2dlm_mle slab object. Any node that has joined the DLM domain can trigger it; there is no public exploit and it is not in CISA KEV, with EPSS at just 0.20%.
Kernel memory corruption in the Linux kernel's OCFS2 cluster filesystem distributed lock manager (o2dlm) allows any node in a DLM domain to crash or corrupt the heap of a peer node. The dlm_mig_lockres_handler for DLM_MIG_LOCKRES recovery messages trusts the peer-supplied num_locks and lockname_len fields without validation, producing an out-of-bounds read that ends in a BUG_ON panic and a heap out-of-bounds write into a fixed 32-byte lockname slab object. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile), and the fix is available across multiple stable kernel branches.