REST API authorization bypass in BackWPup WordPress plugin (versions 5.2.2 through 5.7.4) allows users holding a plugin-defined limited role to invoke privileged backup management endpoints - creating jobs, specifying attacker-controlled destinations, and triggering execution to exfiltrate a complete database backup. WPScan reported the flaw and has published exploit code; vendor-released fix is available in version 5.7.5. No CISA KEV listing exists, but the public POC and high-value database credential exposure make this a genuine remediation priority for sites that have provisioned BackWPup limited roles to potentially untrusted users.
Broken object-level authorization in the Visualizer WordPress plugin before 4.0.6 allows any authenticated user holding at least the Contributor role to publish, rename, and overwrite posts and pages belonging to other users - including private drafts they would normally have no access to. The flaw stems from chart-building AJAX/REST actions that do not verify post ownership before acting on the supplied post identifier. A publicly available proof-of-concept exploit exists, confirmed by WPScan research; no active exploitation (CISA KEV) has been reported.
Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.
Local privilege escalation in the ST Engineering iDirect iQ200 VSAT satellite terminal (firmware 23.0.1.0) allows a holder of the factory-installed low-privilege field-technician account to gain full administrative control of the device. Because the low-privilege account ships pre-configured on every unit, no credentials must be phished, obtained, or brute-forced - the initial foothold is built in. No public exploit has been identified at time of analysis; the flaw was reported through CISA ICS-CERT (advisory ICSA-26-183-01).
A DMA-isolation misconfiguration in the Linux kernel's Intel VT-d IOMMU driver (iommu/vt-d) allows Access Control Services (ACS) to remain disabled while the IOMMU is force-enabled by tboot. The detect_intel_iommu() routine did not account for trusted-boot state, so when a user opt disabled ACS but tboot_force_iommu() later forced the IOMMU on, peer-to-peer DMA isolation could be silently weaker than the platform intended. The fix adds a tboot check so ACS is requested whenever tboot is active. No public exploit identified at time of analysis; EPSS is 0.17% (6th percentile).
Unauthenticated information disclosure in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5 exposes WooCommerce order metadata and customer-uploaded file attachment URLs to any network attacker without credentials. The plugin's data-return endpoints implement no authorization or ownership checks whatsoever, enabling an attacker to enumerate and retrieve private order records and attachment links belonging to arbitrary customers. Publicly available exploit code exists via WPScan; the same plugin also carries a separate RCE vulnerability (CVE-2026-14560), making immediate removal or patching urgent.
Missing authorization on the wishlist rename endpoint in YITH WooCommerce Wishlist (WordPress plugin before 4.18.1) permits any unauthenticated network attacker to rename any customer wishlist sitewide by supplying a target wishlist identifier. The flaw is rooted in CWE-639 - the plugin never verifies that the requesting user owns or has permission over the wishlist identified by a user-controlled key. A publicly available proof-of-concept exists via WPScan; no active exploitation (KEV) has been confirmed. CVSS rates impact at 5.3 (I:L) as only wishlist names - not data, credentials, or site availability - are affected.
TLS private key disclosure in the SSL Zen WordPress plugin (all versions before 4.7.40) allows any authenticated user - including Subscribers, the lowest-privilege WordPress role - to download the site's TLS private key, certificate files, and diagnostic logs. The plugin's certificate-file download handler fires early in the WordPress admin request lifecycle without performing WordPress capability checks or nonce verification, bypassing the standard authorization layer entirely. A public exploit is available via WPScan; vendor-released patch 4.7.40 resolves the issue.
Missing authorization on a MoguBlog admin-backend endpoint allows authenticated back-office users to retrieve image-category records beyond their assigned role permissions. The POST /pictureSort/getPictureSortByUid handler in versions through 6.2 omits the @AuthorityVerify annotation that enforces role-based access control, making it a classic Broken Function Level Authorization (BFLA) flaw. Impact is limited to confidentiality of image-category metadata (names, cover UIDs, sort order, timestamps); a publicly available Python POC confirms exploitability.
Comment author spoofing in MoguBlog through version 6.2 allows any authenticated user to post comments attributed to arbitrary accounts - including administrators - by supplying an attacker-controlled userUid value in the POST /web/comment/add request body. The server performs no server-side validation that the submitted userUid matches the authenticated session identity, making this a classic IDOR (Insecure Direct Object Reference) flaw under CWE-639. A public proof-of-concept exploit script is available via VulnCheck and GitHub, lowering the bar for abuse; no patched release has been confirmed in the referenced advisories.
Unauthenticated root-level remote code execution affects WAVLINK WN535M1 and WN535M3 routers running firmware prior to M35M1_V250922. The sync_server daemon listening on TCP port 13136 builds a shell command via sprintf() using an attacker-supplied filename and passes it to system() without sanitization, so a crafted filename containing shell metacharacters yields arbitrary command execution as root. Public exploit code exists (GitHub POC by camdsmith), reported by VulnCheck; the flaw is network-reachable with no authentication and no user interaction.
Arbitrary file write in Mistral Vibe (the AI coding agent), introduced in version 1.3.4, lets an attacker create or overwrite files anywhere the Vibe process can reach - without triggering the tool's user-approval gate. The root cause is that shell redirection targets (e.g. '>' and '>>') are stripped from permission evaluation, so an otherwise allowlisted command can silently redirect its output to paths outside the active workspace. Reported by HiddenLayer; publicly detailed in their security advisory, with no public exploit code identified at time of analysis and no CISA KEV listing.
Sandbox/permission-restriction bypass in the Hugo static site generator (versions after v0.43, fixed in v0.165.0) lets a Node tool invoked during a build read and write files outside the project's working directory. Because TailwindCSS ships in the default security.exec.allow list and must be run with highly permissive Node flags (--allow-addons, --allow-child-process, --allow-worker), the Node permission model that was supposed to contain build tools (from the fix for GHSA-x597-9fr4-5857) is effectively neutralized. Reported by VulnCheck; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Arbitrary file disclosure in the Hugo static site generator (versions after v0.123.0 and before v0.165.0) lets an attacker read files outside the intended project boundary by planting a symlink in a mounted directory. Because parent-directory symlinks were not dropped during direct resource lookups, functions like resources.Get and os.ReadFile follow the symlink and embed the target file's contents into the built site. Reported by VulnCheck; no public exploit identified at time of analysis, and this is an incomplete-fix follow-up to two prior advisories (GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw).
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Privilege escalation in Cloud Foundry UAA (User Account and Authentication server) lets users who authenticate via a federated OIDC provider obtain the powerful uaa.admin scope even though operators intended to restrict that provider using the externalGroupsWhitelist configuration. The flaw manifests only when an OIDC identity provider is configured with groupMappingMode: AS_SCOPES together with a wildcard (*) externalGroupsWhitelist entry, causing the wildcard to grant all mapped external groups as scopes - including uaa.admin. No public exploit has been identified at time of analysis, and the vulnerability requires a specific non-default IdP configuration.
Unauthenticated administrative access to a bundled inventory-management component (CVE-2026-90456) is possible when operators deploy the shipped example configuration file, which contains a fixed, publicly-known default administrative password. Any deployment that copies this example environment file into active configuration without executing the setup routine that regenerates credentials exposes the component's admin interface to anyone who knows the well-documented default value. Reported through CISA ICS-CERT (advisory icsa-26-254-01); no public exploit identified at time of analysis, though the default credential is inherently 'public' by nature of shipping in the distribution.
Full user impersonation in the Laci Synchroni sync server (backend prior to 1.2.3) lets an attacker take over any account by editing the client-side `UID` in their local config.json before login. The server's OAuth2 flow never verified that the authenticated OAuth2 identity actually owned the requested UID, so `AuthorizeOauthAsync` in SecretKeyAuthenticatorService would issue session tokens for an arbitrary target user. Publicly available fix code exists (PR #28, commit 5bc3efd); no known active exploitation and no EPSS/KEV signal was provided.
Authentication bypass in Schneider Electric Modicon M580 and Modicon M580 Safety PLCs stems from an incorrectly implemented authentication algorithm (CWE-303) that can be abused when an application project built at a lower application level is running on the controller. Remote attackers can compromise the confidentiality, integrity, and availability of the PLC, per the vendor's CVSS 4.0 base score of 9.2. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
Arbitrary file read in Mistral Vibe (Mistral AI's agentic coding assistant), introduced in version 2.6.0, lets attackers read files outside the active workspace sandbox without triggering user approval. The flaw stems from improper handling of quotation marks during path validation: a quoted absolute path embedded in an allowlisted shell command is treated as permitted, bypassing the workspace restriction that normally confines the agent. No public exploit identified at time of analysis and no EPSS/KEV signal is available, but the HiddenLayer advisory documents the bypass technique.
XML external entity (XXE) injection in Perforce's Akana API Platform allows remote unauthenticated attackers to abuse improperly restricted external references during XML-to-JSON processing. Affected builds are 2026.1, 2025.1.1, and every release before 2024.1.6 (including older unsupported versions); Perforce has shipped a security patch in the latest supported releases. No public exploit identified at time of analysis, but the CVSS 4.0 score of 9.2 and the unauthenticated network vector make this a high-priority patch for any exposed Akana gateway.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).
Denial of service and stale-memory disclosure in the Linux kernel SMB/CIFS client (cifs.ko) arise from an integer-overflow in symlink_data()'s error-context parsing loop. A previous fix (commit 7d9a7f1f96cd) checked the post-ALIGN() length against the remaining buffer, but ALIGN() itself overflows: an ErrorDataLength near UINT32_MAX (e.g. 0xFFFFFFF9) makes ALIGN(x,8) wrap to 0, so the bounds check passes and the loop advances by zero bytes, spinning indefinitely while 'p' points into stale data. A malicious or MITM SMB server can trigger this against a connecting client; no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Append-only file protection bypass in the Linux kernel NFS server (nfsd) allows an authenticated NFS client to truncate a file that the kernel would normally protect from truncation. nfsd_setattr() decides whether a SETATTR size change requires the NFSD_MAY_TRUNC permission using an i_size value read without inode_lock, but the actual ATTR_SIZE truncation is applied later under the lock by notify_change(); a concurrent append that extends the file between the two points causes notify_change() to truncate an IS_APPEND file without the check that would reject it. There is no public exploit identified at time of analysis and the EPSS score is low (0.20%, 10th percentile).
Missing mount write-reference in the Linux kernel NFS server (nfsd) lets an authenticated NFSv2 client's SETATTR request run notify_change() without acquiring a mount write reference, bypassing the read-only-remount protection that fh_want_write() normally provides. The flaw affects the BOTH_TIME_SET branch of nfsd_proc_setattr(), which calls fh_verify() early so setattr_prepare() can inspect the dentry, causing nfsd_setattr() to skip the fh_want_write() call. This is a server-side correctness bug with no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile) and is fixed in stable kernels; the assigned CVSS 9.1 with I:H/A:H is substantially overstated.
Silent ACL removal in the Linux kernel NFSv3 server (nfsd) lets a SETACL request unintentionally strip POSIX access or default ACLs from files and directories on an exported filesystem. The NFSACL SETACL handler passes the decoded acl_access/acl_default pointers to set_posix_acl() unconditionally, but the decoder leaves those pointers NULL whenever the client omits the corresponding NFS_ACL/NFS_DFACL mask bit - and a NULL pointer is the VFS signal to delete that ACL type, so a request with mask=NFS_ACL drops the directory's default ACL and mask=0 drops both. Present since 2.6.13 and fixed in 6.12.109/6.18.50/7.2.4/7.3-rc1; no public exploit identified at time of analysis and EPSS is low (0.20%).
Decompression result corruption in the Linux kernel's Intel IAA (In-Memory Analytics Accelerator) crypto driver (iaa_crypto) occurs when a hardware analytics error forces a software fallback that writes the destination buffer with the CPU while it is still mapped DMA_FROM_DEVICE; with SWIOTLB active, the subsequent dma_unmap_sg() overwrites req->dst with the stale bounce buffer, corrupting the decompressed output. The issue was resolved upstream and affects kernels from ~6.8 through the fixed releases. No public exploit identified at time of analysis, and EPSS is low at 0.20%.
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
Out-of-bounds read in the Linux kernel CephFS client (fs/ceph/mdsmap.c) lets a malicious or compromised Ceph monitor crash a client that has a CephFS mount. ceph_mdsmap_decode() advances its decode cursor by num_export_targets*4 bytes for each per-MDS info record without verifying enough bytes remain, and the only runaway-cursor guard is skipped for info versions 2 and 3, so an oversized count walks the cursor past the message front buffer and a later ceph_decode_32() reads slab memory out of bounds. No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Remote out-of-bounds read and general protection fault in the Linux kernel's svcrdma (RPC-over-RDMA server) code allows a connected RDMA client to crash the kernel by advertising a Write or Reply chunk with zero segments. The pcl_for_each_segment iteration macro computed an inclusive upper bound of &ch_segments[ch_segcount - 1]; with a u32 ch_segcount of 0 this underflows to 0xFFFFFFFF, walking far past the flex array until it faults when svc_rdma_get_inv_rkey() dereferences segment->rs_handle. Fixed upstream; EPSS is low (0.17%, 6th percentile) and no public exploit is identified at time of analysis.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds read in the Linux kernel's SMB/CIFS client allows a malicious or compromised SMB server to trigger memory over-reads while the client processes oplock-break responses. A refactor (commit 83bfbd0bb902 removing the RFC1002 header from smb_hdr) mechanically rewrote a DataOffset bounds check in is_valid_oplock_break() into an expression that is identically zero, silently disabling the guard that commit 097f5863b1a0 originally added - so an attacker-supplied 32-bit DataOffset again escapes validation. No public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Unauthenticated arbitrary file write in WAVLINK WN535M1 and WN535M3 routers (firmware before M35M1_V250922) exposes any file on the device to remote overwrite via the sync_server daemon on TCP port 13136, which runs as root and performs no client authentication. The daemon's 100-byte protocol filename field lacks path canonicalization, allowing absolute path traversal (CWE-36) that enables attackers to overwrite startup scripts or credential stores and achieve persistent root-level compromise. A public proof-of-concept repository (camdsmith/wavlink-sync_server-rce) is available on GitHub, substantially lowering the exploitation bar.
Out-of-bounds stack write in `sensor_hub_get_feature()` within the Linux kernel HID sensor-hub subsystem allows an attacker controlling a malicious HID device to corrupt kernel memory. A crafted HID descriptor that advertises an oversized feature field size exploits a mismatch between the function's return-value clamping logic and its unclamped per-value copy loop: when IIO subsystem callers (e.g., pressure or ambient-light sensor drivers) pass a small stack buffer such as a single s32, the copy loop writes beyond the buffer boundary by the full `field->report_size / 8` bytes per value. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), indicating low observed exploitation probability.
Incomplete error-path cleanup in the Linux kernel HID custom sensor driver (`hid-sensor-custom`) creates a use-after-free condition: when `hid_sensor_custom_add_attributes()` fails partway through sysfs group creation, previously created groups are not removed and `sensor_inst->fields` can be freed while `enable_sensor` sysfs attributes retain stale pointers into that array. Systems running Linux kernel from commit 4a7de051 through versions prior to 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1 are affected wherever the `hid-sensor-custom` module is loaded. No public exploit code exists and no CISA KEV listing is present, but kernel-space use-after-free conditions carry inherent privilege-escalation potential.
Use-after-free in the Linux kernel Bluetooth RFCOMM subsystem allows an adjacent Bluetooth peer to trigger kernel memory corruption via a race condition in rfcomm_security_cfm(). The function looks up a session and iterates its DLC list without holding rfcomm_mutex, so a concurrent krfcommd teardown (which does hold the mutex) can free the session and its DLCs while hci_rx_work is still traversing them. KASAN confirmed slab-use-after-free at rfcomm_security_cfm+0x41c. No public exploit or CISA KEV entry exists at time of analysis, and EPSS is 0.20%.
Out-of-bounds read and write in the Linux kernel's ocfs2 refcount block validator allows a local privileged attacker to corrupt kernel memory via a crafted or corrupted filesystem image. The `ocfs2_validate_refcount_block()` function fails to validate `rl_used` and `rl_count` fields against the actual fixed per-block capacity before refcount/reflink/CoW operations walk the record array, allowing a crafted `rl_used == 0xffff` to drive the loop 65534 iterations past the end of the 4096-byte metadata block. A subsequent `memmove()` of up to ~1 MiB from an already out-of-bounds offset in `ocfs2_insert_refcount_rec()` can corrupt arbitrary kernel memory. No public exploit and no KEV listing; EPSS is 0.20% reflecting realistic low exploitation probability.
State machine corruption in the Linux kernel's Thunderbolt networking (tbnet) subsystem allows an adjacent attacker to trigger a double-teardown sequence that causes kernel panics or silently frees HopIDs still in use by other connections. The bug lies in tbnet_connected_work(): every failure path returns without clearing login_sent, so the connection appears established to tbnet_tear_down(), which then re-executes teardown on an already-unwound state - stopping rings already stopped (a dev_WARN, fatal under panic_on_warn) and potentially double-freeing net->remote_transmit_path on HopID mismatch paths. No public exploit code has been identified at time of analysis; EPSS stands at 0.20%.
Use-after-free in the Linux kernel's iommufd selftest IOPF reporting enables local privilege escalation from low-privileged users to kernel-level code execution. The race condition exists between TRIGGER_IOPF's unsynchronized borrow of a PASID attach handle and a concurrent PASID detach that frees the backing iommufd_attach_handle struct, leaving iommu_report_device_fault() dereferencing freed memory. No public exploit code exists and EPSS is low (0.20%), but kernel UAF primitives of this class are routinely leveraged for privilege escalation on affected systems.
Unchecked device-controlled address in the mt7915 WiFi driver's EEPROM copy path allows a malicious or compromised MT7915 MCU to trigger a 16-byte out-of-bounds heap write in the host kernel. The driver's mt7915_mcu_get_eeprom() trusts the MCU response field res->addr (a device-supplied __le32) as a destination offset into eeprom.data without validating it against the buffer's bounds, enabling arbitrary kernel heap corruption. No public exploit has been identified at time of analysis, and EPSS probability is 0.20%; however, successful exploitation of the OOB write could yield kernel code execution or denial of service on any Linux host equipped with an MT7915-based adapter.
Out-of-bounds write in the STM32 CEC driver (media/cec/platform/stm32) allows an adjacent attacker on the same HDMI CEC bus to corrupt kernel memory by sending an overlong CEC frame. The stm32_rx_done() IRQ handler appends each received byte to a fixed 16-byte rx_msg.msg[] buffer using rx_msg.len as an unsanitized write index; a peer device that withholds the EOM signal drives RXBR interrupts indefinitely, writing attacker-controlled bytes past the end of the array into adjacent kernel structures. This vulnerability is reachable as soon as the STM32 CEC driver has probed and reception is enabled, with no local privilege or prior authentication on the CEC bus. No public exploit is identified at time of analysis; the fix is available in stable releases.
Use-after-free in Linux kernel NFSD's copy-notify stateid management (NFSv4.2 server-to-server copy) allows an authenticated NFS client to trigger a KASAN-detectable UAF at nfs4_put_cpntf_state() by racing OFFLOAD_CANCEL or laundromat expiry against concurrent stateid readers. Three separate revoke paths were affected: the parent-stid drain (nfs4_free_cpntf_statelist()), OFFLOAD_CANCEL via manage_cpntf_state(), and laundromat tick expiry. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), and real-world impact is DoS-leaning with theoretical memory disclosure.
IOMMU Stream ID aliasing in the Linux kernel's Tegra241 CMDQV driver allows a guest-controlled VMM to break IOMMU isolation by supplying an oversized virtual Stream ID. The bounds check in tegra241_vintf_init_vsid() only rejects values exceeding UINT_MAX, but the SID_MATCH register's VIRT_SID field is only 20 bits wide; the 'virt_sid << 1 | 0x1' encoding silently truncates bits above position 20, causing a value like 0x80000000 to alias SID_MATCH to vSID 0 and route the IOMMU entry to the wrong DMA Stream ID. Because vdev->virt_id is guest-controlled under CMDQV virtualization, an attacker with guest VM access can break tenant isolation and gain C:H/I:H/A:H access across the IOMMU boundary to host memory and devices. No public exploit is identified at time of analysis; EPSS is 0.17%, consistent with the narrow Tegra241 hardware-specific attack surface.
Silent inode metadata loss in the Linux kernel ext2 filesystem affects all systems using ext2 with IS_SYNC inodes: calls to `sync_inode_metadata()` in `ext2_setsize()` and `ext2_xattr_set2()` were guarded by an IS_SYNC branch that skipped `mark_inode_dirty()`, meaning that if the inode was not already dirty, the sync was a no-op and metadata changes were silently discarded. Affected operations include file truncation and extended attribute writes on synchronous ext2 mounts. No public exploit code exists and EPSS is 0.15%, consistent with a data-integrity correctness fix rather than a security-critical attack surface.