Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.
Integer overflow in RISC-V KVM's SBI PMU EVENT_GET_INFO handler allows a guest VM to trigger out-of-bounds heap reads and writes on the host kernel, with scope-changed impact (C:H/I:H/A:H). A malicious or compromised guest on a RISC-V host running KVM can supply a crafted num_events value (e.g., 0x10000001 on RV64) that overflows a 32-bit multiplication, causing under-allocation of the event-info array while the subsequent loop iterates over the original large count - resulting in slab-out-of-bounds memory corruption confirmed by KASAN traces. No public exploit code exists and EPSS is 0.15%, but the scope change to the host kernel makes this a VM-escape class finding for RISC-V KVM deployments.
Out-of-bounds write in the Linux kernel mt76/mt7996 WiFi driver allows a malicious or malfunctioning MediaTek mt7996 chip to corrupt kernel heap memory. The vulnerability exists in mt7996_mcu_get_eeprom(), which derives a destination offset into dev->mt76.eeprom.data from a device-controlled field (event->addr, a __le32 in the MCU response) without bounding that offset before performing the EFUSE/EXT block copy. A compromised or deliberately crafted mt7996 device can trigger an OOB write of up to MT7996_EXT_EEPROM_BLOCK_SIZE bytes into kernel memory, with potential for privilege escalation or denial of service. No public exploit is identified at time of analysis and EPSS is 0.15%, consistent with the narrow attack surface requiring hardware-level adversarial control.
Heap buffer overflow in stb_vorbis through 1.22 allows remote attackers to crash or corrupt the heap of any application that parses attacker-supplied Ogg Vorbis audio. The root cause is an integer truncation bug in start_decoder() where the codebook multiplicands allocation size is computed as a size_t but narrowed to int before being passed to the allocator, enabling a heap undersizing condition triggerable by crafting codebook entries and dimensions values that overflow the int range. No public exploit code or active exploitation is confirmed, but the no-interaction network vector makes this impactful for any service that accepts Ogg Vorbis input from untrusted sources.
Privilege escalation in Shopper Framework v2.8.0-v2.9.1 allows any authenticated staff member holding only the read-only view_users permission to perform three critical administrative actions: self-escalate by granting arbitrary permissions to their own role, create new admin-privileged team members with attacker-chosen credentials, and delete RBAC roles causing cascading privilege loss for all affected users. The flaw is a direct regression of the partially-applied security fix in PR #511 (GHSA-f946-9qp6-vgch) - three Livewire component authorization gates were left checking view_users instead of access_setting, including one gate in a file introduced by the security fix commit itself. No external exploit tooling has been identified at time of analysis, but Shopper's own regression test suite at commit fcd0c59 functions as documented proof-of-concept, with view_users-only actors passing all three attack-path tests.
PHP Object Injection in the Masteriyo LMS WordPress plugin (versions <= 3.4.0) allows remote attackers to inject a crafted serialized PHP payload, potentially enabling arbitrary code execution via a PHP gadget chain present in the environment. The vulnerability is described as unauthenticated in the Patchstack disclosure title, though the supplied CVSS vector specifies PR:L - a discrepancy that materially affects real-world risk assessment and requires vendor clarification. No public exploit code or CISA KEV listing has been identified at time of analysis.
Privilege escalation in the SMS Alert Order Notifications WordPress plugin (versions ≤ 3.9.9) allows any authenticated subscriber - the lowest standard WordPress role - to elevate their account privileges, potentially gaining full administrative control over the affected site. The CVSS 8.8 score with PR:L confirms that only a low-privileged account is required, making exploitation accessible to any registered user on the platform. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Privilege escalation in the Gato GraphQL WordPress plugin (versions ≤ 19.2.3) allows authenticated subscribers - the lowest registered-user role in WordPress - to elevate their access beyond their assigned privileges. The root cause is CWE-266 (Incorrect Privilege Assignment), where the plugin's GraphQL endpoint handling fails to properly gate privileged operations against low-privilege requestors. No confirmed active exploitation or public POC is identified at time of analysis, but the trivially low access bar of a subscriber account combined with full CIA impact makes this a high-priority finding for any WordPress installation running this plugin.
Cross-origin WebSocket hijacking in Headroom's proxy layer (prior to v0.35.0) allows an unauthenticated attacker-controlled webpage to issue arbitrary LLM requests through the victim's Headroom instance without authentication. Because the WebSocket server forwards requests to the upstream LLM provider without validating the Origin header, any browser with network access to the proxy-standard or headless-can be weaponized as a relay. The primary concrete impact is unauthorized consumption of the stored OpenAI API key and potential exposure of LLM response content; no public exploit code or CISA KEV listing has been identified at time of analysis.
XXE injection via the XSLT Transformer Step in NextGen Mirth Connect (versions ≤4.7.1) allows unauthenticated network attackers to exfiltrate arbitrary server-local files through an out-of-band HTTP callback, and to deny service to the targeted processing channel. The root cause is a bare Java TransformerFactory instantiated without disabling external entity resolution (CWE-611). Full public proof-of-concept code exists at GitHub; CISA published ICS-Medical advisory ICSMA-26-253-01 on 2026-09-10, and the vendor-confirmed fix ships in version 4.7.2.
Command injection in Puppet Enterprise's java_keystore_passwd parameter handling allows authenticated Puppet administrators to execute arbitrary OS commands with root privileges. The parameter value is passed to a shell execution context without sanitization, enabling full system compromise from a high-trust but network-accessible role. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated remote denial of service in Net-SNMP through 5.9.5.2 allows any network-reachable attacker to permanently suspend all SNMP processing by connecting to the SMUX listener and withholding data. The root cause is smux_accept() issuing a blocking recv() call with no timeout on every newly accepted SMUX connection, stalling snmpd's single-threaded main loop indefinitely. Because the block is permanent and snmpd performs all SNMP agent work in that same thread, the entire agent - monitoring, traps, polling - ceases until the process is manually restarted. No public exploit identified at time of analysis, though a researcher gist documenting the behavior is publicly linked in the advisory.
WeenyGenius, a computer lab management system by Howyar Technologies, exposes its endpoint communication protocol without any authentication, allowing any adjacent-network attacker to impersonate either student or teacher roles. The teacher-impersonation path is the critical vector: posing as a teacher causes student workstations to initiate management connections back to the attacker, yielding remote control over every student endpoint in the lab. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the zero-privilege, zero-interaction requirement within a reachable network makes exploitation straightforward for any insider or network-adjacent threat actor.
Server-Side Request Forgery in Google Cloud Gemini Enterprise Agent Platform App Builder (all versions prior to the 2026-06-01 deployment date) enables unauthenticated remote attackers to exfiltrate the Compute Engine default service account access token by forcing the application to issue requests to the GCP instance metadata service. The stolen OAuth 2.0 bearer token carries the IAM permissions of the default service account, potentially enabling lateral movement across GCP project resources. Vendor-released patch was deployed on 1 June 2026, but existing app deployments require a manual redeployment to receive the fix - creating remediation lag risk for unmanaged deployments.
Improper authorization in OpenMRS allows any authenticated low-privilege user to invoke the `startHl7ArchiveMigration` DWR service, an administrative method that should be restricted to admin-level accounts. Affected versions are OpenMRS core prior to 1.23.0 (1.x branch) and prior to 2.10.0 (2.x branch), both patched by their respective releases. No public exploit has been identified at time of analysis, though exploitation requires only a valid session, keeping the practical barrier low for any credentialed system user.
OS command injection via filename manipulation in an ICS file-transfer interface allows authenticated network attackers to execute arbitrary commands with the privileges of an automated processing service. The flaw, tracked under ICSA-26-254-01 and reported by CISA ICS-CERT, affects a log-ingestion workflow where attacker-supplied filenames containing shell metacharacters are passed unsanitized to a system call. Successful exploitation enables read and write access to ingested operational log data and may serve as a pivot point for lateral movement within the operational technology network segment.
Origin validation failure in WeenyGenius, Howyar Technologies' computer lab management system, allows any unauthenticated attacker adjacent to the school network to impersonate the teacher workstation by sending spoofed broadcast packets. Student machines running the WeenyGenius client accept these packets without verifying their source, causing them to initiate management connections to the attacker's host. No public exploit has been identified at time of analysis, but the zero-complexity adjacent-network attack makes exploitation trivially feasible by any insider - including students - on the same LAN.
WeenyGenius computer lab management software by Howyar Technologies transmits control commands over ZMTP Null mode - ZeroMQ's no-authentication, no-encryption transport - leaving all management traffic exposed on the local network. Unauthenticated adjacent-network attackers can passively capture plaintext session data or actively replay forged classroom commands to disrupt exams and lesson control. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the attack requires only standard network tooling and network adjacency.
Remote Code Inclusion in Brainzcompany Zenius EMS 8.0 (through OAM Build 109) is achievable by unauthenticated attackers on an adjacent network who bypass authentication via an alternate path or channel (CWE-288) compounded by improper syntactic input validation. The two-weakness combination allows an attacker to cause the server to include and execute attacker-controlled remote code, yielding full compromise of confidentiality, integrity, and availability. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated arbitrary file read in Dolibarr 23.0.4 through 24.0.0 allows remote attackers to exfiltrate sensitive data by exploiting a hardcoded bypass value in the document access endpoints. Supplying hashp=shared in requests to htdocs/document.php and htdocs/viewimage.php satisfies the authorization condition without a valid token, granting read access to application logs, uploaded business documents, database backups containing password hashes, and files across multicompany tenant boundaries. No public exploit has been identified at time of analysis, but the VulnCheck advisory fully discloses the bypass mechanism and exact parameter value.
XXE injection in NextGen Mirth Connect allows unauthenticated remote attackers to exfiltrate arbitrary files from the server and trigger denial-of-service conditions when XML batch processing is enabled with the XPath option selected. The vulnerability stems from the absence of entity restrictions in the default XPath/JAXP XML parser configuration, permitting malicious external entity declarations to be resolved. A CISA ICS Medical advisory (ICSMA-26-253-01) and a researcher blog post confirm this affects healthcare integration infrastructure; no public exploit identified at time of analysis.
Unauthenticated file read in WWBN AVideo's getRecordedFile.php endpoint exposes recorded live-stream FLV files to any network attacker without authentication or authorization. All AVideo deployments through commit c3edcc274c389816d434acadac07ee78eaf330c1 are affected. An attacker who can reach the web interface and supply a known or guessed stream key can silently download private recorded video content, with no public exploit or KEV status confirmed at time of analysis.
Use-after-free in Microsoft Edge (Chromium-based) enables an authenticated network attacker to achieve remote code execution with scope change across all supported platforms including Windows, Linux, macOS, Android, and iOS. The vulnerability carries a CVSS 8.5 with high complexity and scope change (S:C), indicating that successful exploitation escapes the browser's sandboxing boundary and affects the underlying host. No public exploit or CISA KEV listing is present at time of analysis, though patch-available status from Microsoft confirms vendor acknowledgment.
Sensitive credential hash exposure in ST Engineering iDirect VSAT terminals allows any authenticated web user to retrieve the complete device configuration - including MD5-crypt password hashes for root SSH and web admin accounts - from a single API endpoint. The iQ-series, 3315-series, and 9-series terminal families are all confirmed affected, with no patched version currently identified. Because MD5-crypt is computationally weak against modern GPU-based cracking tools, successful hash extraction typically escalates to full root-level device compromise. Reported by ICS-CERT under advisory ICSA-26-183-01; no public exploit code or active exploitation has been identified at time of analysis.
SSRF fix bypass in FrontMCP v1.2.1 and its dependency mcp-from-openapi 2.3.0 allows authenticated users of hosted deployments to reach internal network services by supplying crafted OpenAPI specs containing external `$ref` URLs. The previous patch for CVE-2026-39885 introduced a hostname-string denylist that is circumvented via DNS names resolving to loopback (e.g., 127.0.0.1.nip.io), HTTP redirect chains to loopback after an initially allowed host, and IPv4-mapped IPv6 syntax (::ffff:127.0.0.1). A working proof-of-concept with five confirmed bypass vectors is included in the advisory; no CISA KEV listing exists at time of analysis.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Out-of-bounds read and write in the Linux kernel's Chrome EC sensorhub driver exposes Chromebook-class systems to kernel heap corruption via an unvalidated 8-bit sensor number in EC FIFO events. The cros_ec_sensor_ring_process_event() function indexes batch_state[] using the sensor_num field from embedded-controller events without checking it against the allocated array size, allowing any event carrying sensor_num >= sensorhub->sensor_num to access arbitrary adjacent kernel heap memory. No public exploit or CISA KEV listing exists; EPSS is 0.20%, but the C:H/I:H/A:H CIA impact reflects the potential for kernel memory corruption on affected Chrome EC hardware.
Uninitialized mutex use-before-initialization in the Linux kernel's ALSA pcxhr driver exposes systems with Digigram PCXHR audio hardware to a race condition during driver probe. The pcxhr_probe() function calls request_threaded_irq() before mgr->lock is initialized; if an interrupt fires during the probe window, the threaded IRQ handler attempts to acquire an uninitialized mutex, resulting in undefined kernel behavior ranging from panic to memory corruption. Patch commits are available across multiple stable kernel branches; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.20% at the 10th percentile.
Dangling pointer vulnerability in the Linux kernel's Qualcomm MSM IOMMU driver (iommu/msm) can lead to kernel memory corruption on systems running Qualcomm MSM/Snapdragon SoCs. The msm_iommu_probe() function registers its devm-managed IOMMU object in the global qcom_iommu_devices list prior to completing sysfs and IOMMU core registration; if either iommu_device_sysfs_add() or iommu_device_register() fails, the devm framework releases the backing memory while the stale list entry remains, producing a dangling pointer that subsequent kernel list walks may dereference. Fixes are available in stable branches 6.18.50 and 7.2.4; no public exploit code has been identified and EPSS sits at 0.20% (10th percentile).
Memory corruption in the Linux kernel's IPMI message handler (ipmi/msghandler) stems from an incomplete error-path cleanup: when an IPMI interface encounters an error during startup, kernel workqueue items already scheduled for that interface are not canceled before the interface structure is freed, creating a use-after-free condition. Systems running kernel versions in the 6.18.20-6.18.49 and 7.0-7.2.3 ranges with IPMI-capable hardware are affected. Patches were released in stable updates 6.18.50 and 7.2.4; no public exploit exists and EPSS is very low at 0.20%.
Use-before-initialization race condition in the ADI I3C master driver of the Linux kernel allows a hardware interrupt to acquire an uninitialized spinlock during device probe. Specifically, adi_i3c_master_probe() requests the IRQ and unmasks REG_IRQ_PENDING_CMDR before the transfer queue lock and IBI state are initialized, so an early CMDR interrupt can invoke adi_i3c_master_irq() and attempt to take master->xferqueue.lock against an uninitialized dynamic key. No public exploit has been identified and EPSS is 0.20%, but the fix is confirmed in stable trees 6.18.50 and 7.2.4.
Seccomp filter bypass in the Linux kernel entry path allows a low-privileged local process to execute syscalls blocked by a newly installed seccomp filter. The vulnerability arises because `syscall_trace_enter()` caches the `syscall_work` flags at entry; when a sibling thread installs a seccomp filter via `SECCOMP_FILTER_FLAG_TSYNC` while the first thread is ptrace-stopped, the `SYSCALL_WORK_SECCOMP` flag is set on the stopped thread but the stale cached variable never reflects it. When the ptrace tracer also modifies the syscall number during the stop (e.g., substituting `execve`), the resumed thread bypasses the filter entirely. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.18%.
Out-of-bounds array access in the Linux kernel ntfs3 filesystem driver allows an attacker who can cause a crafted NTFS image to be mounted to trigger kernel memory corruption via an overflow of the page_lcns[] array. The copy_lcns and redo-shorten loops index page_lcns[] at j+i where i is bounded by the log record's lcns_follow field rather than the target dirty-page entry's field, and because check_dp_table() validates the entry but not the copy_lcns record, and find_dp() bounds j but not i, a crafted record can overflow the array of an otherwise structurally valid entry. No public exploit has been identified at time of analysis, and EPSS is 0.18%, but siblings CVE-2026-89610 through CVE-2026-89613 affect the same ntfs3 code path in the same kernel fix wave.
An infinite loop in the Linux kernel's device property subsystem causes system hangs when iterating firmware nodes (fwnodes) with a secondary fwnode containing more than one child. Affected are Linux kernel versions across multiple stable branches (5.10.x through 6.19.x pre-patch). An attacker or malformed firmware blob that produces such a node topology can cause a kernel thread to spin indefinitely, consuming a CPU core and ultimately triggering a watchdog reset or complete system hang. No active exploitation has been confirmed, and EPSS stands at 0.17%.
Uninitialized mutex race condition in the Linux kernel's omapfb DSI command-mode panel driver (panel-dsi-cm) exposes OMAP SoC systems to kernel panic or memory corruption. dsicm_probe() calls omapdss_register_display() to publish the display device before executing mutex_init() on ddata->lock, creating a window where any concurrently-invoked dsicm callback can attempt to acquire an uninitialized mutex with undefined results. No public exploit exists and EPSS sits at 0.17% (6th percentile), accurately reflecting the extreme niche of OMAP hardware in current deployments. Vendor-released patches are available across affected stable branches.
Dangling pointer in the Linux kernel AS3722 PMIC regulator driver leaves `pdev->dev.of_node` referencing freed memory after `of_node_put()` prematurely drops the reference acquired by `of_get_child_by_name()` during Device Tree parsing in `as3722_get_regulator_dt_data()`. Systems running the ams AS3722 Power Management IC driver - predominantly NVIDIA Tegra-based embedded platforms - are affected across all kernel versions since Linux 3.13. If the stale pointer is subsequently dereferenced by regulator framework operations, kernel memory corruption, information disclosure, or local privilege escalation may result; no public exploit code has been identified at time of analysis.
Slab out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows a malfunctioning, malicious, or compromised Chrome Embedded Controller (EC) to corrupt kernel heap memory during device probe. The driver accepts EC-reported USB PD port counts as loop bounds without validating them against EC_USB_PD_MAX_PORTS (8), so an EC returning any count N > 8 - up to the u8 maximum of 255 - writes N pointers into an 8-entry slab-allocated array, overflowing by up to 247 entries (~1976 bytes). No public exploit exists and EPSS is 0.17%, reflecting the high-complexity attack path that requires prior EC firmware compromise.
Out-of-bounds write in the Linux kernel's cros_usbpd-charger driver allows kernel memory corruption when a malicious or compromised ChromeOS Embedded Controller (EC) returns a falsified USB PD port count. Kernels from approximately v4.20 through unpatched 6.12.x, 6.18.x, and 7.2.x stable branches fail to clamp the EC-supplied charger port count to EC_USB_PD_MAX_PORTS before iterating, enabling heap corruption with potential for privilege escalation or system crash. No public exploit exists (EPSS 0.17%, 6th percentile), and patches have been released in 6.12.109, 6.18.50, and 7.2.4.
Use-after-free in the Linux kernel's LP8727 battery charger driver allows local exploitation via a race condition in lp8727_release_irq() that can corrupt kernel memory. The defect exists because lp8727_release_irq() cancelled the delayed work before freeing the IRQ, leaving a window where a concurrently delivered IRQ could cause the threaded handler lp8727_isr_func() to re-arm the work via schedule_delayed_work(); after the .remove path returned and the devm layer freed pchg, lp8727_delayed_func() could still execute and dereference the freed structure. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%, consistent with a static-analysis-detected defect with no known weaponization.
Use-after-free vulnerability in the Linux kernel's rt9455 power supply driver allows local exploitation through a race condition between delayed workqueue callbacks and driver teardown. The rt9455_remove() function cancels work items in an order that permits batt_presence_work to re-queue max_charging_time_work after the latter has already been cancelled, resulting in a callback executing against already-freed rt9455_info memory. Identical UAF exposure exists in the probe error path if rt9455_hw_init() fails after the IRQ is registered. No public exploit exists and EPSS is 0.17% (6th percentile); the vulnerability was identified by static analysis rather than observed in exploitation.
Off-by-one out-of-bounds NUL write in the Linux kernel's HP BIOS configuration driver (hp-bioscfg) corrupts kernel memory when hp_get_string_from_buffer() receives a BIOS attribute string whose length exactly matches the destination buffer size, causing the terminator write to land one byte past the allocation. The flaw affects multiple fixed-size kernel buffers - path[512], current_value[512], current_password/current_value[64], and the per-entry encodings[][512] and prerequisites[][512] arrays - exclusively on HP hardware with the hp-bioscfg module loaded. No public exploit code has been identified and EPSS stands at 0.17%, but the kernel write primitive carries theoretical privilege escalation potential alongside a realistic denial-of-service outcome.
Slab-use-after-free in the Linux kernel vsock/virtio transport driver allows a local attacker to trigger kernel memory corruption by exploiting a work-item flush ordering bug during device removal. The virtio_vsock_remove() path flushes work items without respecting producer-to-consumer dependencies (tx_work → send_pkt_work → rx_work), allowing kfree(vsock) to race with a newly queued rx_work item, as confirmed by KASAN reporting a UAF read in virtio_transport_rx_work. No public exploit exists and no active exploitation has been identified; EPSS is 0.17% (6th percentile). Patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Landlock LSM in Linux kernel 5.13+ fails to enforce filesystem creation restrictions for whiteout objects across two distinct syscall paths, enabling a sandboxed process to escape its Landlock domain constraints. The renameat2(2) syscall with RENAME_WHITEOUT performs no Landlock MAKE_* access control check whatsoever, allowing any Landlock-restricted process to create whiteout directory entries even when all filesystem creation rights are denied; separately, mknod(2)-based whiteout creation was gated on the incorrect permission class (MAKE_CHAR instead of MAKE_REG). No public exploit exists, EPSS is 0.17%, and the vulnerability is not in CISA KEV, but the renameat2 bypass is a genuine Landlock sandbox escape present in kernels from 5.13 through 7.2.3/6.18.49.
Command injection in projen's task synthesis component before version 0.103.0 allows context-dependent attackers to execute arbitrary commands on developer workstations or CI/CD runners. Shell metacharacters embedded in project configuration values or repository file names are interpolated unescaped into generated .projen/tasks.json task definitions, which execute when developers or automated pipelines invoke synthesized tasks. No public exploit code has been identified at time of analysis, but the supply-chain attack surface - malicious pull requests, forked repositories - significantly lowers the exploitation bar.
OS command injection in TUBITAK BILGEM's Pardus Software (the software center/package management application for the Pardus Linux distribution) allows a local unprivileged user to execute arbitrary OS commands, likely with elevated privileges. Versions before 1.0.5 are affected; the fix is available in 1.0.5. Reported by Turkish national CERT (USOM) and published via the Turkish cyber security authority's advisory portal. No public exploit code or active exploitation confirmed at time of analysis.
Remote code execution in SICK AG's Sentio Creator Extension 'Device Manager' allows an unauthenticated network attacker, with required user interaction, to execute arbitrary code on a target system by delivering a malicious device driver package that bypasses the application's driver verification mechanism. The vulnerability (CWE-347) stems from improper verification of cryptographic signatures on driver packages, with the 'Jwt Attack' tag suggesting the verification layer uses JWT tokens susceptible to forgery or algorithm manipulation. CVSS S:C (scope changed) reflects that driver-level execution escapes application boundaries and achieves OS/kernel-level impact. No public exploit or KEV listing has been identified at time of analysis.
Order metadata tampering in the Advanced Customized Prompts WordPress plugin (all versions through 1.0.1) allows any authenticated subscriber to overwrite WooCommerce order item metadata for orders belonging to other customers. The plugin performs no capability, ownership, or nonce verification before applying user-supplied metadata updates to an arbitrary order ID, making every order's custom fields writable by any registered user. WPScan has published a proof-of-concept, reducing the technical bar for exploitation on any WooCommerce store running this plugin.
Cookie-signing secret forgery in an ICS platform's bundled packet-analysis component allows unauthenticated network attackers to bypass authentication entirely when the deployment was initialized from an example configuration file without running the required secret-regeneration routine. The vulnerability (CWE-1392) is contingent on a specific, detectable misconfiguration: the example `.env`-style file ships a publicly known static secret, and deployments that skip the setup step remain permanently vulnerable. Reported under an ICS-CERT advisory (ICSA-26-254-01), this affects operational technology environments where the packet-analysis UI is network-exposed.
Process termination via unrecovered panic in AWS SDK for Go v2's EventStream header decoder allows a remote actor to crash any Go application consuming AWS streaming service responses. Sending a crafted EventStream response frame containing a header value type byte outside the valid range triggers an unhandled Go panic that propagates to terminate the host process. The affected surface includes Bedrock inference and agent runtime packages, making AI/ML workloads on AWS a particularly relevant target; no public exploit or active exploitation has been confirmed.
Integer overflow during NFSv2 SETATTR/CREATE decoding in the Linux kernel NFSD corrupts file timestamps before proc-level validation can occur. On ILP32 (32-bit) kernels, `tmp2 * NSEC_PER_USEC` overflows a 32-bit unsigned long, wrapping an out-of-range useconds value into an in-range tv_nsec - bypassing the subsequent range check and letting a bogus nanosecond value reach the filesystem. A secondary defect on all platforms allows a client placing useconds==1000000 in the atime field (without also setting mtime to 1000000) to leave ATTR_ATIME_SET armed with tv_nsec=10^9, which also reaches the filesystem unchecked. No public exploit has been identified at time of analysis; EPSS is 0.21%.