IRQ resource leak and potential use-after-free in the Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver allows a kernel crash if an interrupt fires after error-path cleanup. The driver's pit_clockevent_init() error path skips free_irq() when cpuhp_setup_state() fails after request_irq() has already succeeded, then proceeds to kfree(pit), leaving the registered IRQ handler's dev_id pointing to freed slab memory. If the IRQ subsequently fires, the handler dereferences the freed pointer, constituting a use-after-free. No public exploit exists and EPSS is 0.15% (5th percentile), consistent with a race-condition bug on niche embedded hardware.
Incorrect memory free (CWE-590) in PCRE2's JIT fast path allows heap corruption when match data previously used with PCRE2_COPY_MATCHED_SUBJECT is reused in a subsequent pcre2_jit_match() call. Affected versions are PCRE2 prior to 10.48. An attacker who can influence the sequence of PCRE2 API calls - for example, by triggering the vulnerable code path through a regex-consuming application - can potentially achieve memory corruption leading to code execution, data disclosure, or crash. No public exploit and no KEV listing have been identified at time of analysis.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
BMC root account activation without a password on Bull BullSequana XH3406 and XH3515 HPC servers enables full out-of-band management compromise following a factory reset or equivalent triggering operation. With a PoC available (CVSS 4.0 E:P) and no privileges required once the vulnerable state exists, an attacker with access to the BMC management interface can achieve complete control over the managed server, including power cycling, firmware manipulation, and console access. No active exploitation is confirmed in CISA KEV at time of analysis.
Use-after-free and double-free conditions in NetBSD's COMPAT_NETBSD32 kernel compatibility layer enable any local low-privilege user to corrupt kernel heap memory or trigger a kernel panic on affected 64-bit systems. The defect in msg_recv_copyin() causes the kernel to execute cleanup deallocation code on the success path - due to a missing return statement - freeing the iovec buffer after it has already been used, then freeing the same allocation again. A vendor patch is available via the GNATS bug tracker, and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Memory corruption in ArduinoBLE's ATT layer write request handler allows an unauthenticated BLE client within Bluetooth range to overflow the ATTClass global object's write buffer by sending a crafted ATT Write Request. Versions prior to 2.0.2 are affected exclusively when at least one BLE characteristic is configured with the BLEEncryption property. No public exploit has been identified at time of analysis, but vendor-released patch version 2.0.2 fully resolves the flaw.
Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.
Authenticated SQL injection in NextGen Mirth Connect 4.7.1 and earlier allows a low-privilege API user to execute arbitrary SQL via the unsanitized selectLimit parameter in the Database Connector API (POST /api/connectors/jdbc/_getTables). Against the bundled Apache Derby database, this exports administrator password hashes and channel configuration containing plaintext connector credentials to a web-accessible path retrievable without authentication, and can freeze database-backed operations until server restart. Full end-to-end public exploit code exists and CISA has published advisory ICSMA-26-253-01 covering this and two related XXE vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the same product.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Zip-slip path traversal in an industrial control system application allows authenticated low-privileged users to write arbitrary files to any location accessible by the server process. By crafting a malicious archive with directory-traversal sequences (e.g., '../../') in entry paths and uploading it through the platform's file-upload interface, an attacker can overwrite configuration files or inject fabricated records into stored data. Reported by ICS-CERT under advisory ICSA-26-254-01, this affects operational technology environments where data integrity is safety-critical; no public exploit or KEV listing identified at time of analysis.
Privilege escalation in an ICS API routing component (ICSA-26-254-01) allows a low-privileged authenticated attacker to bypass role-based authorization by manipulating a client-controlled HTTP header that governs authentication-path selection. The routing layer directs requests to one of two authentication backends based on a header the attacker fully controls; by setting that header to invoke the alternate path, the attacker assumes a fixed, elevated role and can perform actions restricted to higher-privileged users. No public exploit is identified at time of analysis; the advisory originates from ICS-CERT, indicating deployment in operational technology environments where unauthorized privileged write access carries operational consequence beyond what CVSS scores alone convey.
Server-Side Request Forgery in Shelf (shelf.nu) asset-tracking platform before v1.20.3 allows authenticated users holding the `asset:import` permission to force the application server to make unrestricted outbound HTTP requests by supplying crafted `imageUrl` values inside a CSV import file. Multiple documented bypass techniques - including image-extension suffixes, redirect chains, and domain substring matching - allow the weak URL validation to be circumvented, after which the server executes an unguarded `fetch()` call. Attackers can reach cloud instance metadata endpoints (e.g., AWS IMDS) to steal IAM credentials, probe internal network services, or trigger memory exhaustion by causing the server to buffer arbitrarily large responses before size checks apply. Vendor-released patch v1.20.3 addresses the issue; no public exploit code identified at time of analysis.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Integrity bypass in an industrial OT product's read-only deployment mode allows a low-privileged authenticated user to forge or overwrite stored records that the deployment mode is expressly designed to protect from modification. The vulnerability arises because the read-only mode's API proxy layer forwards HTTP requests to backend routes without enforcing HTTP method restrictions, enabling write operations to be carried out using the application's own elevated service-account credentials. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the ICS/OT context elevates operational risk if exploited to tamper with process historian or audit data.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Out-of-bounds MMIO reads in the Linux kernel CXL RAS driver expose kernel memory contents and can crash the system on hosts equipped with CXL RCH hardware. The cxl_rch_get_aer_info() function bounds its readl() loop by the size of a software struct (struct aer_capability_regs) that has grown beyond the fixed physical on-wire AER register block due to expansions in struct pcie_tlp_log; reading past the MMIO mapping then populates header_log.header_len with garbage, triggering a second OOB read inside pcie_print_tlp_log(). No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), consistent with the niche hardware prerequisite.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.
NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Integer underflow in the Linux kernel CIFS client's cifs_remap_file_range() corrupts SMB protocol fields and inverts write-range operations when a clone-to-EOF request is made with a source offset exceeding the file's current size. A local user with low privileges and access to a CIFS-mounted filesystem can trigger this by supplying len=0 and an offset beyond i_size in a FICLONERANGE ioctl, sending a malformed FSCTL_DUPLICATE_EXTENTS_TO_FILE request to the SMB server and disrupting filemap_write_and_wait_range() with an inverted range. No public exploit has been identified at time of analysis; vendor-released patches are available in stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds heap read latency exists in the Linux kernel's `platform/x86/hp-bioscfg` ACPI package parser, where five `hp_populate_*_elements_from_package()` parsers derive their iteration bounds from `elements[0]->string.length` (the name field's byte length) rather than `obj->package.count` (the real package element count). Currently unexploitable because `hp_init_bios_package_attribute()` enforces a strict element-count pre-check, the flaw becomes reachable the moment an anticipated upstream relaxation of that check lands - at which point a local authenticated user on HP hardware could induce the parsers to read past the end of the ACPI `elements[]` array, disclosing kernel heap memory or crashing the kernel. Patches have been backported to stable series 6.12.109, 6.18.50, and 7.2.4; no public exploit exists (EPSS 0.17%).
Stack memory disclosure and integer underflow in the Linux kernel's IPMI ipmb subsystem allow a local low-privileged attacker with write access to the IPMB device node to read uninitialized kernel stack bytes and trigger a buffer length underflow in `ipmb_write()`. The root cause is that `ipmb_write()` parses message fields prior to validating the length byte, so a zero-length or undersized write crosses into adjacent stack memory. CVSS rates confidentiality impact as High (stack leak) and availability impact as High (SMBus block-write length underflow), while EPSS at 0.17% reflects the niche attack surface. No public exploit or active exploitation has been identified.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
Hugetlb reservation accounting in the Linux kernel underflows when a huge-page folio shared between a parent and child process (after fork) is unmapped by the parent first. Since commit df7a6d1f6405 introduced reservation adjustment logic into `__unmap_hugepage_range()`, the function decrements the reservation counter without verifying that the folio's mapcount has reached zero, leaving the child's mapping unaccounted and the counter in an arbitrarily large (underflowed) state until the child unmaps. Affected kernels from 6.9 through the fix commits expose systems using hugetlb-backed workloads to integrity corruption (overcommit of huge pages) and availability risk (kernel memory management instability). No public exploit or active exploitation is identified at time of analysis.
Out-of-bounds heap read in the Linux kernel CXL fwctl driver allows a local low-privileged user to leak kernel memory to a CXL device mailbox and crash the kernel. The root cause is cxlctl_fw_rpc() ignoring the in_len bound established by fwctl_cmd_rpc(), letting a user-controlled op_size value drive memcpy reads beyond the kvzalloc(in_len) allocation. With a sufficiently large op_size the read walks into unmapped memory, causing a kernel oops. No public exploit code has been identified and EPSS stands at 0.17%, indicating limited active exploitation interest.
Out-of-bounds read in the Linux kernel dm-pcache subsystem allows a local low-privileged user to read past segment data boundaries into adjacent control areas, exposing sensitive kernel memory and potentially crashing the kernel. Specifically, cache_replay(), the writeback worker, and the GC worker all miscalculate the tail-kset read length using PCACHE_SEG_SIZE minus the segment offset rather than the actual data-region remainder via cache_seg_remain(). This affects Linux 6.18.x (before 6.18.50), 7.2.x (before 7.2.4), and pre-release 7.3-rc1. No public exploit or active exploitation has been identified; EPSS is 0.17% (6th percentile).
CVE-2026-19816 is a vulnerability reported by Ubuntu with no public description, CVSS score, or CWE classification available at the time of analysis. The affected product is an Ubuntu package or system component, but the specific vulnerability class, attack vector, and impact cannot be determined from the available intelligence. No exploitation conditions, technical root cause, or patch details are derivable from current data.
Missing origin validation in wpa_supplicant's driver-based PMKSA cache selection path allows a local low-privileged attacker to bypass network context and AKMP matching, forcing the supplicant to use a cached Pairwise Master Key Security Association from a mismatched network or authentication method. All wpa_supplicant versions prior to 2.12 are affected. Successful exploitation can allow the attacker to bypass Wi-Fi authentication controls, potentially enabling connection to unintended network segments or interception of traffic through credential reuse across network boundaries. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing authorization in the Master Addons for Elementor WordPress plugin (≤3.2.2) by Pixar Labs enables privilege abuse by authenticated low-privileged users. The CVSS vector (PR:L/C:N/I:L/A:H) indicates that a subscriber-level or similarly low-privileged WordPress account is sufficient to trigger operations with high availability impact - likely destructive actions such as resetting plugin settings, deleting content blocks, or disrupting site functionality - while retaining limited integrity modification capability. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Password hash extraction from any Dolibarr 24.0.0 user account, including administrators, is possible for authenticated low-privileged users via a case-sensitivity mismatch in the sqlfilters API parameter denylist. The PHP guard in dolForgeSQLCriteriaCallback() performs case-sensitive string matching against forbidden field names, while the underlying database resolves column names case-insensitively, allowing bypasses using uppercase variants such as PASSWORD instead of password. By submitting prefix-matching predicates as boolean oracle queries, an attacker can extract full credential hashes character-by-character without elevated privileges. No public exploit code has been identified at time of analysis; a patch commit is available upstream.
Unrestricted wallet-credit minting in AVideo's AD_Server plugin allows any authenticated user to fraudulently inflate YPTWallet balances for campaign video owners without proof of ad delivery. The flaw resides in plugin/AD_Server/log.php, which accepts arbitrary label values - including label=start - via POST requests and credits the associated campaign wallet unconditionally. Repeated exploitation constitutes ad fraud, enabling attackers to generate synthetic platform currency at will. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site request forgery in WWBN AVideo's playlistRemove.php endpoint allows remote attackers to silently delete authenticated users' playlists by luring victims to a malicious webpage. The endpoint processes POST requests for playlist deletion without validating a CSRF token, meaning any browser-initiated request carrying a valid session cookie - regardless of origin - is accepted. No public exploit has been identified at time of analysis, though the attack is trivially constructible from a standard HTML form.
Silent data corruption in the Linux kernel's s390/dasd subsystem causes local processes to silently receive zeroed data for the unread portion of partially-completed ESE (Extent Space Efficient) disk reads that pass through the ERP (Error Recovery Procedure) chain. The root cause is dasd_default_erp_postaction() omitting the proc_bytes field when copying per-request state back from the ERP request to the originating request, which causes __dasd_cleanup_cqr() to treat the request as fully satisfied and return without requeuing the unread remainder. No public exploit code exists and no active exploitation is confirmed; vendor-released patches are available across multiple stable branches.
Register corruption in Linux kernel s390/percpu silently drops the `mviy` instruction on kernels compiled with GNU binutils prior to 2.39, leaving the per-CPU address register unrepaired after CPU migration following an interrupt. Affected kernels are limited to IBM s390/zSeries architecture builds in the 7.2 lineage using the older toolchain. With C:H/I:H/A:H in the CVSS vector, successful exploitation by a local attacker could lead to privilege escalation via corrupted per-CPU data, though no public exploit or KEV listing exists and EPSS is 0.15%.
Hard-coded bootloader credentials in the ANJIA AJL33PC0801 IP camera allow any attacker with physical device access to authenticate to the bootloader without knowing a legitimate password. Successful exploitation grants full control over firmware loading and system configuration, enabling persistent device compromise, implant installation, or complete operational disruption. CISA issued ICS advisory ICSA-26-251-01 for this vulnerability; no public exploit or CISA KEV listing has been identified at time of analysis.