Silent data loss in Linux kernel NFSD's NFSv4.2 async COPY implementation causes the server to omit a write-verifier rotation when asynchronous copy writeback fails: the server correctly encodes NFS_UNSTABLE in the CB_OFFLOAD callback, but leaves nn->writeverf unchanged, so the client's subsequent COMMIT handshake returns the same verifier the client already holds and the client concludes copied data is durable - silently discarding data whose writeback actually failed. This violates the UNSTABLE+COMMIT durability contract specified in RFC 7862 §15.1 and RFC 8881 §18.32, matching a protocol-state class of bug already remediated in nfsd_vfs_write() and nfsd_commit(). No public exploit or active exploitation is identified; EPSS is 0.20%, consistent with the narrow preconditions required.
Silent data loss in the Linux kernel NFSD NFSv4.2 async COPY offload path allows writeback errors to go undetected, causing clients to treat unwritten data as durably committed. The vulnerability stems from a TOCTOU race in `_nfsd_copy_file_range()`: the writeback-error cursor 'since' is sampled after the copy loop rather than before it, so a concurrent COMMIT or stable WRITE on the same destination inode can advance the error cursor before the COPY worker reads it, masking any writeback failure. CB_OFFLOAD then signals `wr_stable_how = FILE_SYNC4` to the NFS client, which confidently discards its copy of the data under the false belief it is durably stored on the server. No public exploit has been identified at time of analysis, and EPSS stands at 0.20%.
Kernel crash in the Linux libceph client allows a malicious or compromised authenticated Ceph OSD to trigger a BUG_ON assertion in ceph_msg_data_next() by sending a crafted sparse-read reply. The flaw in net/ceph/osd_client.c:osd_sparse_read() validates total data length against summed extents but omits per-extent monotonicity, overlap, and bounds checks, enabling a far-forward extent offset to advance the message-data cursor past the request buffer. Impact is limited to availability - a targeted kernel panic on any Linux client mounting a RADOS-backed filesystem or block device (RBD/CephFS). No public exploit code has been identified at time of analysis, and EPSS is low at 0.20%.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Integer underflow in the Linux kernel's SCTP stream reconfiguration (RECONF) handler allows a remote SCTP peer to crash the kernel by sending duplicate RECONF response chunks. When a cached RECONF chunk contains an ADD_OUT request alongside other parameters, a duplicate response causes the kernel to roll back `stream->outcnt` twice - the second decrement underflows the unsigned counter and can trigger a kernel panic. EPSS exploitation probability is 0.20% (10th percentile), no public exploit exists, and no CISA KEV listing has been issued, indicating no known active exploitation at time of analysis.
Race condition in the Linux kernel's IPA (IP Accelerator) network driver permanently stalls the cellular modem TX queue on Qualcomm Snapdragon-based devices after a runtime power management resume cycle. The flaw occurs because the queue-wake work is dispatched during RPM_RESUMING state before RPM_ACTIVE is reached; the wake is consumed prematurely by a racing transmit, pm_runtime_get() returns -EINPROGRESS with no future wake scheduled, and the TX queue never recovers - blocking both outbound packets queued in qdisc and, through suspended endpoints, inbound RX as well. No public exploit exists and EPSS is 0.20%, but the failure manifests under normal cellular data usage without any adversarial trigger.
Unbounded O(n²) CPU consumption in the Linux kernel NFS server (nfsd) POSIX ACL decoder allows any NFS client reachable on port 2049 to cause server-side denial of service by supplying an oversized ACL entry count in a SETACL compound. The root cause is an asymmetry introduced in commit 5fc51dfc2eb1: the encoder already caps count at NFS_ACL_MAX_ENTRIES, but the decoder added in that commit omits the symmetric bound check, passing the raw wire u32 directly into an O(n²) bubble sort. Patches are available in Linux 7.2.4 and 7.3-rc1; no public exploit or active exploitation has been identified.
POSIX ACL reference-count leaks in Linux kernel NFSD allow a remote attacker to exhaust kernel memory via malformed NFSv4 OPEN compound requests. When the NFS server decodes an OPEN compound carrying valid POSIX ACL createhow4 attributes but encounters a non-seqid-mutating error from claim4 decoding, the compound dispatcher short-circuits before nfsd4_open() executes, permanently leaking both op_pacl and op_dpacl references because OP_OPEN lacked an op_release handler; a secondary leak exists on the NFSv4.0 replay path where op_release was never called from nfsd4_encode_replay(). No public exploit code has been identified and EPSS is 0.20%, but repeated malformed requests against a network-reachable NFSv4 server could drive the kernel toward OOM-induced service failure.
Four coupled error-path defects in the Linux kernel's SUNRPC RPCSEC_GSS option-array XDR decoder (`gssx_dec_option_array`) enable kernel NULL-pointer dereference, a `group_info` refcount leak, and a latent use-after-free during GSS security-context acceptance. Systems acting as NFS servers or clients with Kerberos authentication (sec=krb5/krb5i/krb5p) are in the affected code path; triggering the NULL deref via a failed allocation or malformed GSS response causes a kernel crash (denial-of-service). No public exploit code exists and EPSS sits at the 10th percentile, indicating low current exploitation probability.
Defensive hardening in the Linux kernel NFSD subsystem closes an edge case where nfsd_file_do_acquire() could use a file returned by dentry_create() that was never actually opened. The POSIX VFS interface permits ->atomic_open handlers to return success while delegating the open to a retry path via finish_no_open(); if that path is reached during an NFSv4 file creation, the resulting struct file lacks FMODE_OPENED and is in an invalid state for server I/O. Using such a handle can lead to a kernel crash or panic on the NFS server, causing a denial-of-service. No public exploit exists and exploitation is described as extremely unlikely by the kernel developers themselves; no public exploit has been identified at time of analysis.
Silent data corruption in the Linux kernel NFS server daemon (nfsd) allows authorized NFS write clients to induce incorrect file-offset placement whenever a partial write completes between 50% and 99% of a segment boundary. Affecting kernel revisions from commit 06c5c97293e3fca99ce15da157068edf45a7c6e4 up to the fix commits included in 7.2.4 and 7.3-rc1, the logic error in nfsd_direct_write() causes subsequent write segments to land at wrong file offsets while the byte-count returned to the NFS client is over-reported, masking the corruption. No public exploit has been identified at time of analysis and EPSS stands at 0.19%, but the impact is undetected, silent filesystem data corruption on any NFS-exported volume.
TX queue stall in the Linux kernel's Broadcom bnxt network driver causes network transmission to halt on systems running software UDP Segmentation Offload (SW USO). Under burst traffic conditions, the `bnxt_sw_udp_gso_xmit` function can return early with NETDEV_TX_BUSY while leaving `txr->kick_pending` set to 1, meaning the driver has written Buffer Descriptors (BDs) but never rings the device doorbell - so the NIC never processes the queued packets and the completion event that would wake the TX queue never arrives. The stall was confirmed on a production system where a netdev TX watchdog triggered; no public exploit exists and no active exploitation has been identified.
Memory exhaustion DoS in Linux kernel NFSv4 server (nfsd) allows any network-reachable client to force multi-MiB kernel heap allocations per COMPOUND operation. The flaw lies in nfsd4_decode_create(), which accepted an unbounded cr_datalen wire value for NF4LNK symlink targets without validation - allocating up to the full RPC payload size (several MiB) per request before the VFS eventually rejected the target with ENAMETOOLONG. By flooding the server with malformed NFSv4 CREATE operations, an attacker can exhaust kernel memory and cause a denial of service. No public exploit is identified at time of analysis, and EPSS is 0.17% (6th percentile).
Race condition in the Linux kernel NFSD NFSv4.2 server-side copy state management allows any authenticated NFSv4.2 client to crash the NFS server kernel. The cpntf entry is inserted into the IDR (making it immediately addressable by stateid) before its cp_list is initialized in a separate lock section; a concurrent OFFLOAD_CANCEL - using the cnr_stateid echoed to the client - reaches _free_cpntf_state_locked() and calls list_del() on a zeroed list_head, triggering a kernel oops. No public exploit code is known and the issue is not in CISA KEV; patches are available in stable releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1.
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
NULL pointer dereference in the Linux kernel's SCTP stream reconfiguration handler causes a kernel panic (DoS) reachable from the network. Three SCTP processing functions - sctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out(), and sctp_process_strreset_resp() - dereference chunk->transport to stop the reconf timer when completing a stream reset, but a chunk published in asoc->strreset_chunk before transmission has a NULL transport pointer. This yields two distinct attack paths: a local unprivileged process that removes the association's last IP address then requests a stream reset, or a remote peer that crafts a RECONF chunk carrying Incoming SSN Reset, Outgoing SSN Reset, and Response sub-elements in a single packet, triggering the deref in softirq context. No public exploit code has been identified at time of analysis, and EPSS is 0.17%, but the remote network-unauthenticated path warrants prompt patching.
Memory leak (skb leak) in the Linux kernel's NTB (Non-Transparent Bridge) transport subsystem allows an attacker reachable via the ntb_netdev virtual network interface to cause progressive kernel memory exhaustion and denial of service. The bug exists in ntb_process_tx(), which silently "handles" oversized TX buffers by invoking tx_handler() with a NULL data pointer and returning success - causing ntb_netdev to skip both its completion-callback free and its enqueue error path, permanently leaking the socket buffer. No public exploit has been identified at time of analysis; EPSS is 0.17% (6th percentile), indicating very low exploitation probability currently. Upstream patches have been released across multiple stable kernel branches.
Delegation recall permanently stalls in Linux kernel NFSD when the callback queue fails during a lease break. In nfsd_break_one_deleg(), the NFSD4_CALLBACK_RUNNING bit is set atomically to serialize recall work, but if nfsd4_run_cb() cannot queue the workitem, the refcount is decremented while the bit is left set - creating a permanent latch that causes every subsequent break_lease() on the same delegation to silently return early. The result is that the delegation is never recalled and any conflicting NFS open or lock operation stalls indefinitely, constituting a server-side denial of service. No public exploit has been identified and EPSS is 0.17%, consistent with a logic-error DoS requiring a specific failure condition to manifest.
Persistent denial-of-service in the Linux kernel's NFSv4 server grace-period logic allows any reachable NFSv4 client to hold the server in grace indefinitely by sending CLAIM_PREVIOUS OPEN requests. The root cause is a clock-domain mismatch in clients_still_reclaiming(): the deadline is derived from nn->boot_time (CLOCK_REALTIME, ~1.7 billion seconds since epoch) but compared against ktime_get_boottime_seconds() (CLOCK_BOOTTIME, seconds since last boot - orders of magnitude smaller), making the comparison permanently false. As long as any client continues sending CLAIM_PREVIOUS, the grace period never ends, blocking all non-reclaim NFSv4 operations for every other connected client. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17%.
NULL pointer dereference in the Linux kernel's IPv6 RPL source routing header handler (`ipv6_rpl_srh_rcv()`) enables a remote unauthenticated attacker to crash the kernel by delivering IPv6 RPL-header packets during a concurrent MTU-drop event on the receiving interface. The race exists because `idev` obtained from `__in6_dev_get()` is used without a NULL guard - `addrconf_ifdown()` can clear `dev->ip6_ptr` via `RCU_INIT_POINTER()` between the time `ip6_rcv_core()` validates idev and the time `ipv6_rpl_srh_rcv()` dereferences `idev->cnf.rpl_seg_enabled`. No public exploit or CISA KEV listing exists; EPSS is 0.17% (6th percentile), consistent with low current weaponization.
SymSpellModelSerializer in Apache OpenNLP 3.0.0-M4 and 3.0.0-M5 crashes the host JVM with an OutOfMemoryError when deserializing a crafted SymSpell binary model file whose unigramCount or bigramCount field is set to Integer.MAX_VALUE, forcing a 4-8 GB heap allocation attempt. The root cause (CWE-789: Uncontrolled Memory Allocation) is that these two 32-bit count fields are validated only for non-negativity - no upper bound prevents attacker-controlled pre-sizing of a LinkedHashMap before any dictionary entries are consumed. The attack payload is described by the advisory as under 100 bytes, requires no prior authentication if the target application accepts externally supplied model bytes, and is effective against every deserialization code path in the opennlp-spellcheck extension. No public exploit has been identified at time of analysis, and exposure is substantially limited to the small population running pre-release milestone builds.
Denial of service in the RACER swarm-exploration framework (Robotics-STAR-Lab / SYSU STAR Group) lets an attacker who can reach the exploration manager's ROS communication graph drive FastExplorationFSM::optTimerCallback() into an uncontrolled resource-consumption state, stalling or crashing the node and halting multi-robot exploration. The flaw is classified CWE-400 with a CVSS 3.1 base of 7.5 (full availability impact, no confidentiality or integrity impact). No public exploit code or CISA KEV entry was identified in the supplied intelligence, and EPSS is only 0.15% (5th percentile), consistent with the niche academic-robotics deployment of this codebase.
A denial-of-service condition in ZJU-FAST-Lab EGO-Planner-v2 (all versions up to commit 5c99a95880401e2599638d567abc0e240396cb42) is triggered by the interaction between the traj_server and poscmd_2_odom nodes and the EGOReplanFSM emergency recovery logic, causing the planner to become unresponsive. The affected software is an open-source trajectory planner for autonomous quadrotors, so a successful denial of service can translate from a crashed planning process directly into loss of autonomous flight control. There is no confirmed evidence of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.15% (5th percentile), indicating low predicted exploitation activity.
Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.
Uncontrolled resource consumption in jackson-databind's CoreXMLDeserializers allows unauthenticated remote attackers to trigger multi-minute CPU saturation via a single oversized HTTP request. When jackson-databind deserializes a JSON string into a javax.xml.datatype.Duration or XMLGregorianCalendar field, it passes the raw string directly to JDK's DatatypeFactory, which internally calls BigInteger(String) and BigDecimal(String) constructors that exhibit O(n²) time complexity relative to digit count. Because the malicious digits are embedded in a JSON string token rather than a JSON number token, jackson-core's existing StreamReadConstraints.maxNumberLength guard is bypassed entirely. A few megabytes of input containing millions of digits can consume tens of seconds to minutes of CPU, and a handful of concurrent such requests can exhaust a server's worker thread pool. No public exploit or CISA KEV listing has been identified at time of analysis.
Memory exhaustion DoS in the expressjs/compression Node.js middleware (versions before 1.8.2) allows remote unauthenticated attackers to crash any Express server using the package. When a client aborts an HTTP connection while a compressed response is in flight, the zlib transform stream allocated for that response is never destroyed, permanently leaking its native heap memory. An attacker can automate rapid request-then-abort cycles to exhaust all available server memory, causing process termination. The issue is fixed in 1.8.2 per the OpenJS Foundation advisory; no public exploit code or KEV listing has been identified at time of analysis.
Heap-based buffer overflow in the Sofia IPC daemon's WS-Addressing Action transformation function allows remote unauthenticated attackers to crash Xiongmai XM530 IP cameras or potentially achieve arbitrary code execution by sending a crafted SOAP request containing a wsa5:Action string exceeding 128 bytes. Affected firmware is HMT.CM2005-v220608.1837 and all earlier versions. A public vulnerability research repository exists for this CVE, suggesting exploit code or detailed PoC is available. No public exploit identified as confirmed actively exploited at time of analysis.
IRQ resource leak and potential use-after-free in the Linux kernel's NXP PIT (Periodic Interrupt Timer) clocksource driver allows a kernel crash if an interrupt fires after error-path cleanup. The driver's pit_clockevent_init() error path skips free_irq() when cpuhp_setup_state() fails after request_irq() has already succeeded, then proceeds to kfree(pit), leaving the registered IRQ handler's dev_id pointing to freed slab memory. If the IRQ subsequently fires, the handler dereferences the freed pointer, constituting a use-after-free. No public exploit exists and EPSS is 0.15% (5th percentile), consistent with a race-condition bug on niche embedded hardware.
Incorrect memory free (CWE-590) in PCRE2's JIT fast path allows heap corruption when match data previously used with PCRE2_COPY_MATCHED_SUBJECT is reused in a subsequent pcre2_jit_match() call. Affected versions are PCRE2 prior to 10.48. An attacker who can influence the sequence of PCRE2 API calls - for example, by triggering the vulnerable code path through a regex-consuming application - can potentially achieve memory corruption leading to code execution, data disclosure, or crash. No public exploit and no KEV listing have been identified at time of analysis.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
BMC root account activation without a password on Bull BullSequana XH3406 and XH3515 HPC servers enables full out-of-band management compromise following a factory reset or equivalent triggering operation. With a PoC available (CVSS 4.0 E:P) and no privileges required once the vulnerable state exists, an attacker with access to the BMC management interface can achieve complete control over the managed server, including power cycling, firmware manipulation, and console access. No active exploitation is confirmed in CISA KEV at time of analysis.
Use-after-free and double-free conditions in NetBSD's COMPAT_NETBSD32 kernel compatibility layer enable any local low-privilege user to corrupt kernel heap memory or trigger a kernel panic on affected 64-bit systems. The defect in msg_recv_copyin() causes the kernel to execute cleanup deallocation code on the success path - due to a missing return statement - freeing the iovec buffer after it has already been used, then freeing the same allocation again. A vendor patch is available via the GNATS bug tracker, and no public exploit has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Memory corruption in ArduinoBLE's ATT layer write request handler allows an unauthenticated BLE client within Bluetooth range to overflow the ATTClass global object's write buffer by sending a crafted ATT Write Request. Versions prior to 2.0.2 are affected exclusively when at least one BLE characteristic is configured with the BLEEncryption property. No public exploit has been identified at time of analysis, but vendor-released patch version 2.0.2 fully resolves the flaw.
Heap out-of-bounds write in Orthanc DICOM Server allows a low-privileged network attacker to corrupt memory by supplying a malformed PNG image, potentially enabling remote code execution or denial-of-service against medical imaging infrastructure. The root cause is a CWE-190 integer overflow in pitch and buffer-size computation during PNG decoding, reported by CISA ICS-CERT under medical advisory ICSMA-26-253-02. No public exploit code has been identified at this time, but the nature of the flaw (heap corruption via attacker-controlled image data) makes it a credible RCE candidate in clinical environments.
Authenticated SQL injection in NextGen Mirth Connect 4.7.1 and earlier allows a low-privilege API user to execute arbitrary SQL via the unsanitized selectLimit parameter in the Database Connector API (POST /api/connectors/jdbc/_getTables). Against the bundled Apache Derby database, this exports administrator password hashes and channel configuration containing plaintext connector credentials to a web-accessible path retrievable without authentication, and can freeze database-backed operations until server restart. Full end-to-end public exploit code exists and CISA has published advisory ICSMA-26-253-01 covering this and two related XXE vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the same product.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Zip-slip path traversal in an industrial control system application allows authenticated low-privileged users to write arbitrary files to any location accessible by the server process. By crafting a malicious archive with directory-traversal sequences (e.g., '../../') in entry paths and uploading it through the platform's file-upload interface, an attacker can overwrite configuration files or inject fabricated records into stored data. Reported by ICS-CERT under advisory ICSA-26-254-01, this affects operational technology environments where data integrity is safety-critical; no public exploit or KEV listing identified at time of analysis.
Privilege escalation in an ICS API routing component (ICSA-26-254-01) allows a low-privileged authenticated attacker to bypass role-based authorization by manipulating a client-controlled HTTP header that governs authentication-path selection. The routing layer directs requests to one of two authentication backends based on a header the attacker fully controls; by setting that header to invoke the alternate path, the attacker assumes a fixed, elevated role and can perform actions restricted to higher-privileged users. No public exploit is identified at time of analysis; the advisory originates from ICS-CERT, indicating deployment in operational technology environments where unauthorized privileged write access carries operational consequence beyond what CVSS scores alone convey.
Server-Side Request Forgery in Shelf (shelf.nu) asset-tracking platform before v1.20.3 allows authenticated users holding the `asset:import` permission to force the application server to make unrestricted outbound HTTP requests by supplying crafted `imageUrl` values inside a CSV import file. Multiple documented bypass techniques - including image-extension suffixes, redirect chains, and domain substring matching - allow the weak URL validation to be circumvented, after which the server executes an unguarded `fetch()` call. Attackers can reach cloud instance metadata endpoints (e.g., AWS IMDS) to steal IAM credentials, probe internal network services, or trigger memory exhaustion by causing the server to buffer arbitrarily large responses before size checks apply. Vendor-released patch v1.20.3 addresses the issue; no public exploit code identified at time of analysis.
Out-of-bounds read and write in the Linux kernel's forcedeth NVIDIA ethernet driver triggers on every S3 suspend/resume cycle due to an off-by-one loop terminator in nv_suspend() and nv_resume(). The loop runs one iteration past the end of the saved_config_space[] array, overwriting adjacent kernel memory (np->name_rx[]) and issuing a stray MMIO write one dword beyond the ioremap'd hardware window; with CONFIG_UBSAN_TRAP=y the kernel aborts during the suspend path. The bug has existed since Linux 2.6.27 but was only surfaced by UBSAN on Apple Macmini3,1 (MCP79) hardware during S3 cycling. No public exploit has been identified at time of analysis.
Integrity bypass in an industrial OT product's read-only deployment mode allows a low-privileged authenticated user to forge or overwrite stored records that the deployment mode is expressly designed to protect from modification. The vulnerability arises because the read-only mode's API proxy layer forwards HTTP requests to backend routes without enforcing HTTP method restrictions, enabling write operations to be carried out using the application's own elevated service-account credentials. No public exploit code has been identified and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, but the ICS/OT context elevates operational risk if exploited to tamper with process historian or audit data.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Out-of-bounds read in the Linux kernel's Intel Speed Select Technology (ISST) platform driver allows a local low-privileged user to disclose sensitive kernel memory or crash the system via malformed ioctl input. The functions isst_if_get_perf_level_mask() and isst_if_get_base_freq_mask() accept a user-controlled level value and pass it as an array index into perf_levels[] without validating it against max_level bounds, unlike adjacent helper functions that perform this check. No public exploit is identified at time of analysis, and patches have been released for stable kernel branches 6.12.109, 6.18.50, and 7.2.4.
Out-of-bounds MMIO reads in the Linux kernel CXL RAS driver expose kernel memory contents and can crash the system on hosts equipped with CXL RCH hardware. The cxl_rch_get_aer_info() function bounds its readl() loop by the size of a software struct (struct aer_capability_regs) that has grown beyond the fixed physical on-wire AER register block due to expansions in struct pcie_tlp_log; reading past the MMIO mapping then populates header_log.header_len with garbage, triggering a second OOB read inside pcie_print_tlp_log(). No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), consistent with the niche hardware prerequisite.
Missing ownership verification in AVideo's addLiveLink.php enables any authenticated canStream user to hijack another user's LiveLink by supplying a known linkId in an update request, overwriting the victim's HLS source URL and stream metadata without authorization. The flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 and allows an attacker to silently redirect the victim's viewers to attacker-controlled media. No public exploit has been identified at time of analysis, but the low privilege bar - only a canStream account is required - makes this a realistic threat on shared multi-user AVideo deployments.