2026-09-16
IPv6 IPsec receive processing in the Linux kernel writes one element past the end of the six-slot xfrm_state pointer array in xfrm6_input_addr(), because the depth guard tests '1 + sp->len == XFRM_MAX_DEPTH' instead of '>=', so a secpath already stacked to XFRM_MAX_DEPTH by xfrm_input() and preserved across xfrm_trans_reinject() bypasses the check and stores into sp->xvec[sp->len++]. The attacker must control an inner packet carrying a Mobile IPv6 destination-options Home Address option or a type-2 routing header, and because the write stays inside the larger sec_path allocation it is invisible to KASAN - it is only flagged by UBSAN_BOUNDS and only fatal when the non-default panic_on_warn sysctl is enabled, otherwise it is a logged warning with no functional effect. This means the input CVSS 3.1 vector of 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is the generic maximal score auto-assigned to Linux kernel CVEs and is not credible for this bug: the authoritative independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.9, availability-only, high attack complexity), since exploitation requires IPsec transport mode with six nested SA transforms, a Mobile IPv6 header, and a UBSAN_BOUNDS kernel with panic_on_warn enabled. Exploitation status: no public exploit identified at time of analysis; EPSS is only 0.21% (11th percentile) and the flaw is not listed in CISA KEV, consistent with the layered prerequisites. Authentication requirements: unauthenticated remote attackers (CVSS vector contains PR:N).
A use-after-free in the Linux kernel's in-kernel ksmbd SMB3 server allows an authenticated attacker with an established SMB2 session to race an SMB2 TREE_CONNECT request against a concurrent session LOGOFF, so the tree-connection object is freed while smb2_tree_connect() is still initializing it and building the response. Successful triggering yields memory corruption in kernel context that can be leveraged for both confidentiality and integrity impact (KASAN reports slab-use-after-free at fs/smb/server/smb2pdu.c:2872). The CVE carries a 9.8 base score from the kernel CNA, but the assessed vector is AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that exploitation requires a valid session and precise timing; EPSS is low (0.19%, 9th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Unauthenticated remote code execution affects Check Point Quantum Security Management, where a stack-based buffer overflow is reachable through the login process before authentication completes. Because the flaw is triggered during the pre-authentication login path, a remote attacker with network reachability to the management server's login/administration service needs no credentials, no user interaction, and no non-default configuration, and the resulting code execution is described as running with root privileges - consistent with the CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not listed in CISA KEV), but the pre-auth, root-level impact and the criticality of the management plane make this a top-priority patch target; CPE data lists the product with a wildcard version, indicating the affected version range is not bounded in the available feed data.
Concurrent NVMe-FC I/O submission in the Linux kernel's qla2xxx QLogic Fibre Channel driver can corrupt the hardware request-ring producer state, producing duplicated or dropped commands. The defect affects hosts running the qla2xxx driver with a QLogic FC HBA configured for NVMe-over-FC that uses ha->base_qpair; qla_nvme_ls_reject_iocb() advances the ring and rings the request-in doorbell via __qla2x00_alloc_iocbs() and qla2x00_start_iocbs() (both of which assume hardware_lock is held) but two of its callers, qla_nvme_xmt_ls_rsp() and qla2xxx_process_purls_pkt(), invoke it without holding qp_lock_ptr. Our independent assessment rates this as a local, race-window-dependent integrity/availability issue (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L), materially lower than the vendor's NVD score of 9.8, because the reject events are driven by Fibre Channel fabric/transport conditions rather than attacker-supplied input and require precise concurrency with normal base-ring submission; there is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
A double-completion race in the Linux kernel's qla2xxx QLogic Fibre Channel driver can cause a use-after-free write into a freed on-stack completion structure, leading to kernel memory corruption, a kernel crash, or potential local privilege escalation. Only hosts with a QLogic FC HBA and the qla2xxx driver loaded are affected, and the fault requires qla24xx_async_abort_cmd() to fail while the response ISR completes the same SRB handle at almost the same instant the async IOCB timeout handler re-scans outstanding_cmds[], so the attacker must win a very narrow concurrency window - local access only and no network reachability. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); vendor patches are available in the stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and the NVD score of 9.8 (AV:N/AC:L/PR:N) should not drive prioritization given the assessed vector of AV:L/AC:H/PR:L/UI:N.
Root-level remote code execution affects Pepperl+Fuchs ICE2/ICE3-series and Phoenix Contact IOL-MA8 IO-Link master gateways, where an unauthenticated attacker uploads a crafted IODD (IO Device Description) file that drops and executes an arbitrary shell script as root. The injected script survives reboot, granting persistent full control of the industrial device. No public exploit is identified at time of analysis and the CVE is not in CISA KEV, but the CVSS 9.8 rating reflects trivial network reachability and complete device compromise.
Authentication bypass in Pepperl+Fuchs ICE2/ICE3-series IO-Link masters (and OEM-equivalent Phoenix Contact IOL-MA8 modules) lets a remote unauthenticated attacker reach the _account_log function and authenticate as administrator, even on devices where accounts are correctly provisioned. The flaw grants full administrative control of the device management interface with no credentials. Reported by CERT@VDE; no public exploit code and no active-exploitation evidence are present in the available data, though the CVSS 9.8 rating reflects trivial exploitability.
Unauthenticated privilege escalation in JetFormBuilder - Dynamic Blocks Form Builder plugin for WordPress (versions up to and including 3.6.2) allows remote attackers to create administrator-level user accounts on affected sites. The flaw stems from missing validation that a submitted form ID belongs to a JetFormBuilder form before parsing the referenced post's content as form schema and executing an Advanced Validation server-side callback, enabling arbitrary user creation with maximum privileges. No public exploit code has been identified at time of analysis, but the CVSS 9.8 critical rating and lack of authentication or user interaction make this a top-priority risk for any site running the vulnerable plugin.
The TrueBooker - Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the email address of arbitrary user accounts, including administrators, which can be leveraged to reset the account's password and gain access to it.
Unauthenticated remote code execution affects Arista EOS platforms on which the non-default P4Runtime service has been explicitly enabled, letting an attacker who can reach that service take complete administrative control of the switch. The defect is a code-injection flaw (CWE-94) triggered by a crafted packet during P4Runtime session initiation, rated 9.5 Critical under CVSS 4.0 and assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with high attack complexity and a changed scope because compromise of the switching platform can extend to subsequent systems. Exposure is limited: P4Runtime is disabled by default, so stock EOS deployments are not at risk, and successful exploitation also depends on a specific timing/condition requirement (AT:P, 'Attack Requirements: Present'); Arista discovered the issue internally, reports no malicious exploitation in customer networks, and no public exploit code has been identified at time of analysis.
SAML single sign-on handling in Delinea Secret Server (On-Prem) 10.5.0 through 12.1.3 allows an unauthenticated remote attacker to impersonate another Secret Server user by presenting a valid SAML IdP response under certain conditions, giving high confidentiality and integrity impact to the impersonated account and to connected components (CVSS 4.0 base 9.5; assessed as CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). No pre-existing Secret Server credentials and no victim interaction are required, but the vulnerability only affects deployments actually configured to use SAML-based SSO, and exploitation hinges on unspecified preconditions in the SAML assertion-handling path (reflected as AC:H/AT:P), so the raw 9.5 score overstates how easily the flaw can be triggered. There is no CISA KEV listing and no public exploit identified at time of analysis; environments using local or AD-backed authentication and versions later than 12.1.3 are not affected per the assessed exploitation conditions.
Authenticated gRPC users on Arista EOS devices that have AAA-based gRPC authorization enabled for OpenConfig can have their requests evaluated at the wrong privilege level and matched against the wrong AAA method list, granting read and configuration-write access they should not hold. The flaw (CWE-266, incorrect privilege assignment) is confined to the gRPC OpenConfig path; Arista explicitly states that non-gRPC OpenConfig requests such as NETCONF are not affected, and the vulnerable configuration is not a default state. A vendor patch is available via Arista Security Advisory 0163, and no public exploit code has been identified at time of analysis; the supplied CVSS 4.0 score of 9.4 should be treated with caution, as it reflects an authorization mismatch on a management interface that requires an already-authenticated user (CVSS vector PR:H) plus a non-default AAA configuration rather than an unauthenticated, scope-changing compromise.
RabbitMQ's amqp091-go Go client library, in all versions before 1.13.0, builds TLS configuration from amqps:// URIs without setting a minimum protocol version, so builds that use a Go runtime permitting TLS 1.0 or 1.1 can negotiate an obsolete protocol. An active man-in-the-middle positioned on the network path could then force a downgrade and weaken the confidentiality and integrity of AMQP traffic, including credentials, though the independently assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N) shows this requires a high degree of attacker positioning plus the legacy-toolchain precondition, and the published 9.4 CVSS 4.0 score overstates real-world exposure for modern deployments. The fix is a two-line MinVersion change shipped in version 1.13.0; no public exploit identified at time of analysis.
Unauthenticated OS command injection in the WNC T-Mobile 5G Box IDU router (firmware below 1.1.0.651412) lets an attacker on the adjacent network run arbitrary shell commands as root through a crafted cli_cookie parameter POSTed to /cgi-bin/portal.cgi. Because the affected parameter is concatenated straight into a shell 'find' command with no sanitization, successful exploitation yields full root-level control of the device - high confidentiality, integrity, and availability impact - and the CVSS 4.0 score of 9.4 reflects that severity. The decisive limiting factor is reachability: the vector is AV:A (adjacent), so the attacker must already sit on the LAN/Wi-Fi side or the same L2 segment unless the management interface is exposed to the WAN. There is no CISA KEV entry and no public exploit code identified at time of analysis, but a vendor patch exists, and CERT-PL is credited with reporting the issue.
Command injection in Arista EOS-based products lets an authenticated user of the gRPC Network Security Interface (gNSI) Certz service escalate privileges and run arbitrary OS commands as root by sending a crafted Certz Rotate request, resulting in full device compromise; the Bootz service is affected by the same flaw. The issue is a CWE-78 OS command injection reported by Arista and carries a CVSS 4.0 base score of 9.4. There is no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated OS command injection in the edgserver management service of Advantech EKI-1242EIMS and EKI-1242IEIMS gateways running firmware V1.06.01 lets remote attackers execute arbitrary operating-system commands with root privileges via crafted requests sent to TCP port 5058. No credentials or user interaction are required (CVSS 4.0 vector PR:N/UI:N, provider score 9.3; our independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity and availability impact), and default configurations are affected. Exploitation is gated only by network reachability to the management port - there is no public exploit identified at time of analysis and the CVE is not in CISA KEV, but the issue is a genuine high-priority risk on any deployment where port 5058 is exposed beyond a trusted management segment.
OS command injection in the WNC T-Mobile 5G Box IDU router's portal.cgi password-change function allows an attacker who already holds high-privilege portal credentials and is positioned on the adjacent network to run arbitrary operating-system commands as root, yielding full device compromise (CVSS 4.0 base 9.3). The root cause is improper neutralization of shell metacharacters in the http_passwd_hidden and http_passwdConfirm_hidden parameters, so a crafted password-change request is interpreted by the underlying shell rather than treated as inert input. Only firmware below 1.1.0.651412 is affected and the issue is fixed in 1.1.0.651412; exploitation is constrained by AV:A (LAN/Wi-Fi-side reachability, not the public internet) and PR:H (valid admin credentials required first), and no public exploit identified at time of analysis.
Authenticated OS command injection in the WNC T-Mobile 5G Box IDU router's web management portal lets an admin-level attacker on the adjacent network run arbitrary shell commands as root. The flaw (CWE-78) sits in the ping diagnostic feature of /cgi-bin/portal.cgi, where the ping_ip, ping_size, and ping_times POST parameters are concatenated into a system command without validation or sanitization; no user interaction is required once credentials are held. All firmware versions below 1.1.0.651412 are affected, and exploitation is constrained by two prerequisites - network reachability to the portal (AV:A, adjacent/local rather than internet-facing) and valid high-privilege (PR:H) portal access - so the practical risk, despite the 9.3 CVSS 4.0 base score, is bounded by the fact that the attacker must already be an authenticated admin on the local network segment. No public exploit code has been identified and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis; CVE-2026-40855 was reported by CERT-PL and a vendor patch exists.
Address-rollover bug in the Linux kernel's KVM/arm64 TLB-by-VA invalidation path causes the hypervisor to silently skip an invalidation when the range ends at the last page or block of the TTBR1 VA space, because the exclusive end computation (base + size) wraps to zero. The faulty logic was introduced in Linux 6.16 and is fixed in 6.18.51, 7.2.5 and 7.3-rc1; hosts running unpatched kernels are exposed where a guest vCPU can drive trapped TLB-by-VA invalidations, while the IPA-invalidation path never suffered the rollover. The assessed vector is local (AV:L) with low privileges (PR:L) and high attack complexity (AC:H) because of the narrow address-layout precondition, with scope change and high availability impact; no public exploit code and no confirmed active exploitation (no CISA KEV entry) have been identified, and the provided reference CVSS of 9.3 overstates the practical risk relative to that assessment.
Race conditions in the arm64 KVM path that invalidates VNCR translations can leave a stale stage-1 TLB entry installed for a page-table mapping that another vCPU has just invalidated, so a guest can keep using a translation the host believes is gone, corrupting host state and potentially crashing the host. The flaw only affects arm64 hosts running KVM with nested virtualization (FEAT_NV2 / VNCR fixmap) enabled where an attacker already controls a guest with at least two concurrently executing vCPUs, and exploitation hinges on winning a narrow race window between invalidate_vncr_va() on one vCPU and a VNCR translation fault-in on another (one vCPU rewriting S1 page tables and issuing TLBI S1E2 while the other is mid-walk). Because the path is local-only and nested virtualization on arm64 is rarely deployed, the independent assessment rates the issue well below the vendor's CVSS 9.3 (assessed AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:H - high availability impact, low integrity impact, no confidentiality impact); no public exploit identified at time of analysis, and vendor patches are available in Linux 7.2.5, 6.18.51 and 7.3-rc1.
Missed TLB invalidations in the arm64 KVM nested-virtualization path of the Linux kernel can leave stale translations for an L1-supplied VNCR page in L0, allowing a guest with control of an L1 vCPU on an arm64 host to cross the guest-to-host boundary in a timing-sensitive way. Affected systems are those running kernel 6.16 or later with arm64 nested virtualization (FEAT_NV2 / VNCR page support) enabled and exposed to a guest; the flaw is a guest-to-host (L1-to-L0) issue, so exploitation requires guest-vCPU privileges and is local to the host, which contradicts the vendor's PR:N vector. Vendor-released patches exist in Linux 6.18.52, 7.2.5, and 7.3-rc1, and no public exploit code has been identified at time of analysis; the vendor's CVSS of 9.3 substantially overstates real-world risk given that nested virtualization is off by default and deployed on only a small subset of arm64 KVM hosts, and the missed-invalidation window is opportunistic and mapping-state dependent rather than deterministic.
Range-based TLB invalidation in the arm64 KVM hypervisor of the Linux kernel is computed against the wrong address range because the decode_range_tlbi() helper omitted the required virtual-address sign-extension when it was reused for stage-1 TLBI handling, and the same helper can overflow physical-address bits when invoked for stage-2 invalidation. Only arm64 hosts running KVM are affected, and the attacker must already control a guest VM/vCPU able to issue range-based TLBI operations (low-privilege guest context, no user interaction, no network reachability); kernels from the 6.16 introduction through the fixes in 6.18.51, 7.2.5 and 7.3-rc1 are in scope. Exploitation results in stale or incorrectly scoped TLB entries on the host, with the assessed impact being availability loss (A:H) plus limited integrity impact (I:L) and no confidentiality impact; no public exploit identified at time of analysis.
Reflected cross-site scripting in Delinea Secret Server (On-Prem) versions 10.2.19 through 11.9.48 allows an attacker to craft a malicious link that, when clicked by a legitimate Secret Server user, causes the browser to execute attacker-supplied JavaScript in the context of the Secret Server web application. The attacker requires no authentication (PR:N per the CVSS 4.0 vector), but exploitation is not self-contained: a human victim must be lured into clicking the link (UI:A), and the practical impact scales with the victim's privileges - a privileged vault user's session and access could be abused to read or modify secrets, producing high confidentiality and integrity impact on both the vulnerable system and subsequent systems (VC:H/VI:H, SC:H/SI:H, S:C). CVSS 4.0 base score is 9.3 (Critical) and the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N; no public exploit code and no confirmed active exploitation were identified at time of analysis, and note that only on-premises deployments in the stated version range are affected - SaaS/cloud instances are not listed as affected.
A crafted DNSKEY whose owner name is a compression pointer into its own RDATA overflows the digest buffer in the DNSSEC validator of NLnet Labs Unbound 1.26.0 and earlier, letting an attacker who controls an authoritative zone crash a validating recursive resolver and, depending on heap layout, potentially execute code with attacker-influenced data. Exploitation is unauthenticated over the network per the CVSS vectors but is gated on DNSSEC validation being active and on inducing the resolver to query a name in the attacker's zone; the independently assessed impact is primarily denial of service (availability High, confidentiality and integrity Low), with remote code execution only possible rather than demonstrated. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, although the vendor rates the issue 9.1 under CVSS 4.0 and an advisory has been published.
Out-of-bounds heap reads in the Linux kernel's ext4 inline-directory code (ext4_read_inline_dir()) let a local actor who can present a crafted inline-data ext4 directory - by creating one on a writable ext4 volume with the inline_data feature enabled, or by mounting a malicious ext4 image (e.g. via removable-media automount) - leak kernel heap memory and crash the kernel through an ordinary getdents64()/iterate_dir() call. The kernel emits a KASAN slab-out-of-bounds report in __ext4_check_dir_entry when the size-2 rec_len probe is dereferenced past the end of the kmalloc(inline_size) buffer. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is 0.21% (11th percentile), indicating low predicted exploitation activity; the supplied CVSS of 9.1 (AV:N/PR:N) is inconsistent with the flaw's local-only reachability and should be treated as mis-scored, with the assessed vector being AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H (High).
IP spoofing in @fastify/proxy-addr 3.0.0 through 5.1.0 allows any unauthenticated remote client to control the client address an application believes it received, defeating IP-based access control, rate limiting, geolocation, and audit logging. The flaw is triggered only under a specific operator misconfiguration: a trusted-proxy subnet expressed in IPv4-mapped IPv6 notation with an IPv4-sized prefix (for example ::ffff:10.0.0.0/8) is silently accepted but expands to trust every IPv4 address, making the socket peer trusted at hop 0 so an attacker-supplied X-Forwarded-For header is honored. Vendor CVSS is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), and no public exploit code or confirmed active exploitation was identified at time of analysis; severity in practice is bounded by the misconfiguration precondition, and the issue is fixed in 5.1.1.
Silent AMQP 0.9.1 metadata corruption in the RabbitMQ amqp091-go Go client library prior to 1.13.0 lets an application that assigns an oversized value to any shortstr message property (CorrelationId, ReplyTo, MessageId, Expiration, UserId, AppId, ContentType, ContentEncoding, or Type) serialize a wrapped uint8 length prefix alongside only a truncated value while reporting no error. The result is broken request/reply correlation, routing, tracing, and downstream message processing rather than code execution or disclosure; the flaw requires attacker-influenced data to reach a shortstr property, so applications that only set short, trusted, fixed-length values are not practically exposed. No public exploit code or confirmed active exploitation was identified at time of analysis, and version 1.13.0 contains the vendor fix (CVSS 4.0 base 9.1; our independent assessment scores this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, reflecting no privileges required but a high attack-complexity precondition).
An out-of-bounds read in the Linux kernel's qla2xxx Fibre Channel host bus adapter driver (qla2x00_status_entry()) allows a hostile, compromised, or malfunctioning FC storage target to leak adjacent response-ring or heap memory into the local SCSI sense buffer of a host using a QLogic 24xx/29xx-class HBA. The bug is an unsigned integer underflow: the target-supplied 32-bit sf.rsp_data_len (rsp_info_len) is subtracted from the IOCB data-area size (par_sense_len, 28 bytes on 24xx and 60 bytes on 29xx) without a clamp, so oversized values wrap par_sense_len to a huge number and advance sense_data past its bounds before the capped memcpy in qla2x00_handle_sense(). Vendor-released patches are available in stable branches 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.51, 7.2.5 and 7.3-rc1, and no public exploit has been identified at time of analysis; the vendor CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/I:N/A:H) substantially overstates real-world risk, since the attacker must already occupy a trusted target role on the Fibre Channel fabric and the disclosed memory is bounded to at most SCSI_SENSE_BUFFERSIZE of local ring/heap data.
An unauthenticated user with access to Secret Server could leverage a padding oracle to decrypt or encrypt data using one of the server's cryptographic keys. The key itself is not exposed.