Login CSRF through partial-pipeline session fixation in the social-core library of Python Social Auth before 5.0.0 allows an unauthenticated remote attacker (PR:N) to seed an authentication flow, harvest the resulting partial_token and verification data, and then induce a victim's browser to resume that attacker-controlled flow so the victim ends up authenticated as the attacker's account. Only applications that use resumable partial pipeline steps - such as the built-in mail_validation step or custom steps decorated with @partial - are exposed; success additionally requires victim interaction (UI:R) and reliable delivery of the attacker's token into the victim's browser, which is why the high attack complexity keeps the CVSS 3.1 base score at 4.2. The impact is limited to authenticating the victim as the attacker (a login-CSRF/session-fixation outcome) rather than taking over the victim's own account, and no public exploit has been identified at time of analysis.
Out-of-bounds read and unbounded iteration in the Linux kernel's NVMe driver allow a local attacker who controls or emulates an NVMe device advertising Flexible Data Placement (FDP) to crash the kernel and potentially disclose adjacent memory contents. Only kernels before 6.18.53 and the 7.x line before 7.2 are affected, and exploitation is not reachable purely over a network: per the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H the attacker needs an authenticated local foothold (PR:L) plus a malicious, tampered or emulated NVMe controller, so the published CVSS 8.2 (AV:N/AC:L/PR:N) overstates both reachability and required complexity. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Stored cross-site scripting in phpMyFAQ versions prior to 4.2.0-alpha allows unauthenticated remote attackers, as well as low-privileged registered users, to plant arbitrary JavaScript in user-submitted FAQ entries that executes in an administrator's browser when the entry is reviewed or edited, enabling admin session theft and full account takeover. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, 8.2 High) reflects that no authentication is needed to submit the payload, but exploitation succeeds only when an administrator later interacts with the attacker-controlled content; the scope change indicates the compromise crosses from the unauthenticated submitter into the privileged admin session. No public exploit code was identified at time of analysis and CISA KEV does not list this CVE, though the default community-submission workflow in affected releases makes the attack path straightforward once a target is identified.
Failed connection acceptance in the Linux kernel's svcrdma transport (server-side NFS-over-RDMA) can corrupt reference-count and XArray registration state, leaking transport memory and mismatched device references. The bug is reachable only on hosts running the kernel NFS server over an RDMA fabric (InfiniBand or RoCE) where svc_rdma_accept() takes its error path before rpcrdma_rn_register() succeeds, and no public exploit has been identified at time of analysis. The assessed impact is primarily availability (repeated failed accepts leak svcxprt_rdma and its net/ns_tracker, leading to memory exhaustion) with a limited integrity effect from an erroneous erase of another caller's slot-0 entry; the CVSS vector carries PR:N, so no authentication is required, but attacks must originate from the adjacent RDMA fabric.
Unauthenticated attackers can bypass TOTP-based two-factor authentication in phpMyFAQ 3.2.0 through 4.1.5 and take over any 2FA-enabled account, including administrator accounts, by submitting a victim's numeric user ID together with a valid or brute-forced six-digit code to the public 2FA verification flow in index.php without ever supplying the account password. The flaw rates CVSS 3.1 base 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H); the high attack complexity reflects the cost of guessing a TOTP code inside its rolling validity window, while the practical enabler pre-patch is the complete absence of any failed-attempt limit and the fact that token verification was never bound to a prior password-authenticated session. There is no public exploit identified at time of analysis and no CISA KEV listing, but exploitation requires only that the targeted account have 2FA enabled, making the exposure significant for deployments that adopted TOTP. Vendor-released patch: 4.1.6.
An out-of-bounds slab read in the Linux kernel's SMB/CIFS client allows an attacker-controlled SMB1 server to make a victim's kernel read past the end of a kmalloc'd response buffer when that victim lists a directory on a mounted share. cifs_filldir() trusts the server-supplied de.namelen field from a TRANS2_FIND_FIRST/FIND_NEXT response without verifying that the name stays inside the response buffer, so an oversized FileNameLength drives memchr() (via filldir64()/verify_dirent_name()) beyond the allocation and produces a KASAN slab-out-of-bounds report; CVSS 3.1 is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H), with high confidentiality and availability impact from the out-of-bounds read. Exploitation requires the victim to mount a share from a hostile server using the deprecated SMB1 dialect and then browse it, so user interaction is required; no public exploit identified at time of analysis.
Permission widening in the Linux kernel's ksmbd in-kernel SMB3 server allows an authenticated SMB session holder to create files and directories whose inherited POSIX ACLs are recomputed incorrectly, discarding restrictive ACL_MASK entries that the parent directory's default ACL was intended to enforce, so newly created objects can end up more permissive than the parent's policy allows. The bug affects the ksmbd code shipped in Linux kernels before 6.18.53 and before 6.12.111, and in practice only matters where an SMB share exports a parent directory with a restrictive default POSIX ACL; userspace Samba deployments are unaffected. Vendor-released patches exist (6.18.53, 6.12.111 and 7.2) and no public exploit code has been identified at time of analysis.
A race condition in the Linux kernel's in-kernel NFS server (nfsd) allows two concurrent callers of nfsd4_end_grace() to both see the non-atomic grace_ended boolean as unset during the NFSv4 grace period following server (re)start, causing both to run the grace-done drain of reclaim_str_hashtbl and corrupt the list with double-frees and use-after-free reads. The defect dates to Linux 5.2 and is resolved by vendor-released patches in Linux 7.2.4 and 7.3-rc1; no public exploit code has been identified at time of analysis, and there is no KEV entry or EPSS data indicating active exploitation. Exploitation realistically requires a permitted NFSv4 client of an export and winning a tight, attacker-uncontrolled timing race between the laundromat kworker and a RECLAIM_COMPLETE compound, so the published CVSS 8.1 vector overstates real-world risk; the assessed vector is AC:H/PR:L with limited confidentiality and integrity impact and high availability impact, and hosts that do not run nfsd are unaffected.
Path traversal in the pulpcore content upload API allows an authenticated user holding only low-privilege file-repository permissions to read arbitrary files accessible to the Pulp server process by submitting a crafted 'file:' URL through the 'file_url' parameter, which is dispatched to the file downloader despite an intended scheme check. Baseline impact is confidentiality loss on the Pulp host; in deployments that include Pulp Container the same flaw escalates to theft of the container registry token signing private key, enabling forged bearer tokens and unauthorized access to every private container repository in the registry. Downstream products embedding pulpcore are affected, including Red Hat Satellite 6, Red Hat Ansible Automation Platform 2, and Red Hat Update Infrastructure 4/5. There is no public exploit identified at time of analysis, and EPSS data was not provided; Red Hat tracks the issue under advisory https://access.redhat.com/security/cve/CVE-2026-90959.
Improper access-mask computation in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client obtain file access rights that the stored DACL never granted to it, and can also wrongly deny access that should have been permitted. The maximal-access calculation folds in masks from every ACE in the ACL regardless of whether the ACE's SID applies to the caller, so a client issuing a MAXIMUM_ALLOWED request against a share whose files carry ACEs for other principals can be granted rights belonging to an unrelated user, yielding high confidentiality and integrity impact (CVSS 3.1 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N); SIM, treating an Authenticated Users (S-1-5-11) ACE inconsistently also causes spurious STATUS_ACCESS_DENIED errors. Exploitation requires ksmbd to be running with an exported share and a valid authenticated SMB session; no public exploit code has been identified at time of analysis, and vendor-released fixes ship in Linux 7.2.6 (and 7.3-rc1).
Improper authorization in Dell Rugged Control Center (RCC) builds prior to 5.2.206 allows a low-privileged local user to escalate privileges on an affected rugged Dell endpoint. The vendor rates this CVSS 8.1 with a local attack vector, low privileges required, scope change, and high integrity and availability impact (AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H), meaning an attacker or malware must already hold a foothold on the specific rugged device - it is not remotely or unauthenticated exploitable. No public exploit code or confirmed active exploitation was identified at time of analysis, and Dell has released a fixed build (5.2.206) via advisory DSA-2026-410.
Server-side request forgery in TREK before 3.3.0 allows an authenticated user (CVSS PR:L) to persist an attacker-controlled llm_base_url through the settings API whenever the LLM_PARSING feature is enabled, and that stored URL is later fetched by the server with no SSRF guard. Reaching the vulnerable path additionally requires write permission on the target trip instance, after which the server can be pointed at internal services or link-local cloud metadata endpoints (for example 169.254.169.254), with upstream error text reflected back in parsing warnings, creating a credible path to infrastructure credential disclosure and, per the vendor's assessment, modification of protected cloud resources. No public exploit code has been identified at time of analysis, and independent assessment rates the impact as high confidentiality but only low integrity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N), so exploitation is bounded by feature configuration, trip permissions, and network egress controls.
API serializers in authentik return stored credentials to any authenticated account that holds only VIEW permission on an affected configuration, exposing secrets the account was never authorized to read. Affected configurations include one-time-code delivery by mail or SMS, Google Workspace and Microsoft Entra outbound provisioning targets, endpoint (GDTC) device-trust stages, identity sources, the Kubernetes outpost service connection (kubeconfig), OAuth2 applications using a client or shared secret, and applications using a proxy provider; the flaw is fixed in 2026.2.7, 2026.5.7, and 2026.8.2. Exploitation requires an authenticated account (CVSS PR:L) that has been granted view - but not change - permission on one of those objects, so deployments where every viewer is already entitled to read those secrets are not affected; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Unauthenticated attackers within WiFi range of a Botslab G980H dash camera can derive its default WiFi password from predictable device information - portions of which the camera itself advertises - and use limited guessing to obtain the remaining characters, gaining unauthorized access to the camera's own wireless network. Exploitation requires physical proximity and is only feasible while the factory default WiFi password remains unchanged, so this is a moderate, geographically constrained risk rather than an internet-facing one. No public exploit code or confirmed active exploitation has been identified at time of analysis, and mitigation is trivial where the operator has already set a custom WiFi password.
WiFi credential exposure affects Botslab G980H dash cameras, whose firmware encrypts the credentials the device communicates using a hard-coded cryptographic key and initialization vector (CWE-321). An attacker who is within adjacent wireless range of the camera, captures the protected credential, and then extracts the key and IV from a firmware image can recover the WiFi password and join the camera's network; no authentication or user interaction is required, though the combination of credential interception and firmware reverse-engineering makes practical exploitation difficult (CVSS 4.0 base 6.0; assessed as AV:A/AC:H/PR:N/UI:N with high confidentiality impact only). Impact is confined to disclosure of the WiFi passphrase and access to the device's own network, with no direct integrity or availability effect on the camera, and no public exploit identified at time of analysis; CISA's ICS-CERT published the finding as ICSA-26-267-01, so deployers of this IoT camera should treat the risk as LOW-to-MODERATE and localized rather than broadly exploitable.
Command injection in rpm enables an attacker to run arbitrary shell commands as the invoking user when a victim installs, rebuilds, or otherwise processes a malicious source RPM (.src.rpm) that contains a %() macro construct in a source or spec file basename. The flaw is local and requires user interaction, with impact confined to the privileges of the user running rpm or rpmbuild, typically non-root; build farms and CI/CD pipelines that automatically handle untrusted SRPMs are the highest-risk targets. Red Hat CPEs list RHEL 6 through 10 and Red Hat Hardened Images, and no public exploit was identified in the provided intelligence; monitor the vendor advisory for exploitation and patch updates.
Page-table corruption can be triggered on LoongArch Linux kernels when the architecture fails to define DIRECT_MAP_PHYSMEM_END, causing get_free_mem_region() and mhp_get_pluggable_range() to fall back to the generic mm.h constant (1ULL << MAX_PHYSMEM_BITS) - 1 instead of the CPU's actual vmemmap-covered range. On LoongArch CPUs whose probed physical address bits (cpu_pabits from CPUCFG1) are fewer than MAX_PHYSMEM_BITS - notably the Loongson-2K series - a ZONE_DEVICE region can be allocated outside the vmemmap window, and vmemmap_populate() then wraps the memmap range around into low memory, silently corrupting page tables. The bug is local (CVSS vector PR:L), requires specific hardware plus CONFIG_SPARSEMEM_VMEMMAP and the ZONE_DEVICE/device-memory or amdkfd code path, and our independent assessment rates it AC:H with only C:L (versus the auto-generated 7.8 score with AC:L/C:H); no public exploit code or CISA KEV entry was identified at time of analysis.
A use-after-free in the Linux kernel's VXLAN multicast database (MDB) handling allows a local attacker who holds CAP_NET_ADMIN (including within a user namespace) to corrupt kernel memory by manipulating VXLAN MDB entries and then triggering a flush. The bug lives in vxlan_mdb_flush(), which iterates the MDB hash list with hlist_for_each_entry_safe() under the false assumption that only the current entry can be removed; flushing the remotes of a (*, G) entry actually cascades into removal of the associated (S, G) entries, one of which may be the saved next-pointer, producing a double hlist_del() that writes LIST_POISON1 into LIST_POISON2 and yields attacker-influenced memory corruption (KASAN reported wild-memory-access). Per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) the impact is high for confidentiality, integrity and availability, but exploitation requires local privileges, CAP_NET_ADMIN, and a non-default VXLAN MDB configuration; there is no remote or unauthenticated path. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (not in CISA KEV); vendor-released patches exist for the affected stable branches.
A use-after-free in the Linux kernel's MD RAID5 Partial Parity Log (PPL) implementation lets a local attacker holding low privileges on a host that runs a PPL-enabled RAID5 array corrupt kernel memory, with the assessed impact being full loss of confidentiality, integrity and availability (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a plausible path to kernel code execution or privilege escalation to root. The bug lives in ppl_do_flush(), whose loop keeps iterating over io->pending_flushes after ppl_io_unit_finished() has already freed the io unit; the fix is a single break statement that terminates the loop once the unit is released. Vendor patches are available across the affected stable branches, and no public exploit code was identified at time of analysis; exploitation is gated on reaching the PPL flush path at all (RAID5 with PPL journaling) and on winning the use-after-free window, so practical priority is moderate rather than urgent.
Local attackers can achieve arbitrary code execution by tricking a user or automation into processing a crafted manifest file with 'rpm -q -p', due to unexpected macro expansion of manifest entries in RPM before they are opened. This command injection flaw (CWE-78) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction but no privileges, and impact is limited to the privileges of the rpm process. No public exploit code or active exploitation has been identified at time of analysis.
Local privilege escalation-class memory-safety flaw in the Linux kernel's RDMA/bnxt_re driver allows an authenticated local user with access to the RDMA userspace-verbs interface (/dev/infiniband/uverbsN) to trigger use-after-free or double-free conditions by forcing udata copy failures after resource teardown, causing destroy callbacks to run again against freed driver state; a create-AH path can also leak a hardware object. The CVSS 3.1 vector is AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), and exploitation requires a Broadcom NetXtreme-E adapter running bnxt_re in RoCE/RDMA mode, which is not a default configuration on general-purpose hosts. No public exploit was identified at time of analysis.
An out-of-bounds write in GIMP's GIMPressionist plug-in allows an attacker to corrupt memory by convincing a user to load a malicious preset file, potentially leading to a crash or arbitrary code execution. The flaw is an unauthenticated local attack (CVSS PR:N) that requires user interaction (UI:R) to open a crafted preset file, and it affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 plus likely upstream GIMP versions. No public exploit has been identified at time of analysis, and the overall risk is assessed as genuine but not urgent due to the requirement for user interaction with a crafted file.
Local privilege escalation in Rapid7 Insight Agent on Windows allows an authenticated low-privileged local user to execute arbitrary code as SYSTEM when the agent runs InsightVM assessment content at or below version 0.0.261.0. The flaw stems from an unqualified `code` command invoked from a SYSTEM process, so a user-writable directory placed earlier in the machine PATH can supply a malicious executable. Rapid7 self-reported the issue and automatically remediated it through assessment content 0.0.269.0 on September 15, 2026; no public exploit was identified at time of analysis.
Btrfs subvolume metadata handling in the Linux kernel can read out of bounds when a mounted filesystem contains a crafted ROOT_REF or ROOT_BACKREF item whose on-disk name_len does not exactly match the remaining item payload, and BTRFS_IOC_GET_SUBVOL_INFO then copies more bytes than intended into its fixed-size UAPI name buffer. Only systems using btrfs are affected; the flaw is local rather than remote and per the assessed vector requires low privileges plus the ability to present a corrupted/malicious btrfs image to the kernel (typically mount privilege or an auto-mount/removable-media/container path). The kernel.org stable fixes are published (6.12.111, 6.18.53, 7.2), and no public exploit code or active exploitation has been identified at time of analysis. The upstream/NVD score of 7.8 overstates practical risk: the hardened assessment rates it as a local out-of-bounds read with limited confidentiality and availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:L).
An out-of-bounds SDMA queue index in the Linux kernel's AMD amdkfd (KFD) GPU-compute driver allows a local low-privileged user on AMD GPU systems to corrupt kernel memory and crash the machine via the CRIU checkpoint/restore path that supplies a caller-controlled restore_sdma_id. The missing bounds check against the maximum queue count affects kernels predating the 6.12.111, 6.18.53 and 7.2 releases, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Assessed impact is local integrity and availability loss, with memory corruption and panic as the dominant realistic outcome rather than disclosed data.
A use-after-free race in the Linux kernel's amdkfd (AMD KFD compute) queue destruction path lets a local user who can access the AMD GPU compute interface free a queue while it is still being dereferenced. The flaw sits in wait_on_destroy_queue(), which drops its locks while waiting for a queue to resume, creating a window in which a concurrent destroy_queue_cpsch() can free the same queue; the fix serializes destruction using the is_being_destroyed flag. Affected systems are those running an AMD GPU with the KFD/ROCm compute path active on kernel versions before 6.12.111 / 6.18.53 (fixed in 7.2); exploitation requires local low-privilege access, a favorable race outcome, and no public exploit code has been identified at time of analysis.
Boundary-condition mishandling in the Linux kernel's RDMA user-memory path (ib_umem_find_best_pgsz()) lets a local user who can register a user memory region through RDMA verbs drive out-of-range iova/length arithmetic into a GENMASK, producing incorrect page-size masks and, in the worst case, kernel memory corruption or a crash. Exposure is narrow and architecture-dependent: the truncation and >4G GENMASK overflow cases are principally reachable on 32-bit kernels where iova is passed as a 32-bit value, while 64-bit builds are far less affected, and access is gated by PR:L (an RDMA/InfiniBand or RoCE-capable device plus permission to call ib_umem_get()). Our independent assessment is less severe than the published 7.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H), since the patch addresses arithmetic on page-size masks rather than a direct attacker-controlled heap write; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
A use-after-free in the Linux kernel perf events core lets a local user who can create perf events with address filter ranges trigger a race between event teardown and an RCU reader, resulting in memory corruption that is most reliably observed as a kernel crash or denial of service. The bug affects the kernel up through the stable branches fixed in 6.12.111 and 6.18.53 and the mainline fix released as 7.2; systems running those or later versions are not affected. Exploitation requires local access, the ability to open perf events subject to CAP_PERFMON and the kernel.perf_event_paranoid sysctl, and precise timing because the window is a narrow UAF race, so an unprivileged attacker on a default or hardened configuration is unlikely to reach it; no public exploit code has been identified at time of analysis and there is no indication of active exploitation. The NVD vector rates this 7.8, but the assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H, roughly 5.3) is more conservative because of the high attack complexity, the privileged precondition, and the limited realistic confidentiality impact.
Mounting a crafted btrfs filesystem image on an unpatched Linux kernel can overflow a fixed 255-byte name buffer while processing a malformed INODE_REF item, producing an out-of-bounds memcpy/page fault and a kernel panic (denial of service, with memory-safety implications). The assessed vector is local, high-complexity, PR:L (authenticated/low-privileged local access) - an attacker must be able to supply the malicious image and get it parsed, for example via mount, an unprivileged user-namespace/loopback mount, or the NFS/open_by_handle export path (exportfs_decode_fh_raw → reconnect_path → btrfs_get_name) shown in the crash trace. Only systems that use btrfs (and particularly those exporting btrfs filesystems over NFS) are affected; there is no confirmed active exploitation (CISA KEV) and no public exploit code identified at time of analysis. Patches are available in the vendor stable releases Linux 6.12.111, 6.18.53, and 7.2 (EUVD-2026-86201).
A race condition in the btrfs filesystem's relocation code (merge_reloc_roots() in fs/btrfs/relocation.c) allows a local user with an active balance or device add/remove/replace operation in progress to observe an inconsistent root->reloc_root pointer because the code clears that pointer without the memory barrier used elsewhere in the same code path. The affected code also clears the BTRFS_ROOT_DEAD_RELOC_TREE flag even when the root no longer points at the reloc root being cleaned up, so cleanup can target the wrong reloc root. The upstream fix routes cleanup through clear_reloc_root(), which issues the barrier after nulling ->reloc_root and before clearing the flag. Our independent assessment rates this far below the vendor-published CVSS 7.8: it is a local, high-complexity race that requires btrfs to be in active use and block-group relocation to be underway, is only meaningfully exploitable on weakly-ordered CPU architectures, and yields at most low integrity and availability impact with no confidentiality loss; there is no remote vector and no public exploit identified at time of analysis, and no KEV listing.
A use-after-free in the Linux kernel's netfilter nfnetlink_log (NFLOG) subsystem lets a local attacker who can create and tear down network namespaces race packet logging against per-net state teardown, so that ops_free_list() frees the NFLOG pernet data while nf_log_packet() may still dereference the stale logger pointer under rcu_read_lock(). Impact is confined to local hosts running an affected kernel where the NFLOG logging path is in use and unprivileged network-namespace creation (or CAP_NET_ADMIN) is available; the flaw is a timing race, not a remotely reachable bug, and the assessed vector is AV:L/AC:H/PR:L. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2.
Oversized SMBus block transfers in the Linux kernel I2C subsystem can reach tracepoints and native driver callbacks without ever being validated against I2C_SMBUS_BLOCK_MAX, allowing local memory corruption and out-of-bounds reads. The flaw is fixed by adding an early length check in __i2c_smbus_xfer(), which previously deferred validation to i2c_smbus_xfer_emulated() - too late for the smbus_write tracepoint and skipped entirely by adapters that supply a native .smbus_xfer implementation. The independently assessed vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H) reflects that exploitation requires local access to an /dev/i2c-* interface plus a non-default configuration - SMBus tracing enabled (Bug 1) or the i2c-stub testing module loaded (Bug 2) - and default production kernels without tracing, i2c-stub, or unprivileged i2cdev access are not readily exploitable; no public exploit code was identified at time of analysis.
A use-after-free race in the Linux kernel's ACRN hypervisor service module (HSM) lets an authenticated local attacker with control of the ACRN irqfd ioctl path free a struct hsm_irqfd that a queued shutdown work item still references, yielding kernel memory corruption via container_of() on a dangling pointer. Exploitation is not a default Linux configuration: it requires the ACRN hypervisor stack to be built and running on the host with the acrn HSM driver loaded and an ACRN VM present, plus the attacker must win a narrow timing window between acrn_irqfd_deassign()/deinit and an eventfd EPOLLHUP wakeup. Our assessment rates this CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H - a low-complexity vector is not realistic because the race is hard to trigger reliably, and the dominant impact is availability (kernel crash), with only limited integrity impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (Linux 6.18.53 / 7.2).
A race condition in the Linux kernel's vhost-scsi backend allows a local, authenticated attacker with access to the vhost-scsi device to write command responses to an unrelated userspace memory region by replacing the memory table (VHOST_SET_MEM_TABLE) while SCSI commands are in flight. This can lead to host memory corruption and potential privilege escalation, though the attack requires a non-default vhost-scsi offload configuration and a narrow race window that makes reliable exploitation difficult. No public exploit has been identified at time of analysis; patches are available in Linux 6.12.111, 6.18.53, and 7.2.
A use-after-free race in the Linux kernel's chips-media wave5 VPU (video codec) driver allows a local user who can open the codec's V4L2 mem2mem device node to crash the kernel: if the driver's IRQ thread acquires the instance spinlock in the narrow window between m2m_ctx release and wave5_release() removing the stream instance from the active-instances list, the IRQ handler walks a freed/stale context and dereferences a NULL pointer. The vendor-listed CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N, C:H/I:H/A:H) reflects a worst-case write-after-free scenario, but our assessment scores it lower (AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H) because the concrete observed outcome is a kernel crash rather than confirmed code execution, exploitation is local-only, and the race window is non-deterministic; the affected hardware/driver is present only on specific SoCs. No public exploit code or in-the-wild exploitation has been identified at time of analysis (not in CISA KEV), and vendor-released stable fixes exist.
Server-side request forgery in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an authenticated remote attacker to make the server issue requests to internal endpoints and return sensitive information by supplying a manipulated X-Forwarded-Proto header that the application fails to validate. Exploitation requires a valid account on the platform (CVSS PR:L) with network access to the DataStage web interface; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The vendor/NVD CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) reads as Critical, but the independent assessment scores it C:H/I:N - a confidentiality-only SSRF whose real-world impact depends on which internal services the DataStage host can reach and what those endpoints expose.
Kernel crash risk in the Linux Kernel arises from insufficient buffer validation in ACPICA's acpi_ut_walk_aml_resources(), allowing malformed ACPI resource descriptors to overflow internal buffers. Exploitation requires control over ACPI resource descriptor data - firmware, a rogue device advertising crafted resource data, or a privileged local path that feeds ACPI tables into the kernel - so the NVD CVSS 3.1 score of 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) overstates real-world risk; the independently assessed vector is AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H with a predominant kernel-crash impact. Vendor-released patches are available, and no public exploit identified at time of analysis.
Out-of-bounds memory access in the Linux kernel PCI/pwrctrl driver for the Toshiba TC9563 PCIe switch, caused by the driver parsing both physical functions of the DSP3-integrated Ethernet MAC Endpoint when only one entry exists in the tc9563_pwrctrl->cfg array. Affected systems are those running Linux 6.19 or kernels built from commit 4c9c7be47310c1dbd7b6d37d45986123f5b133b4 up to the fixes in 7.2.6 / 7.3-rc1, but only when the specific TC9563 hardware is physically present, since the buggy code runs during driver probe; there is no network path or attacker-supplied runtime input. No public exploit has been identified at time of analysis (no CISA KEV listing, no POC, no EPSS signal provided), and while the published vector is 7.7, independent assessment rates real-world risk LOW with a modified vector of AV:L/AC:H/PR:H/UI:N/C:N/I:L/A:H, reflecting the hardware prerequisite as the dominant limiting factor.
Out-of-bounds access in the Linux kernel's ACPICA AML parser function acpi_ps_get_next_field allows crafted ACPI/AML field definitions to be parsed beyond intended boundaries, producing a crash-dominant denial of service; exploitation requires malicious or tampered platform firmware that supplies crafted DSDT/SSDT tables, or a privileged local user with CAP_SYS_ADMIN injecting custom AML via configfs/custom_method. The NVD CVSS 3.1 base is 7.7 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H), but the independent assessment treats the practical vector as AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H because this is not reachable by a remote or unprivileged local attacker on a default configuration. Vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2; no public exploit code or CISA KEV active exploitation is identified in the provided data.
Out-of-bounds reads in the Linux kernel's ACPI interpreter (ACPICA) - specifically in acpi_ps_get_next_namestring() and acpi_ps_peek_opcode() - can cause a kernel crash or expose adjacent memory contents when parsing malformed AML bytecode from ACPI tables. All kernel versions tracing back to the initial git commit (1da177e4c3f41524e886b7f1b8a0c1fc7321cac2) are affected; fixes are published in Linux 6.12.111 and 6.18.53 (mainline 7.2). Exploitation requires the ability to supply crafted ACPI tables - malicious or modified firmware/BIOS, physical boot-time table override, root-level override via initrd (CONFIG_ACPI_TABLE_UPGRADE), or a hostile hypervisor - which is why our independent assessment lowers the supplied CVSS 7.7 (PR:N, AC:L, C:H) to AV:L/AC:H/PR:L with confidentiality impact limited to adjacent-memory leakage; the realistic outcome is a kernel denial of service. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the patch is available from the vendor via the referenced upstream stable commits.
Out-of-bounds reads in the Linux kernel amdgpu FRU PIA parser can crash affected systems when malformed or truncated EEPROM data is processed during driver initialization. Exploitation requires local access with low privileges and high attack complexity on AMD GPUs that expose a FRU PIA, primarily datacenter or professional models, and an attacker must be able to supply corrupted on-board EEPROM contents rather than network or ordinary userspace input. The assessed impact is low confidentiality and high availability, not reliable code execution or data theft; vendor patches are available in Linux 6.12.111, 6.18.53, and 7.2, and no public exploit was identified at time of analysis.
Use-after-free in the Linux kernel's ACPICA acpi_ns_build_normalized_path() function allows local attackers to crash or destabilize ACPI-enabled systems by triggering a stale node dereference, producing a denial of service (availability impact). The flaw affects kernels before 6.12.111, before 6.18.53, and before 7.2; exploitation requires low-privileged local access and depends on winning a race or lifetime window, and no public exploit code is identified at time of analysis. The independent assessment rates this as availability-only (AV:L/AC:H/PR:L, C:N/I:N/A:H), conflicting with the higher confidentiality-loss 7.7 score in the supplied CVSS input.
Server-side request forgery in Termix 2.5.0 allows an authenticated user - including a self-registered low-privilege account where open registration is enabled - to make the Termix backend fetch arbitrary internal URLs through the /homepage/proxy endpoint. Because the handler JSON-parses the fetched body and returns the complete response to the caller, an attacker can reach loopback, RFC1918, link-local and cloud metadata destinations (notably 169.254.169.254) and exfiltrate internal service data and cloud credentials. The vulnerable code path existed only in the narrow 2.5.0-to-2.5.1 window, is fixed in 2.5.1, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Espruino 2v29 (commit bffc6d0) allows local attackers to trigger a one-byte out-of-bounds write by supplying crafted JavaScript with an overlong token, corrupting the adjacent tokenValue pointer and causing application crashes or denial of service. The flaw only manifests in RELEASE/NO_ASSERT firmware builds; debug builds with assertions enabled catch the overlong token before the write. No public exploit code has been identified at time of analysis, and the assessed CVSS 3.1 vector rates this as AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (score 7.7).
SigNoz deployments configured to use the non-default opaque session tokenizer leave existing sessions valid after a password reset or user deletion, so a remote authenticated attacker who already holds a live session token for an account retains that account's full access - up to administrator - for up to the token's configured maximum lifetime (30 days by default) after a reset, and until the token next rotates (30 minutes by default) after deletion. Affected versions run from v0.98.0 up to but not including v0.143.0; default installations in that range never used the opaque tokenizer and are therefore not exposed. The vendor has released v0.143.0 as the fix, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Gerrit Code Review 2.16.0-3.12.9, 3.13.0-3.13.8, and 3.14.0-3.14.2 mishandle project-name normalization, allowing an authenticated user (or an unauthenticated user when the repository was previously public) to keep reading private repository content and to durably restore revoked project-owner administrative privileges. Requests that reference a project with repeated terminal .git suffixes (for example project.git.git) are cached under a different key than the canonical project, so revoking read access or removing owner rules on the canonical name never evicts the stale alias ProjectState during the ProjectCache validity window, permitting reads of newly created private commits and writes to refs/meta/config. No public exploit code has been identified at time of analysis; exploitation requires the attacker to have previously held access to the project and to act before the stale cache entry would naturally expire.
Malformed SAML messages sent to an authentik deployment that uses SAML either as an identity provider (/application/saml/*) or as a SAML source (/source/saml/*) can terminate the worker process handling the request, so every request assigned to that worker fails. No authentication or user interaction is required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), and because workers restart automatically and database-backed sessions survive, each message causes only a brief localised failure - sustained disruption requires a continuous stream of malicious messages, which is why the assessed availability impact is Low rather than High. Only SAML endpoints are affected; deployments using OAuth/OIDC/LDAP or other protocols are not exploitable, and no public exploit code was identified at time of analysis (CWE-770, CVSS 7.5 per the CVE record, adjusted to A:L in our independent assessment).
Denial of service in PHP: attacker-influenced input passed into a recursive routine can exhaust process resources and terminate the PHP worker or interpreter (CVSS 3.1 base 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with impact confined to availability and no data exposure or code execution. The flaw is network-reachable, unauthenticated, and low-complexity per the vector, so any deployment that feeds untrusted remote input into the affected recursive code path is exposed, while deployments that only pass trusted input are not. No public exploit code or confirmed active exploitation was identified at time of analysis, and the upstream PHP security advisory GHSA-rgrp-mwpx-f6rm is the authoritative source for the exact affected and fixed versions.
Stored social and enterprise SSO provider access tokens can be retrieved from Logto's Account API by a low-trust application that holds only an `openid`-scoped same-user access token, because the third-party token handlers in packages/core/src/routes/account/third-party-tokens.ts authenticate the caller but omit the `identities` scope check that protects neighboring identity-detail endpoints. Logto deployments from 1.31.0 through 1.41.x are affected; version 1.42.0 adds the missing scope gate to the GET /api/my-account/identities/{target}/access-token, GET /api/my-account/sso-identities/{connectorId}/access-token, and related PUT routes. No public exploit code was identified at time of analysis, and exploitation is constrained: federated token-set storage must be enabled in the tenant and the victim must already have linked a supported social or enterprise SSO connector, with downstream impact bounded by the scopes granted to the leaked provider token.
A malformed TCP SACK option stream can crash the Linux kernel on CPU architectures that do not tolerate unaligned memory access, because netfilter's nf_conntrack TCP option parser reads a 32-bit value through an unaligned pointer dereference in its timestamp fast path. The defect affects the kernel's connection-tracking code that processes TCP traffic, which runs on virtually every firewall, gateway, or NAT host that uses nf_conntrack, and it is exploitable by a remote, unauthenticated attacker who can reach a conntrack-processing path and craft SACK options at a non-4-byte-aligned offset (PR:N/UI:N), though the independent assessment rates this AC:H rather than AC:L because exploitation is limited to non-x86 alignment-faulting architectures. Impact is availability-only - a kernel fault/crash rather than memory corruption or disclosure - and no public exploit code was identified at time of analysis; the vendor fix is already available in stable releases.