Bludit CMS through version 3.22.0 allows authenticated users with Author or Editor roles to read private drafts and scheduled posts belonging to any other user, including administrators, by sending a crafted request to the content-get-list AJAX endpoint. This missing authorization vulnerability (CWE-862) is network-reachable, requires low-privilege authentication, and results in high confidentiality impact with no integrity or availability effects. No public exploit code or active exploitation has been identified at time of analysis.
Information disclosure in Actual Sync Server versions prior to 26.7.0 allows an authenticated user (CVSS PR:L) to bypass the plugin CORS proxy allowlist and cause the server to attach its configured ACTUAL_GITHUB_TOKEN to GitHub API requests outside the permitted repository, exposing private GitHub resources that the token can reach. The flaw is a prefix-matching error: the allowlist check accepts any GitHub API path beginning with /repos/{owner}/{repo}, so sibling repositories sharing an allowlisted repository's name prefix pass validation. Exploitation is config-gated - it requires the operator to have set ACTUAL_GITHUB_TOKEN and to have at least one allowlisted public plugin repository - and impact is bounded by whatever permissions that token holds; no public exploit code was identified at time of analysis, and the vendor has released a fix in 26.7.0.
Unauthenticated attackers on the management network can crash the ASMI web interface on IBM Server Firmware by sending a malformed HTTPS request, causing a temporary denial of service that may become sustained with repeated exploitation. The vulnerability is an out-of-bounds read (CWE-125) with a CVSS score of 7.1 (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H); while the interface restarts automatically after a single crash, sustained attacks could lead to a persistent loss of management access. No public exploit identified at time of analysis; this is a moderate-risk availability flaw, not a critical priority, and exposure is limited to attackers already on the management network segment.
Out-of-bounds reads in the Linux kernel's btintel Bluetooth driver can expose kernel memory or crash a host when an undersized version TLV value is parsed. The issue affects systems with an Intel Bluetooth controller and a pre-fix kernel; the assessed CVSS vector is local, low-privilege, no user interaction, with high confidentiality and availability impact but no integrity impact. Vendor fixes are identified, no public exploit was identified at time of analysis, and EPSS is 0.17% (5th percentile).
Out-of-bounds read (CWE-125) in the Linux kernel's btintel Intel Bluetooth driver occurs when a firmware-ID TLV value is not NUL-terminated: the code treats the value as a string and lets snprintf() read past the advertised TLV value length, which is the only boundary it enforces. Systems running the btintel driver with Intel Bluetooth adapters and processing such a malformed response during firmware/TLV parsing are affected; the assessed vector is local, low-privileged (PR:L), no user interaction, with high confidentiality and high availability impact. EPSS is low at 0.17% (5th percentile), no public exploit has been identified at time of analysis, and vendor fixes are listed as 6.18.53, 6.12.111, 7.2.7 and 7.3-rc2, with a vuln.today priority decision of this_week.
Out-of-bounds read in the Linux kernel's accel/qaic driver can expose kernel memory or cause a denial of service when resp_worker() processes a malformed wire response from a Qualcomm Cloud AI 100 (QAIC) device. Affected systems run vulnerable Linux kernel branches with the QAIC driver loaded and an attached QAIC accelerator; a local attacker with low privileges (CVSS PR:L) who can control or compromise the device/firmware can trigger the missing-bounds-check path. No public exploit has been identified at time of analysis (EPSS 0.16%, 4th percentile), and real-world risk is low-to-moderate because the hardware and device-control prerequisites are substantial.
Local attackers able to execute code on a Linux host that has an active netfs/fscache-backed filesystem mount (e.g. AFS, Ceph, CIFS/SMB, 9p) can race the netfs readahead folio handling, where the application thread appends folios to the rolling buffer while the collector thread inspects or clears them - for instance reading front_folio_order before the next folio has been added, or unlocking folios before the xarray has been scanned. The kernel fixes the race by loading all readahead folios into the queue upfront and deferring the bulk reference drop until the first subrequest is dispatched, with the collector waiting on NETFS_RREQ_NEED_PUT_RA_REFS. Vendor scoring is CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/C:H/I:N/A:H), while our assessment raises attack complexity to High because a narrow timing window must be won on a host with a netfs mount in use; EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis. Vendor-released patches are available in Linux 7.2.7 and 7.3-rc3 (plus the listed stable commits).
Signature-verification bypass in MinIO (all releases through commit 7aac2a2) and in the pgsty/silo fork (before commit 1233254) lets an attacker who holds a valid SigV4 presigned PUT URL - one scoped to a single object - append an unsigned x-amz-copy-source header to the otherwise unmodified URL and cause a server-side CopyObject executed with the signer's credentials, converting a write grant into reads of every object that signing key can reach. The root cause is a CWE-347 improper-verification-of-signature error: extractSignedHeaders() in cmd/signature-v4-utils.go iterates only the client-claimed X-Amz-SignedHeaders list and never enumerates the x-amz-* headers that actually arrived, so an unsigned header is neither hashed into the canonical request nor rejected, while cmd/api-router.go dispatches CopyObject purely on the presence of x-amz-copy-source. Amazon S3 rejects the equivalent request with HTTP 403 AccessDenied; exploitation here requires a delegated presigned URL plus a signing key with broader read permission, making this a privilege escalation from a delegated credential rather than unauthenticated access, with no public exploit code or confirmed active exploitation identified at time of analysis.
Out-of-bounds read in the Linux kernel NTFS driver allows a local attacker who can mount a crafted NTFS volume to read past a heap allocation while the in-memory $AttrDef table is walked, producing a kernel crash (denial of service) and potential disclosure of adjacent kernel memory. Only systems that mount attacker-controlled NTFS images are affected - the kernel must have the NTFS driver enabled and the attacker needs either local mount capability (CAP_SYS_ADMIN) or an automount service that mounts untrusted removable media; authentication requirements are low privileges per the CVSS vector (AV:L/PR:L). No public exploit code has been identified at time of analysis and EPSS is negligible (0.14%, 3rd percentile), though a vendor patch is available and carries a moderate 7.1 severity score.
S/MIME signature spoofing in Zammad before 7.1.2 lets a remote, unauthenticated sender forge email that Zammad displays with the same 'validly signed' indicator as a genuine message, by presenting a self-made certificate whose subject name matches a certificate already stored for a real, previously trusted sender - no access to that sender's private key is required. Exploitation requires inbound S/MIME signature verification to be enabled on the target instance, a certificate to already exist for the impersonated sender, and a human (agent/user) to view and act on the forged ticket, so impact is confined to integrity/spoofing with no data disclosure or service disruption. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor fix exists in 7.1.2, and the flaw is genuine rather than inflated CVSS.
TX ring memory corruption in the Linux kernel's stmmac (STMicroelectronics DWMAC/DWXGMAC) Ethernet driver allows a local sender to overwrite TX descriptors that are still owned by the DMA engine. The flaw is in the stmmac TSO transmit path: stmmac_tso_xmit() underestimates how many free descriptors a highly-fragmented TSO skb will actually consume, so a nearly-full descriptor ring can pass the availability check and let stmmac_tso_allocator() write past the available slots. Exploitation requires the stmmac driver in use with TSO/GSO enabled and a local sender able to submit a large, heavily-fragmented TSO skb at the moment the ring is almost full; the assessed impact is limited integrity damage and availability loss on affected (largely ARM/embedded STMicro MAC) systems, and no public exploit has been identified at time of analysis.
Out-of-bounds memory access in the Linux kernel's UFS (BSD FFS/UFS2) filesystem driver is reachable when the kernel mounts an attacker-crafted UFS image, because ufs_read_cylinder() caches unvalidated cylinder-group metadata and later uses it as an array index and bitmap-scan start during ordinary block and inode allocation or free. Affected are kernels from the initial git import (commit 1da177e4, i.e. Linux 2.6.12 era) through the 6.12.x, 6.18.x and 7.2.x lines prior to the stable fixes 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), with UFS support compiled in; per the CVSS vector the flaw is unauthenticated (PR:N) but requires high-complexity prerequisite conditions and user interaction (AV:L/AC:H/UI:R), since the victim must actually mount the malicious image, typically via removable-media automount or an explicit mount. The CNA scores this 7.0, but our independent assessment rates confidentiality and integrity impact as Low and only availability as High (AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:H), because mounting arbitrary images normally requires CAP_SYS_ADMIN and the trigger is contingent on subsequent allocation activity; no public exploit code and no CISA KEV entry were identified at time of analysis.
A soundness bug in the Linux kernel BPF verifier lets a crafted eBPF program slip past verification: when handling a 32-bit 'if w1 != 0' comparison, is_branch_taken() fails to distinguish BPF_JMP32 from BPF_JMP, wrongly reports the jump as always taken, and then tracks the wrong execution path for the rest of the program - leaving register bounds inconsistent with runtime behaviour. A local attacker who can load eBPF programs (CAP_BPF/CAP_SYS_ADMIN, or a host where kernel.unprivileged_bpf_disabled has been turned off) can turn this into memory corruption and kernel privilege escalation, with the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.0) rating high confidentiality, integrity and availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; practical risk is strongly limited by the default posture of disabling unprivileged BPF on modern distributions.
Linux kernel ALSA us122l driver code leaves VM_MAYWRITE set on read-buffer mappings that were created with PROT_READ, so a local user who can open the hwdep character node O_RDWR can simply call mprotect() to upgrade that mapping to writable after the initial rejection. Once writable, the attacker can alter the struct usb_stream read_size field, which the fault handler uses to decide which pages belong to the read buffer and which usb_stream_free() uses to size the free_pages_exact() release, resulting in out-of-bounds page mapping/access and out-of-bounds freeing of memory outside the allocation. Exploitation requires local authenticated access to /dev/snd's us122l hwdep node plus a physically attached Tascam US-122L-class USB audio device, so no public exploit code has been identified at time of analysis and the practical risk is modest despite the 7.0 base score; the independent assessment rates confidentiality and integrity impact as limited with availability impact high.
Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that leaves a stale per-network-namespace logger pointer which later sysctl reads or packet-logging operations dereference. A local actor able to rebind the kernel's log backend - realistically requiring CAP_NET_ADMIN in the target network namespace - must win a narrow timing window against module unload or network-namespace exit, so the assessed impact is no confidentiality loss, limited integrity impact, and high availability impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H). Vendor patches are available in stable releases 6.12.111, 6.18.53 and 7.2.7 (mainline 7.3-rc3), and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
Double completion of asynchronous crypto requests in Linux kernel s390 protected-key drivers (paes_s390 and phmac_s390) can crash or destabilize IBM Z systems when an error path returns a negative code after the request was already finalized. The issue is local-only, requires some privileges (PR:L) and high complexity (AC:H), and is limited to s390 hardware using these drivers; the independent assessment rates real-world risk as low despite NVD's 7.0 base score, with integrity and availability impact but no confidentiality impact. Vendor patches are available and no public exploit has been identified at time of analysis.
A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET_ADMIN and can trigger module unload or network-namespace teardown crash or corrupt kernel memory via the connection-tracking timeout policy path. The flaw exists because cttimeout_exit() unregisters the per-net operations (freeing the per-net timeout storage) before clearing the nf_ct_timeout_hook, so a concurrent nf_ct_set_timeout() call reached through an iptables/xtables CT target can dereference the stale hook and read already-freed memory. KASAN-reported use-after-free; no public exploit identified at time of analysis, and exploitation requires a narrow timing race plus elevated privileges (CAP_NET_ADMIN, and CAP_SYS_MODULE/root or repeated netns churn), so the practical outcome is a kernel crash rather than controlled corruption.
The Linux kernel's bcm_sf2 (Broadcom Starfighter2) DSA switch driver walks the entire CFP 'unique' rule bitmap into a caller-supplied rule_locs[] array without limiting the walk to nfc->rule_cnt, so a local, low-privileged user can read/write past the end of that allocation - or, with rule_cnt of 0, trigger a NULL-pointer dereference - simply by issuing the ETHTOOL_GRXCLSRLALL ethtool ioctl with a slot count smaller than the number of installed CFP rules. The ioctl itself requires no CAP_NET_ADMIN, but the bug is only reachable after a privileged administrator has installed at least one CFP classification rule, so it is confined to embedded or networking hardware that uses the Broadcom SF2 integrated switch and is not a risk on generic or default kernels; no public exploit has been identified at time of analysis. Our independent assessment scores it AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H (NVD publishes 7.0), reflecting a local attack path, a privileged precondition, impact dominated by availability, and only limited integrity exposure rather than the confidentiality/integrity compromise implied by the higher vendor score.
An out-of-bounds write, plus a NULL pointer dereference path, exists in the Linux kernel's nfp driver for Netronome/Corigine SmartNICs: nfp_net_get_fs_loc() walks every entry in nn->fs.list and dumps it into rule_locs[] without checking cmd->rule_cnt, the number of slots the caller actually allocated. A local, low-privileged user session can reach this path because the ETHTOOL_GRXCLSRLALL ioctl requires no CAP_NET_ADMIN and sizes the buffer from the userspace-supplied rule_cnt, so passing fewer slots than installed rules (or 0, which leaves the destination pointer NULL) corrupts kernel memory; a system administrator must first have installed ethtool ntuple/flow-steering rules via CAP_NET_ADMIN, and the nfp driver must be loaded on real NFP hardware. The provided CVSS 3.1 record rates this 7.0 with C:H/I:H/A:H, while our independent assessment bounds it to CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H, keeping local access and the high availability impact but scaling confidentiality and integrity down. No public exploit code or confirmed active exploitation was identified at time of analysis; vendor patches exist in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc3.
The mv88e6xxx DSA switch driver in the Linux kernel can be driven into an out-of-bounds kernel memory write - or a NULL-pointer dereference - by a local user issuing the ETHTOOL_GRXCLSRLALL ioctl on a host where an administrator has previously installed at least one RX-flow classification rule; the ioctl requires no CAP_NET_ADMIN, so any local account can reach the buggy path, although the most likely outcome is a kernel crash with limited integrity impact rather than code execution or data theft. The defect is a missing bound on the policy-rule dump: the caller's rule_cnt buffer limit is clobbered by the driver before it is ever read, and a value of 0 leaves the destination pointer NULL. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; vendor fixes are available in the stable trees (6.12.111, 6.18.53, 7.2.7 and 7.3-rc3), and per the independent assessment exploitation is gated on non-default prerequisites - Marvell switch hardware using this driver plus pre-existing policy rules installed by a privileged administrator.
A use-after-free in the Linux kernel's btrfs RAID stripe-tree insertion path can free an in-flight transaction handle and transaction twice, corrupting kernel memory on systems that enable the opt-in raid-stripe-tree feature (added in Linux 6.7). Only local users who can write to such a filesystem, and only when a memory allocation fails (-ENOMEM) at exactly the btrfs_insert_one_raid_extent() failure site during ordered-extent finishing, can trigger it; the independent assessment scores this AV:L/AC:H/PR:L with no confidentiality impact but high availability impact (C:N/I:L/A:H), noting it is a high-CVSS-but-low-real-risk kernel issue that is not attacker-input-controlled. There is no public exploit identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV); vendor-released patches exist in the affected branches.
The Linux kernel's nvme-rdma host driver mishandles command teardown when a queue_rq submission returns -EIO, unmapping SQE DMA and cleaning up the block-layer request after the host-path-error helper has already completed that request. The result is a double cleanup of the nvme-rdma command and blk-mq request plus a DMA unmap against an already-completed request, which can corrupt request/command state, trigger a kernel crash or denial of service, and - per the assessed vector - cause limited integrity impact. Only hosts running the nvme-rdma driver while connected to an NVMe-oF target over an RDMA fabric (RoCE, iWARP or InfiniBand) are exposed, and the faulting branch only executes on a transient RDMA command-submission failure that is not directly attacker-controllable; the local, high-complexity, privileged nature of the trigger makes real-world risk substantially lower than the base score suggests, and no public exploit identified at time of analysis.
Improper CPU-ID validation in the Linux kernel's BPF subsystem (the BPF_F_CPU map-operation flag) allows a local user with BPF privileges - CAP_BPF, or any environment where unprivileged BPF is enabled - to drive an out-of-bounds per-CPU map access on hosts whose possible-CPU mask is sparse/non-contiguous, producing a kernel paging fault and denial of service (assessed availability impact A:H, with only limited integrity impact and no confidentiality impact). Only kernels exposing the relatively new BPF_F_CPU flag (introduced around Linux 7.0) are in scope, and exploitation additionally requires a machine with a CPU ID gap such as 0,2-3 - typical of certain arm64/embedded boards or virtualized guests with CPU device-tree holes - while mainstream x86 systems with contiguous 0..N-1 CPUs are not affected because num_possible_cpus() equals nr_cpu_ids there. There is no remote vector, exploitation is local and requires BPF privileges (CVSS vector PR:L, AC:H), and no public exploit code was identified at time of analysis; no CISA KEV entry was provided, so active exploitation is not confirmed, and this is best characterized as a high-CVSS-but-low-real-risk issue given the sparse-mask and CAP_BPF prerequisites.