Unauthenticated cross-site scripting (XSS) in the BoldGrid Post and Page Builder WordPress plugin (versions <= 1.27.14) allows remote attackers to inject malicious scripts into pages viewed by victims, potentially leading to cookie theft or session hijacking in the victim's browser. Exploitation requires user interaction (UI:R) and the vulnerable plugin to be active, with impact confined to the browser context. No public exploit identified at time of analysis, and no active exploitation has been confirmed.
Unauthenticated cross-site scripting in the Photonic Gallery & Lightbox for Flickr, SmugMug & Others WordPress plugin at versions up to and including 3.36 lets an attacker inject script that executes in a victim's browser within the context of the affected WordPress site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Because the vector is PR:N but UI:R, no credentials are needed to deliver the payload, yet the attack only lands if a victim loads attacker-supplied content or a crafted link that reaches the vulnerable plugin output path; impact is bounded to the client/browser scope (S:C) rather than direct server compromise, with meaningful damage requiring a targeted administrator session. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the plugin must be installed and actively rendering the affected gallery/lightbox functionality on a reachable page for exploitation to be possible.
Denial of service and kernel memory disclosure in the NVIDIA GPU Display Driver for Windows and Linux let a local, low-privileged user who already holds an interactive session on the host force the kernel-mode component to dereference an untrusted pointer, crashing the driver or leaking kernel memory. The flaw is scored CVSS 3.1 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) - a local-only, low-complexity attack requiring low-privilege authenticated access with no user interaction, delivering high confidentiality and availability impact but no integrity or write primitive, so it cannot by itself be chained into privilege escalation or code execution. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); the most exposed deployments are multi-user, VDI, and cloud-GPU hosts where untrusted users share a GPU, since the attacker must first obtain code execution or an interactive session on the GPU host.
Authenticated low-privileged local users can bypass cryptographic signature verification in the kernel-mode layer of the NVIDIA GPU Display Driver for Linux when the system is under memory pressure, leading to data tampering and denial of service. The flaw affects GeForce, RTX/Quadro/NVS, and Tesla driver branches on Linux; no public exploit code has been identified at time of analysis. Our assessment rates this as a genuine but bounded-priority local issue because the attacker must reliably induce a low-memory kernel state at the moment of verification, making exploitation opportunistic rather than dependable.
Unauthenticated reflected cross-site scripting (XSS) in Popup by Supsystic versions 1.13.1 and earlier allows remote attackers to inject malicious scripts that execute in a victim's browser when they interact with a crafted link or page. This affects WordPress sites with the plugin active, potentially leading to session hijacking, defacement, or data theft. The CVSS 3.1 score is 7.1 (High), and no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions through 1.5.5) lets remote, unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is socially engineered into clicking an attacker-crafted link. The flaw is an output-encoding failure of class CWE-79 rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L); the attacker needs no credentials, but a victim with an active session on an affected site must be lured to the malicious page, and the resulting script runs in that site's origin. Impact is bounded to the browser context - script execution, possible session/token theft or content manipulation on the affected site - and does not by itself grant server-side code execution; there is no public exploit identified at time of analysis and no CISA KEV record for this CVE.
Unauthenticated cross-site scripting in the Easy Google Maps WordPress plugin (Supsystic, versions up to and including 1.14.6) allows remote attackers to inject and execute arbitrary script in a victim's browser session on any site where the plugin is installed and active. Exploitation requires the victim to interact - typically by clicking a crafted link or visiting an attacker-influenced page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1) - and the advisory does not disclose the specific vulnerable parameter or sink, which limits precise targeting but not the underlying flaw. No public exploit code has been identified at time of analysis and there is no CISA KEV entry, so this is a genuine but moderate-priority issue rather than an urgent one; impact escalates materially only when the interacting victim holds elevated privileges such as an administrator, where a single successful injection can lead to full site compromise.
Unauthenticated cross-site scripting in the WordPress plugin Ninja Forms (versions 3.15.3 and earlier) allows a remote attacker to have crafted script content rendered in a victim's browser session, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Exploitation requires the attacker to induce a victim - typically a logged-in administrator or a site visitor - to click a crafted link or load a malicious page, since the vector mandates user interaction (UI:R); no credentials are required (PR:N). Impact is confined to the victim's browser context (C:L/I:L/A:L) rather than server compromise, and no public exploit code or confirmed active exploitation was identified in the available data; the Patchstack report is the sole intelligence source provided, and the exact vulnerable parameter or endpoint is not specified, which limits precise targeting by defenders or attackers.
Unauthenticated cross-site scripting in Premmerce Permalink Manager for WooCommerce (versions 2.3.13 and earlier) allows remote attackers to inject script that executes in the context of a victim's browser when the crafted content is rendered. Because the CVSS vector carries PR:N with UI:R, no attacker credentials are required, but successful exploitation depends on a victim - typically a logged-in WordPress administrator - interacting with the attacker-influenced page, which is the primary limiting factor; the S:C scope-change flag means the injected script runs in a different security context (the admin session/browser) than the vulnerable plugin itself. No public exploit code or confirmed active exploitation was identified at time of analysis, and the site must be running WooCommerce with this specific plugin installed and active for exposure.
Unauthenticated cross-site scripting in the WPFunnels WordPress plugin at versions 3.13.1 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser within the target site's origin once the victim loads or clicks a crafted link or request. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) confirms no authentication is required but that victim interaction is necessary, and the Changed scope means the injected script can affect resources beyond the vulnerable plugin while confidentiality, integrity, and availability impacts remain partial. No public exploit code and no active exploitation were identified at time of analysis, and the provided intelligence contains no CISA KEV listing and no EPSS score.
Reflected cross-site scripting in the Kreatura LayerSlider WordPress plugin (versions through 8.4.0) allows an unauthenticated remote attacker to inject script into a page response by luring a victim to a crafted URL that carries malicious input in a plugin request parameter; the payload is reflected back without proper output encoding. Because the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, exploitation does not require authentication on the attacker's side but does require victim interaction (a click on the attacker-supplied link), and impact is confined to the victim's browser session within the target site's origin rather than the server. There is no public exploit identified at time of analysis and no CISA KEV listing, and the plugin is widely deployed across WordPress sites, so the practical risk lies in mass opportunistic scanning and targeted phishing rather than confirmed active exploitation.
Unauthenticated cross-site scripting in the WordPress Geo Mashup plugin affects all versions up to and including 1.13.21, allowing a remote attacker who can convince a logged-in or visiting user to follow a crafted link or submit crafted input to execute arbitrary script in that user's browser context. No authentication is required to reach the vulnerable code (CVSS vector PR:N), and the scope change (S:C) means injected script can act against the wider WordPress site rather than just the vulnerable plugin component, though exploitation is not autonomous because it depends on victim interaction (UI:R). No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the plugin's relatively niche deployment footprint plus the required social-engineering step are the main practical limiters on real-world risk.
Reflected cross-site scripting in the ThemeREX Addons WordPress plugin affects all versions below 2.45.0, allowing an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser within the affected site's origin. Exploitation requires user interaction (CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base score 7.1): the attacker must lure a victim to a crafted link or attacker-influenced page that triggers the injected payload, and success also depends on the site lacking a WAF or the patched plugin. There is no public exploit code identified at time of analysis and no confirmed active exploitation; impact is confined to the victim's browser session (low confidentiality, integrity and availability) rather than direct server compromise.
Unauthenticated cross-site scripting (XSS) in the Ad Inserter WordPress plugin through version 2.8.18 allows remote attackers to execute arbitrary script in a victim's browser via a crafted request, provided the victim is tricked into clicking a link or visiting an attacker-influenced page (CVSS 3.1 base 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C). The flaw is network-reachable and requires no authentication, but the UI:R dependency limits mass exploitation; no public exploit code or confirmed active exploitation was identified at time of analysis. The specific injectable parameter is not named in the available data and should be confirmed from the Patchstack advisory.
Unauthenticated cross-site scripting in the Happyforms WordPress plugin affects every release through version 1.26.15, allowing an attacker to inject script that executes in a victim's browser when they view attacker-influenced content. The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L (7.1, High) confirms no authentication is required (PR:N) and no non-default configuration beyond an active plugin, but exploitation depends on a victim loading the crafted content (UI:R), so the attacker cannot compromise a site autonomously and impact stays within the browser/session context rather than server-side code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the only scoring signal available is the Patchstack-assigned CVSS 3.1 score, and the specific vulnerable form field or parameter has not been published.
Reflected cross-site scripting in the Parsi Date (wp-parsidate) WordPress plugin, affecting all versions up to and including 6.3, allows an unauthenticated remote attacker to inject script into a victim's browser by getting that user to load a crafted URL or request. Tracked as CVE-2026-96836 with a CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw carries low confidentiality, integrity and availability impacts because execution is limited to client-side script in the victim's session rather than server-side code execution, and exploitation requires victim user interaction (UI:R) since the target must click or load the malicious link. No public exploit code has been identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV), though as a broadly deployed WordPress plugin it presents an attractive mass-scanning target for unauthenticated request campaigns.
Unauthenticated reflected cross-site scripting in GiveWP 4.16.9 and earlier allows remote attackers to inject arbitrary script into a victim's browser through crafted input that the WordPress plugin fails to properly output-encode. Exploitation requires the victim to interact with the attacker-controlled request (UI:R), and the CVSS 3.1 score is 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), so the attacker needs no credentials but must lure a user, ideally a privileged GiveWP administrator. The provided intelligence contains no CISA KEV entry and no public exploit code; no public exploit identified at time of analysis.
Stored/reflected cross-site scripting in the Awesome Support WordPress plugin (versions 6.3.9 and earlier) allows a low-privileged subscriber-level account to inject script that executes in the browser of an administrator or support agent who views the crafted content, enabling session theft, credential harvesting, or privileged actions performed in the victim's authenticated context. Rated CVSS 3.1 7.1 (HIGH), the flaw requires victim user interaction (UI:R) and, per the vulnerability description, a subscriber account to plant the payload, meaning sites that do not permit public registration are substantially less exposed; exploitation is scope-changing (S:C) because the script runs in the victim's session rather than the plugin's own context. No public exploit identified at time of analysis; there is no CISA KEV listing and no exploit code was observed in the supplied intelligence. Note that the published CVSS vector claims PR:N while the description and our assessment indicate a subscriber (authenticated) injection path - authentication requirements are therefore not fully confirmed from available data.
Cross-site scripting in the oik plugin for WordPress (versions 4.15.4 and earlier) allows script injection that executes in a victim's browser session, with the Patchstack advisory scoping the issue to Subscriber-level users. The reported CVSS 3.1 vector scores 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), but the PR:N rating conflicts with the 'Subscriber' qualifier, which indicates a low-privilege authenticated account is the probable prerequisite, and exploitation additionally requires a victim to render the injected payload (UI:R). No public exploit code, no CISA KEV listing, and no confirmed patched release were identified at time of analysis, and the plugin's niche deployment combined with the authentication and interaction requirements keeps practical risk below what the raw 7.1 figure implies.
Cross-site scripting in the Trusted Shops Easy Integration for WooCommerce plugin through version 2.0.6 allows unauthenticated attackers to deliver crafted input that executes as script in a victim's browser session once that victim is induced to follow a malicious link or request (UI:R, PR:N). Impact is bounded to Low for confidentiality, integrity and availability while the vulnerable component's scope is changed (S:C), producing a 7.1 CVSS base score, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because successful attacks depend on social engineering a store visitor or authenticated administrator, this is a moderate-risk issue rather than an urgent priority; the site must have the plugin installed and active.
Unauthenticated reflected cross-site scripting in the WooCommerce Product Table Lite WordPress plugin (versions up to and including 5.6.7) allows an attacker to execute arbitrary script in a victim's browser within the affected store's origin by luring that user to a crafted URL or request that reflects the malicious payload, potentially leading to session theft or actions performed as the victim. Exploitation is gated by mandatory user interaction (CVSS 3.1 7.1 High, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires the plugin to be installed and active on a WordPress site that also runs WooCommerce, so practical risk is bounded by the social-engineering step needed to deliver the link. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data was provided; the issue was reported by Patchstack.
Cross-site scripting (XSS) in YITH WooCommerce Ajax Search versions 2.28.0 and earlier allows unauthenticated attackers to inject malicious scripts into web pages viewed by other users, requiring victim interaction such as clicking a crafted link. The vulnerability is rated CVSS 7.1 with a scope change (S:C) and low confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at time of analysis, but the plugin is widely used in WordPress e-commerce sites, making timely patching advisable.
Unauthenticated cross-site scripting (XSS) in the Classified Listing WordPress plugin (by radiustheme) affects versions up to and including 6.1.3, allowing remote attackers to inject malicious JavaScript that executes in the browser of a victim user who views a crafted page. The CVSS 3.1 score is 7.1 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network exploitation without privileges but requiring user interaction, and limited impact on confidentiality, integrity, and availability. No public exploit code or active exploitation has been identified at time of analysis, but the plugin's widespread use on WordPress sites makes it a potential target for attackers seeking to compromise administrative sessions or deface sites.
Missing authorization checks in the FormGent WordPress plugin (versions through 1.12.2) allow an authenticated user holding only a subscriber-level account to reach form-management functionality and data normally reserved for higher-privileged roles, yielding high confidentiality impact and limited integrity impact. The flaw is network-reachable and needs no user interaction, but it does require a low-privileged account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N, 7.1), so sites that permit open user self-registration are the most exposed while registration-restricted sites are considerably less at risk. No public exploit identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Unauthenticated cross-site scripting in the WordPress Persistent Login plugin (author lukeseager) at versions 3.1.3 and earlier allows a remote attacker to execute arbitrary script in a victim's browser by luring them into loading attacker-influenced content that reaches the vulnerable sink; per the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) exploitation needs victim interaction but no authentication. The issue is rated High at 7.1, with scope change and low impact to confidentiality, integrity and availability confined to the victim's browser session, and the exact vulnerable parameter is not detailed in the advisory data. No public exploit code was identified at time of analysis, and there is no indication of confirmed active exploitation (no CISA KEV listing); no EPSS score was supplied.
Cross-site scripting in the Site Reviews WordPress plugin through version 8.3.1 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim loads a page rendering the malicious content, with CVSS 3.1 scoring it 7.1 High due largely to scope change and unauthenticated reach. Exploitation requires user interaction (UI:R) and is most realistic on sites that accept untrusted or public review submissions or otherwise render attacker-controlled input to a privileged viewer, and there is no public exploit identified at time of analysis. Impact is limited to the browser context, such as session or credential theft and action forgery, rather than direct server compromise.
Cross-site scripting (XSS) in the WP Statistics WordPress plugin (versions 14.16.13 and earlier) enables remote, unauthenticated attackers to inject malicious scripts into web pages. Exploitation requires a victim to interact with a crafted link or page, after which the script executes in the victim's browser context, potentially leading to session hijacking or data theft. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated cross-site scripting in the WordPress plugin Notification for Telegram (versions up to and including 3.5.2) lets a remote attacker inject script that executes in a victim's browser when the crafted content is rendered. No authentication is required to deliver the payload (PR:N), but exploitation depends on a logged-in or administrative user visiting the page where the injected script is displayed (UI:R), and the resulting impact is limited to the client side with low confidentiality, integrity, and availability effects under a scope change (S:C). No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing); EPSS data was not provided, so no exploitation-probability figure is asserted here.
Unauthenticated cross-site scripting in JW Player for WordPress 2.3.11 and earlier allows remote attackers to inject script into a victim's browser when the victim interacts with a crafted link or attacker-influenced page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) reflects a network-reachable, low-complexity flaw that requires no attacker authentication but does require user interaction; successful exploitation runs script in the victim site's origin due to scope change. The issue is reported via Patchstack, and no public exploit or CISA KEV active-exploitation confirmation was provided at time of analysis.
Reflected cross-site scripting (XSS) in WPFunnels plugin versions 3.13.1 and earlier allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when they are tricked into clicking a crafted link. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, base 7.1) indicates network-reachable, low-complexity exploitation requiring user interaction but no authentication, with a scope change and limited confidentiality, integrity, and availability impact. No public exploit code or active exploitation has been identified at the time of analysis.
Arbitrary file read in Digiwin EasyFlow .NET allows an authenticated remote user to download files from the underlying host outside the intended document scope, exposing configuration files, credentials, or other sensitive data. Exploitation requires a valid low-privilege session (PR:L per the CVSS v4.0 vector and the corroborating CVSS v3.1 assessment) but no user interaction and only low attack complexity, so any party holding a legitimate account can reach the flaw over the network. Impact is confined to confidentiality - the vulnerability does not modify data or affect availability - and no public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis.
SQL injection in Digiwin EasyFlow .NET allows an authenticated, low-privilege remote user to read arbitrary contents of the application's backend database. Per the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N), exploitation is network-reachable and low-complexity but requires a valid account (PR:L) and produces high confidentiality impact only - no integrity or availability effect, consistent with a read-only data-exfiltration primitive. The CVSS base score is 7.1; no public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, and no EPSS score was provided with the source data.
An out-of-bounds write in the Pgpool-II connection pooling and load-balancing middleware allows an authenticated remote attacker to trigger abnormal termination of the Pgpool-II process, denying service to PostgreSQL clients routed through it. Exploitation requires valid credentials accepted by the Pgpool-II frontend (PR:L) and network reachability to its listening port; no user interaction or high privileges are needed, and the assessed impact is availability only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, vendor-scored 7.1 under CVSS 4.0). Affected releases are Pgpool-II 3.5.x through 4.2.x, 4.3.0-4.3.20, 4.4.0-4.4.17, 4.5.0-4.5.12, 4.6.0-4.6.7 and 4.7.0-4.7.2. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, so this is a genuine but bounded-severity availability issue rather than an active exploitation campaign.
Stored cross-site scripting in the WP Mobile Menu WordPress plugin (versions 2.7.4 up to but not including 2.9) lets an attacker import arbitrary plugin settings through a forged cross-site request in a logged-in administrator's session, because the settings-import routine does not correctly verify its nonce. The imported values are then rendered unescaped to every site visitor, so the injected script persists and executes for all users until the malicious setting is removed. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) shows the attacker needs no account of their own but must socially engineer a privileged, authenticated admin into loading the crafted request; there is no public exploit code identified at time of analysis, exploitation has not been observed, and patch status is vendor-released version 2.9.
Authenticated plugin installation in the Vayu X WordPress theme before 1.0.6 allows any logged-in user - even a Subscriber - to install and activate arbitrary plugins hosted on the WordPress.org repository. The theme's AJAX action omits a capability check (CWE-284) and leaks its guarding nonce to every authenticated user, so the nonce provides no protection whatsoever; the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L, 7.1) reflects high integrity impact with no user interaction required. Exploitation is limited to WordPress.org-hosted plugins rather than arbitrary code upload, so maximum impact depends on chaining to a vulnerable installable plugin; no public exploit code has been identified at time of analysis, there is no confirmed active exploitation (CISA KEV), and CISA SSVC rates exploitation as none and automatable as no.
Stack exhaustion in the Gosub browser engine (gosub-engine through 0.1.0 and main before commit 46868b3) lets a remote, unauthenticated attacker crash any application built on the engine by getting it to render an SVG document containing an excessive number of deeply nested elements. The malicious SVG can be embedded via the SRC attribute of an IMG element on an attacker-controlled page, so exploitation requires only that a victim visit that page (UI:P) - no credentials are needed (PR:N) and the attack is network-reachable (AV:N). Impact is availability-only (a hard crash of the host application; no data exposure or code execution), no public exploit code has been identified at time of analysis, and the practical exposure is limited to the narrow set of deployments embedding the engine at those revisions, making this a genuine but low-priority issue.
Authorization bypass in the MSSP (multi-tenant) module of AiSOC 10.0.0 through before 12.0.0 allows any authenticated user who already owns at least one portfolio to submit arbitrary tenant UUIDs to the add_tenants_to_portfolio endpoint and pull unclaimed tenants into their own portfolio without those tenants' consent. Once a victim tenant is claimed, the attacker can read its security alerts, incidents, and posture metrics, giving high confidentiality impact with limited integrity impact but no availability loss (assessed CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Exploitation requires a valid account with portfolio ownership in an MSSP-enabled deployment and only works against tenants not already managed by another organisation; single-tenant installations are unaffected, and no public exploit code was identified at time of analysis.
Unauthenticated XML External Entity (XXE) processing in Kiteworks Email Protection Gateway allows a remote sender to read files accessible to the gateway service account - including cryptographic key material and credentials - and have them sent to a destination the sender controls. The vulnerable parsing path is only reachable when the optional, non-default message-processing feature is enabled, which is the sole reason the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L carries AC:H despite needing no authentication or user interaction; default installations are not exposed. Per the provided intelligence, no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status, and impact is bounded to files readable by the gateway service account plus the limited integrity/availability side effects typical of XXE.
Local privilege escalation, code execution, denial of service, information disclosure, and data tampering are possible in NVIDIA GPU Display Driver for Linux due to a use-after-free in the open-source kernel module's event-delivery path. An authenticated local user with access to NVIDIA GPU device nodes can race asynchronous event delivery against file close (CVSS 7.0, AV:L/AC:H/PR:L/UI:N), though the high attack complexity makes success non-deterministic and typically requires repeated attempts; no public exploit has been identified at time of analysis. Risk is concentrated on Linux hosts using the affected open-source kernel module, particularly multi-tenant vGPU, VDI, and cloud GPU deployments.
Local privilege escalation in the NVIDIA GPU Display Driver for Linux kernel-mode layer allows an already-present local user or code-execution foothold (PR:L) to write to memory that should be read-only because memory permissions are not preserved, potentially achieving code execution and elevated privileges on affected GeForce, RTX/Quadro/NVS, and Tesla systems, including vGPU Guest Driver deployments. Exploitation requires local access and high attack complexity, with no remote or unauthenticated network path; no public exploit was identified at time of analysis and the CVE is not listed in CISA KEV. The vendor-supplied CVSS vector uses AV:P while our independent assessment uses AV:L, so the physical-access requirement should be confirmed against NVIDIA bulletin 5861.
Out-of-bounds write in the NVIDIA GPU Display Driver for Windows kernel module can let a local, authenticated low-privileged user execute code, escalate privileges, cause denial of service, disclose information, or tamper with data on affected GeForce, RTX/Quadro/NVS, and Tesla systems. Exploitation requires local access to the GPU-equipped Windows host plus a low-privileged account able to reach the kernel module, and the high attack complexity means it is not reliably one-shot; multi-user, VDI, and cloud/virtual-GPU environments are the main risk. No public exploit identified at time of analysis, and CVSS is 7.0 with high confidentiality, integrity, and availability impact.