Kernel slab memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) occurs when a malicious or compromised SMB3 server returns a short reply to a snapshot-enumeration ioctl (FSCTL_SRV_ENUMERATE_SNAPSHOTS), causing smb3_enum_snapshots() to set ret_data_len to sizeof(struct smb_snapshot_array) (12 bytes) without validating the server's actual reply length; the subsequent copy_to_user() then reads past the end of the server-sized retbuf and exposes adjacent kernel heap contents to the requesting user-space process. Only Linux systems acting as SMB clients are affected, and exploitation requires the victim to connect outbound to the attacker-controlled server and actively trigger snapshot enumeration (UI:R) while running a kernel with the vulnerable cifs client code, so unauthenticated remote attackers cannot reach an idle host. There is no public proof-of-concept and no evidence of active exploitation at time of analysis; EPSS is 0.21% (11th percentile), and patches are available in stable releases 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
Unauthenticated Go pprof debug endpoints exposed on the postgres-exporter metrics listener let any attacker who can reach that port from inside the cluster network read process arguments, full goroutine stacks, and heap memory - potentially leaking database connection strings and credentials - and repeatedly trigger CPU profiling to exhaust resources in a denial-of-service condition. The flaw is tracked as CVE-2026-83550 (CVSS 7.1, AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H per the vendor, C:H for confidentiality in our assessment) and affects postgres-exporter as shipped in Red Hat Multicluster Global Hub, where the CPE covers all tracked versions; exploitation requires adjacent/cluster network reachability rather than internet exposure. No public exploit code has been identified at time of analysis, and no CISA KEV listing indicates active exploitation; risk is best characterized as a real design flaw of moderate priority, with exposure materially reducible through NetworkPolicies that restrict access to the metrics port.
A slab use-after-free read in the Linux kernel's drm/msm driver (Qualcomm Adreno GPUs) allows a local, low-privileged user with access to the DRM device node to leak or corrupt freed kernel memory. The flaw arises because msm_ringbuffer_destroy() and msm_gem_vm_free() call drm_sched_fini() and then free objects that still embed a drm_gpu_scheduler with plain kfree(), while a signalled fence exported to userspace (submit out-fence or VM_BIND fence via sync_file/drm_syncobj) still points at that embedded scheduler; an unprivileged SYNC_IOC_FILE_INFO call then reaches drm_sched_fence_get_timeline_name() and dereferences the freed slab. Rated CVSS 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) with EPSS of only 0.21% (10th percentile) and no public exploit identified at time of analysis; the issue is confined to systems where the msm driver is built and loaded, and is fixed by freeing these scheduler-containing objects with kfree_rcu().
Unauthenticated cross-site scripting in the Fluent Forms Pro Add-On Pack WordPress plugin (versions 6.2.13 and earlier) lets a remote attacker supply script payloads that execute in the browser of any user who renders the affected content, most significantly a logged-in administrator reviewing form submissions or an affected page. Rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L), the flaw needs no attacker-side credentials but does require victim interaction to fire. No public exploit code and no CISA KEV entry were identified at time of analysis, and the advisory does not name the exact vulnerable parameter or feature.
Unauthenticated cross-site scripting in the CF7 Views - Complete Entry Management for Contact Form 7 WordPress plugin through version 3.2.6 allows an attacker to have injected script execute in a victim's browser session when the victim follows a crafted link or loads attacker-influenced content. Exploitation requires no credentials (PR:N) but is gated by mandatory user interaction (UI:R), and impact is bounded by the victim's privileges on the affected WordPress origin, so maximum damage requires socially engineering a logged-in administrator. Patchstack reports the issue at CVSS 7.1; no public exploit code and no confirmed active exploitation (CISA KEV) are identified in the available data, and no EPSS value was supplied.
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
Unauthenticated cross-site scripting in the nicdark Hotel Booking WordPress plugin affects all versions up to and including 3.8, allowing a remote attacker to inject script that executes in a victim's browser within the vulnerable site's origin. Exploitation is network-reachable and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is not automatic: per the assessed vector the attack depends on user interaction (UI:R), meaning a victim has to open a crafted link or page for the payload to fire. The assessed impact is browser-scoped (C:L/I:L/A:N with S:C), making this a moderate-risk XSS issue rather than an emergency; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Unauthenticated cross-site scripting in the Document Gallery WordPress plugin (versions 5.1.1 and earlier) allows remote attackers to inject script that executes in the browser of any user who opens a crafted link or views attacker-influenced gallery content, consistent with an assessed CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). No authentication is required (PR:N) and no server-side privileges are needed, but exploitation depends on victim interaction (UI:R), which limits reliable mass exploitation. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis; the issue was reported by Patchstack and affects any WordPress site running the vulnerable plugin.
Reflected cross-site scripting in the Youzify WordPress plugin (versions through 1.3.7) lets unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is lured into following a crafted link, carrying a CVSS 3.1 base score of 7.1. No authentication is required of the attacker (PR:N), but successful exploitation depends on victim interaction with an attacker-supplied URL (UI:R), and the script executes with changed scope (S:C) producing low confidentiality, integrity, and availability impact confined to the victim's browser session rather than the server. No public exploit code was identified and the vulnerability is not listed in CISA KEV, so exploitation status is assessed as no public exploit identified at time of analysis.
Reflected cross-site scripting in the Ansar Import - One Click Starter Sites - for Elementor & Themes WordPress plugin (versions up to and including 2.1.2) lets an unauthenticated attacker inject arbitrary script that executes in a victim's browser session once the victim clicks a crafted link or visits a malicious page. The flaw is rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N per independent assessment) - no attacker authentication is required, but exploitation depends on convincing a user to interact, and impact is confined to the victim's browser rather than the server. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; Patchstack is credited with the report.
GiveWP versions 4.17.0 and earlier are affected by an unauthenticated cross-site scripting (XSS) vulnerability that allows remote attackers to inject arbitrary JavaScript into a victim's browser when the victim visits a crafted page or link. The attack requires user interaction (UI:R), which limits automated mass exploitation and makes this a moderate-priority issue rather than an emergency. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS score is 7.1.
Unauthenticated cross-site scripting in the LearnPress WordPress plugin through version 4.4.9 allows remote attackers to deliver script payloads that execute in a victim's browser once the victim is induced to interact with attacker-controlled input, typically by clicking a crafted link or rendering injected content produced by the plugin. No authentication is required to reach the vulnerable code (PR:N), but exploitation is not zero-click because it depends on victim interaction (UI:R); any publicly reachable WordPress site running a vulnerable LearnPress release is a candidate target in its default configuration. Patchstack reported the issue as a WordPress plugin XSS, no CISA KEV listing or EPSS score was supplied with the intelligence, and there is no public exploit identified at time of analysis.
Incorrect DMA mmap handling in the Linux kernel's IB/hfi1 Omni-Path driver (PIO_CRED case) lets a local, authenticated user with access to the HFI character device crash the kernel with a corrupted page-table oops or, once only the offset arithmetic is corrected, permanently stall send-PIO transfers. Kernels from 6.3 onward that include the hfi1 driver are affected, but the fault is intermittent-it appears only when the hardware send-context index reaches 64 or 128-and requires Intel Omni-Path 100 hardware plus the PSM2 path to invoke hfi1_file_mmap(). No public exploit code was identified at time of analysis, EPSS is low (0.18%, 6th percentile), and vendor-released fixes exist in 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4; given the local-only vector, mandatory specialized hardware and intermittency, overall risk is assessed as moderate rather than high-priority.
Devolutions Server versions up to 2026.3.7.0 contain a missing authorization flaw in the global vault that allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries. The issue requires valid credentials and a specific view grant, so it is primarily an insider or compromised-account risk rather than unauthenticated remote exploitation. No public exploit code has been identified, EPSS is low (0.17%), and the vendor has released a patch in version 2026.3.8.
An out-of-bounds read in the Linux kernel's legacy libipw 802.11 stack allows an unauthenticated attacker within wireless range to make affected systems walk roughly 64 KiB past the end of a received management frame buffer. Only machines using the legacy Intel PRO/Wireless ipw2100 or ipw2200 drivers are exposed, because those receive paths validate just the generic 24-byte three-address management header while libipw_process_probe_response() and libipw_network_init() assume the full 36-byte beacon/probe-response prefix; the length arithmetic then underflows and is truncated to 65524. The resulting flaw yields limited information disclosure (C:L) and a high availability impact via kernel crash (A:H) against adjacent-network attackers, though it is sharply constrained by the obsolete hardware requirement. Risk signals are low: EPSS is only 0.17% (6th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis.
Out-of-bounds reads in the Linux kernel's legacy libipw 802.11 management-frame parser, reachable through the ipw2100 and ipw2200 wireless drivers, let an unauthenticated attacker within wireless range crash the kernel by injecting a crafted association response that is shorter than the fixed 30-byte prefix. The root cause is an unsigned integer underflow: stats->len (u16) minus sizeof(*frame) (size_t) is evaluated in size_t and wraps, so the truncated u16 length handed to libipw_parse_info_param becomes a value near 64 KiB and the information-element parser walks well past the receive buffer. Exploitation requires the obsolete Intel PRO/Wireless 2100 or 2200BG hardware and driver stack to be present and processing association responses, so the realistic outcome is a denial-of-service kernel crash with only limited disclosure potential; no public exploit code has been identified at time of analysis, no KEV entry exists, and EPSS is a low 0.17% (6th percentile), while vendor-released patches are available in the 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4 kernels.
Local use-after-free in the Linux kernel's dma-buf/dma-fence subsystem lets a low-privileged local user with access to a fence-exposing interface (DRM/GPU, sync_file, or other DMA-buf consumers) read freed kernel memory when a fence's timeline or driver name string is retrieved concurrently with the fence being signaled. The regression was introduced by an earlier NULL-pointer dereference fix that replaced the signaled-bit check with an ops-pointer check, which is insufficient because many dma_fence implementations never clear the ops pointer on free and thus lose the RCU protection that keeps the returned string alive. Impact is a kernel crash (denial of service) or disclosure of freed heap contents; exploitation requires local device access and winning a narrow race, and no public exploit has been identified at time of analysis (EPSS 0.16%, 5th percentile; no CISA KEV listing).
Integrity and availability tampering in Dell Container Storage Modules before 1.18.0 stems from use of insufficiently random values (CWE-330), allowing a local attacker to corrupt integrity-sensitive data or disrupt availability on a host or Kubernetes node running the modules. Exploitation requires local access (AV:L) and no user interaction; the CVSS 7.1 vector rates integrity and availability impact high while confidentiality is unaffected. No public exploit has been identified at time of analysis - EPSS is 0.16% (4th percentile) and CISA SSVC marks exploitation as none - making this a moderate, low-priority issue; the vendor's 'unauthenticated' wording conflicts with the PR:L vector and should be verified against Dell DSA-2026-448.
Broken access control in Gitea's push-mirror API (CVE-2026-86684) lets an authenticated repository administrator push a repository's refs into an existing Git repository located on the server's local filesystem, using the permissions of the Gitea process rather than the caller's own privilege. Exploitation requires three conditions to hold simultaneously: the instance must be configured with [security] IMPORT_LOCAL_PATHS = true (not a default setting), the attacker must hold repository-administrator rights on a repository whose owner holds the AllowImportLocal permission (the owner's permission is what the flawed check inspected), and a writable Git repository must already exist at the chosen path. The integrity-only impact (CVSS 3.1 7.1, AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N as independently assessed) and non-default prerequisites mean real-world risk is lower than the headline score implies; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is 0.15% (3rd percentile).
Gitea 1.27.3 and earlier misattributes the pushing identity to the repository owner whenever a git push is authenticated with a repository deploy key, causing the pre-receive hook pipeline to evaluate permissions against the owner rather than the deploy key. An attacker holding a write-enabled deploy key can therefore create protected tags despite not being on the tag allow list, or flip repository visibility (for example private to public) through git push options, and pull requests created via the AGit flow are likewise attributed to the owner. Access is gated: a read-only deploy key is insufficient, exploitation requires an authenticated push (CVSS PR:L), no public exploit code has been identified at time of analysis, EPSS is only 0.15% (3rd percentile), and CISA SSVC rates exploitation as none with partial technical impact.
Reflected cross-site scripting in the Tomlister Payflex Payment Gateway WordPress plugin (versions through 2.7.1) lets remote attackers inject script into a page generated by the plugin, which then executes in the browser of any victim who is persuaded to open a crafted URL. The CVSS vector requires user interaction (UI:R) and carries a scope change (S:C), so the practical payoff is theft of session or authentication tokens and manipulation of the rendered payment/admin page rather than any server-side compromise, with the highest value realized when the victim is a privileged WordPress user. There is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing); no EPSS score was provided in the source data.
Unauthenticated reflected cross-site scripting (XSS) in the WordPress plugin Real 3D FlipBook versions 5.5 and earlier allows remote attackers to inject arbitrary script into a victim's browser session via a crafted link, requiring user interaction (UI:R) such as clicking the link. No authentication is required (PR:N), and the flaw is network-reachable (AV:N) with low complexity (AC:L), but impact is limited to the victim's browser context with no server-side compromise. Our independent assessment adjusts the availability impact to none (A:N), yielding a CVSS 3.1 base score of 6.1 rather than the vendor's 7.1; no public exploit code or active exploitation is identified at time of analysis.
Qualcomm Snapdragon firmware skips authentication and cryptographic signature checks when processing non-ELF partition images, allowing an attacker with local low-privileged access to stage and mount unsigned or corrupted images that the device then trusts. The flaw carries a 7.1 CVSS score (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H) and maps to CWE-347; no public exploit code and no CISA KEV entry were identified at time of analysis, and because exploitation is not remote and requires an existing on-device foothold or physical/debug access, it is a moderate-priority local issue rather than a mass-exploitation threat.
Crafted HTTP requests sent by an unauthenticated wireless client associated to a captive-portal-enabled SSID can crash the Captive Portal service on affected Arista Wi-Fi access points, and a sustained low-rate flood of such requests can keep the portal persistently unavailable (CVSS 7.1, availability-only, no confidentiality or integrity impact and no remote code execution). Exploitation is limited to the wireless adjacency: the attacker must be within RF range and associated to a captive-portal SSID, and access points without Captive Portal configured are not exposed. Because the portal process restarts automatically after each crash, a single request is self-healing; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation.
A crafted HTTP request from an unauthenticated wireless client associated to a Captive-Portal-enabled SSID can crash the Captive Portal service on Arista Wi-Fi access points, causing a temporary denial of service until the service automatically restarts. Exploitation requires the Captive Portal feature to be explicitly enabled (non-default) and the attacker to be within wireless range; it is not reachable from the general internet. The vendor confirms remote code execution is not possible, and no public exploit code has been identified at time of analysis.
Authenticated SQL injection in the Arista CloudVision CUE API allows a network user with valid credentials to degrade backend availability by supplying malicious values in specific request parameters that lack proper validation. The CVSS 4.0 score is 7.1 (High), driven entirely by high availability impact (VA:H) with zero confidentiality or integrity impact (VC:N/VI:N), which is atypical for SQL injection. No public exploit code has been identified at time of analysis, and exploitation requires prior authentication (PR:L).
Authenticated users of the Arista Spectralight WiFi-server application can submit crafted XML requests that trigger external-entity resolution and disclose arbitrary local files from the server, with a secondary partial denial-of-service effect from entity processing. Exploitation requires valid credentials (CVSS 4.0 vector shows PR:L; the independent assessment concurs with PR:L) and network reach to an XML-accepting endpoint, so the realistic threat population is insiders or attackers who have already obtained an account rather than unauthenticated internet scanners. No public exploit code and no CISA KEV listing were identified at time of analysis, and the issue is rated CVSS 7.1 / CWE-611 - a moderate-severity, authentication-gated information-disclosure flaw rather than a top-tier emergency.
Unauthenticated attackers with adjacent-network access can crash the TDP daemon on TP-Link Tapo C500 v2.0 cameras by sending a single crafted UDP datagram, causing a denial-of-service condition. The flaw is an out-of-bounds function-pointer dispatch (CWE-823) that triggers an invalid indirect call, and the CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H) plus our independent CVSS 3.1 assessment (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) confirm only availability is impacted-no data disclosure or code execution. No public exploit code or active exploitation is identified in the provided data, but the vendor has released a patch; the attack requires Layer-2 adjacency and no authentication, session, or pairing.
Quasar Framework's development-only SSR/SSG error handler (@quasar/render-ssr-error before 2.2.4 and @quasar/app-vite before 3.3.0) serializes the developer's shell environment variables, request headers, and cookies into the HTML error page produced by serve.devError(), and because the dev server listens on all interfaces by default, any network-adjacent client that can provoke a render failure can read those secrets without authentication. The same page escaped only the exact lowercase '</script>' spelling, so case variants or alternate closing-tag delimiters reflected in diagnostic data can terminate the script element and inject markup; for that injected code to execute in a browser it must accompany the developer's own request, which is why user interaction and high attack complexity apply. The issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0 (commit 61c2bd8, advisory GHSA-r5mf-4r5x-q78f); no public exploit identified at time of analysis, and production SSR builds are unaffected - this is a developer-workstation-scoped risk rather than a broad production threat.
Path traversal in @quasar/icongenie versions before 6.1.1 lets a crafted profile cause the icongenie generate --profile command to write generated image content to any path writable by the invoking developer, enabling overwrite of shell startup files, build scripts, or other executable configuration. Exploitation requires the developer to run the command against an attacker-supplied profile (UI:R) and gives no direct remote access; no public exploit code identified at time of analysis, and the issue is fixed in 6.1.1.
A label-enforcement bypass in the External Secrets Operator (ESO) webhook generator lets any Kubernetes principal that is permitted to create webhook generator resources point a generator at a victim's Secret that was never labelled for webhook use, and then have its contents exfiltrated to an attacker-controlled URL. The flaw affects ESO releases from 0.10.0 up to (but not including) 1.3.2 and stems from an initialization-order bug that cleared the EnforceLabels flag after it had been set, so the provider-side check for the external-secrets.io/type=webhook label was skipped instead of failing. Exploitation is conditional: it requires an affected version, the webhook generator feature in use, and delegated RBAC rights to create generators.external-secrets.io/v1alpha1 Webhook objects, which is why the assessed vector carries PR:L; clusters that never use webhook generators or that tightly constrain generator creation are not exposed. No public exploit code was identified at time of analysis and the issue is not in CISA KEV, and a vendor patch is available in 1.3.2.
Arbitrary file read in Rundeck before 6.2.0 lets an authenticated user who holds only the project 'configure' ACL read any file on the server by setting the resources.source.N.config.file property to an absolute path outside the project directory, then retrieving the contents through the editProjectNodeSourceFile or apiSourceGetContent endpoints. Recoverable data includes database passwords, LDAP bind credentials and configuration belonging to other projects, making this a meaningful lateral-movement aid for anyone with delegated project administration rights; there is no user-interaction requirement and no non-default configuration needed. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing), but VulnCheck reported it and the vendor-released fix ships in Rundeck 6.2.0.
Refcount initialization ordering in the Linux kernel's RDMA iWARP port-mapper (iwpm) subsystem allows a local, low-privileged attacker to trigger a kref "addition on 0" race that can lead to premature object release and kernel memory corruption, rated 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Only systems that actually load and use the RDMA stack with iWARP port-mapper netlink traffic are exposed - the iwpm subsystem is not active on default desktop or server installs without InfiniBand/RDMA hardware or the software RDMA drivers (rxe, siw). Exploitation requires local code execution plus winning a narrow timing window on an SMP system, and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is 0.22% (11th percentile).
Stale sysfs attributes left behind by the Linux kernel's w83791d hwmon driver after unbind can expose freed memory to local users, because the normal remove path deletes only the w83791d_group but not the optional w83791d_group_fanpwm45 group created when the fan/pwm 4-5 pins are not used as GPIO. Callbacks on those leftover files dereference devm-allocated driver data that is released after unbind, creating a use-after-free condition. The flaw is local-only and highly conditional (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score 7.0): it requires a system physically equipped with the Winbond W83791D sensor chip, the fan/pwm 4-5 pins not configured as GPIO, and a driver unbind through the normal teardown path, and exploitation further depends on winning a race against the devm free. There is no public exploit identified at time of analysis, EPSS is low at 0.22% (11th percentile), and vendor patches are available in the stable trees.
A write use-after-free in the Linux kernel's XFRM (IPsec) state framework allows a local attacker who can add and delete xfrm states to corrupt freed slab memory, which in turn spawns a read use-after-free during state lookup. The defect is an incomplete fix: commit 14acf9652e56 switched the bydst/bysrc/byseq/byspi hash lists to hlist_del_init_rcu() but missed state_cache and state_cache_input, so a second __xfrm_state_delete() on the same state writes through the LIST_POISON2 pprev value instead of becoming a harmless no-op. Exploitation requires low privileges (CVSS PR:L, AV:L) - realistically the ability to manipulate xfrm state, normally gated by CAP_NET_ADMIN, which unprivileged users can obtain inside a user plus network namespace - and the attacker must win a timing-dependent delete/delete race (AC:H), so this is a real but not urgent kernel memory-corruption bug rather than a mass-exploitation priority: no public exploit identified at time of analysis, EPSS 0.21% (10th percentile), and no CISA KEV listing.
A stale virtual interface entry in the Linux kernel's mac80211 WiFi stack can drive the kernel into a BUG() at net/wireless/core.h:141 (wiphy_to_rdev) and crash or corrupt memory when a network namespace holding a wiphy is destroyed and the wiphy's migration back to init_ns fails on a memory-allocation error. Kernels with mac80211 loaded are affected from the 2.6.32-era lineage carrying commit 463d018323851a608eef52a9427b0585005c647f, with local exploitation requiring namespace-administration privileges (PR:L) plus a racy, largely attacker-uncontrollable allocation failure (AC:H) - CVSS 3.1 base 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), though independent assessment downgrades confidentiality and integrity to LOW while retaining HIGH availability impact. No public exploit code has been identified at time of analysis, the CVE is not in CISA KEV, and EPSS is only 0.18% (7th percentile), so the effective real-world priority is LOW despite the HIGH base score; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4.
A use-after-free in the Linux kernel's Soft-RoCE (rdma_rxe) driver allows a local user who can open the RDMA uverbs interface and issue ATTACH_MCAST on a UD queue pair to trigger freeing of a published multicast-group object while it is still reachable from the driver's mcg_tree, giving high confidentiality, integrity and availability impact (CVSS 3.1 base 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The race is only reachable when the backing Ethernet multicast programming step, rxe_mcast_add(), fails mid-operation (for example -ENODEV after the backing netdev is removed, or a propagated dev_mc_add() error), which is why the attack complexity is High and the practical priority is low. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (7th percentile), and vendor patches are available in mainline and multiple stable branches.
Network namespace teardown in the Linux kernel's cfg80211 wireless configuration subsystem can leave a wiphy (wireless device) pointing at a freed network namespace when the interface migration back to the initial namespace fails, producing a kernel mode fault (reported at address 0x30 via genlmsg_multicast_netns / nl80211_notify_wiphy / wiphy_unregister) and crashing the host. The independent assessment rates this availability-only (C:N/I:N/A:H) with AV:L/PR:L, meaning a local attacker with low privileges - CAP_NET_ADMIN or access to an unprivileged user namespace that permits netns creation - is required, and the attack is complicated because it depends on a memory allocation failure occurring at exactly the right moment. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile), consistent with a low-priority defensive fix rather than an imminent threat.
Local users with low privileges can drive the Linux kernel into a race condition in the RDMA/core helper ib_get_eth_speed(), which calls a net_device's ethtool callback after that device has already completed NETDEV_UNREGISTER and ndo_uninit during teardown, corrupting or crashing the kernel. Exposure is narrow: the host must have an active RDMA device bound to an Ethernet (RoCE) or InfiniBand link layer and that device must be unregistering while an asynchronous RDMA port query is in flight, so exploitation requires winning a tight timing window (upstream CVSS 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; the independent assessment keeps the same AV:L/AC:H/PR:L vector but rates confidentiality and integrity as low and availability as high). Vendor-released patches exist for stable branches 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8 (plus 7.3-rc4); no public exploit code or confirmed active exploitation is known, and EPSS is only 0.17% (5th percentile).
Authenticated (site-admin) users on MISP installations prior to commit 2ebf29f93 can repoint the application's Redis host settings for the core app, ZeroMQ plugin, and SimpleBackgroundJobs plugin to an attacker-controlled Redis server, because those settings are exposed through the web UI and API instead of being restricted to CLI configuration. Combined with a separate session-hijack primitive such as stored XSS, an attacker can then restart the background workers, which trust raw Redis job payloads without validation, and inject malicious jobs that execute with the privileges of the worker account - effectively remote code execution. Exploitation requires a hijacked site-admin session and an attacker-operated Redis instance, so it is a conditional rather than drop-everything risk; no public exploit code or confirmed active exploitation was identified at time of analysis, and the assessed CVSS:3.1 vector is AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.
Out-of-bounds kernel memory writes in the WibuKey driver for Windows below version 6.72 allow an authenticated, locally logged-on low-privileged user who can send input to the driver (for example via a device IOCTL) to crash the affected system and, under unfavorable kernel heap layouts, modify adjacent kernel memory. Because the flaw requires local access and authentication and depends on uncontrolled kernel memory layout, reliability is limited primarily to denial of service, with adjacent-memory modification explicitly conditional rather than a guaranteed outcome. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is local-only with no network vector.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
Unauthenticated information disclosure in the StylemixThemes Motors WordPress plugin (car dealership and classified-listings plugin, all versions through 1.4.124) allows any remote visitor to retrieve sensitive data that the plugin embeds into the responses it sends to clients - for example internal configuration values, tokens, or other embedded secrets surfaced in rendered pages or AJAX/REST output. The CVSS 4.0 base score of 6.9 reflects a network-reachable, no-privilege, no-user-interaction, no-configuration-dependency attack path where the only impact is low-sensitivity confidentiality loss (VC:L, with no integrity or availability effect and no subsequent-system impact). No public exploit code has been identified at time of analysis and the CVE is not associated with CISA KEV, so exploitation is not confirmed as active.
Denial of sign-in in Payload CMS before 3.90.0 (and canary releases before 4.0.0-canary.34) allows an unauthenticated remote attacker who already knows a valid account email address or username to deliberately trigger the account lockout mechanism of a local-authentication collection, preventing that specific user from logging in until the lock period expires. The flaw is rated CVSS 6.9 under CVSS 4.0 (independent assessment: CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N, availability-only impact) and requires no prior access, only knowledge of a valid identifier - arbitrary unknown accounts cannot be targeted and no data exposure, code execution, or persistence results. Vendor-released patch: 3.90.0 (canary 4.0.0-canary.34); no public exploit identified at time of analysis.
Session cookie and API token theft in NetBox versions 2.9.5 through 4.6.x lets an authenticated user holding the "Can add custom links" permission exfiltrate the credentials of higher-privileged users who merely view an affected object. The flaw exposes the raw Django HttpRequest object to the Jinja2 custom-link template context, so an attacker can embed request.COOKIES['sessionid'] or a victim's API token inside an <img src> URL that slips past the clean_html sanitizer and auto-transmits to an attacker-controlled host when a privileged user opens the page, enabling full account takeover. Exploitation is conditional: it requires a delegated custom-link permission (PR:L) and a privileged victim to passively trigger the payload (UI:P), and no public exploit has been identified at time of analysis; upgrading to NetBox 4.7.0, which substitutes a sanitized request subset, removes the exposure entirely.
Denial-of-service in ESET PROTECT On-Prem allows remote, unauthenticated attackers to exhaust CPU and RAM resources by sending crafted requests, leading to availability degradation. This moderate-severity issue affects the on-premises management console and requires network reachability to the server's listening service; no public exploit code has been identified, and a vendor patch is available per the ESET advisory. The CVSS 4.0 base score is 6.9, but our independent assessment rates it as a moderate availability-only risk (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Remote SQL injection in SourceCodester Simple Student Information System 1.0 via searchquery.php allows attackers to manipulate database queries and potentially read or alter application data, and the independent assessment rates this as a low-to-moderate real-world risk despite the network-reachable vector. The assessed CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, while the CVSS v4.0 score is 6.9; the PR:N/UI:N values indicate unauthenticated exploitation with no user interaction, but the search endpoint may sit behind an application login in common deployments, so defenders should confirm whether searchquery.php is reachable pre-authentication. No public exploit was identified at time of analysis.
Missing authorization in the PowerMax CSI Driver's csireverseproxy component of Dell Container Storage Modules before 1.18.0 allows unauthenticated attackers with adjacent-network access to perform unauthorized actions, with high confidentiality, integrity, and availability impact in a changed-scope CVSS 9.6 scenario. The flaw is only reachable from the cluster or storage-management network, not the public internet, and requires the PowerMax CSI driver to be deployed and network-exposed. No public exploit was identified at time of analysis and EPSS is low at 0.23% (13th percentile), while a vendor patch is available in 1.18.0.
LDAP query injection in Arista CloudVision CUE (versions 2021.2.0 through 2026.2.0) lets an unauthenticated network attacker manipulate directory-service queries when the appliance is configured to authenticate against an external LDAP directory. Exploitation is gated by high attack complexity (CVSS AC:H), meaning the attacker must land on specific conditions largely outside their control - such as a particular directory schema or query-construction path - and the resulting impact is confined to the confidentiality of the downstream directory service (scope-changed C:H), with no direct confidentiality, integrity, or availability effect on CloudVision CUE itself. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); EPSS data was not provided, and the issue should be treated as a moderate-priority hardening item rather than an emergency.
WordPress through version 7.1.2 contains an information disclosure flaw (CWE-201) that allows unauthenticated remote attackers to retrieve embedded sensitive data from server responses. The vulnerability, reported by Patchstack, has a CVSS 4.0 base score of 6.9, reflecting high exploitability but low confidentiality impact; no public exploit identified at time of analysis. The affected version 7.1.2 does not match any known public WordPress core release, so the actual vulnerable scope may be narrower or misreported.