Authenticated arbitrary file deletion in Payload CMS before version 3.90.0 (and canary releases before 4.0.0-canary.34) lets a user who can update or delete uploads stored on the local filesystem cause the file-cleanup routine to remove files outside the configured upload directory, resulting in data loss or service disruption. The flaw is a path traversal in the upload deletion logic that requires a valid account holding update/delete permission on an upload-enabled collection (CVSS 3.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, score 8.1), so it is not exploitable by anonymous visitors. There is no public exploit identified at time of analysis and the issue is not reported as actively exploited; deployments using cloud/object storage adapters or restricting upload management to trusted operators are largely unaffected. Vendor-released patches are available in 3.90.0 and 4.0.0-canary.34.
Authenticated users of Backstage Scaffolder can bypass administrator-configured action restrictions in @backstage/plugin-scaffolder-backend by supplying a restricted input value with different letter casing or as a different JSON type (for example a number instead of a string), causing permission checks to fail to match and letting the action execute with the backend integration's credentials. This can grant unauthorized access to repositories and related source-control resources, bounded by the privileges of the integration tokens attached to the affected actions. The issue affects versions before 3.3.1, 3.4.1, 4.0.3, and 4.1.0, and only matters in deployments that actually use input-value-based permission rules; no public exploit code has been identified at time of analysis.
Authenticated remote code execution in IBM Langflow OSS 1.0.0 through 1.12.2 lets any holder of valid credentials - even a low-privileged one - submit or edit a flow that reaches the server-side code-generation and execution path, resulting in arbitrary OS command execution on the Langflow backend. IBM scores it 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) and classifies the root cause as CWE-94 code injection; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so active exploitation is not confirmed. The decisive risk factor is deployment posture: internet-exposed or multi-tenant instances running with authentication disabled, default or shared credentials, or open self-registration collapse the PR:L barrier and behave like unauthenticated RCE targets.
Unauthenticated privilege escalation in the GiveWP WordPress donation plugin (versions up to and including 4.17.0) lets a remote attacker gain elevated privileges on a vulnerable site without any credentials or user interaction, consistent with the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The key mitigating nuance is the High attack complexity: success depends on preconditions the attacker cannot fully control, so this is a serious 8.1 High-severity issue rather than a trivially scriptable one. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but because it is unauthenticated and grants high confidentiality, integrity, and availability impact, sites running GiveWP 4.17.0 or earlier should treat it as urgent; sites that do not run the plugin or have already moved past 4.17.0 are not affected.
Improper authentication in the Backstage @backstage/plugin-auth-backend-module-oidc-provider package prior to 0.4.20 lets an authenticated user of a configured OIDC identity provider impersonate another catalog identity. Exploitation requires a deployment that resolves sign-in identities by matching the OIDC email claim AND an identity provider that issues email addresses without asserting email_verified=true, in which case the attacker's unverified, self-controlled email can match a victim's catalog identity and inherit that identity's access and permissions (CVSS 3.1 base 8.1, PR:L, no availability impact). No public exploit code has been identified at time of analysis, and the flaw is fixed by omitting the email from the default OIDC profile transform unless the provider explicitly marks it verified.
Insufficient audience validation in Backstage's Cloudflare Access auth provider package (@backstage/plugin-auth-backend-module-cloudflare-access-provider 0.1.0 through 0.4.x) lets a user who already holds a valid Cloudflare Access JWT issued for a different Access application inside the same Cloudflare Zero Trust team authenticate to Backstage, because the provider verifies the token signature and team issuer but never checks the token's audience (AUD) claim. Exploitation is conditional: the forged-context token must actually reach the Backstage auth endpoint on a path where Cloudflare Access has not already enforced the Backstage application's own AUD tag upstream, and the attacker must be an authenticated member of the shared Zero Trust team, which is why the assessed vector carries AC:H and PR:L and the resulting rating is a moderate, conditional authentication bypass rather than a top-tier priority. No public exploit code has been identified at time of analysis, and the issue is fixed in plugin version 0.5.0 (shipped with Backstage v1.55.0), where the 'audience' configuration value becomes mandatory.
Access-control bypass in SSSD lets an already-authenticated user from a trusted identity domain reach hosts and services that Host-Based Access Control (HBAC) rules are supposed to protect. Because SSSD strips the domain qualifier and compares only short usernames during HBAC evaluation, a trusted-domain user whose short name collides with an authorized local account is silently granted that local account's access. Publicly available exploit code exists, but exploitation is not automatable and EPSS is low at 0.28% (18th percentile); exposure is limited to trust-enabled FreeIPA/IdM-style deployments that delegate host access decisions to SSSD.
Unauthenticated PHP object injection in the Haaken WordPress theme affects all versions up to and including 1.5, allowing remote attackers to supply crafted serialized data to an unserialize() sink without any prior authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1). The conditional nature of the risk is captured by the AC:H rating: full impact (remote code execution or data compromise) generally depends on a usable POP gadget chain being present in the theme, WordPress core, or another installed plugin, so exposure is limited to sites actually running this theme at an affected version. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and several vectors beyond the single Patchstack advisory reference (EUVD-2026-93080) remain unpublished.
Unauthenticated privilege escalation in the SMS Alert Order Notifications WordPress plugin through 4.0.0 allows network attackers to obtain elevated privileges on affected sites, with the CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (base 8.1 High) indicating no authentication or user interaction but high attack complexity. The underlying issue is CWE-266 incorrect privilege assignment, and successful exploitation depends on a condition outside the attacker's control such as a race condition, predictable value, or specific plugin/site state; the exact trigger was not disclosed in the provided data. No public exploit identified at time of analysis.
Site isolation bypass in Google Chrome on Android (prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to reach the browser's Passwords component via a crafted HTML page and a missing authorization check, exposing stored credential data. The bug is a chained, second-stage issue: it cannot be triggered by an unprivileged remote attacker without pre-existing renderer code execution, and it requires user interaction to load the crafted page, which is why the assessed vector (AV:N/AC:H/PR:L/UI:R/C:H/I:N/A:N) makes realistic risk LOW despite the 8.1 base score. No public exploit identified at time of analysis, EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none, and Google rated the Chromium security severity Medium, so this is a routine patch-cycle fix rather than an emergency.
A use-after-free write in the Linux kernel's lan743x Ethernet driver (Microchip LAN7430/LAN7431) lets a packet that spans more than one RX buffer trigger a kernel memory corruption through a stale skb pointer in the checksum-success path of lan743x_rx_process_buffer(), with the flawed write landing on freed fragment skb metadata. According to the vendor description this multi-buffer condition only arises transiently after an operator performs a live MTU increase, because existing ring entries retain their old, smaller buffer size until they are replenished; the vulnerable driver must be present and the host must be using that specific Microchip hardware. Vendor patches are available in the stable trees (6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4), EPSS is low at 0.18% (7th percentile), and no public exploit code or CISA KEV activity was identified at time of analysis; our independent assessment rates real-world priority LOW despite the vendor-supplied 8.1 CVSS because exploitation is gated on hardware, a concurrent operator-initiated MTU change, and a short-lived window.
Confused-deputy bypass in Google Chrome's Contextual Tasks feature allows a remote attacker who already holds renderer code execution to cross a security boundary into a privileged page by loading a crafted HTML page, with high confidentiality and integrity impact (unauthenticated per the CVSS vector, but requiring user interaction). The flaw affects Chrome builds prior to 155.0.8059.39 and functions primarily as a chain link - the prerequisite renderer compromise from a separate bug is the real gate, which sharply narrows standalone risk despite the 8.1 score. No public exploit code has been identified at time of analysis and EPSS is very low at 0.18% (7th percentile), with CISA SSVC recording no observed exploitation; a vendor-released patch exists in 155.0.8059.39.
Site isolation bypass in Google Chrome versions earlier than 155.0.8059.39 lets a remote attacker who has already compromised a renderer process escape Chrome's process boundary and reach data or privileged accessibility functionality belonging to other origins by way of a crafted HTML page the victim loads. The flaw is an incorrect-authorization bug (CWE-863) in the browser's Accessibility component, making it a chained, second-stage primitive rather than a standalone remote compromise, which is why the assessed vector uses AC:H (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) despite an underlying base score of 8.1. Google has released a vendor patch in 155.0.8059.39; no public exploit code and no confirmed active exploitation were identified at time of analysis (EPSS 0.18%, CISA SSVC exploitation: none, automatable: no), so the risk is real but is not currently a frontline emergency.
Kernel memory corruption in the Linux CIFS/SMB client (cifs.ko) allows a malicious or compromised SMB server to have a channel and its primary server structure freed while the client still dereferences them, producing a use-after-free that crashes the kernel and can expose or corrupt freed memory. Exposure is limited to clients that mount a share from an attacker-controlled server with SMB multichannel in use: the vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H) indicates no client-side credentials are required, but the victim must initiate the mount and the bug depends on a race/teardown timing window, so the net real-world risk is lower than the 8.1 base score suggests. No public exploit code is identified at time of analysis, EPSS is 0.18% (6th percentile), and vendor-released patches exist for the affected stable branches.
Broken access control in Gitea up to and including 28.0.0 allows an authenticated repository collaborator who holds write access to the Code unit (but not Releases write access) to permanently delete published releases and their attachments by sending a single POST to /{owner}/{repo}/tags/delete against the release's tag. The flaw is rated CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H per the assessed vector), reflecting high integrity and availability impact with no confidentiality loss, and exploitation requires the attacker to already be a trusted collaborator on the target repository rather than an anonymous outsider. There is no public exploit code identified at time of analysis, CISA KEV does not list it, SSVC rates exploitation as none and automatable as no, and EPSS is low at 0.17% (6th percentile).
Site isolation bypass in Google Chrome affects versions prior to 155.0.8059.39, where a missing authorization check (CWE-862) in the browser's Workers implementation lets an attacker who has already compromised a renderer process cross the site-isolation boundary using a crafted PDF file. The attack is remote (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1), but exploitation is gated on a pre-existing renderer foothold obtained through a separate vulnerability, so this is a chained sandbox/site-isolation escape rather than a standalone remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (5th percentile), and CISA SSVC rates exploitation as 'none' with automation as 'no', while acknowledging total technical impact if the chain is completed. A vendor patch is available in Chrome 155.0.8059.39.
Blind SQL injection in LogicalDOC Enterprise up to and including 9.1.1 lets an authenticated user inject arbitrary SQL through the workflow template name parameter processed by the WorkflowsDataServlet, potentially exposing or tampering with the backend database that stores documents and metadata. Exploitation requires a valid account that can create or submit a workflow template (PR:L; no administrative role, no victim interaction), so realistic exposure is limited to insiders or attackers who already hold credentials against a niche document-management deployment. EPSS is low at 0.17% (5th percentile), the product is not in CISA KEV, and no public exploit has been identified at time of analysis.
A teardown race in the Linux kernel's iSER target (ib_isert) frees the isert_conn and iscsit_conn structures while a deferred control PDU completion is still queued on isert_comp_wq, so isert_put_cmd() later dereferences freed memory - a slab use-after-free (KASAN splat) rated CVSS 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) because it can in principle lead to kernel code execution, data disclosure, or a crash. Exposure is limited to hosts that run the LIO iSER target with the ib_isert module loaded and export an iSER/RDMA transport over an InfiniBand or RoCE fabric; the CVSS vector shows no authentication prerequisite (PR:N), but the attacker must win a narrow race between connection teardown and the workqueue handler, a window so tight that the reporter needed an injected msleep(200) to reproduce it reliably. No public exploit code and no CISA KEV entry are associated with this issue, EPSS is only 0.16% (5th percentile), and vendor-released stable patches are available.
Gitea through 1.27.3 fails to revoke per-unit repository access when an organization team is demoted through the REST API, so existing team members silently keep their previous unit permissions - including write access to the team's repositories - after an owner lowers the team level (for example admin to read). The flaw is CWE-272 Incorrect Privilege Assignment: a PATCH that supplies only the permission field updates the team's access mode but never rebuilds its per-unit grants nor applies the new level as a cap, and exploitation requires an authenticated organization owner to make that API call plus a team that already holds per-unit repository permissions, with the CVSS vector (PR:L) confirming an authenticated beneficiary; the web form path is not affected. Vendor scoring is 8.1 with high confidentiality and integrity impact, while EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis; upgrading to Gitea 28.0.0 restores the intended cap behavior.
Unauthenticated attackers who can reach Gitea's web installer on an instance whose INSTALL_LOCK has been reset to false (or is otherwise unset) can obtain a fully authenticated session for any existing account - including an administrator - simply by submitting the install form with a username that matches that account, with no password verification whatsoever. Full administrative takeover follows, allowing the attacker to change the account's password and control the instance. The bypass only exists while the installer is network-reachable against a database that already contains users; the default hardened post-install state (INSTALL_LOCK=true) is not affected. Independent assessment rates this CVSS 8.1 (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H); EPSS is low at 0.16% (4th percentile) and no public exploit code has been identified at time of analysis.
Push mirror synchronization in Gitea 1.27.3 and earlier reuses a remote address that was validated against the [migrations] allow/block lists only once, at mirror-creation time, so a hostname that later resolves to a blocked or internal address is still handed to git push - a time-of-check/time-of-use flaw (CWE-367). An authenticated user who administers a repository (which includes any repository they create themselves) can therefore aim a push mirror at an internal Git service and force-push the repository's contents to it, assuming attacker influence over name resolution and a network-reachable internal endpoint. The assessed severity is high (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N) because scope changes and both confidentiality and integrity of internal Git services are affected, but no public exploit code has been identified at time of analysis and EPSS is low (0.12%, 2nd percentile), with SSVC recording no observed exploitation and a non-automatable attack path - a real but bounded risk rather than a mass-exploitation emergency.
Remote code execution (RCE) in WPShopmart Tabs Responsive plugin for WordPress (versions <= 2.5) allows an authenticated attacker with Editor-level privileges to execute arbitrary code on the server. This high-severity vulnerability (CVSS 8.0, CWE-94) requires high-complexity conditions (AC:H) and no user interaction (UI:N). No public exploit code has been identified at time of analysis; risk is concentrated on multi-user sites where untrusted users have elevated editing roles.
Unauthenticated SQL injection in the eLoanApp Platform's AJAX user-verification endpoint allows remote attackers to inject boolean- and time-based payloads into the POST parameter 'logina', enabling database engine discovery and query delays. The affected product is RDL Technologies eLoanApp Platform as represented by CPE cpe:2.3:a:rdl_technologies:eloanapp_platform:*:*:*:*:*:*:*:*, and the independent assessment scores this as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L, meaning network-reachable, unauthenticated exploitation with low confidentiality, integrity, and availability impact rather than full compromise. No public exploit identified at time of analysis, and the practical risk is moderate because blind extraction is slow and noisy, making large-scale data theft time-consuming and more detectable than error-based injection.
Configuration-controlled code execution in the hydra-optuna-sweeper package (Hydra 1.2.0 up to but not including 1.3.0, plus 1.4.0 development builds before 1.4.0.dev10) allows an attacker who controls Optuna sweep configuration or command-line overrides to name an arbitrary importable Python callable in hydra.sweeper.custom_search_space that Hydra resolves and then invokes inside the controller process at the application's privilege level, including bypassing the trusted execution whitelist introduced on affected 1.4.0 development releases. The assessed CVSS 3.1 vector is AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High): delivery is local and unauthenticated, but a victim must actually launch the sweep, after which confidentiality, integrity, and availability impact is total for the affected process. Exploitation is only meaningful where sweep configuration or overrides cross a trust boundary; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Use-after-free in the Linux kernel netfilter flowtable datapath allows a local, authenticated low-privileged user to potentially execute code, corrupt memory, or disclose information by winning a race condition against the RCU grace period. Affected are unpatched kernels in the 5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 7.2.x, 7.3-rc, and 6.18.x ranges before their respective fixes; systems without a configured netfilter flowtable offload are not exposed. No public exploit code has been identified at time of analysis, and the EPSS score is 0.22% (11th percentile), indicating low predicted exploitation activity; vendor patches are available.
Local use-after-free in the Linux kernel's virt_wifi virtual wireless driver (CVE-2026-98311) lets a low-privileged local attacker with network-admin capability corrupt kernel memory, causing a crash and potentially enabling code execution in kernel context. virt_wifi_newlink() propagates the lower device's operstate before the new netdevice is registered, so a dormant lower device queues the still-uninitialized netdev on the linkwatch event list; if registration later fails - attacker-controllable by supplying an interface name such as 'bad/name' - free_netdev() releases the object and the subsequent linkwatch_fire_event() dereferences freed memory. Exposure is narrow: exploitation is strictly local, requires CAP_NET_ADMIN (attainable via user namespaces on some distributions) plus the rarely deployed virt_wifi module, no public exploit code has been identified, CISA KEV does not list this issue, and EPSS is only 0.22% (11th percentile).
Local privilege escalation and code execution in Dell System Update (DSU) versions prior to 2.3.0.0 allows an authenticated, low-privileged local user to supply a crafted pathname that escapes the directory DSU intends to restrict, causing the elevated DSU process to read, write, or execute content from an attacker-controlled location. Exploitation yields complete loss of confidentiality, integrity, and availability on the affected host (CVSS 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), but it is not remotely reachable and requires the attacker to already hold a local low-privileged account or code-execution foothold; no public exploit code has been identified at time of analysis, EPSS is low at 0.22% (11th percentile), and CISA's SSVC assessment rates exploitation as 'none' with automatable 'no'. Vendor-released patch: 2.3.0.0.
Use-after-free in the Linux kernel's IPsec/xfrm receive path (xfrm_input) can be triggered by a local attacker with low privileges on hosts that run IPsec with VTI tunnels or XFRM interfaces configured. The receive callbacks for VTI and XFRM interfaces - as well as the XFRM_MAX_DEPTH error path - call secpath_reset(), which can drop the last reference to an xfrm_state that xfrm_input() subsequently dereferences when selecting transport_finish() or reporting the drop-callback protocol; if that state is concurrently deleted, the freed object is accessed, yielding memory corruption with high confidentiality and integrity impact. Successful exploitation requires winning a race between secpath_reset() and concurrent xfrm_state teardown, so the assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (note the high attack-complexity, which differs from the NVD-published AC:L value); EPSS is low at 0.21% (10th percentile), there is no KEV listing, and no public exploit identified at time of analysis.
Deserialization of untrusted data in NVIDIA Model-Optimizer (CVSS 3.1 base score 7.8) allows an attacker who supplies a crafted model artifact to achieve code execution, data tampering, denial of service, and information disclosure on the machine that loads it. The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) shows the severity comes from full loss of confidentiality and integrity once the payload runs, but the attacker must first get the victim to open or deserialize the malicious artifact in a local processing environment, so there is no remote, zero-interaction path. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so this is a credible but priority-setting issue for ML/AI pipelines that ingest third-party models rather than an emergency remote-exploitation case.
Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
Code injection in the Hydra configuration framework (all releases prior to 1.3.6 and 1.4.0.dev9) lets an attacker who controls the application's Hydra logging configuration name an arbitrary importable class or factory that Hydra will then import and invoke with the application's own privileges. Hydra routes logging settings to Python's logging.config.dictConfig() without applying its own target policy, so the handler 'class' values and the formatter, filter, handler, queue and listener factories are resolved and called directly - this bypasses the _target_whitelist_ protection that otherwise guards instantiate(), meaning even hardened deployments are exposed. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): a local, unprivileged attacker must plant malicious logging configuration (a config file, an override, or a shared/untrusted config source) and the victim must then run the Hydra application, yielding high confidentiality, integrity and availability impact; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but exploitation only requires that the victim execute the tampered configuration.
Hydra 1.3.4 through 1.3.5 and the 1.4.0.dev line prior to 1.4.0.dev9 can execute attacker-chosen code when an application runs Hydra's instantiate() on configuration an attacker can influence, because the callable blacklist added for CVE-2026-68508 is name-based and can be sidestepped via wrappers, aliases, dispatch helpers, or deferred invocation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) indicates no attacker privileges are required but a victim application must actually instantiate untrusted or externally sourced config, which is why user interaction is scored; the flaw is CWE-184 (Incomplete List of Disallowed Inputs) and is best understood as an incomplete fix rather than a new class of bug. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and vendor-released patches exist in Hydra 1.3.6 and 1.4.0.dev9. Applications that only ever instantiate developer-authored, trusted configuration are not exposed, and the vendor explicitly documents the blocklist as a best-effort defense-in-depth stopgap rather than a security boundary.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper runlist locking in the Linux kernel's NTFS driver allows a local attacker who can perform file and attribute operations on a mounted NTFS volume to race the cluster-freeing and runlist-truncation paths, potentially corrupting runlist and on-disk mapping-pair state and achieving high confidentiality and integrity impact inside the kernel (NVD score 7.8; our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local-only with a timing-dependent trigger). The flaw is that ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock without holding it, and ntfs_attr_map_cluster() can merge a newly allocated run before a mapping-pairs update that may fail, with the rollback path itself able to fail and force the volume into an error state. EPSS is low at 0.16% (5th percentile), no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the affected NTFS driver is not enabled or mounted by default on most Linux servers, which materially limits real-world exposure.
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.