Use-after-free in the Linux kernel's drm/ttm graphics memory manager (a regression introduced by commit b2ed01e7ad3d, present in roughly 7.0.10 through 7.1 and in stable backports such as Ubuntu 7.0.0-31) allows a locally authenticated user with an active GPU workload to crash the kernel minutes to hours after a swapout event. Because ttm_bo_swapout_cb() skips the bulk_move bookkeeping on successful swapout, a swapped-out resource stays on its buffer object's bulk_move range and on the manager LRU while being unevictable; when it is later freed or the BO leaves the bulk_move, ttm_resource_del_bulk_move() skips it due to its unevictable guard, leaving a dangling cursor that the next ttm_lru_bulk_move_tail() or ttm_resource_add_bulk_move() dereferences. Exploitation requires local presence, an affected AMD/drm-ttm system, and timing-dependent hibernation or memory-pressure conditions (the reporter observed crashes in only 5 of 18 hibernation cycles), and no public exploit code has been identified at time of analysis; EPSS is 0.20% (9th percentile), signalling low near-term exploitation likelihood.
A race condition in the Linux kernel networking stack (sock_gettstamp()) allows a local, authenticated unprivileged user to trigger a slab-use-after-free in the UDP receive path by issuing a SIOCGSTAMPNS_NEW socket-timestamp ioctl on a UDP socket concurrently with a bind() on that same socket. Because sock_enable_timestamp() modifies sk->sk_flags with non-atomic bit operations while the SIOCGSTAMPNS_NEW path does not hold the socket lock, the concurrent read-modify-write can silently drop the SOCK_RCU_FREE bit that udp_lib_get_port() had just set, causing sk_destruct() to free the socket immediately instead of after an RCU grace period while lockless receive lookups still hold a pointer to it. Exploitation is local-only and requires winning a narrow timing window (our assessment rates it AV:L/AC:H/PR:L, versus the vendor-published CVSS 3.1 score of 7.8 with AC:L), EPSS is low at 0.18% (7th percentile), there is no KEV listing and no public exploit identified at time of analysis, and vendor-released patches exist for the affected stable branches.
A race-condition use-after-free in the Linux kernel's RDMA user-space connection manager (ucma) allows a local user who can open /dev/infiniband/rdma_cm to corrupt kernel memory and potentially escalate privileges. Two concurrent JOIN_MCAST calls for the same multicast address, combined with a forced copy_to_user() failure, can leave a queued RoCE work item dereferencing a ucma_multicast structure that another thread has already freed, because ucma_process_join() dropped ctx->mutex after a successful join and reacquired it only on error. No public exploit code or confirmed active exploitation has been identified at time of analysis (CISA KEV: not listed), EPSS is a low 0.18% (7th percentile), and real-world risk is limited by the requirement for local RDMA/RoCE configuration plus a narrow timing window - so despite the 7.8 base score this is a LOW-priority issue in practice.
A race condition in the Linux kernel's Open vSwitch conntrack label handling lets a local user trigger a read of a reallocated-and-freed conntrack extension block, which can leak kernel memory or corrupt state in the OVS datapath. ovs_ct_get_conn_labels() added a label extension even to already-confirmed conntrack entries, so a lockless reader on another CPU could dereference storage that was freed underneath it; the fix restricts extension insertion to unconfirmed conntracks and makes a label operation on a label-less confirmed conntrack fail instead. The flaw exists in kernels carrying the OVS conntrack labels feature (introduced around Linux 4.3) and is fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8 and 7.3-rc4. Exploitation is local and authenticated (CVSS:3.1/AV:L/AC:H/PR:L/UI:N per the independent assessment), requires OVS with connection tracking and labels actively configured, and depends on winning a narrow timing window; EPSS is 0.18% (7th percentile) and there is no CISA KEV entry or public exploit identified at time of analysis.
Out-of-bounds memory reads in the Linux kernel's IPv6 XFRM local path allow a locally authenticated attacker who can trigger specific XFRM/IPsec routing conditions to miscast a TCP request socket as a full IPv6 socket, disclosing kernel heap memory. The flaw affects Linux 3.2 and later and is triggered only when IPv6 XFRM tunnel routes are configured, an IPv6 TCP service emits SYN-ACKs, and rerouting selects a lower-MTU tunnel so the local PMTU or local error callback runs while the skb is still owned by a TCP_NEW_SYN_RECV request_sock. It requires local access with low privileges (CVSS vector PR:L, AV:L); there is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and CISA KEV does not list it. Vendor patches are available, and the timing-dependent, non-default XFRM configuration substantially narrows the realistic attack surface below what the raw 7.8 score suggests.
A use-after-free and RCU-safety defect in the Linux kernel's IPsec/xfrm transport-mode packet reinjection path can crash or corrupt the kernel, and is reachable by a local low-privilege attacker (CVSS PR:L) who can also trigger network device unregistration. The flaw was introduced when xfrm_trans_reinject() was converted from a tasklet to a workqueue (commit 4f4920669d21), so finish callbacks such as ip6_rcv_finish() now run in process context without an RCU read-side critical section, and queued skbs may hold non-refcounted dst entries whose skb->dev is not kept alive while deferred. Our independent assessment scores this CVSS 3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (availability-only, high attack complexity), and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (7th percentile) and no CISA KEV listing exists.
Use-after-free in the Linux kernel's POSIX CPU-timer cleanup path during exec() can corrupt kernel memory and, under the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), potentially lead to local privilege escalation or arbitrary code execution in kernel context. The flaw exists in kernels from Linux 5.7 onward and is triggered when a non-leader thread that has armed a CLOCK_THREAD_CPUTIME_ID timer calls execve(), the exec later fails after bprm->point_of_no_return, and the task is forced into do_exit() before begin_new_exec() reaches posix_cpu_timers_exit(), freeing a k_itimer whose node is still queued in an rbtree. Exploitation requires local code execution as an unprivileged user and winning a narrow timing race around a failing exec path, so it is not remotely reachable; EPSS is low (0.18%, 6th percentile) and no public exploit has been identified at time of analysis, while vendor-released patches exist in 6.6.158, 6.12.112, 6.18.54 and 7.2.8.
Incorrect page-frame/offset bookkeeping in the Linux kernel's swiotlb bounce-buffer code (swiotlb_bounce) can place DMA copies one page away from the intended location whenever a non-zero tlb_offset, produced by partial syncs through dma_sync_single_range_for_cpu()/for_device(), crosses a page boundary. Affected are kernels with swiotlb bounce buffering plus meaningful highmem (typically 32-bit or large-memory builds); because the offset and the page frame are taken from mismatched values, DMA_FROM_DEVICE can overwrite the wrong page while leaving the intended page stale, and DMA_TO_DEVICE can feed data from a page the mapping may not cover, and a lowmem-recorded slot can even be adjusted into highmem and then passed to phys_to_virt(). The assessed vector is local, PR:L (authenticated local access), with AC:H reflecting that the flaw is dormant for aligned full-buffer DMA and needs a DMA pattern that produces a page-crossing offset, so although confidentiality, integrity and availability impact are all rated High, reliable targeted exploitation is difficult; no public exploit code has been identified at time of analysis and EPSS is low at 0.18% (6th percentile), with no CISA KEV listing.
A use-after-free in the Linux kernel's cfg80211 wireless configuration subsystem can be triggered locally when a network interface is taken down while a scan is still running, causing cfg80211 to free a scan request that the Wi-Fi driver still believes it owns. Successful exploitation corrupts kernel memory reachable at scan completion (scan_done()), yielding high confidentiality, integrity, and availability impact, though the attacker must already hold local privileges sufficient to manage the wireless interface (CVSS PR:L) and must win a narrow asynchronous-cancellation race (assessed AC:H, versus the vendor's AC:L). There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (6th percentile).
Local privilege escalation in the Linux kernel futex subsystem (CVE-2026-98281) lets an existing local user with the ability to execute binaries corrupt or manipulate the per-mm private futex hash, potentially leading to full compromise of confidentiality, integrity and availability on the affected host. The flaw stems from the kernel failing to allocate the private futex hash when the mm is shared across a vfork() (or other CLONE_VM) boundary, so private futex waiters can exist before that hash is initialized; the fix closes this ordering window. Exploitation requires an authenticated local account (CVSS PR:L) and reliable triggering of the ordering condition, which our assessment rates as high attack complexity despite the vendor's base vector (AV:L/AC:H versus the published AC:L). There is no public exploit identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at roughly 0.17% (6th percentile), indicating a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency.
Use-after-free in the Linux kernel's POSIX CPU timer subsystem lets a local low-privileged user free a timer that is still queued on the expiry handler's private firing list, corrupting kernel memory and opening the door to privilege escalation or denial of service on kernels built from commit bf635681c906 onward (roughly 6.13 until the referenced stable fixes). Exploitation needs only the standard timer_create/timer_settime/timer_delete calls available to ordinary users, but it is gated by a narrow concurrency window that must be won (assessed CVSS:3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), which keeps real-world risk modest. No public exploit code or confirmed active exploitation is known and EPSS is 0.17% (6th percentile), while vendor patches are available.
Use-after-free write in the Linux kernel's signal delivery path lets a local, unprivileged user corrupt a freed POSIX timer sigqueue and potentially escalate privileges on the host. The race triggers when a non-leader thread calls execve() while a blocked SIGEV_THREAD_ID timer signal aimed at the old thread-group leader's TID is being flushed, so the kernel can re-queue the sigqueue onto a task::pending list that release_task()/exit_signals() is concurrently tearing down and then dereference the freed timer via a later tgkill(). Affected builds are those carrying the change that moved the sigqueue flush out of the sighand-locked region (EUVD lists Linux 6.15 era onward); exploitation requires local access and winning a timing/memory-ordering race, no public exploit code has been identified at time of analysis, the CVE is not listed in CISA KEV, and EPSS is 0.17% (6th percentile), so the practical concern is a HIGH-severity (7.8 base, C:H/I:H/A:H) local privilege-escalation primitive rather than mass exploitation.
A use-after-free race in the Linux kernel's RDMA/siw (SoftiWARP) driver lets a local, low-privileged user who can issue RDMA verbs operations corrupt kernel memory and potentially escalate privileges or crash the system. The bug is reachable when siw_qp_modify() fails inside siw_accept() and the QP's state_lock is released before the error path clears qp->cep, opening a window in which a concurrent ibv_modify_qp() transition to ERROR frees the same cep object. Exploitation requires the siw module to be loaded and a narrow race to be won, so practical risk is limited to environments using software RDMA; no public exploit code has been identified, EPSS is low (0.17%, 6th percentile), and the issue is not listed in CISA KEV, while vendor patches are available for all supported stable branches.
Use-after-free of GUP-pinned zerocopy page buffers in the Linux kernel's IPsec ESP out-of-place output path lets a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) who can send MSG_ZEROCOPY traffic over an ESP transform corrupt memory, potentially achieving privilege escalation (C:H/I:H/A:H), while the same code path simultaneously leaks an x->xfrag page per packet. Exploitation requires a host with IPsec ESP configured where esp->inplace == false and where the transmitted skb carries SKBFL_MANAGED_FRAG_REFS, so hosts without ESP or without zerocopy sends on that path do not reach the vulnerable frag mutation. No public exploit has been identified at time of analysis, the issue is not in CISA KEV, and the EPSS score is low (0.17%, 6th percentile), consistent with a moderate-priority local issue; vendor-released patches exist in 6.1.189, 6.6.158, 6.12.112, 6.18.54, 7.2.8, and 7.3-rc4.
Code injection in the Hydra configuration framework (all releases prior to 1.3.6 and 1.4.0.dev9) lets an attacker who controls the application's Hydra logging configuration name an arbitrary importable class or factory that Hydra will then import and invoke with the application's own privileges. Hydra routes logging settings to Python's logging.config.dictConfig() without applying its own target policy, so the handler 'class' values and the formatter, filter, handler, queue and listener factories are resolved and called directly - this bypasses the _target_whitelist_ protection that otherwise guards instantiate(), meaning even hardened deployments are exposed. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8): a local, unprivileged attacker must plant malicious logging configuration (a config file, an override, or a shared/untrusted config source) and the victim must then run the Hydra application, yielding high confidentiality, integrity and availability impact; no public exploit code has been identified at time of analysis and the flaw is not in CISA KEV, but exploitation only requires that the victim execute the tampered configuration.
Hydra 1.3.4 through 1.3.5 and the 1.4.0.dev line prior to 1.4.0.dev9 can execute attacker-chosen code when an application runs Hydra's instantiate() on configuration an attacker can influence, because the callable blacklist added for CVE-2026-68508 is name-based and can be sidestepped via wrappers, aliases, dispatch helpers, or deferred invocation. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.8) indicates no attacker privileges are required but a victim application must actually instantiate untrusted or externally sourced config, which is why user interaction is scored; the flaw is CWE-184 (Incomplete List of Disallowed Inputs) and is best understood as an incomplete fix rather than a new class of bug. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, and vendor-released patches exist in Hydra 1.3.6 and 1.4.0.dev9. Applications that only ever instantiate developer-authored, trusted configuration are not exposed, and the vendor explicitly documents the blocklist as a best-effort defense-in-depth stopgap rather than a security boundary.
Local privilege escalation and data-corruption primitive in the Linux kernel's RDMA/rxe (Soft-RoCE) software-RDMA driver: a missing HMM_PFN_WRITE permission test in the on-demand-paging (ODP) write path lets an unprivileged local user who can register an ODP memory region over a PROT_READ file mapping direct incoming RDMA traffic (RDMA WRITE, RDMA READ responses, SEND payloads, atomics) through kmap into read-only page-cache pages without ever triggering copy-on-write, overwriting files the attacker only holds O_RDONLY - classically /etc/passwd or a setuid binary - in the same primitive class as Dirty COW and CVE-2022-2590. The flaw was introduced by commit 0b261d7c1cd3 ("RDMA/rxe: Break endless pagefault loop for RO pages"), which stripped the access-permission test from rxe_check_pagefault() and left only HMM_PFN_VALID, affecting kernels built from that baseline (reported as Linux 6.16 onward) until the stable fixes. Exploitation is bounded by configuration: the rxe/Soft-RoCE module is not loaded by default on typical servers, and the CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) confirms a local, authenticated attacker with low complexity but no network reach; EPSS is low at 0.16% (5th percentile), and no public exploit code or CISA KEV entry has been identified at time of analysis. Vendor patches are available.
A memory-corruption bug in the Linux kernel's PXA DMA engine driver (pxad) causes the software descriptor counter nb_desc to be double-counted, leading to out-of-bounds indexing and freeing of descriptors that were never allocated. Only systems running the Marvell PXA dmaengine driver (CONFIG_PXA_DMA / pxad) and built with gcc 15.1 or clang 22.1 or newer are affected, because the kzalloc_flex() conversion of pxad_alloc_desc() only updates the __counted_by counter when __builtin_counted_by_ref() is available. The flaw requires local access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8) and a low-privileged user able to trigger DMA descriptor allocation through a consuming client; EPSS is low at 0.16% (5th percentile), no public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
Memory corruption in the Linux kernel's SMB/CIFS client (cifs.ko) allows a local user with write access to a mounted share to trigger out-of-bounds writes and a massive heap/stack overflow by creating a native symlink whose absolute target lacks an NT drive prefix. Affected code ships in mainline Linux from 6.15.6 onward and is patched in 6.16, with stable backports in 7.2.8 and 7.3-rc4 per EUVD; exploitation requires a Linux client to have mounted a share using default settings (symlinkroot unset) and an attacker able to place a crafted symlink on that share, matching the assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector. Impact is high confidentiality, integrity and availability loss through kernel memory corruption, though EPSS is only 0.16% (5th percentile) and no public exploit code has been identified at time of analysis - no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Improper runlist locking in the Linux kernel's NTFS driver allows a local attacker who can perform file and attribute operations on a mounted NTFS volume to race the cluster-freeing and runlist-truncation paths, potentially corrupting runlist and on-disk mapping-pair state and achieving high confidentiality and integrity impact inside the kernel (NVD score 7.8; our independent assessment rates it CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, i.e. local-only with a timing-dependent trigger). The flaw is that ntfs_non_resident_attr_shrink() calls runlist helpers that require the runlist write lock without holding it, and ntfs_attr_map_cluster() can merge a newly allocated run before a mapping-pairs update that may fail, with the rollback path itself able to fail and force the volume into an error state. EPSS is low at 0.16% (5th percentile), no public exploit code and no confirmed active exploitation have been identified at time of analysis, and the affected NTFS driver is not enabled or mounted by default on most Linux servers, which materially limits real-world exposure.
A race condition in the Linux kernel's mxl862xx DSA driver for MaxLinear MxL862xx Ethernet switches allows a stats-polling delayed work item to execute against already-freed dsa_port structures, yielding a use-after-free with high confidentiality, integrity and availability impact. The flaw is reachable only by an authenticated, highly privileged local actor (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H per independent assessment) who can drive a teardown path - switch unregister, driver shutdown, driver unbind, or a failed dsa_register_switch() during probe - and simultaneously win a narrow timing race, since the WORK_STOPPED flag test is not atomic with cancel_delayed_work_sync(). Exploitation additionally requires kernel builds compiled with the mxl862xx driver and actual MaxLinear MxL862xx switch silicon present and bound, so practical exposure is limited; there is no public exploit identified at time of analysis, EPSS is a low 0.16% (5th percentile), and the issue is not in CISA KEV.
A use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) memory-region re-registration path lets a local attacker who can reach the RDMA user-verbs character device corrupt kernel memory and potentially achieve privilege escalation, scored CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The bug is reachable only when rxe_rereg_user_mr() is called with both IB_MR_REREG_PD and IB_MR_REREG_ACCESS set while supplying an access bit outside RXE_ACCESS_SUPPORTED_MR, causing the protection domain to be reassigned without the core's use-count being rolled back and leading to a protection domain (and a memory window still referencing it) being freed while in use. Exploitation is realistically narrow: the rdma_rxe module must be loaded and an rxe device configured (not a default configuration), the attacker needs local device access, and an existing memory window must reference the PD; no public exploit code was identified at time of analysis and EPSS is low at 0.16% (4th percentile).
A missing hardware memory-ordering barrier in the Linux kernel's MIPS EYEQ support lets a local, authenticated user crash the kernel on Mobileye EyeQ5 / MIPS I6500 systems. On I6500 cores the lld/scd (LL/SC) instructions provide no ordering guarantees, so arch_cmpxchg() - documented and relied upon as fully ordered - can be reordered and read freed or uninitialized memory, producing a kernel paging fault and oops (observed in anon_pipe_read while stressing an anonymous pipe, whose mutex uses cmpxchg). Exploitation requires CONFIG_EYEQ hardware, local access, and winning a timing/race window; there is no network vector and no impact on x86, ARM, or other MIPS configurations. The fix commit is public and includes a userspace reproducer (pipe_race.c), so publicly available exploit code exists, but no confirmed active exploitation (not in CISA KEV); EPSS is 0.15% (4th percentile), and the observed outcome is a kernel oops rather than a controlled compromise.
A race-condition use-after-free in the Linux kernel's xfrm (IPsec) bundle-creation path allows a local attacker with low privileges to trigger a stale net_device pointer dereference, yielding kernel memory corruption with high confidentiality, integrity, and availability impact. The flaw is reachable when an IPv6 UDP send traverses xfrm_lookup_with_ifid()/bundle creation while a concurrent RTM_DELLINK tears down the underlying net_device - a capability typically obtained by an unprivileged user inside a user+network namespace on kernels that permit unprivileged namespaces. Exploitation is local-only and probabilistic (it depends on winning an inherent timing race and on xfrm/IPsec policies being active), so realistic risk is below the vendor CVSS of 7.8; EPSS is low at 0.15% (4th percentile), no public exploit code was identified at time of analysis, and the issue is not in CISA KEV.
Heap-based buffer overflow in GIMP's DirectDraw Surface (DDS) loader allows attackers to corrupt memory and potentially execute arbitrary code by convincing a user to open a crafted .dds image. The flaw affects GIMP as shipped in Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and requires local file access plus user interaction (opening the malicious file) with no authentication required per the CVSS vector (PR:N). No public exploit code has been identified at time of analysis, and exploitation is limited to the privileges of the user running GIMP.
Memory corruption in Qualcomm Snapdragon graphics command-list processing allows a local low-privileged attacker to corrupt GPU driver memory by submitting draw objects of an incorrect type, scored CVSS 7.8. Exploitation requires the ability to execute code locally on a Snapdragon device and submit graphics command lists to the GPU driver, typically achievable by any installed application or a compromised process with access to the graphics/rendering stack; no user interaction is required. There is no remote network path, and no public exploit identified at time of analysis, though exact affected Snapdragon chipset and driver versions should be confirmed against the Qualcomm October 2026 bulletin.
Buffer overflow in the HPE Aruba ClearPass Policy Manager OnGuard agent lets an authenticated local user execute arbitrary code with elevated privileges or crash the agent, disrupting endpoint posture enforcement. Exploitation requires an existing low-privileged session on the endpoint where the agent is installed and running and cannot be triggered remotely, since the attack vector is local (AV:L, PR:L) while the privilege gain is High across confidentiality, integrity, and availability. HPE has published a vendor advisory, but no public exploit code has been identified at time of analysis; at CVSS 7.8 this is a credible but not emergency-level priority, most relevant to hosts where unprivileged local users and the OnGuard agent coexist.
Local privilege escalation in the HPE Aruba ClearPass Policy Manager Windows client software (CVSS 7.8, High) allows an attacker who already holds a low-privileged account on an affected Windows host to run attacker-supplied code with elevated privileges. The flaw is a missing integrity verification weakness: a file or component consumed by the client is loaded or executed with high privileges without being validated first, so an authenticated local user (PR:L, AV:L, UI:N per the assessed vector) can substitute a crafted component and gain SYSTEM-level execution. No remote path exists, the host must have the ClearPass Windows client installed, and no public exploit code or active exploitation has been identified at time of analysis; HPE's bulletin hpesbnw05158en_us is the authoritative source for fixed releases and affected version detail.
Local privilege escalation in the HPE/Aruba ClearPass Policy Manager OnGuard Linux agent lets a user who already holds a low-privileged account on a managed Linux endpoint elevate to root, rated CVSS 3.1 base 7.8 (HIGH). Exploitation is local only (AV:L), requires an existing foothold on the host (PR:L), needs no user interaction, and yields full confidentiality, integrity, and availability impact once root is obtained; Windows and macOS clients, and Linux hosts without the OnGuard agent, are out of scope per the vendor report. No CISA KEV listing, public proof-of-concept, or EPSS score was supplied with the available intelligence, so the current status is no public exploit identified at time of analysis, and the practical exposure is limited to environments that deploy the OnGuard Linux agent to endpoints where an attacker can first obtain a local unprivileged account.
Memory corruption - specifically a use-after-free (CWE-416) - in Qualcomm Snapdragon components lets a locally-positioned attacker holding low privileges corrupt memory while the platform processes service requests, with high confidentiality, integrity and availability impact (CVSS 3.1 base 7.8, vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation is not remote: the attacker must already have a foothold on the device, such as a malicious or compromised application capable of reaching the affected Qualcomm service interface, and no user interaction is needed once that foothold exists. No public exploit code has been identified and the issue is not confirmed actively exploited (CISA KEV) at time of analysis, and because the available data does not name the specific service, chipset model, or configuration, the precise triggering interface should be verified against the Qualcomm October 2026 security bulletin.
Memory corruption in Qualcomm Snapdragon system service routines allows a locally installed, low-privileged application to trigger a use-after-free by supplying a malformed input buffer, potentially achieving code execution at the privilege level of the affected service and thereby compromising confidentiality, integrity, and availability. The flaw is scored CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), so exploitation is access-gated: the attacker must already be executing code on the device with low privileges and must be able to reach and invoke the vulnerable routine - there is no remote or network vector, and no user interaction is required once that code runs. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; reliable exploitation would generally require heap grooming of the target service, and actual exposure depends on the specific Snapdragon chipset and firmware build listed in Qualcomm's October 2026 security bulletin.
Memory corruption via a use-after-free in the FastRPC implementation on Qualcomm Snapdragon platforms allows a local attacker with low-privilege code execution to escalate privileges and compromise confidentiality, integrity, and availability of the affected device. Triggering the bug requires a pre-existing foothold - code able to open the FastRPC driver interface and drive DSP invocations - plus concurrent asynchronous threads that race shared performance counter data, so successful exploitation depends on winning a timing window rather than a deterministic primitive. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV; because the vector is local-only (AV:L) with no network reachability, this is a genuine but not emergency-grade priority.
Use-after-free memory corruption in Qualcomm Snapdragon components allows a local, low-privileged attacker who already holds code execution on the device - for example through a malicious or compromised app - to corrupt memory and potentially achieve code execution or privilege escalation in the context of the affected component, with high confidentiality, integrity, and availability impact. Triggering the flaw requires winning a race between concurrent operations that access and modify geographic mapping data without proper synchronization, a timing dependency our assessment scores as AC:H rather than the base AC:L, which makes reliable exploitation non-deterministic. No user interaction is required and there is no remote or network path to the flaw; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Use-after-free memory corruption affecting Qualcomm Snapdragon platforms lets a local, low-privileged attacker (PR:L, AV:L, UI:N) trigger concurrent operations on shared memory page lists that are not properly synchronized, potentially reusing freed memory and gaining high impact to confidentiality, integrity, and availability. Because the root cause is a race condition (CWE-416), exploitation is timing-dependent and may require repeated attempts; the attacker must already have code running on the device, so there is no remote or network attack path. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor advisory is the October 2026 Qualcomm security bulletin. Note that the independent assessment rates this as AC:H (high attack complexity; score 7.0) rather than the submitted CVSS 7.8 with AC:L, reflecting the difficulty of reliably winning the race.
Memory corruption in the Qualcomm Snapdragon boot chain allows an attacker who already controls the non-secure loader to rewrite page tables during the narrow window before secure memory is initialized, corrupting memory used by secure-world setup and bypassing an authorization boundary (CWE-862) with high confidentiality, integrity, and availability impact. Exploitation is strictly local (AV:L) and requires pre-existing privilege in the boot chain (PR:L), with no remote or unauthenticated path, which limits this to attackers who have already compromised or can influence the device boot process. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Qualcomm published the fix details in its October 2026 security bulletin.
Attacker-controlled pointer dereference in AMD's ROCm Communication Collectives Library (RCCL) can escalate to remote code execution when a compromised peer rank - or a network-adjacent attacker on the collective fabric - participates in a multi-GPU or multi-node distributed workload. The defect (CWE-822, untrusted pointer dereference) affects RCCL running on AMD Instinct MI200/MI300/MI350-class accelerators and carries a CVSS 4.0 base score of 7.7 (vector AV:N/AC:H/AT:N/PR:L/UI:N, High confidentiality/integrity/availability), mapping to an assessed CVSS 3.1 of AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Exploitation is not confirmed as active (CVE is not in CISA KEV) and no public exploit code has been identified at time of analysis; the attack requires a pre-existing foothold as a peer rank inside the collective group rather than anonymous internet access, so this is a moderate-priority issue for distributed AMD GPU deployments rather than an internet-wide emergency.
Arbitrary file deletion in Jobs for WordPress 2.8.2 and earlier allows authenticated Contributor-level users to delete arbitrary files via a path traversal flaw (CWE-22). The vulnerability is network-reachable, requires no user interaction, and has a CVSS score of 7.7 with high availability impact but no confidentiality or integrity impact. No public exploit has been identified at the time of analysis, and no vendor-released patch is available.
Dell Container Storage Modules releases before 1.18.0 write sensitive information into their log files, so a low-privileged, authenticated remote user who can read those logs can obtain credentials, tokens, or other confidential data recorded there. The issue carries a CVSS 3.1 base score of 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), inflated primarily by the scope change to components beyond the vulnerable module rather than by ease of mass exploitation. There is no public exploit identified at time of analysis and no confirmed active exploitation (no CISA KEV listing), so the practical risk is bounded by the prerequisite of existing low-privileged authentication plus read access to the module's log output.
Server-side request forgery in the Backstage @backstage/plugin-techdocs-node package (0.11.12 through 1.14.6, and 1.15.0 through 1.15.4) lets an authenticated user who controls a TechDocs source repository have documentation builds fetch and publish content from network locations reachable by the build environment. The issue is rated CVSS 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N), reflecting a confidentiality-only, scope-changing impact that requires repo write access and a build topology where internal endpoints are reachable without token or special-header protections; newer cloud metadata services that require tokens or custom headers are explicitly not directly accessible. Vendor-released patches exist in @backstage/plugin-techdocs-node 1.14.7 and 1.15.5 (and in Backstage releases v1.50.6, v1.54.8, v1.55.0); no public exploit identified at time of analysis.
Improper URL validation in the @backstage/plugin-catalog-backend package of Backstage prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1 lets an authenticated user with catalog-write capability craft catalog entities whose placeholder directives ($text, $json, $yaml) resolve to files in a repository other than the entity's own source repo. Because the placeholder resolver executes with the backend's configured SCM integration credentials, the attacker can read content the resolver is authorized to fetch but that the user should not see, giving a confidentiality impact rated 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Exploitation requires a valid authenticated account plus a deployment where integrations can reach the targeted external resource - the vendor scopes impact to 'certain configurations,' so hardened single-repo or tightly scoped integration setups may not be affected; no public exploit code was identified at time of analysis.
Arbitrary file write through path traversal in lrzsz before 0.13.0 lets a malicious ZMODEM sender place files outside the current directory - including by absolute pathname - when the victim runs the lrz receive utility in restricted mode. Exploitation requires the victim to actively initiate or accept a ZMODEM transfer (UI:P/AT:P), the binary to be built without the --enable-pubdir option (the default, since only that build hardens checkpath()), and the attacker to control the sending side; the primitive is limited to files the receiving user account can already write, though overwriting SSH keys, shell profiles, or cron entries can extend impact. No public exploit identified at time of analysis, and the risk is a conditional integrity/availability issue rather than a mass-exploitation emergency given the user-interaction and build-configuration prerequisites.
Server-side request forgery in Gitea 1.27.3 and earlier allows an authenticated user with permission to start repository migrations to reach internal services by pointing an allow-listed migration hostname at a loopback or private address, bypassing the ALLOW_LOCALNETWORKS=false restriction. Exploitation requires the optional [migrations] ALLOWED_DOMAINS allow-list to be configured (default installations are unaffected by this specific bypass), valid migration rights (CVSS PR:L, authenticated), and attacker control over DNS resolution for a hostname already present in that allow-list. No public exploit code or confirmed active exploitation was identified at time of analysis; the root-cause class is network-restriction bypass (SSRF-style) rather than an authentication bypass, despite that tag in the source data.
Unauthenticated adjacent-network attackers can crash or potentially execute arbitrary code on Arista Wi-Fi access points when the packet-capture service is running in an uncommon non-default streaming mode. The flaw is a stack-based buffer overflow (CWE-121) triggered by a crafted packet to the capture service; no authentication or user interaction is required, but the attacker must have Layer-2/adjacent access and the target must already have the non-default streaming mode enabled, so default-configured devices are not exposed. No public exploit code was identified at time of analysis, and this is a conditional priority rather than a drop-everything emergency because exploitation depends on that deliberately enabled configuration.
OS command injection in lrzsz before 0.13.0 allows a remote ZMODEM/YMODEM sender to execute arbitrary shell commands as the receiving user by supplying a crafted filename during an lrz receive. The flaw is reachable only when lrz is invoked under a suffixed/alias name such as lrztar and operates in pipe mode, where procheader() in src/lrz.c forwards the unescaped filename to popen() and shell metacharacters are interpreted. Successful exploitation requires the victim to accept or initiate the transfer (UI:P) and yields command execution at the receiver's privilege level only (no cross-system impact per SC:N/SI:N/SA:N); no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor-supplied CVSS 4.0 score is 7.7 (High) while an independent assessment rates it CVSS 3.1 8.1 with AC:H given the non-default invocation and interaction prerequisites.
Improper authentication in the OAuth token endpoint of Cloud Foundry UAA (CWE-287) enables an authenticated remote attacker to exchange a low-privileged user access token for a fully-privileged client_credentials token, bypassing the need for the client secret. The attacker must possess a valid user token for an OAuth client that is configured to support both a public authorization_code+PKCE flow and the client_credentials grant on the same client_id, a non-default combination; the resulting client token carries the client's full authorities (e.g., clients.write), allowing creation of arbitrary OAuth clients. No public exploit code has been identified at time of analysis, and exploitation requires authenticated user access, with impact scaling to the authorities assigned to the affected client.
Web origin policy bypass in Google Chrome's Navigation component on iOS allows a remote, unauthenticated attacker to escape intended origin boundaries and reach a privileged page when a victim opens a crafted HTML page. Exploitation is constrained by two factors: the mandatory user interaction (CVSS UI:R - the victim must actively load the malicious page) and the narrow platform scope, since only the iOS build of Chrome is affected rather than Chrome on other operating systems. Risk signals are modest - EPSS is 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis - and Google has shipped a fix, so this is a moderate-priority issue rather than an urgent one.
Information disclosure in JetBrains TeamCity before 2026.2.1 allows a crafted Git submodule URL to make the server read files from local repositories reachable by the TeamCity service account, exposing source code and other local repository contents. The supplied NVD vector rates this as network-reachable without privileges (PR:N), but our assessment applies a low-privileged precondition (PR:L), because the attacker must be able to influence a submodule URL - typically by committing a malicious .gitmodules file to a repository TeamCity checks out, or by controlling a VCS root - on an instance configured to resolve Git submodules. Impact is confidentiality-only with no integrity or availability effect; EPSS is low (0.62%, 48th percentile), SSVC records no exploitation activity, and no public exploit code has been identified at time of analysis.
Argument injection in Microsoft UFO's run_shell tool lets an attacker who can influence an agent workflow execute arbitrary code as the desktop user on Windows systems running UFO prior to 3.0.9. The tool validates only the first token of the bash_command parameter and permits explorer.exe, which then delegates its path argument to ShellExecute - so a crafted call such as explorer.exe "C:\Users\victim\payload.bat" launches an attacker-controlled executable or script even though the subprocess is spawned with shell=False. Exploitation requires user interaction (an active agent workflow on Windows and a successfully induced tool call), and successful execution gives the attacker access to the victim user's files, tokens, and sessions. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV; the vendor-released patch is version 3.0.9.
Hard-coded credentials embedded in the csm-docs component of Dell Container Storage Modules (CSM) before version 1.18.0 expose sensitive information to remote attackers who can reach the affected service over the network. Per the CVSS vector (PR:N/UI:N), no legitimate authentication or user interaction is required once a network path exists, although the attacker must know the embedded credentials, and impact is confined to confidentiality (C:H with I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (SSVC Exploitation: none, not in CISA KEV); EPSS is low at 0.54% (44th percentile), and Dell has released a fixed version, CSM 1.18.0.
Insufficient validation in the Single Sign-On (SSO) login flow of Arista CloudVision lets a remote, unauthenticated attacker craft a login URL that, once clicked by a user, causes the identity provider to send IdP-issued authentication material to an attacker-controlled URL rather than to CloudVision (CWE-601 open redirect), resulting in credential/assertion theft and potential account impersonation. The vulnerability is rated High (vendor CVSS 4.0 7.6; assessed CVSS 3.1 7.6, AV:N/AC:H/PR:N/UI:R with High confidentiality and integrity impact) and only affects deployments where CloudVision SSO is configured and in use. No public exploit code or confirmed active exploitation was identified at time of analysis, and exploitation depends on victim interaction plus specific SSO/IdP configuration and the attacker's ability to produce a redirect accepted by the deployment.