Arbitrary file write through path traversal in pghoard 2.7.1 and earlier allows an authenticated attacker with write access to the backup object store to place files outside the PostgreSQL data directory when a database administrator runs a restore. The attacker poisons a delta backup manifest with traversal sequences, and pghoard_restore get-basebackup then writes the payload to attacker-chosen host paths, which can lead to code execution or system compromise under the restore account. The issue is rated CVSS 8.4 and requires both the storage-write prerequisite and a legitimate restore action; only versions up to 2.7.1 are affected, 2.7.2 contains the fix, and no public exploit was identified at time of analysis.
Host-header injection in OpenReception's confirmation-email path lets unauthenticated remote attackers redirect a pending invitee's one-time confirmation token to an attacker-controlled host and then claim that account before the legitimate invitee ever onboards. The unauthenticated POST /api/auth/resend-confirmation rotates a pending invitee's token and builds the emailed link from the request Host with no allowlist, so a single request carrying a spoofed Host and the victim's email address produces a genuine onboarding email whose only link points at the attacker. Because the account is claimed first and bound to an attacker-registered WebAuthn passkey, the attacker gains a full session in the invited role (staff or tenant admin), with read and potentially modify access to client and appointment data; a public proof-of-concept package is attached to the advisory and reported to demonstrate the flow end-to-end against the official image, though it is not independently verified as working exploit code. Exploitation requires the victim to click the poisoned link (UI:R) and depends on the front proxy forwarding an arbitrary Host, which the stock Caddy catch-all does.
Reflected cross-site scripting in phpBB's registration module allows an unauthenticated remote attacker to execute script in a victim's browser session when the victim opens an attacker-crafted link. The flaw is CWE-79 and requires user interaction; the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so the direct impact is limited to confidentiality and integrity within the changed scope rather than server compromise. No public exploit identified at time of analysis.
Predictable FileTransfer tokens in XDG Desktop Portal let a malicious sandboxed application redirect drag-and-drop and copy-paste data intended for other applications to itself. Through version 1.22.0, tokens used by the FileTransfer.RetrieveFiles portal method were generated with g_random_int or g_uuid_string_random, both backed by GLib's GRand Mersenne Twister PRNG, so collecting enough tokens lets an attacker recover the generator state and predict the next token that would normally authorize an out-of-band resource transfer. The assessed vector is local with high attack complexity and low privileges (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N): the attacker needs a hostile or compromised sandboxed app already running on the desktop, plus a victim drag-and-drop or copy-paste for data to be redirected. The vendor released a patch in 1.22.1; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the issue is prioritized as this_week rather than an emergency.
Slack app_mention events in the PraisonAI bot (PyPI package praisonai, versions 3.11.0 through 4.6.58) skip the allowed_users, allowed_channels and unknown_user_policy checks that the normal message handler enforces, so any Slack workspace member who can mention the bot in a channel where the app is installed can drive the configured agent even when the identical event content is dropped by the message path. The root cause is missing authorization (CWE-862, also tracked as CWE-863) in src/praisonai/praisonai/bots/slack.py, and the assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L (8.3, High) - network reachable, low complexity, and authenticated, since the attacker must already hold Slack workspace membership and be able to mention the bot. A public PoC reference exists in the form of a local-only harness that mocks Slack Bolt and the Slack SDK in-process and does not connect to Slack; it is not verified as working exploit code against a live deployment, and there is no confirmed active exploitation (no CISA KEV listing). Remediation is prioritized as this week rather than an emergency.
Out-of-bounds write in the Snap7 S7 communications library through 1.4.3 lets a malicious active partner crash or corrupt the process of any application acting as a passive BSend/BRecv partner - typically a SCADA front end, HMI gateway or data collector listening on TCP/102. The library stores the BSend total length declared by the peer (up to 65535) rather than the number of bytes actually reassembled, and BRecv as well as the asynchronous CheckAsBRecvCompletion path hand that length straight to memcpy without any knowledge of the caller's buffer capacity, so even correctly written applications overflow. Vendor patch data indicates a fix is available via PR #41 (no tagged release version is stated in the provided data), an AddressSanitizer PoC was produced by the reporter but withheld rather than published, and no public exploit code or CISA KEV entry was identified at time of analysis; exploitation requires reaching TCP/102 from (or successfully spoofing) the configured peer address, which is the constraint behind the assessed CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N with high integrity and availability impact and no confidentiality impact.
WireGuard in Zephyr (subsys/net/lib/wireguard) accepts an unauthenticated transport-data datagram and copies its source address into peer->endpoint, letting any host that can reach the listener's UDP port 51820 off-path redirect all subsequent handshake initiations, keepalives and encrypted tunnel traffic to an address of the attacker's choosing. Affected builds are Zephyr 4.4.0 through 4.4.2 with CONFIG_WIREGUARD enabled, which is marked experimental and off by default, and the defect fires only while the targeted peer has no valid handshake and no current keypair - the state at boot and after a session expires. The result is persistent tunnel denial (assessed A:H) and limited confidentiality loss (C:L) through traffic-metadata observation or selective dropping if the attacker relays redirected initiations; the Noise/AEAD cryptography prevents decryption or forgery, so keys are not compromised. The advisory's original report includes a 16-byte datagram recipe as a proof of concept; it is not verified as working exploit code, no public exploit is confirmed in use, and KEV status is not indicated - exploitation requires only UDP reachability to the listener, with no credentials or user interaction.
CGM CLININET stores user passwords as unsalted MD5 hashes, so once a credential store is obtained the passwords can be recovered quickly offline rather than remaining protected by a slow, per-user-salted hash. All versions tracked by the supplied CPE for the product are in scope; the vendor fixed the issue in releases 2026.MS1 and 2026.MS3. The flaw is passive and only weakens credential protection after the hashes are already exposed - it does not itself grant access - but the resulting disclosure of user passwords is rated high severity (CVSS 4.0 base 8.2). No public exploit code has been identified, there is no CISA KEV listing, and priority guidance places remediation in the current week rather than as an emergency.
Local file inclusion in the AncoraThemes 'Your Dress' WordPress theme, affecting versions from the initial release through 1.4.1, allows unauthenticated remote attackers to drive PHP include/require statements toward unintended local file paths, exposing sensitive content such as wp-config.php and its database credentials. The published CVSS 3.1 base score is 8.1, while our independent assessment scopes the demonstrated impact to confidentiality loss on sites where this specific theme is installed and active. No CISA KEV entry exists and no public exploit was identified at time of analysis; the only reference is the Patchstack database advisory, so this is a priority item for inventory and cleanup rather than a confirmed active campaign.
PraisonAI versions 4.5.112 through 4.6.58 expose the Recipe HTTP API without authentication when an operator starts the deprecated Typer command `praisonai recipe serve` on a non-localhost interface without explicitly selecting API-key auth, allowing unauthenticated network callers to enumerate and execute recipes and, when `--admin` is enabled, invoke `/admin/reload`. The issue is an authentication bypass at the installed Typer callsite (CWE-287, with CWE-306 and CWE-862 also applicable); the hardened legacy feature handler rejects non-localhost binding without auth, and `create_auth_middleware()` fails closed with 503/401 when auth is selected but misconfigured. The CVSS 3.1 base score is 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), and PraisonAI 4.6.59 contains the vendor fix; no CISA KEV entry or confirmed working remote exploit code is present in the supplied intelligence, and the advisory's public local-only proof-of-value harness exercises the bypass in-process without binding a socket, so it is not verified as working remote exploit code. Given the this-week decision label, prioritize upgrading internet-reachable or Docker-deployed instances.
Unauthenticated PHP object injection in the ThemeREX Helion WordPress theme, affecting versions up to and including 1.1.12, carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is rated for remediation this week. Because the vector is PR:N and UI:N, any remote attacker who can reach the theme's vulnerable deserialization path needs neither credentials nor victim interaction, though the AC:H rating reflects that the high confidentiality, integrity and availability impact depends on a usable PHP gadget chain being present in the theme, an installed plugin, or WordPress core - a condition the available sources do not confirm. The specific feature, endpoint or parameter that performs the unsafe deserialization is not described in the available sources, and no public exploit code or active exploitation is identified in the available intelligence. Sites are exposed only where the vulnerable Helion theme is installed and active at version 1.1.12 or earlier.
Privilege escalation in Okta Access Gateway allows an already authenticated user with an active session to obtain Admin Console access by altering the authentication-source parameter during sign-on, which OAG fails to validate before issuing a SAML assertion. Okta rates the flaw 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), while our assessment adjusts the privilege requirement to PR:L because valid credentials and a live session are mandatory; the AC:H metric reflects that the parameter manipulation is not trivial to perform reliably. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but successful abuse grants administrative control of the gateway, so it warrants prompt patching on this week's cycle rather than emergency action.
Stale cached IP-option offsets in the Linux kernel's CIPSO removal path let remote attackers drive ip_forward_options() and __ip_options_echo() to read the wrong bytes, and __ip_options_echo() may interpret packet data as an option length and copy it into fixed-size option storage, producing out-of-bounds reads and possible memory corruption (CVSS 8.1, C:H/I:H/A:H). Only kernels that actually process CIPSO/NetLabel labeled-networking options and are built from base commit 89aa3619d141 up to the fixed releases are affected; vendor fixes exist in 7.3, 7.2.11, 6.18.57 and 6.12.113. No public exploit has been identified at time of analysis and EPSS is low (0.21%, 10th percentile), yet the flaw needs no authentication and no user interaction - the high attack-complexity rating reflects the non-default, specialized CIPSO configuration rather than any attacker-side obstacle.
A use-after-free in the Linux kernel's AMT (Automatic Multicast Tunneling) driver can be triggered when an IGMP/MLD General Query generated by an AMT relay sits in the amt device's egress qdisc longer than the tunnel object it references survives, so the tunnel is freed before dequeue and amt_dev_xmit() dereferences stale memory - KASAN reports a slab-use-after-free in amt_dev_xmit(). Only systems running the in-kernel amt driver (CONFIG_AMT) with a relay-mode device configured are exposed, and the known trigger additionally needs a delaying qdisc such as netem whose delay exceeds the tunnel lifetime (the repro uses a 180s netem delay against a 135s tunnel lifetime from igmp_qrv=1), which is why the assessed vector rates AC:H despite the network vector. Impact is scoped to a local kernel memory-safety fault with potential confidentiality and integrity effects and a realistic crash/availability outcome; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV, with EPSS at 0.21% (10th percentile).
Any account holding the lowest 'member' role in a PraisonAI Platform workspace can permanently delete projects, agents, issues, labels, issue dependencies and issue-label attachments created by the workspace owner or by other members, because all six content DELETE endpoints verify workspace membership but never verify resource ownership or an owner/admin role. The flaw affects praisonai-platform from 0.1.4 up to the fix and scores CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:H), since an authenticated low-privileged user can destroy integrity and availability of workspace content while confidentiality is untouched. Exploitation requires a valid member account inside the targeted workspace - either invited by the victim or obtained through a compromised member credential - so the practical exposure is an insider or account-takeover scenario rather than a mass internet threat; there is no CISA KEV entry, no EPSS signal supplied and no confirmed working exploit package, though the vendor advisory publishes a full step-by-step reproduction.
Path traversal in PraisonAI 2.6.0 through 4.6.57 lets an attacker-supplied GitHub template URI write outside the template cache and, once a normal cache entry exists for the same owner/repo/template prefix, delete an attacker-chosen directory via shutil.rmtree. The resolver keeps the user-controlled template path and ref verbatim and the cache layer joins them into ~/.praison/cache/templates/github/<owner>/<repo>/<template>/<ref> without normalization or a boundary check, so a ref such as @../../../../../../outside-target escapes the cache root; nothing triggers unless a user or automated service is induced to load the crafted github: URI (CVSS 3.1 8.1 High, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), which is why PraisonAI rates the flaw this_week rather than an emergency. A public PoC reference exists in the GitHub advisory in the form of a local-only reproducer that disables networking; it is not verified as working exploit code, there is no CISA KEV listing, and no EPSS data was supplied. The project patched the issue in 4.6.59.
Unauthenticated takeover of a site administrator account is possible in the Advanced Custom Fields: Extended and Extended PRO WordPress plugins before 0.9.2.8 through the front-end Forms module. The update-user action resolves its target inconsistently between the stage that authorises the request and the stage that executes it, so an attacker can direct the update at an administrator account and be issued a valid session for it. The configuration prerequisite is narrow but explicit: the site must publish two separate front-end form configurations whose update-user targets are mapped to visitor-submitted values, which is reflected in the high attack complexity of the assessed CVSS vector. No public exploit code was identified at time of analysis, SSVC records no observed exploitation, and no KEV or EPSS data was supplied; the vendor has released a patch in 0.9.2.8.
Unauthenticated credential takeover of non-administrator WordPress accounts is possible in ACF Extended and ACF Extended PRO before 0.9.2.8 through the front-end Forms module's update-user action. The plugin checks authorization only when the targeted account is an administrator, so a visitor can overwrite another non-admin user's credentials and obtain a session for that account when a published form maps the target user to a visitor-submitted value instead of the default current user. The flaw is remotely reachable without authentication or user interaction but is conditional on that non-default form configuration; no public exploit was identified at time of analysis and the vendor has released a patch.
Use-after-free and linked-list corruption in the Linux kernel's drm/xe (Intel Xe) GPU driver arise when a buffer object is pinned simultaneously through the external path (xe_bo_pin_external, e.g. dma-buf export) and as a display scanout framebuffer (__xe_pin_fb_vma), and the external unpin occurs before the framebuffer performs the final pin_count 1 -> 0 transition; the bo is then left on xe->pinned.late.external after being freed, so the stale node points into freed memory. Exploitation requires a local, authenticated user (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) able to allocate Xe buffer objects, perform dma-buf export and drive framebuffer pinning, and yields high confidentiality, integrity and availability impact (CVSS 7.8) consistent with kernel memory corruption that could be leveraged toward privilege escalation. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at 0.22% (12th percentile), and vendor patches are available in the referenced stable commits and releases.
Improper RCU locking discipline in the Linux kernel's netfilter ipset subsystem allows a local attacker who can manage ipset objects to reach the referred hash tables outside a protected RCU read-side critical section, with the assessed impact being high confidentiality, integrity and availability loss on the affected host. Every kernel branch released before the fixed versions is affected, but reachability is limited: the attacker must already hold ipset management capability (in practice CAP_NET_ADMIN, assessed PR:H) on a kernel built with netfilter ipset support, so this is not remotely reachable and not available to a fully unprivileged user. EPSS is low at 0.21% (11th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis. The exact input or sequence that triggers the unsafe behaviour is not described in the available sources.
Oversized information elements supplied in an nl80211 scheduled-scan request can be copied into the fixed-size probe-request buffer of the Linux kernel's iwlwifi mvm driver, because the probe request is assembled before iwl_mvm_scan_fits() performs its length validation, allowing a local user holding CAP_NET_ADMIN on a host with an Intel wireless adapter running mvm firmware to corrupt kernel memory with potential confidentiality, integrity and availability impact (CVSS 7.8). The driver also under-advertised the usable scheduled-scan IE budget, so userspace limits did not account for the DS/TPC bytes the driver itself inserts. Exploitation is local and privileged rather than network-reachable, EPSS is low at 0.21%, and no public exploit code was identified at time of analysis; patches are available in the stable trees.
Use-after-free in the Linux kernel's strparser affects kernels from 5.6 before the vendor fixes, allowing a local, low-privileged attacker to race an in-flight __strp_recv() against strp_done() and crash or potentially exploit the freed parser. The changelog states that only espintcp is reachable in practice and that a published reproducer turns the possible UAF into an exploit; EPSS is low at 0.21% (10th percentile) and the vendor fix is available, with vuln.today prioritization set to this_week.
A use-after-free race in the Linux kernel's TIPC topology server (tipc_topsrv) can be triggered by a local user during network-namespace teardown: tipc_topsrv_stop() closed subscriber connections while the send and receive workqueues were still running, letting socket callbacks queue work and in-flight work drop the last connection reference mid-walk. This produces a refcount addition on 0, a use-after-free in tipc_conn_close(), queue_work() on a destroyed workqueue, and an RCU stall in tipc_topsrv_exit_net(). The flaw only matters where the tipc module and topology service are enabled and in use, which is non-default on most systems; no public exploit is identified at time of analysis (EPSS 0.21%, 10th percentile) and it is not in CISA KEV, though local low-privilege access is required per the assessed vector.
A use-after-free in the Linux kernel's TIPC netlink link handlers (LINK_SET, LINK_GET, LINK_RESET_STATS) lets a local user who already holds CAP_NET_ADMIN race a handler against timer-driven cleanup of a down peer node, potentially corrupting or reading freed slab memory. The flaw is reached only on systems built with CONFIG_TIPC where the module is loaded and a bearer plus at least one peer node are configured, and exploitation requires winning a narrow timing window against tipc_node_timeout(), which is why the assessed vector is AC:H rather than the vendor-published AC:L. Vendor fixes are available in 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3; no public exploit has been identified at time of analysis and EPSS is 0.21% (10th percentile), so priority is this-week patching rather than emergency response.
A local race in the Linux kernel's SMC (AF_SMC) socket stack lets a getsockname() caller dereference smc->clcsock after a link-group termination worker has cleared and released that CLC socket, producing a slab use-after-free or, if the pointer is cleared first, a NULL dereference. Exploitation is constrained: it requires a kernel built with SMC support (CONFIG_SMC) and an established SMC socket whose link group is torn down (reachable via shutdown(SHUT_WR) driving smc_close_active_abort()/smc_clcsock_release()), plus winning a tight timing window - the KASAN report was only obtained with added test-only timing instrumentation, so the race is not trivially reliable on an unmodified kernel. No public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and vendor fixes are available in the 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3 releases.
Local privilege escalation and kernel control-flow hijack affect RISC-V Linux kernels built with CONFIG_SHADOW_CALL_STACK. An attacker with local unprivileged code execution can set the user-writable tp register to the linear-map address of its task_struct so exception entry incorrectly skips reloading the shadow call stack pointer (gp); the poisoned gp is then used for shadow-stack stores and return-address loads, producing an arbitrary-write and control-flow-hijack primitive that persists for that task. The flaw is not in CISA KEV and no public exploit identified at time of analysis; EPSS is 0.21%.
A use-after-free in the Linux kernel Bluetooth HCI command-sync path affects kernels from 6.6.28 and 6.8.7 onward, up to the fixed releases, and is triggered when a Periodic Advertising (PA_LINK) sync setup causes the scan worker on req_workqueue to keep using command skb storage that the command worker on the device workqueue has already freed and replaced. A local, low-privileged user able to drive Bluetooth HCI/PA sync operations can win a tight race between those two workqueues, producing a KASAN slab-use-after-free in hci_sent_cmd_data with the potential for memory corruption and privilege escalation; the assessed vector is AV:L/AC:H/PR:L, reflecting that reliable exploitation depends on winning that timing window. No public exploit code is identified at time of analysis, the flaw is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), which is consistent with a genuine but moderate-priority local kernel bug rather than an internet-facing emergency; vendor patches are available.
Concurrent listen() calls on the same Linux kernel Bluetooth ISO broadcast (BIS) socket can overwrite the socket's connection pointer, leaking the first connection and leaving a stale socket reference that is later dereferenced after free, producing a slab use-after-free in iso_sock_hold() when an HCI disconnect event is processed. The race requires a local authenticated user able to create Bluetooth ISO broadcast sockets (CVSS AV:L/PR:L) and a narrow timing window (AC:H) in iso_sock_listen()/iso_listen_bis(), and is fixed in stable branches including 6.12.113 plus sibling commits. EPSS is 0.21% (11th percentile), the flaw is not in CISA KEV, and no public exploit was identified at time of analysis; the overall signal is a genuine but non-emergency local kernel flaw.
Use-after-free in the Linux kernel's Bluetooth ISO socket handling allows a local authenticated user (PR:L) to race concurrent iso_sock_connect() calls, replace the socket destination or connection state, and trigger a stale-connection callback after socket release. Affected systems are kernels built with Bluetooth ISO (LE Audio CIS/BIS) support and a reachable controller path; the assessed vector is AV:L/AC:H/PR:L because the attacker needs local code able to open AF_BLUETOOTH ISO sockets and must win a narrow concurrency window. No public exploit was identified at time of analysis, EPSS is 0.21% (10th percentile), and the vuln.today decision label is this_week rather than act_now.
Local privilege escalation and memory corruption in the Intel i915 DRM/GEM execbuffer path of the Linux kernel, where cleanup of failed execbuffer parsing frees pointers past the end of the relocated exec object array. Kernels built with the i915 driver (Intel GPU systems) on branches prior to the fixed releases 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3 are affected, and an attacker needs local access to the i915 DRI device plus a workload that drives the legacy relocation slow path; the assessed impact is high for confidentiality, integrity and availability on the host. No public exploit has been identified at time of analysis and EPSS is low at 0.21% (11th percentile), but the vendor fix is available and patching is scheduled for this week.
Out-of-bounds read in the Linux kernel's drm/vmwgfx driver, reachable by a local, low-privileged user who can open the vmwgfx DRM device and drive the cursor-snooping path with a crafted surface carrying an invalid pitch. Only Linux guests running on VMware with the paravirtual SVGA/vmwgfx GPU driver loaded are exposed, so bare-metal systems and guests not using vmwgfx are unaffected; EPSS is low (0.21%) and no public exploit or CISA KEV entry is reported at time of analysis.
The Linux kernel's mount-namespace code copies the internal MNT_UMOUNT flag when clone_mnt() duplicates a mount, so a lazily unmounted mount that is still pinned by a file descriptor on an nsfs or pidfs node can be re-bound into a namespace already carrying that stale flag. Because MNT_UMOUNT is never cleared and is treated by propagation, detach and locked-mount logic as proof that a mount is already going away, holders of mount privileges can corrupt mount-tree bookkeeping, strand a mount in a namespace with one reference too few and make it its own parent, and later read a freed struct mnt_namespace through may_change_propagation()/anon_ns_root() - a use-after-free that can escalate to kernel code execution in the local privilege-escalation sense. Exploitation is local and requires the ability to create mounts and mount namespaces (CAP_SYS_ADMIN, obtainable by unprivileged users where unprivileged user namespaces are enabled), with no user interaction; the vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8). A vendor patch is available (fixed in the 6.6.160, 6.12.114, 6.18.57, 7.2.11 and 7.3 branches per the EUVD data), EPSS is low at 0.21% (10th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis.
A use-after-free in Linux kernel mount and namespace handling can be reached when a BPF token file - created via bpf_token_create() and placed on a bpffs mount inside the caller's own mount namespace - is bind-mounted through /proc/self/fd/<token> and then cloned with open_tree(OPEN_TREE_CLONE) plus move_mount(). This turns a d_alloc_pseudo() dentry that carries DCACHE_NORCU into the root of a mount, and because such dentries are freed immediately by dentry_free(), the lockless path walk in __follow_mount_rcu() can read ->mnt_root, d_seq and d_flags of a dentry that has already been released. A local attacker who can reach bpf_token_create() with a delegated bpffs mount can therefore trigger a use-after-free that corrupts kernel memory, giving a path to confidentiality, integrity and availability impact; the assessed vector is AV:L/AC:H/PR:L/UI:N (a local, low-privileged attacker), reflecting that bpf token delegation and a suitable bpffs mount are not a default general-purpose configuration and that the flaw requires winning a race in __follow_mount_rcu against the final dput(). No public exploit code has been confirmed and the issue is not in CISA KEV; EPSS is 0.21% (11th percentile) and the vendor has released fixes.
Local users on systems running XFS with reflink-enabled files can silently corrupt data shared between two files. When a mapping exchange (EXCHANGE_RANGE_TO_EOF, or the legacy XFS_IOC_SWAPEXT ioctl) covers offset 0 through i_disk_size, xmi_can_exchange_reflink_flags() incorrectly assumes all mappings moved and hands the reflink flag to the other file, even though the source may still own shared blocks beyond i_disk_size; the flag is cleared and the next write to that block happens in place instead of copy-on-write, corrupting the other file. The flaw requires local, unprivileged access (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) and results in integrity loss without confidentiality or availability impact; no public exploit code has been identified at time of analysis, EPSS is 0.21% (11th percentile), and the Linux kernel fix is available upstream.
Local users on XFS filesystems can break reflink copy-on-write isolation so that an extending write lands in a block still shared with another file, corrupting that other file's contents and leaving filesystem metadata inconsistent. The bug is in the XFS_IOC_EXCHANGE_RANGE ioctl when the TO_EOF flag is combined with a nonzero offset: the code swaps the on-disk and in-core file sizes incorrectly, and a follow-up exchange then wrongly clears the reflink flag on what it believes is a single-block file. Kernels from 6.10 up to the fixed stable releases 6.12.114, 6.18.57, 7.2.11 and 7.3 are affected; exploitation is local only, requires reflink and exchange-range (both mkfs.xfs 7.x defaults), and follows a deterministic FICLONERANGE-plus-two-exchange sequence. EPSS is 0.21% (11th percentile) with no CISA KEV entry, and a public PoC reference exists but is not verified as working exploit code.
A use-after-free in the Linux kernel's HID steam driver (hid-steam, CONFIG_HID_STEAM) lets a local actor with existing privileges on the machine reach a narrow timing window during driver teardown, where callbacks - including rumble and mode-switch work - can still be scheduled against a steam struct that has already been freed, leaving a dangling pointer that yields high confidentiality, integrity and availability impact. Only systems that have the driver built and loaded, in practice machines with a Steam Controller or Steam Deck controller bound, are exposed; the assessed vector is local with PR:L and AC:H, so the race window is narrow and the actor is not anonymous. Severity is genuinely high on paper (CVSS 7.8) but real-world urgency is moderate: EPSS is 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
The HID Steam driver in the Linux kernel can leave a stale power_supply object registered after the steam device object has already been torn down, because the battery-unregistration step was accidentally dropped from a failure path during an earlier registration refactor. Local users on systems built with CONFIG_HID_STEAM and bound to Valve Steam Controller hardware (physical or emulated USB HID) are the only reachable population, and the assessed vector is AV:L/AC:H/PR:L/UI:N, meaning a local authenticated user plus an error condition that the available sources do not describe how to force deterministically. Vendor patches exist in 6.6.160, 6.12.113, 6.18.57, 7.2.11 and 7.3; EPSS is 0.21% (10th percentile), no KEV listing, and no public exploit code was identified at time of analysis, so this is a genuine but non-urgent local kernel memory-safety fix rather than an internet-facing emergency.
Use-after-free in the Linux kernel's gpio-mpsse driver, reachable only by a local user with the privilege to arm the IRQ poll worker on an attached FTDI MPSSE-based USB GPIO adapter, when a device disconnect lands in the narrow window between schedule_work() and the worker being published to priv->workers. The window lets gpio_mpsse_disconnect() miss the orphaned worker, which then keeps touching mpsse_priv after the USB core frees it; the assessed vector is AV:L/AC:H/PR:L/UI:N with high confidentiality, integrity and availability impact, so the 7.8 base score reflects memory-corruption consequences rather than ease of reach. The driver is not loaded in typical deployments, EPSS is 0.21% (10th percentile), no public exploit has been identified at time of analysis, and vendor stable fixes are listed (6.18.57, 7.2.11, 7.3).
The RISC-V futex implementation in the Linux kernel fails to strip address tags from user-supplied pointers before executing atomic operations, allowing a local unprivileged process to make FUTEX_WAKE_OP write to an arbitrary kernel address. Affected systems must run RISC-V with CONFIG_RISCV_ISA_SUPM, have the tagged-address ABI enabled via PR_SET_TAGGED_ADDR_CTRL with a non-zero PMLEN, and use Sv57 paging with PMLEN=16 so that tag bits overlap canonical kernel address bits - on such configurations the flaw yields both kernel memory corruption and, through the FUTEX_OP_CMP_* result, a read oracle that discloses kernel memory. The vendor has published fixes in Linux 6.18.57, 7.2.11 and 7.3 (commits 8e48d8d51ab37b7decfbff3e2844e027a52ad6ea, 405290be962b32eec842776fbe3bdf81f15b1676 and 2e5c80bbc062a8dda33e687ebf7be8f074ee4f7d); no public exploit has been identified at time of analysis and EPSS is low at 0.21% (10th percentile), reflecting the narrow hardware/configuration prerequisites rather than the severity of the outcome.
A use-after-free exists in the Linux kernel mount-namespace code path that relocates mounts, where mnt_change_mountpoint() fails to reset the old parent's ->overmount pointer the way __umount_mnt() does. A local attacker who can perform mount operations - including the 'mount beneath'/overmount feature - and who holds an open file descriptor keeping an unmounted mount alive can leave ->overmount pointing at a moved mount that is subsequently unmounted and freed; do_lock_mount() then walks that dangling pointer and takes references into freed memory, giving high confidentiality, integrity and availability impact to a local user with mount capability. The assessed vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8), EPSS is 0.21% (10th percentile) and there is no KEV entry and no public exploit identified at time of analysis; the vulnerable overmount/reparent logic is present in kernels around 6.17, with fixes in 6.18.57 and 7.2.11.
The Linux kernel's mount-notification bookkeeping can queue the same mount twice on notify_list, truncating the list and leaving it pointing at memory that is freed after the grace period, so that later mount operations walk a freed slab object (CVSS 3.1 score 7.8, AV:L/PR:L, high confidentiality and integrity impact). Reaching the bug requires a local actor able to mount a source carrying MNT_SHRINKABLE (NFS, AFS or CIFS submounts created by finish_automount(), or the tracefs mount under debugfs, with the flag inherited by bind mounts) inside a mount namespace that holds a FAN_MARK_MNTNS fanotify mark, which an otherwise unprivileged user can arrange as root inside a user namespace on systems where unprivileged user namespaces are enabled. No public exploit code and no confirmed active exploitation were identified in the available data, and EPSS is low at 0.21% (10th percentile); vendor fixes are published in the stable trees.
A use-after-free in the Linux kernel's fsverity subsystem lets a local attacker who already holds low privileges on a fsverity-enabled system race concurrent __fsverity_get_info() lookups against different verity-protected inodes, potentially leading to memory corruption, information disclosure, or code execution in kernel context. Only kernels built and deployed with fsverity in active use are exposed, and because the flaw is a race the attacker must win a narrow timing window between the rhashtable lookup and the freeing of struct fsverity_info, which makes reliable triggering harder than a plain local-privilege-escalation bug. There is no CISA KEV listing and no confirmed public exploit code at time of analysis; EPSS is 0.20% (9th percentile), so mass exploitation is not expected, although the vendor-priority signal places remediation in the current week.
The Linux kernel's mount-namespace propagation code can strip the MNT_LOCKED protection from a locked mount that covers a sensitive path - such as a user namespace's /proc or its root - allowing a local user who controls a user namespace to unmount that cover and read content it was supposed to hide, as demonstrated by the propagation sequence in the upstream commit message. Affected are kernels built with user-namespace support where an unprivileged user can create user namespaces whose shared-mount copies receive propagation from the host and whose cover over a sensitive mountpoint carries MNT_LOCKED; hosts that disable unprivileged user namespaces or never share mounts into user namespaces are not exposed. The assessed severity is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N (local, high complexity, scope-changing, high confidentiality impact), EPSS is 0.20% (9th percentile), and this is not a CISA KEV entry: no public exploit was identified at time of analysis.
Stale arm64 TLB entries in Zephyr RTOS 4.3.0 through 4.4.2 let an unprivileged user thread (CVSS PR:L, local access) retain read/write mappings to a physical page frame after the demand paging eviction algorithm has reclaimed and reissued that frame to the kernel or to another memory domain. Because the single-VA invalidation only ever matched ASID 0 and global entries, a domain-private non-global leaf created for a k_mem_partition or a user thread stack survives page-out, enabling information disclosure and memory corruption that breaks CONFIG_USERSPACE isolation with scope-changing impact beyond the vulnerable component. Exploitation requires an arm64 build with both CONFIG_USERSPACE and the experimental CONFIG_DEMAND_PAGING enabled, an active backing store, and a demand-paged page privately mapped into a user memory domain; the attacker must already be running user-mode code and must drive memory pressure to force eviction and immediate frame reuse (AC:H). No public exploit code or PoC reference was identified in the available sources and the issue is not listed in CISA KEV; vendor fix commits are merged upstream on main with a projected fixed version of 4.5.0, while branch backports remain open.
Local privilege escalation in the optional dnscache package of Zimbra Collaboration Suite lets the low-privileged Unix 'zimbra' service account gain root on the host, affecting the dnscache builds shipped with ZCS 10.1.16 and 10.1.21 (EUVD lists 10.0 through 10.1.21). An attacker who already controls the zimbra account can abuse the passwordless sudo rule for the zmunbound wrapper, which forwards arbitrary arguments to Unbound without constraining the configuration path, to run Unbound with a root-owned configuration that disables chroot, read root-readable files such as password hashes and private keys through Include-directive parser errors, and write or append root-owned files. There is no KEV listing and no confirmed public exploit code in the available data, although Rapid7 has published a research write-up on breaking Zimbra identity boundaries; exploitation is local and requires the optional package to be installed, so it is an authenticated (PR:L) post-compromise escalation rather than a network-facing attack, and the base 7.8 score reflects high confidentiality and integrity impact once that foothold exists.
The Zimbra Collaboration Suite MTA package lets the Unix zimbra account escalate to root: the installed sudo policy permits passwordless root execution of Postfix administration commands without constraining their arguments, and since the zimbra user controls the daemon_directory setting and can write the Postfix configuration directory, invoking 'postfix set-permissions' makes Postfix run an attacker-supplied post-install program as root. Rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N, C/I/A:H), it is strictly a local escalation primitive - an attacker must already have command execution as zimbra on an MTA node, so no remote or unauthenticated path exists, and exploitation is confined to MTA nodes running the affected package. No public exploit code and no confirmed active exploitation were identified at time of analysis; the priority label is 'this_week', reflecting a genuine high-impact chaining primitive whose risk is gated by the local prerequisite.
Local privilege escalation in the zmmailboxdmgr launcher of Zimbra Collaboration Suite lets the Unix zimbra account execute arbitrary commands as root, breaking the boundary between the mail service account and the host. Because the launcher's passwordless sudo path does not adequately restrict JVM arguments (CWE-88 argument injection), an attacker with a zimbra-level foothold on a mailbox server can delay Jetty's privilege drop and register an -XX:OnOutOfMemoryError command that fires while the JVM is still root, although the malicious restart interrupts mailboxd and is therefore disruptive. Affected builds are the identified ZCS 10.1.16 and 10.1.21 releases (EUVD lists versions up to and including 10.1.21); no KEV entry or confirmed working exploit code is present in the available data, though Rapid7 has published a technical research write-up of the technique, and the EPSS/KEV signal base is absent here. CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects full root impact behind a mandatory local prerequisite, which places it at this-week rather than emergency priority.
PraisonAI recipe execution in versions 4.5.87 through 4.6.60 allows an untrusted steps-based recipe to self-approve the default-denied execute_command shell tool, so an operator who never set allow_dangerous_tools=True can still end up running arbitrary OS commands with the PraisonAI process's privileges. The recipe-level gate (CWE-78/CWE-863) inspects only TEMPLATE.yaml requires.tools, while workflow.yaml agents.*.tools declarations and a top-level approve: list are parsed by YAMLWorkflowParser and installed into the approval registry as already approved. Exploitation is local and user-interaction driven (CVSS 7.8, AV:L/UI:R, PR:N), a public proof-of-value reference exists in the advisory demonstrating the bypass with a harmless printf canary rather than verified working exploit code, and no active exploitation (CISA KEV) is reported for this this_week-priority issue.
PraisonAI versions 4.5.87 through 4.6.58 apply their default-deny dangerous-tool policy only on the standard recipe path, so a recipe that honestly declares a dangerous tool such as execute_command in TEMPLATE.yaml requires.tools is correctly returned as POLICY_DENIED by recipe.run() but proceeds into _execute_recipe() through recipe.run_stream() with allow_dangerous_tools=False, letting commands run with the privileges of the PraisonAI process. The issue is reachable either when an operator runs an untrusted recipe via 'praisonai recipe run <recipe> --stream' or when a lower-trust user can reach the recipe HTTP sidecar endpoint POST /v1/recipes/stream, though for the HTTP path the advisory does not claim default unauthenticated remote code execution because the sidecar is documented as a localhost REST API with optional API-key/JWT authentication. CVSS 3.1 scores it 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting Local access and Required User Interaction rather than a remotely reachable pre-auth flaw; there is no CISA KEV entry for this CVE, and the vendor advisory includes a local proof-of-value script using a harmless printf canary, which is a PoC reference rather than verified working exploit code against a deployed target.
Command injection in ASUS router firmware lets an unauthenticated attacker on an adjacent network segment execute arbitrary commands with root privileges, but only while the device is still in its factory-default, unconfigured state. Per the vendor-sourced advisory and the assessed vector, authentication is not required and no user interaction is needed, so any reachable router that has not completed initial setup is exposed to devices on the same LAN/Wi-Fi segment; internet-facing exploitation is not implied. The exact vulnerable parameter and endpoint are not described in the available sources, no public exploit code has been identified at time of analysis, and the vendor points to the 'Security Update for ASUS Router Firmware' section of its advisory for fix guidance.