Local privilege escalation in Android 17 allows an app already installed on the device to bypass permission checks and gain elevated access by invoking a privileged system component that fails to validate the caller's identity. The CVSS 8.4 score reflects high confidentiality, integrity and availability impact with no user interaction required, but the attack surface is strictly local - an attacker must first get code running on the device, and no network path exists. Exploitation is not confirmed: no public exploit code or KEV listing was identified at time of analysis, CISA SSVC records exploitation as 'none' and automatable as 'no', while technical impact is rated total; no EPSS score was supplied in the source data.
Local privilege escalation in Android's Wi-Fi system service (WifiServiceImpl.startTetheredHotspotRequest) allows an already-installed application to bypass permission checks through a confused-deputy pattern, gaining access to privileged tethering/hotspot operations without holding any granted permissions. Affected branches are Android 14, 15, 16, 16-qpr2 and 17, with a CVSS 3.1 score of 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflecting local-only attack, no required permissions and no user interaction. Exploitation is not confirmed in the wild - SSVC records Exploitation: none and no public exploit code was identified at time of analysis - and the fix ships in the November 2026 Android Security Bulletin. The attack surface is bounded: an attacker must already have code execution on the device (a malicious or trojanized app), and SSVC marks the issue as not automatable.
Local privilege escalation in Android's telecom framework (queryRemoteConnectionServices in ConnectionServiceWrapper.java) allows a malicious or compromised app installed on the device to induce the privileged telecom service to act on its behalf, bypassing a permission check through a confused-deputy pattern (CWE-441). The flaw is rated CVSS 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning no granted privileges and no user interaction are required, but it is not remotely reachable - the attacker must already have local code execution, in practice the ability to install and run an app. Android 14, 15, 16 and 16-qpr2 are listed as affected; no public exploit has been identified at time of analysis and fixes are addressed in the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Android's GrantCredentialsPermissionActivity allows an installed application to obtain account credentials it should not be granted, by presenting a misleading or insufficiently informative permission dialog to the user. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17 according to EUVD version data, with the vendor bulletin covering the Android Open Source Project component. The vector is local (AV:L) with no privileges required and high confidentiality, integrity and availability impact, rated 8.4; no public exploit has been identified at time of analysis and SSVC marks the flaw as not automatable, so the practical barrier is first obtaining app-level code execution on the device.
Local privilege escalation in Google Android's NotificationManagerService (affecting Android 14, 15, 16, 16-qpr2 and 17) lets an app running on the device drive a policy desynchronization in notification-listener access grants, yielding high confidentiality, integrity and availability impact. Per the CVSS vector (AV:L, PR:N, UI:N) the attacking app needs no previously granted privileges and no user interaction; it only needs a foothold on an affected build, so remote exploitation is not possible. No public exploit has been identified at time of analysis (SSVC exploitation: none) and the issue is scheduled in the vendor's November 2026 Android Security Bulletin, placing it in the current weekly patching cadence rather than an emergency response.
Local privilege escalation in the Android framework's UsbDialogHelper component, caused by misleading or insufficient UI (CWE-451) in the USB dialog path, affecting Android 14, 15, 16, 16-qpr2 and 17. Per the assessed vector (AV:L/AC:L/PR:N/UI:N), code already running on the handset can trigger the flaw without elevated privileges and without user interaction, yielding high confidentiality, integrity and availability impact; network reachability does not apply. Exploitation status is none per SSVC and no public exploit has been identified at time of analysis, so this is a real but non-urgent priority for the current week rather than an emergency.
Android's Storage Access Framework contains an access-control logic error in ExternalStorageProvider.java, specifically in the shouldBlockDirectoryFromTree method, allowing a locally-present app to reach protected data by abusing the document-tree interface. Because the vector is AV:L with PR:N and UI:N, any permission-less app already installed on the device can trigger the flaw without user interaction, yielding high confidentiality and integrity impact (our assessment scores it 8.4 with availability unaffected). The vendor lists the fix in the November 2026 Android security bulletin; no public exploit code or confirmed active exploitation is identified in the available data, and the this_week decision label reflects a serious but locally-gated issue rather than an urgent remote threat.
Android 14, 15, 16, 16-qpr2 and 17 contain a confused deputy flaw (CWE-441) in the AppTimeTracker deliverResult path that lets a locally installed app trigger a background activity launch and escalate to the privileges of a more trusted component, yielding high confidentiality and integrity impact. Per the independent assessment the malicious app needs no extra execution privileges and no user interaction (PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must first get code onto the device with no remote path available. No public exploit code or active exploitation is confirmed at time of analysis - SSVC Exploitation is 'none' and Automatable is 'no' - and the vendor bulletin is the November 2026 Android security release.
Local privilege escalation in Android's ActivityStarter component (resolveToHeavyWeightSwitcherIfNeeded in ActivityStarter.java) lets an app already installed on the device abuse a confused-deputy condition to make a privileged system component perform a background activity launch on its behalf, yielding high confidentiality, integrity and availability impact with no user interaction. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) confirms the attacker needs local code execution - in practice a locally installed application - but no additional execution privileges and no user tap; remote exploitation is not possible without first getting code onto the device. Affected versions reported are Android 14, 15, 16, 16-QPR2 and 17; SSVC rates technical impact as total but marks the flaw as not automatable with no exploitation observed, and there is no public exploit identified at time of analysis.
Background activity launch in Google Android 14, 15, 16, 16-qpr2, and 17 allows a locally installed app to start activities in the background by exploiting a confused deputy in ActivityTaskManagerService.moveTaskToFrontLocked, bypassing the task-ordering checks that are supposed to prevent exactly that. Per the assessed CVSS vector (AV:L/PR:N/UI:N), the attacker needs no special permissions and no user interaction once an untrusted app is running on the device, yielding high confidentiality and integrity impact with local escalation of privilege. The flaw is rated this-week priority rather than emergency: it is not marked as actively exploited in CISA KEV, SSVC records exploitation as none and automatable as no, and no public exploit code was identified at time of analysis. Fixes are delivered through the Android Security Bulletin dated 2026-11-01.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2 and 17 lets an unprivileged application already installed and running on the device abuse a confused-deputy flaw in AddAccountSettings.java, causing a privileged component to launch a background activity on the attacker's behalf and yielding high confidentiality and integrity impact with no additional execution privileges and no user interaction. The attack surface is strictly local (AV:L, PR:N, UI:N), so there is no remote vector, and the attacker must first get code running on the target. No public exploit identified at time of analysis; CISA SSVC records exploitation as none and automatable as no, and the issue carries a this-week priority, meaning it should be scheduled into the current patch cycle rather than treated as an emergency.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2, and 17 allows an app already installed on the device to exploit a missing permission check in AccessibilityWindowManager.setAccessibilityWindowAttributes and create untrusted or misleading UI. The independent assessment rates the issue AV:L/AC:L/PR:L/UI:N with high confidentiality and integrity impact, requiring a local app foothold but no user interaction, while SSVC records Exploitation: none and Technical Impact: total. No public exploit has been identified at time of analysis, and the vendor reference is the Android Security Bulletin for 2026-11-01.
Local privilege escalation in Google Android 17 allows an app already running on the device to abuse a confused-deputy component and execute sensitive USSD codes without additional execution privileges or user interaction, with high confidentiality and integrity impact. The issue is rated CVSS 8.4, no active exploitation is confirmed in the supplied data, and no public exploit identified at time of analysis; the vendor reference is the November 2026 Android Security Bulletin. This is a genuine prioritization candidate but not an emergency, matching the this_week decision label.
Intent redirection in Android 17's ContactsPickerActivity lets a locally installed malicious app relay an attacker-controlled intent into a more privileged handler, gaining the privileges of that handler and thereby escalating from an ordinary app sandbox to a higher-integrity context (CVSS 8.4, AV:L/AC:L/PR:N/UI:N, C:H/I:H/A:H). The confused-deputy flaw sits in forwardToPreferredActionPickHandler within ContactsPickerActivity.kt and requires no user interaction and no permissions granted to the calling component, but the attacker must already be able to run code or deliver an intent on the device - typically through a separately installed application. Affected scope is stated as Android 17 only; no public exploit code has been identified at time of analysis and CISA SSVC records exploitation as none, so this is a genuine but non-emergency local privilege-escalation issue slated for remediation in the current patch cycle.
A confused-deputy flaw in multiple Android onActivityResult handlers allows a locally installed app to read contact data belonging to a protected profile (such as a work or managed profile) without holding any permission for it. Per the assessed vector (AV:L/AC:L/PR:N/UI:N) the attacker needs only an installed app - no granted privileges and no user interaction - but the device must actually be configured with a separate protected profile holding the contacts, since without that boundary there is nothing to cross. Affected builds span Android 14, 15, 16, 16-qpr2 and 17 per EUVD; no public exploit code was identified at time of analysis and there is no CISA KEV entry, so priority follows the vendor bulletin rather than observed exploitation.
Authorization bypass in NLnet Labs Krill lets an authenticated Krill operator assert an arbitrary child identity during parent-child provisioning when the target CA's parent CA is hosted on the same Krill server, bypassing the signed CMS verification normally used in the RFC 6492 exchange. The issue is conditional on a shared or multi-tenant deployment with co-located parent and child CAs; single-tenant setups with remote parents are not reachable through this path. CVSS 3.1 rates it 8.4 with high confidentiality and integrity impact, and no public exploit has been identified at time of analysis.
An authorization bypass in NLnet Labs Krill allows an account whose role is deliberately scoped to a subset of CAs (cas = [...]) to exercise its full permission set on any API request that is not tied to a specific CA, including the bulk import endpoint POST /api/v1/bulk/cas/import. Exploitation requires a valid, provisioned Krill account holding such a restricted role (PR:L in the CVSS vector, so this is an authenticated insider or compromised-credential scenario), but a successful attacker can create a child CA beneath any existing CA, hand it that CA's resources, and mint the ROAs supplied in the request, affecting other tenants sharing the instance (S:C). No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, and the vendor advisory is the authoritative source.
Nonce reuse in Krill's login-session token encryption lets an attacker who captures multiple encrypted tokens across Krill restarts exploit a repeated (key, nonce) pair to recover or forge session-token plaintext. The flaw stems from a nonce counter that resets to zero on every restart, so deployments that restart Krill periodically accumulate ciphertexts encrypted under identical key/nonce combinations. Exploitation is not anonymous: it requires low-privilege authenticated access to the login flow, several restarts the attacker cannot directly trigger, and cryptanalytic effort (AC:H), so realistic risk sits below the raw 8.4 score; no public exploit code or active exploitation was identified at time of analysis, and the vuln.today decision label is this_week.
Missing permission checks in the MediaTek GPU pdma driver, paired with a use-after-free, allow local privilege escalation on MT8910 and MT6993 chipsets: code running without privileges can reach the pdma interface and gain elevated execution with no user interaction and no additional execution privileges. MediaTek assigned patch ALPS11365075 (issue MSV-9546) and published it in the November 2026 product security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and SSVC records exploitation as none and the flaw as not automatable, but the total technical impact and CVSS 8.4 severity support this-week rather than emergency-grade prioritization, since the vector is local-only and confined to the listed chipset models.
Out-of-bounds write in the MediaTek modem component allows code that is already running locally on an affected device to corrupt memory and escalate privileges, with no authentication or user interaction required (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/SU/ C:H/I:H/A:H, base score 8.4). Roughly 77 MediaTek MT-series chipsets are enumerated as affected, ranging from entry-level parts such as MT6739, MT6761 and MT6765 through premium SoCs such as MT6989, MT6991 and MT6993. No public exploit code has been identified at time of analysis and SSVC records exploitation as none with no automatable path, but technical impact is rated total and the only complete fix is MediaTek patch MOLY01778991 (issue MSV-8900), published in the November 2026 product security bulletin.
Local privilege escalation in the GPU pdma path of MediaTek MT8910 and MT6993 chipsets allows an unprivileged local process to gain elevated privileges through a use-after-free condition in memory handling. Per the CVSS vector (AV:L/AC:L/PR:N/UI:N), no prior privileges and no user interaction are required once code is running on the device, but the attacker must already have local execution - the flaw is not remotely reachable. Exploitation activity is not confirmed (CISA SSVC: Exploitation none) and no public exploit code has been identified at time of analysis; MediaTek has issued patch ALPS11365070, so exposure is confined to firmware predating that fix.
Absolute Secure Access server versions 13.0 up to but not including 14.61 mishandle attacker-supplied input, allowing a low-privilege authenticated remote user to cause a persistent denial of service. The flaw affects availability only, with an independent CVSS 3.1 score of 8.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and a vendor CVSS 4.0 vector that adds subsequent-system availability impact (SA:H); no public exploit code or CISA KEV entry was identified at the time of analysis.
Heap buffer overflow in QuickJS-NG before 0.16.0 allows JavaScript code executed by the embedding application to drive an integer overflow inside js_typed_array_sort(), corrupting heap memory on 32-bit hosts and crashing the process, with limited potential for code execution (vendor CVSS 4.0 score 8.3; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Only 32-bit builds are affected, and exploitation requires a typed array near 2^30 elements - roughly a 1 GB ArrayBuffer - to be allocated successfully, followed by a .sort() call with a comparator; 64-bit builds do not overflow the size computation. No public exploit code was identified at time of analysis, and the vulnerability has not been confirmed as actively exploited (CISA KEV).
Denial of service in Eclipse ThreadX NetX Duo 6.0 through 6.5.2.202603a: the BSD raw IPv6 send path adds a destination-table entry and then reads that entry without first checking whether the add succeeded, so when the table is full and an off-link destination is reached through a default router whose neighbour cache entry is unknown, a NULL entry is dereferenced and the sending thread crashes. The defect is only reachable in builds that enable NX_BSD_ENABLE, NX_BSD_RAW_SUPPORT and FEATURE_NX_IPV6 where the application itself sends on an AF_INET6 raw socket with IP_RAW_IPV6_HDRINCL set, and only while the default router is unresolved - preconditions a remote sender does not control. A remote party can fill the destination table only if NX_ENABLE_IPV6_PATH_MTU_DISCOVERY is compiled in (32 crafted ICMPv6 Packet Too Big messages quoting distinct destinations were measured to do it); otherwise the table fills from the device's own outbound traffic to distinct off-link destinations. Unauthenticated (PR:N in both the vendor CVSS 4.0 vector and the assessed 3.1 vector) with high attack complexity and present attack requirements; no public exploit code was identified at time of analysis.
Unauthenticated path traversal in the Fastify plugin @fastify/reply-from (all releases up to and including 12.8.0) lets a crafted request escape a configured upstream prefix and reach other upstream endpoints. The plugin's buildURL() checked proxy paths only for forward-slash dot-segments, but the WHATWG URL parser it then used collapses backslashes and %5c into forward slashes on http, https, ws and wss, so a path containing \..\ or %5c..%5c passes the check and resolves to a different upstream path - an unauthenticated request (PR:N) can therefore slip past prefix scoping or Fastify route guards placed in front of reply.from(). Impact is primarily confidentiality (C:H) with limited integrity effect (I:L); no public exploit identified at time of analysis, and exploitation is conditional on the consuming application concatenating untrusted input into the forwarded path.
http4k's Digest authentication advertises the RFC 7616 auth-int quality-of-protection but never binds the request entity body into the digest, so an on-path attacker on a cleartext channel can rewrite the body of an already-authenticated, state-changing request while leaving the Authorization header valid. Affected is the org.http4k:http4k-security-digest module from 4.9.10.0 through 6.59.0.0, and only when an operator explicitly configures ServerFilters.DigestAuth with qop = listOf(Qop.AuthInt); the default Qop.Auth is not affected. The attack is unauthenticated - no credentials are needed - but requires a non-default QoP setting, no TLS, an active MITM foothold, and a body-omitting peer such as http4k's own DigestAuthReceiver, so a strictly RFC 7616-conformant client that hashes the body would simply fail to authenticate. A public PoC reference exists (a dependency-free digest-equivalence harness published with the advisory); it is not verified as working exploit code, and there is no confirmed active exploitation.
Path traversal in http4k’s ThymeleafTemplates Caching and HotReload wrappers allows remote unauthenticated attackers to read files outside baseTemplateDir when an application lets request-controlled data reach ViewModel.template() or its ::selector suffix. The issue affects http4k before 6.62.0.0-ee and is conditional on request-derived template selection; Pug4j is protected by commit 725f1b9697’s containment check, and the pinned Handlebars 4.5.5, FreeMarker and Pebble 4.1.2 engines are not affected. A verified component-level reproduction is published with the advisory, but there is no CISA KEV entry or confirmed exploitation of deployed applications, and impact is limited to disclosure of files readable by the server process; the assessed priority is this_week.
Improper verification of cryptographic signatures in Dell Alienware Command Center (AWCC) versions prior to 6.14.54.0 allows an unauthenticated attacker with an adjacent-network position to present a forged or tampered signed object that the application accepts as trusted, resulting in arbitrary code execution and elevation of privilege. No user interaction is required, but attack complexity is rated high and reach is limited to hosts on the same adjacent network running the consumer gaming utility. No public exploit has been identified at the time of analysis, and the supplied data contains no KEV listing confirming active exploitation.
Argument injection in Dell OpenManage Enterprise versions prior to 4.8.0 allows a low-privileged authenticated user who can reach the appliance over an adjacent network segment to slip attacker-controlled delimiters into a command the product builds, resulting in command execution on the management appliance. The impact is bounded in the CVSS vector to partial confidentiality and integrity loss with no availability effect (C:L/I:L/A:N), giving a moderate base score of 4.6. Exploitation requires both presence on the management network (AV:A) and a valid low-privilege OME account (PR:L), so practical risk is concentrated among insiders or actors who have already established a foothold on the management segment; no public exploit has been identified at the time of analysis and the priority label is this_month, not act_now.
Command injection in Dell OpenManage Enterprise versions prior to 4.8.0 lets an authenticated low-privileged attacker with adjacent-network access execute arbitrary OS commands on the console host. Exploitation requires presence on the same LAN or management VLAN (AV:A) plus valid low-privileged console credentials (PR:L), with no user interaction and low attack complexity; CVSS 3.1 base score is 8.0. No public exploit was identified at time of analysis, and Dell's advisory identifies upgrading to 4.8.0 or later as the only confirmed complete fix, consistent with the vuln.today this_week priority.
Android Automotive OS 14 through 17 builds that include the privileged ClusterHomeSample component allow a locally installed unprivileged app to persistently place potentially misleading or distracting content on the safety-critical instrument cluster. The app can declare an activity with the android.car.cluster.NAVIGATION category and request navigation app focus, after which ClusterHomeSample acts as a confused deputy and launches it without enforcing android.car.permission.CAR_DISPLAY_IN_CLUSTER. The assessed impact is high integrity and low availability with no confidentiality impact; exploitation requires prior local app installation and a build that ships the vulnerable sample path, EPSS is 0.18% (8th percentile), and no public exploit was identified at time of analysis.
Dell Alienware Command Center (AWCC) releases prior to 6.14.54.0 contain an improper privilege management flaw (CWE-269) that lets an attacker who already holds a low-privileged local account escalate to higher privileges, with high impact to confidentiality, integrity and availability. Exploitation requires local access to a Windows host running the affected AWCC build, and the vendor has published a security advisory (DSA-2026-429) covering multiple vulnerabilities in the 6.x line. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (no CISA KEV listing) despite a high CVSS base score of 7.8.
Improper input validation in Android's MMI/USSD handling code (MmiUtils.java) allows a local attacker to escalate privileges by getting crafted USSD/MMI codes processed on the device. Android 14, 15, 16, 16-QPR2 and 17 are listed as affected, and successful exploitation yields high confidentiality, integrity and availability impact, though it requires local presence and a user action (AV:L/PR:N/UI:R, CVSS 7.8). No public exploit has been identified at time of analysis, SSVC records exploitation as none and non-automatable, and EPSS is only 0.11% (1st percentile), so the practical threat is locally scoped rather than a mass-exploitation risk.
Enhanced Confirmation Mode (ECM) can be bypassed on Android 16, Android 16-qpr2 and Android 17 by an already-installed, sideloaded application that manipulates its own package source during a self-update, because of a logic error in handlePackagePostInstall within InstallPackageHelper.java. The result is local escalation of privilege to a higher-integrity state with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L/AC:L/PR:L/UI:N), though the attacker must first get a malicious app onto the device and running with ordinary User execution privileges. No public exploit code or exploit reference has been identified at time of analysis, SSVC records exploitation as none and the issue as not automatable, so the practical risk is second-tier and tied to environments where sideloading of untrusted applications is permitted.
Local privilege escalation in the Linux kernel Bluetooth L2CAP subsystem: a race between l2cap_sock_bind() and l2cap_chan_connect() lets an L2CAP channel be linked to an l2cap_conn twice, breaking the one-connection-per-channel invariant that l2cap_chan_del() cleanup relies on and exposing memory-corruption paths with high confidentiality, integrity and availability impact. Only local, authenticated processes (PR:L) with access to AF_BLUETOOTH sockets on a kernel built with Bluetooth/L2CAP support can reach the flaw, and exploitation requires winning a narrow timing window (AC:H); there is no remote or unauthenticated path. No public exploit code has been identified at time of analysis, and the issue is prioritized for remediation this week per the assigned decision label.
A race condition in the Linux kernel's ftrace tracing subsystem lets a local, already-privileged user free-and-reuse a trace_array: trace_module_record() walks the ftrace_trace_arrays list from the module notifier without holding trace_types_lock, while a concurrent rmdir of a persistent/named trace instance removes that same array from the list and frees it under the lock, so a module load or unload can walk into freed memory. Affected are kernels built with tracing enabled that actually use persistent trace instances; exploitation is local-only (AV:L) and requires the ability to load or unload kernel modules and to create/remove instance directories under tracefs, which normally means root or CAP_SYS_MODULE/CAP_SYS_ADMIN. Per the independent assessment the race is timing-sensitive (AC:H rather than AC:L), no public exploit code or CISA KEV entry was identified at time of analysis, and impact is rated high for confidentiality and integrity of the kernel.
Local kernel memory corruption in the Linux tracing subsystem can result from a race in update_last_data_if_empty(): concurrent readers that reset persistent 'last boot' trace data without trace_types_lock can double-free module_delta, and a module notifier can update the object while it is being freed. Affected are Linux kernel builds using the non-default persistent boot-mapped last-boot ring buffer, with exploitation requiring local access to tracefs (CVSS AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H; tracefs is commonly root/CAP_SYS_ADMIN-restricted). No public exploit identified at time of analysis, and the supplied decision signal places remediation in the this_week priority band.
Out-of-bounds read and possible out-of-bounds write in the Linux kernel tracing event-filter parser: a local user able to create a perf tracepoint counting event and issue PERF_EVENT_IOC_SET_FILTER with an expression that ends after a logical operator (optionally followed by unary '!' tokens, e.g. 'common_pid == 1 || common_pid == 2 &&') leaves unresolved operator state, so the second parsing pass reads prog[-1] and, depending on adjacent slab contents, can copy an out-of-bounds word into a branch target that survives the forward-only jump check. The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (base 7.8) matches an unprivileged local attacker gaining high confidentiality, integrity and availability impact through kernel memory access, but exploitation requires local access plus permission to open perf tracepoint events, in practice governed by kernel.perf_event_paranoid and/or CAP_PERFMON/CAP_SYS_ADMIN. No public exploit code and no CISA KEV entry were identified at time of analysis, and reliable memory corruption is contingent on adjacent slab contents; upstream stable fix commits are available.
A use-after-free in the Linux kernel's ftrace histogram-trigger code lets a local user who can write to the tracefs event-trigger interface create a target histogram with a field variable, have it latch onto an unrelated pre-existing histogram that merely shares the same keys, and then remove that other trigger - after which unregister_field_var_hists() dereferences the freed histogram, producing a KASAN slab-use-after-free read in event_hist_trigger_free. The assessed vector is AV:L/AC:L/PR:H with high confidentiality, integrity and availability impact, reflecting that tracefs trigger files are normally writable only by root or CAP_SYS_ADMIN, so the practical attack surface is privileged local access on kernels built with CONFIG_HIST_TRIGGERS. No public exploit has been identified at time of analysis; the flaw is fixed by a series of upstream stable commits on git.kernel.org, and the priority label is this_week.
Local use-after-free in the Linux kernel's tracing/histogram subsystem allows a local user with access to the ftrace event-trigger interface to free a synthetic event while an active histogram action still holds a pointer to it, creating a kernel memory-corruption risk. Affected kernels must be built with CONFIG_HIST_TRIGGERS and permit local access to tracefs; exploitation requires registering a histogram on a non-synthetic trace event whose basename collides with a synthetic event before that synthetic event is created, then removing the histogram afterward so se->ref is decremented without a matching increment. No public exploit identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Use-after-free in the Linux kernel's io_uring waitid handling can allow a local user who can issue io_uring syscalls to corrupt kernel memory and potentially escalate privileges, because a race between request completion and the waitid wake handler can free and reuse the request while a wakeup callback still touches it. The flaw is timing-sensitive and requires local access (AV:L, PR:L, AC:H in the independent assessment); it is not remotely exploitable, and hosts that disable io_uring are not exposed. No public exploit code or active exploitation has been identified at time of analysis.
The io_uring waitid implementation in the Linux kernel can be driven into a 31-bit reference-counter wrap by a local user, allowing a waitid request to be claimed and completed a second time, corrupting kernel state. Kernels built with io_uring and waitid support are affected wherever unprivileged users can submit and cancel io_uring waitid operations; systems that disable io_uring for unprivileged users (io_uring_disabled sysctl or seccomp policy) are not exposed. The assessed vector is local with high attack complexity (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) because the wrap demands on the order of 2^31 failed cancellation attempts and winning the completion-ownership handoff; no public exploit code or active exploitation has been identified at time of analysis, and priority is this_week rather than emergency.
Missing authorization in eta-register versions 2.0.8 and later but before 2.0.9 lets a locally present, low-privileged authenticated user escalate privileges within the application, with high impact on confidentiality, integrity and availability (CVSS 3.1: 7.8, AV:L/AC:L/PR:L/UI:N). The flaw is a CWE-862 missing authorization check reported by TR-CERT; the specific feature, endpoint or request that skips the check is not described in the available sources. No public exploit code is identified in the supplied data and the issue is not in CISA KEV; updating to 2.0.9 is the stated resolution, and priority is rated for handling this week.
Local privilege escalation in the MediaTek GPU pdma kernel driver allows a process already running with user-level privileges on a device built on an affected MediaTek chipset (EUVD lists MT8910 and MT6993) to corrupt kernel memory via a use-after-free and elevate to higher privileges; the flaw is rated CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and requires no user interaction beyond the attacker's existing local code execution. The attacker must already have local code running on the device and the device must use one of the affected chipsets, so there is no remote vector, and no public exploit code or active exploitation has been identified at time of analysis. MediaTek has assigned Patch ID ALPS11365081 (Issue MSV-9545), with fixes delivered to device makers through the November 2026 product security bulletin.
A stack-based buffer overflow in PyMuPDF's JM_set_annot_callout_line() lets code that controls the 'callout' argument of Page.add_freetext_annot() pass four or more points into a fixed three-element stack array, corrupting the stack frame and potentially crashing the interpreter or achieving code execution in the process that imports the library. The flaw is present in PyMuPDF 1.25.3 up to but not including 2.0, and is fixed in the 2.0 release by an added count>3 bounds check that raises a 'bad seq of points' RuntimeError. The supplied CVSS 4.0 vector scores it 7.7, while the independent assessment rates it CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting that low privileges and a specific precondition (the hosting application must route untrusted data into the callout parameter) are required; there is no CISA KEV entry and no public exploit identified at time of analysis, though the upstream fix commit ships a regression test that reproduces the overflow with a 100-point callout.
Authenticated tenants who can write their Alertmanager configuration in Grafana Mimir or Grafana Enterprise Metrics (GEM) can read arbitrary files from the Alertmanager host and exfiltrate them to a server they control. The receiver validation that rejects local file references missed two HTTP client settings, http_headers.<name>.files and basic_auth.username_file, so a tenant can point them at any file the Alertmanager process can read; the contents are then placed in an outgoing request header when a notification fires. The issue is rated 7.7 High (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) with confidentiality-only impact, is fixed in Mimir 3.1.7 and 3.2.2 and in GEM 2.17.20, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Server-side request forgery in SUSE Rancher Manager's `/meta/proxy` endpoint allows an authenticated Rancher user without administrative privileges on the local cluster to make the Rancher server issue requests to hosts the destination allowlist is supposed to block, including internal services and, where IMDSv1 is enabled, the AWS instance metadata endpoint. The allowlist decision is evaluated in a place where it cannot prevent forwarding, so a rejected destination is logged but the request is still handed to the proxy transport; the attacker controls method, headers, body and query string and receives the response. Affected releases are 2.15.0 through 2.15.3, 2.14.0 through 2.14.7, 2.13.0 through 2.13.11, 2.12.0 through 2.12.15 and 2.11.0 through 2.11.19 (and potentially older EOL versions), rated CVSS 7.6 with a vuln.today decision label of this_week; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV).
Remote denial of service in Google Android 14 through 17, including Android 16-qpr2, is caused by a missing bounds check in ipphelper.c that permits a stack buffer overflow when crafted input reaches the IPP-helper parsing code. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction, but the supplied sources do not confirm whether the IPP listener or printing service must be active or exposed for an attacker to reach the flaw; impact is availability-only (A:H) with no code execution or data exposure. This is a moderate, this-week priority rather than an emergency: no public exploit identified at time of analysis, SSVC exploitation is none, and no CISA KEV entry is indicated in the supplied data.
An out-of-bounds write in MediaTek modem (baseband) firmware, tracked as CVE-2026-20549, lets an attacker who operates a rogue base station corrupt memory in the modem of a connected user equipment device, with the potential for remote privilege escalation and code execution in the modem context. The flaw is an improper input validation issue (CWE-787) reachable over the adjacent cellular radio interface (CVSS 7.5, AV:A/AC:H/PR:N/UI:N), affecting devices built on a long list of MediaTek chipsets that have not received patch MOLY01775865. The attacker must first induce the target device to attach to attacker-controlled radio infrastructure, and the CVSS high attack-complexity metric reflects that conditions beyond the attacker's direct control must align for the write to succeed; no public exploit code has been identified at time of analysis and CISA's SSVC assessment records no observed exploitation.
Escalation of privilege in MediaTek modem firmware affects a broad set of MediaTek chipsets, including the MT67xx, MT68xx, MT69xx, MT87xx and MT88xx families enumerated in EUVD-2026-115013, when a user equipment connects to a rogue base station controlled by an attacker. A crafted over-the-air message triggers an integer overflow and out-of-bounds write in the modem, allowing privilege escalation with no authentication (PR:N) and no user interaction (UI:N); the assessed vector is AV:A/AC:H, reflecting the need for radio proximity and successful attachment to attacker infrastructure. No KEV listing or EPSS score accompanies the CVE in the provided intelligence, and no public exploit has been identified at the time of analysis; SSVC records Exploitation: none and Automatable: no, and the independent assessment describes the risk signals as moderate and internally consistent.