Monthly
Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.
Privilege boundary violation in FreeBSD's hwpmc(4) hardware performance monitoring subsystem allows a low-privileged local user to continue observing a process via attached PMCs after that process elevates privileges by executing a setuid or setgid binary, directly contrary to the kernel's intended security policy. Affected versions span FreeBSD 14.4-RELEASE before p9, 15.0-RELEASE before p13, and 15.1-RELEASE before p3; vendor patches are available per FreeBSD Security Advisory SA-26:56. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), placing this as a low near-term exploitation priority despite the high vendor CVSS score.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privilege management regression in FreeBSD 15.x ktrace(2) allows an unprivileged jail user to manipulate or suppress the jailed root user's kernel tracing configuration. Because an unrelated code change inadvertently causes PRIV_KTRACE to always be denied to jailed root, that user's active trace sessions are not marked as privileged - permitting any jail user holding debug rights over a traced process to alter or clear those trace flags. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) reflects negligible opportunistic exploitation probability, though multi-tenant jail environments relying on ktrace for security auditing face a meaningful auditability risk.
Path containment bypass in FreeBSD's unlinkat(2) and funlinkat(2) syscalls allows a local low-privileged process to delete files outside its intended directory scope. The kernel validates AT_RESOLVE_BENEATH but silently discards it before handing off to the path resolution layer, making the flag a no-op security guarantee. Applications using this flag as a sandbox boundary for file deletion operations are exposed to unintended tree traversal, with impact on both filesystem integrity and availability. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.13% (3rd percentile), indicating low observed exploitation probability.
Privilege escalation via incomplete privilege drop in the Python 'sh' subprocess library (versions < 2.2.4): when a root/privileged process launches a command with the _uid option, the child changes UID and primary GID but fails to clear the parent's supplementary groups via setgroups(). Any subprocess expected to run unprivileged can therefore retain sensitive parent groups (root, docker, disk, shadow, sudo), reading or writing resources those groups grant. No public exploit identified at time of analysis and it is not in CISA KEV; the fix is confirmed in release 2.2.4.
Security-policy bypass in PraisonAI before 4.6.78 renders the default Subprocess Sandbox backend inert, so administrator-defined blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are silently ignored. Any actor able to feed instructions into a PraisonAI agent can execute arbitrary subprocess commands, read sensitive files, and perform destructive file operations even though an explicit deny policy is configured. Reported by VulnCheck with a CVSS 4.0 base score of 8.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged local app to launch an arbitrary activity from the background by abusing a logic error in HostEmulationManager.onNullBinding(). Exploitation requires user interaction but no extra execution privileges, and no public exploit has been identified at time of analysis.
Privilege retention in Netatalk 1.5.0 through 4.4.2 results from auth modules silently ignoring failures of the seteuid() system call, allowing an authenticated network attacker to operate with unintended elevated privileges. When seteuid() fails-due to resource exhaustion, OS limits, or specific system configurations-the process continues execution under its original (higher) UID rather than the intended reduced privilege level, exposing file system objects or operations the user should not access. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor has confirmed the flaw and released a fix in version 4.5.0.
Privilege escalation to root in xrdp 0.10.5 and earlier allows authenticated local attackers to execute arbitrary code due to improper error handling during privilege drop in the session execution component. The flaw requires low attack complexity and no user interaction (CVSS 8.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available in xrdp v0.10.6. No public exploit or active exploitation confirmed at time of analysis, though CVSS scope change (S:C) indicates potential container/VM escape scenarios.
Write-before-consent in Hugging Face Transformers' GenerativePreTrainedModel.load_custom_generate() allows attacker-controlled Python files to be silently written to ~/.cache/huggingface/modules/ even when the user declines the trust prompt. Affected versions span 4.49.0 through 5.8.1. While immediate execution is blocked by the trust gate, the persisted cache file creates a stale-cache collision risk: subsequent loads of unrelated trusted models may inadvertently execute the previously cached, attacker-supplied Python code. No public exploit has been identified at time of analysis.
Privilege boundary violation in FreeBSD's hwpmc(4) hardware performance monitoring subsystem allows a low-privileged local user to continue observing a process via attached PMCs after that process elevates privileges by executing a setuid or setgid binary, directly contrary to the kernel's intended security policy. Affected versions span FreeBSD 14.4-RELEASE before p9, 15.0-RELEASE before p13, and 15.1-RELEASE before p3; vendor patches are available per FreeBSD Security Advisory SA-26:56. No public exploit has been identified and EPSS sits at 0.15% (5th percentile), placing this as a low near-term exploitation priority despite the high vendor CVSS score.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Privilege management regression in FreeBSD 15.x ktrace(2) allows an unprivileged jail user to manipulate or suppress the jailed root user's kernel tracing configuration. Because an unrelated code change inadvertently causes PRIV_KTRACE to always be denied to jailed root, that user's active trace sessions are not marked as privileged - permitting any jail user holding debug rights over a traced process to alter or clear those trace flags. No public exploit has been identified and the EPSS score of 0.18% (8th percentile) reflects negligible opportunistic exploitation probability, though multi-tenant jail environments relying on ktrace for security auditing face a meaningful auditability risk.
Path containment bypass in FreeBSD's unlinkat(2) and funlinkat(2) syscalls allows a local low-privileged process to delete files outside its intended directory scope. The kernel validates AT_RESOLVE_BENEATH but silently discards it before handing off to the path resolution layer, making the flag a no-op security guarantee. Applications using this flag as a sandbox boundary for file deletion operations are exposed to unintended tree traversal, with impact on both filesystem integrity and availability. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.13% (3rd percentile), indicating low observed exploitation probability.
Privilege escalation via incomplete privilege drop in the Python 'sh' subprocess library (versions < 2.2.4): when a root/privileged process launches a command with the _uid option, the child changes UID and primary GID but fails to clear the parent's supplementary groups via setgroups(). Any subprocess expected to run unprivileged can therefore retain sensitive parent groups (root, docker, disk, shadow, sudo), reading or writing resources those groups grant. No public exploit identified at time of analysis and it is not in CISA KEV; the fix is confirmed in release 2.2.4.
Security-policy bypass in PraisonAI before 4.6.78 renders the default Subprocess Sandbox backend inert, so administrator-defined blocked_commands, blocked_paths, blocked_imports, allow_subprocess, and allow_file_write restrictions are silently ignored. Any actor able to feed instructions into a PraisonAI agent can execute arbitrary subprocess commands, read sensitive files, and perform destructive file operations even though an explicit deny policy is configured. Reported by VulnCheck with a CVSS 4.0 base score of 8.7; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Google Android (versions 14, 15, 16, and 16-qpr2) allows a low-privileged local app to launch an arbitrary activity from the background by abusing a logic error in HostEmulationManager.onNullBinding(). Exploitation requires user interaction but no extra execution privileges, and no public exploit has been identified at time of analysis.
Privilege retention in Netatalk 1.5.0 through 4.4.2 results from auth modules silently ignoring failures of the seteuid() system call, allowing an authenticated network attacker to operate with unintended elevated privileges. When seteuid() fails-due to resource exhaustion, OS limits, or specific system configurations-the process continues execution under its original (higher) UID rather than the intended reduced privilege level, exposing file system objects or operations the user should not access. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV, but the vendor has confirmed the flaw and released a fix in version 4.5.0.
Privilege escalation to root in xrdp 0.10.5 and earlier allows authenticated local attackers to execute arbitrary code due to improper error handling during privilege drop in the session execution component. The flaw requires low attack complexity and no user interaction (CVSS 8.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available in xrdp v0.10.6. No public exploit or active exploitation confirmed at time of analysis, though CVSS scope change (S:C) indicates potential container/VM escape scenarios.