Canonical
Monthly
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Craft CMS versions 5.0.0-RC1 through 5.10.10 allow an authenticated low-privileged contributor to permanently delete canonical entry content by exploiting a broken authorization chain in ElementsController::actionDeleteForSite(). The method authorizes deletion against the user's provisional draft rather than the canonical element, then propagates the destructive action to the canonical record without re-verifying deleteEntriesForSite permission. Deleted content bypasses the recycle bin and is unrecoverable, making this an integrity-destroying flaw despite its mid-range CVSS score. No public exploit code is identified at time of analysis.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's net/sched fq_codel queueing discipline lets a local actor with traffic-control privileges trigger a wild kernel memory access and crash. When fq_codel drops packets during a peek operation, it calls qdisc_tree_reduce_backlog before restoring qlen; if qlen momentarily hits zero while peek still holds an skb, the parent class (e.g. qfq) is wrongly deactivated, producing a general-protection fault against a poisoned list pointer (0xdead000000000100 range) as seen under KASAN. No public exploit identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV.
Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell commands as root (real UID 0) by injecting a GNU sed 'e' flag payload into their ~/.pam_environment LANGUAGE entry, which is then processed unsanitized by Ubuntu-specific helper scripts (save-to-pam-env, update-langlist) when the SetLanguage D-Bus method is invoked. All Ubuntu accountsservice packages before version 23.13.9-8ubuntu7 are affected; this is a Ubuntu-specific packaging defect, not an upstream accountsservice issue. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack path is well-described and technically straightforward.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. No active exploitation has been identified (no KEV listing, no public exploit), and the fix is available in 0.9.0a2.
Zip Slip path traversal in Notepad++'s bundled WinGup update component (versions prior to 8.9.7) allows network-delivered malicious ZIP archives to overwrite DLL files outside the intended extraction directory, enabling arbitrary code execution when Notepad++ next loads the affected plugin. The attack requires user interaction to trigger the update workflow (CVSS UI:R) but demands no authentication on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability is fixed in the vendor-released 8.9.7 build.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify whether the bundled metadata.yaml entry is a symbolic link, letting an authenticated user with image-import rights supply a crafted archive whose symlinked metadata.yaml resolves to sensitive host paths. Rated CVSS 9.9 with a scope change (S:C), successful exploitation crosses the container/management boundary to read or overwrite files as the LXD daemon (typically root) on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; details are published only in Canonical advisory GHSA-j825-cg34-5fr5.
Path traversal in Canonical LXD's image metadata template processing enables an authenticated low-privilege attacker to read arbitrary host files or create files in arbitrary host filesystem locations. The flaw resides in the virtual machine/QEMU driver execution path, where LXD fails to sanitize template file paths from escaping the designated instance templates directory. Exploitation crosses the container/VM boundary to the host (scope change, S:C), making this high-severity in environments where host isolation is a security assumption. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write or read files outside the intended restore directory by embedding traversal sequences in the instance or storage-volume names stored in a crafted backup archive's metadata. Because LXD does not validate these names on import/restore, an attacker can corrupt or overwrite host files, potentially leading to full host compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the very high CVSS (9.9) is driven by the scope-changing, high-integrity/availability impact on the host.
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privilege instance configurations into restricted projects. When an instance is migrated to a target project, LXD applies caller-supplied configuration overrides without re-validating them against the destination project's enforced restrictions, so security controls such as privileged-container or device limits can be defeated. Rated CVSS 9.9 (CWE-863) with a scope-changing impact; no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallowed high-privilege configurations into restricted projects, defeating per-project security controls. The root cause is a time-of-check to time-of-use race in which LXD validates project restrictions before configuration merging finishes during cross-project instance copies. Rated CVSS 9.9 with a scope change; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authenticated user exceed the disk and volume limits an administrator configured on a project. The flaw stems from two code paths - cross-project volume moves (storagePoolVolumeTypePostMove) and volume snapshot restores with a nil config - that skip the AllowVolumeCreation/AllowVolumeUpdate limit checks, enabling over-allocation of storage. Reported by Canonical with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated user smuggle disallowed instance configurations into a restricted project by triggering a cross-project, cross-cluster-member migration. Because the migration arrives at the destination node as an internal cluster notification, the destination skips all target-project restriction checks (CWE-863), so limits and security restrictions on the target project are not enforced. Rated CVSS 9.9; reported by Canonical with a vendor patch available, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted project escape that project's security policy by migrating an instance into it. Because instancePostMigration never re-validated the incoming instance against the target project's enforced restrictions, an attacker could build a high-privilege or otherwise disallowed instance inside an unrestricted project and relocate it into the restricted one, inheriting capabilities (low-level container access, arbitrary devices, unrestricted network access) that the project was configured to forbid. Rated CVSS 9.9 by the vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%.
Portainer CE through 2.44.0 exposes root-level Docker host access to any authenticated low-privileged user via a URL path normalization flaw in the Docker proxy endpoint. The authorization middleware evaluates a non-canonical request path (e.g., percent-encoded slashes, double slashes, or traversal sequences) differently from the proxy layer that ultimately forwards it to the Docker daemon - allowing crafted requests to bypass all access controls while executing with full Docker API privileges. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, create, overwrite, or delete objects outside the operator-configured backend directory. The flaw spans rclone v1.40 through v1.74.4 and affects WebDAV, FTP, SFTP, HTTP, and Memory backends - but not S3-compatible or local filesystem backends, which encode `..` as literal filename characters. A fully functional, step-by-step proof of concept has been publicly released; no CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.
Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.
Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
We need to produce a JSON object with specific fields based on the provided CVE data. The user wants a multi-source synthesis. We have the CVE description, CVSS vector (CVSS 4.0), EPSS, patch info, CPE, tags, references, etc. Let's extract relevant details: CVE ID: CVE-2026-66040 Description: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. Remote attackers can supply a crafted PNG image with a malicious eXIf chunk. Attackers craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution. CVSS Score: 8.7, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (with other fields as X). So base score 8.7, high impact, user interaction required (UI:P). Attack vector network, low complexity, no privileges required. CWE: CWE-122 (Heap-based Buffer Overflow) EPSS: 0.55% (43rd percentile) – relatively low exploitation probability. Patch: Available from vendor (commit b506faf). Also EUVD says patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc Reported by: VulnCheck CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (all versions prior to fix) Tags: Heap Overflow, Buffer Overflow, RCE, Canonical, Ffmpeg ENISA EUVD ID: EUVD-2026-48742, affected versions: FFmpeg 0 ≤8.1.2, patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc References: pull request, commit, VulnCheck advisory, vuldb advisory. Now we need to fill each field. product_name: "FFmpeg" (primary product, 1-3 words) summary: Start with impact verb and product. Impact: heap out-of-bounds write in PNG/APNG encoder, leading to heap corruption, crash, potential RCE. Affected: FFmpeg through
Unauthenticated denial of service in Gitea's Locale middleware allows any remote attacker to consume ~2 seconds of server CPU per HTTP request by crafting a ~1 MiB Accept-Language header composed of underscore separators, bypassing the existing CVE-2022-32149 guard in golang.org/x/text which only counts dash characters. All Gitea releases from 1.22.x through 1.26.x are affected because the middleware at modules/web/middleware/locale.go:38 passes the raw, unfiltered header directly to the quadratic-time ParseAcceptLanguage parser; ten concurrent attackers consuming ~10 MiB/s of upstream bandwidth can saturate all cores of a ten-core host indefinitely. Publicly available exploit code exists in the GHSA advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.
Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. Reported by Canonical; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.
We need to process CVE-2026-64189. The user wants a JSON with multiple fields, all plain text strings. We'll synthesize all provided data: description, EPSS, KEV? Not in input, KEV not mentioned, so assume no KEV. EPSS 0.16% low. Patch available from vendor? The patch data says "Patch: Available from vendor" but also shows Linux version ranges and patch commits. Tags: Canonical, Information Disclosure, Linux. CWE: N/A. CVSS: 7.8, vector local. We need to be careful: all fields must be strings, not arrays. The product_name: "Linux" (too generic? The affected product is the ipset subsystem in the Linux kernel's netfilter. So "Linux kernel" or "ipset"? The CPE is "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*" – that's the Linux kernel. I'll choose "Linux kernel". But the instruction says "1-3 words ONLY. The specific product or service name affected." Could be "Linux kernel", "netfilter ipset", maybe "Linux ipset". However, CPE says "linux:linux" which is the kernel. I'll go with "Linux kernel". Summary: need to synthesize description and mention EPSS, active exploitation status (none), POC? No mention of POC. So "no public exploit identified at time of analysis." But description has use-after-free in ipset dump race. So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during dump operations, potentially leading to memory corruption and privilege escalation." Need to mention EPSS low, no active exploitation. The CVSS is 7.8 (local, low privileges). So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during concurrent dump and resize operations, potentially achieving elevated privileges. No public exploit or active exploitation has been identified; EPSS score low (0.16%)." Technical_context: Explain the underlying technology: netfilter, ipset, netlink socket communication. Use-after-free due to missin
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.
Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker who can spoof or tamper with the Ubuntu Pro contract server response to inject arbitrary APT source lines and install malicious root-owned packages. The client builds /etc/apt/sources.list.d entries from the server's directives.suites[] and directives.aptURL fields via Python str.format() without escaping or newline filtering, and passes additionalPackages[] positionally into a root-run apt-get install. Because the component is preinstalled on supported Ubuntu Server releases and auto-attaches on cloud Ubuntu Pro images the exposure is broad; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
Unauthenticated arbitrary file read in FacturaScripts (all versions through v2026.2) lets remote attackers retrieve protected documents by abusing the static file controllers Files.php and Myfiles.php, which authorize requests on the raw URL prefix rather than the resolved filesystem path. A request such as /Plugins/../MyFiles/Private/invoice.pdf passes the prefix allow-list yet resolves to a private file, leaking customer/supplier invoices, attachments, and .sql database backups. A detailed, reproducible exploit is publicly available in the GitHub Security Advisory; there is no vendor-released patch identified at time of analysis and no evidence of active exploitation.
Access key authentication bypass in Apollo ConfigService (com.ctrip.framework.apollo, versions < 2.5.2) lets an unauthenticated remote attacker read raw configuration data even when AccessKey/management-key authentication is enabled. The service mis-parses the appId on the /configfiles/raw/{appId}/{clusterName}/{namespace} endpoint as the literal string 'raw', so no matching secret is found and the signature check is skipped for the real target app. No public exploit identified at time of analysis; the flaw is fixed in Apollo 2.5.2.
Authentication bypass in Apollo (Ctrip apolloconfig) ConfigService allows an unauthenticated remote attacker to read protected configuration data from /configs and /configfiles endpoints even when AccessKey/management-key authentication is enabled. The flaw stems from ConfigService accepting a non-canonical appId variant (e.g. accented or trailing-space forms) that misses the AccessKey secret cache lookup - causing signature verification to be skipped - while the downstream release lookup still resolves the value to the real, protected app under equivalence-treating database collations. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only impact drives the CVSS 7.5 (High) rating.
Server-side request forgery in NukeViet CMS before 4.6.00 lets a remote unauthenticated attacker coerce the server into issuing outbound HTTP requests to an arbitrary host by spoofing the X-Forwarded-Host and X-Forwarded-Proto headers, which flow unvalidated into the cURL URL built by server_info_update(). Because the __serverInfoUpdate=1 POST handler in includes/ini.php runs before authentication, no credentials are needed. The flaw is blind, HEAD-only and uses a fixed request path, so its practical value is internal host/port discovery and poisoning of the cached server_headers rather than data exfiltration; no public exploit beyond the advisory PoC is identified and it is not in CISA KEV.
Arbitrary Python code execution in BabelDOC (funstory-ai, pip package `babeldoc`) prior to 0.6.3 allows an attacker to run code in the context of the translation process by having a victim process a crafted PDF. The vendored pdfminer CMap loader (`cmapdb.py::_load_data`) strips only NUL bytes from a PDF-controlled CMap/Encoding name and passes it to `pickle.loads()`, so a hex-encoded absolute path in the PDF's `/Encoding` name redirects deserialization to an attacker-planted `.pickle.gz` file. A detailed, working proof-of-concept exists (publicly available exploit code exists); there is no CISA KEV listing and no public evidence of active exploitation at time of analysis.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Stored cross-site scripting in the lxml_html_clean Cleaner (≤ 0.4.4) and the bundled lxml legacy html.clean module (≤ 6.1.0) lets attackers smuggle javascript: URLs through HTML sanitization on the namespaced xlink:href attribute. When callers configure Cleaner with safe_attrs_only=False, the URL-scheme scrubber never inspects <a xlink:href="javascript:..."> inside SVG or MathML, so the payload survives and executes when a victim clicks the rendered anchor. Publicly available exploit code exists (a working reproducer ships with the advisory), but there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Confidential-client impersonation in better-auth below 1.6.11 lets an attacker who holds any leaked refresh_token and the public client_id mint fresh access tokens and rotated refresh tokens indefinitely. The deprecated oidcProvider() and mcp() plugins expose an OAuth 2.0 token endpoint whose refresh_token grant authenticates solely on the bound refresh-token row plus a matching client_id, never verifying the registered client_secret - a regression, since the same plugins' authorization_code grant does enforce the secret. No public exploit identified at time of analysis; the flaw was reported by @subhanUmer and fixed by the maintainers, with no CISA KEV listing or EPSS score supplied in the input.
Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.
Canonical URL spoofing in Gitea before 1.25.5 lets remote attackers inject malformed X-Forwarded-Proto values that the server trusts when computing its public-facing URL, causing it to emit attacker-controlled canonical links (e.g. in emails, redirects, and generated absolute URLs). No public exploit identified at time of analysis, and the low EPSS score (0.17%, 6th percentile) reflects minimal in-the-wild interest, but a vendor patch is available in v1.25.5. Note that the published CVSS vector claims availability impact (A:H) while the description describes URL spoofing (an integrity concern), a discrepancy worth verifying with the vendor.
HTTP request smuggling in Ruby's WEBrick HTTP server through v1.9.2 allows remote attackers to desynchronize front-end/back-end request parsing by exploiting how WEBrick reparses a Content-Length value supplied in chunked trailers back into the canonical request state. Any deployment fronting WEBrick with a proxy, load balancer, or CDN that disagrees on message length can have requests smuggled past it, enabling request routing manipulation and information disclosure. Publicly available exploit code exists (SSVC exploitation status: poc), though EPSS remains low at 0.16% and it is not on CISA KEV.
Remote denial of service in the Zebra Zcash full-node (zebrad) up to and including v4.4.1 lets an unauthenticated peer deterministically crash any synced node running the standard Linux dual-stack configuration. By completing a P2P handshake over IPv4 to a `[::]` listener and then advertising a single invalid mempool transaction (e.g. a coinbase), the attacker triggers a reachable-assertion panic in the address book after a 30-second batch flush, and `panic = "abort"` terminates the process. No public exploit has been identified at time of analysis, but the advisory documents the full reproduction path; the crash is repeatable after every restart, enabling persistent downtime.
Block suppression via ZIP-244 transaction malleability in zebrad up to v4.4.1 allows a remote unauthenticated P2P peer to permanently stall a target node at a specific block height by poisoning the sent-hash cache with a validation-rejected block whose hash is never cleaned up. The root cause is that `non_finalized_block_write_sent_hashes` records a block's header hash before contextual validation completes, and on failure the stale entry remains, causing any subsequent delivery of the legitimate canonical block to be discarded as a duplicate. No active exploitation is listed in CISA KEV, but the Zcash Foundation advisory credits two independent researchers with E2E reproduction, confirming the attack is practically executable against all default configurations; vendor-released patch zebrad 4.5.0 is available.
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers forge valid HS256/HS384/HS512 tokens whenever the application's verification secret resolves to an empty string or None. Because HMACAlgorithm.verify feeds a zero-length key straight into hmac.new(b"", ...) and OctKey.import_key only warned (never rejected) empty material, an attacker who knows no secret can reproduce the exact digest with HMAC(key=b"") and pass hmac.compare_digest. Publicly available exploit code exists (working PoC in the advisory); the flaw is fixed in 1.6.8. This is the cross-language sibling of ruby-jwt CVE-2026-45363. No EPSS score or CISA KEV listing was provided; no public exploit-in-the-wild is claimed.
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfiltrate files from the PostgreSQL host even under the strict default config (allow_dangerous_operations=False, allowed_statement_types=['SELECT']). The _validate_query blocklist enumerates dangerous functions by exact name and misses the pg_read_file/pg_stat_file/pg_ls_*/pg_current_logfile family (plus MSSQL OPENDATASOURCE and keyword-less SQLite ATTACH), so these SELECT-shaped payloads pass both the statement-type allowlist and the regex blocklist and reach the live SQLAlchemy engine. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); no public exploit identified as actively exploited and this is not in CISA KEV.
Credential leakage in oras-go v2 (oras.land/oras-go) lets a malicious or compromised OCI registry steal a client's Authorization credentials by returning a cross-host Location header during monolithic blob upload; oras-go follows the redirect and reuses the original bearer/basic credentials on the PUT to the attacker-controlled host, also yielding client-side SSRF to an arbitrary cross-host target. Any Go application that pushes artifacts using oras-go v2.6.0 (and likely earlier v2.x) is affected. Rated CVSS 7.5 (High); no CISA KEV listing and no public exploitation, but the reporter includes a local proof-of-concept reproduction harness (poc.zip), and a fixed release (v2.6.1) is available.
Cross-tenant JWT authentication bypass in Centrifugo (v3 through v6) lets an attacker holding a valid token for one allowed issuer/tenant authenticate as a different issuer/tenant when the server uses dynamic JWKS endpoint templates. The flaw stems from the JWKS cache and singleflight lookup being keyed only by the JWT header 'kid', so a key fetched for tenant A is reused to verify a token claiming tenant B whenever both JWKS documents share the same 'kid' and tenant A's key is cached first. Publicly available exploit code exists in the form of a reporter-supplied Go unit-test PoC; there is no evidence of active exploitation, and the CVSS base score is 8.2 (AC:H, PR:L, scope-changed).
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers reach protected parameterized route handlers by placing an encoded slash (%2F) in a path parameter. The middleware layer decodes %2F before matching while Fastify's router preserves the encoding, so the two disagree on the canonical path and any middie-based auth, authz, rate-limiting, or auditing middleware silently fails to run while the route handler still fires. No public exploit identified at time of analysis; the flaw is method-agnostic and requires no special preconditions, and the vendor rates it CVSS 9.1.
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation.
Privilege escalation in Canonical LXD (versions 6.0-6.8, 5.21.0-5.21.4, and 5.0.0-5.0.6) allows an authenticated project operator in a restricted multi-tenant deployment to escape tenant confinement and obtain host root. Because project-restriction policies are not re-validated when an instance backup is imported and its snapshot restored, an operator can smuggle restricted configuration keys into a snapshot, restore them onto the live instance, and start it to gain unauthorized root on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch and the fixing source code are available.
Cross-guest storage-volume hijacking in Canonical LXD 6.6 through 6.8 lets an untrusted guest instance mount, read, and overwrite the custom storage volumes owned by other guests on the same host, breaking tenant isolation. Exploitation requires the non-default security.devlxd.management.volumes option to be enabled, and is fixed in LXD 6.9. Rated CVSS 9.6 with a scope change and CISA SSVC 'total' technical impact; SSVC lists exploitation as proof-of-concept, but EPSS is very low (0.11%, 1st percentile) and it is not in CISA KEV.
Remote denial of service in the Linux kernel's UDP receive path affects systems where a UDP socket is placed in a BPF sockmap with an attached SK_SKB verdict program. Because skb->dev is repurposed as dev_scratch on the UDP path and never cleared before the verdict program runs, a verdict program that calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) causes dev_net() to dereference a stale integer as a net_device pointer, triggering a general protection fault on a non-canonical address in softirq. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and the flaw is fixed; impact is availability only (kernel crash), not the 'Information Disclosure' the input tags suggest.
Local denial of service in the Linux kernel's Intel VT-d (iommu/vt-d) driver lets a privileged user crash the host by terminating a QEMU/VFIO guest, triggering a general-protection-fault oops. The flaw lives in domain_remove_dev_pasid(), which dereferences the global static blocked domain - a dummy iommu_domain with no backing dmar_domain - during PASID teardown on device reset. No public exploit is identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
PolymorphicTypeValidator bypass in jackson-databind versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 allows attackers controlling JSON type identifiers to smuggle denied gadget classes through allow-listed generic containers, leading to arbitrary class instantiation and potential remote code execution. The flaw stems from DatabindContext._resolveAndValidateGeneric() validating only the raw container class name while skipping all nested generic type arguments. No public exploit identified at time of analysis, but the GHSA advisory includes a proof-of-concept configuration and payload structure.
Arbitrary file read in motionEye versions before 0.44.0 lets remote attackers retrieve any file readable by the motionEye process by supplying an absolute path to the media playback, download, and preview handlers. The flaw stems from os.path.join() discarding the configured media directory when given an absolute path, compounded by MoviePlaybackHandler deliberately overriding Tornado's StaticFileHandler path-safety checks. A proof-of-concept exists and the CVSS 4.0 exploit-maturity is rated Proof-of-Concept, but there is no public evidence of active exploitation.
Unauthenticated NoSQL operator injection in Budibase server <= 3.39.0 allows anonymous attackers to read or modify all documents in any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasource when a builder has published a query with a PUBLIC role. By injecting JSON metacharacters through query parameters, an attacker can override the intended filter, bypass authentication, and exfiltrate sensitive data or mass-update records in a single HTTP request. Exploit code is publicly available, though no active exploitation is confirmed, and the vulnerability has been patched in version 3.39.12.
Unauthenticated S3 pre-signed URL minting in Budibase (npm @budibase/server before 3.39.0) lets anonymous attackers abuse the route POST /api/attachments/:datasourceId/url, which was registered with only a recaptcha middleware and no authorized() gate. An attacker who knows or enumerates a workspace id (app_...) and an S3 datasource id (ds_...) receives a 15-minute AWS SigV4 pre-signed PutObjectCommand URL minted on the victim's stored IAM credentials, and because the bucket is caller-controlled they can write to any bucket those credentials permit. Publicly available exploit code exists (a self-contained Node.js PoC is published in the advisory); this is not listed in CISA KEV and no EPSS score was provided.
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary Root CA certificate into managed Ubuntu hosts during Active Directory Certificate Services auto-enrollment. The vendored Samba GPO extension fetches the CA certificate over plaintext HTTP from the AD CS GetCACert endpoint, and the response is registered into the system trust store via update-ca-certificates without authenticity validation. No public exploit identified at time of analysis, but the impact enables persistent decryption of TLS traffic across the host.
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth grants to read and modify private account resources via `/api/v1/user/...` self routes, despite the public-only flag being designed to restrict tokens to public data. The flaw is a systemic scope-boundary failure across many self routes (SSH keys, emails, OAuth apps, Actions secrets/variables/runners, private repos, webhooks), publicly available exploit code exists in the form of reproducible Go PoCs in the advisory, and the issue represents an incomplete fix of CVE-2025-68941 in a different route family.
Path traversal in NASA AMMOS AIT-Core's Binary Stream Capture (BSC) component allows unauthenticated remote attackers to direct the ait-bsc process to append attacker-controlled binary data to arbitrary files on the host filesystem, limited only by the OS permissions of the running process. Affected are AIT-Core 3.1.0 and all 2.x versions before 2.6.1, exploitable via a direct HTTP request if the BSC port is network-accessible or via a browser-based CSRF attack that works even against localhost-bound deployments. Publicly available exploit code exists (python_poc.py, attacker_tcp.py, and test1.html), though no CISA KEV listing was identified at time of analysis.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and Host headers to be forwarded to attacker-controlled origins during cross-origin HTTP redirects. The Tesla.Middleware.FollowRedirects component compares header names case-sensitively against a lowercase filter list, so headers using the RFC 7235 canonical casing (e.g., 'Authorization') bypass stripping and reach the redirect target. No public exploit identified at time of analysis, but the upstream fix is committed and a patched release (1.18.3) is available.
Out-of-bounds heap read in Ubuntu Linux kernels 6.8, 6.17, and 7.0 stems from AppArmor SAUCE patches miscomputing an internal buffer size during notification handling, allowing an unprivileged local user to feed invalid data into the AppArmor DFA policy engine. The flaw carries a CVSS 7.8 (high) and currently has no public exploit identified at time of analysis, though Canonical has shipped an upstream kernel fix. Impact is limited to local attackers but high-severity given full CIA impact in the CVSS vector.
Local privilege escalation in Ubuntu Linux 6.8 kernel stems from an AppArmor SAUCE patch that omits proper locking when modifying a linked list, enabling a race condition that can be exploited by an unprivileged local user. Successful exploitation leads to a use-after-free condition with theoretical arbitrary code execution in kernel context. No public exploit identified at time of analysis, and the issue is not present on the CISA KEV list.
Virtual machine escape in Canonical Multipass before 1.16.3 allows a root user inside a guest VM to read arbitrary files on the host filesystem by bypassing the host-side sshfs_server path containment. The flaw lives in the validate_path function (CWE-22 path traversal), which uses naive string prefix matching and accepts dot-dot sequences. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV, though the technical write-up in the GHSA advisory provides enough detail to make exploitation reproducible.
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain root execution by replacing co-located auxiliary binaries that the multipassd LaunchDaemon invokes via a user-writable PATH directory. The flaw is an incomplete remediation of CVE-2025-5199: while 1.16.0 corrected ownership of the multipassd binary itself, five sibling binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, sshfs_server) were left owned by the installing user and writable, enabling binary planting. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
TLS server impersonation in Erlang/OTP's public_key library lets a name-constrained subordinate CA forge a trusted identity for hostnames outside its permitted DNS subtree. By chaining a nameConstraints enforcement gap with a legacy CommonName fallback in pkix_verify_hostname/3, an attacker holding a DNS-restricted intermediate (e.g. permitted;DNS:allowed.example.com) can issue a SAN-less leaf whose CN is an out-of-scope host (e.g. victim.example.com) and have a stock ssl:connect client with verify_peer accept it. It affects OTP 19.3 through the fixed releases (public_key 1.4 onward) and is rated CVSS 4.0 7.6; there is no public exploit identified at time of analysis and it is not on CISA KEV.
Fastify's route schema compilation silently nullifies conditional header requirements declared via the JSON Schema Draft 7 `dependencies` keyword, enabling unauthenticated remote clients to bypass schema-enforced authorization checks. Versions before 5.12.2 lowercase header property keys and the root `required` array during schema compilation but leave trigger and dependent names inside `dependencies` in their original casing; since Node.js stores all incoming request header names in lowercase, those case-sensitive dependency references never match and the conditional requirement is invisibly skipped. An attacker can present a privileged-operation header while omitting the authentication or authorization header the dependency was intended to mandate, causing the application's privileged branch to execute as though the guard had passed. No public exploit has been identified at time of analysis.
Craft CMS versions 5.0.0-RC1 through 5.10.10 allow an authenticated low-privileged contributor to permanently delete canonical entry content by exploiting a broken authorization chain in ElementsController::actionDeleteForSite(). The method authorizes deletion against the user's provisional draft rather than the canonical element, then propagates the destructive action to the canonical record without re-verifying deleteEntriesForSite permission. Deleted content bypasses the recycle bin and is unrecoverable, making this an integrity-destroying flaw despite its mid-range CVSS score. No public exploit code is identified at time of analysis.
SSRF in the Bifrost AI gateway's multimodal URL-fetch path permits any client that can submit a Bedrock or Vertex provider request to reach internal network services - including cloud instance-metadata endpoints - by supplying IPv6 transition-form addresses (6to4, NAT64) or CGNAT addresses that the `isPublicIP` deny-list in `core/providers/utils/fetch.go` incorrectly classifies as routable public IPs. All releases of the `github.com/maximhq/bifrost/core` Go module prior to v1.5.17 are affected, confirmed on dev HEAD f415c14 (core/version 1.5.15). Publicly available exploit code exists in the GHSA advisory as a runnable Go test; no CISA KEV listing at time of analysis.
Memory corruption in the Linux kernel's net/sched fq_codel queueing discipline lets a local actor with traffic-control privileges trigger a wild kernel memory access and crash. When fq_codel drops packets during a peek operation, it calls qdisc_tree_reduce_backlog before restoring qlen; if qlen momentarily hits zero while peek still holds an skb, the parent class (e.g. qfq) is wrongly deactivated, producing a general-protection fault against a poisoned list pointer (0xdead000000000100 range) as seen under KASAN. No public exploit identified at time of analysis, EPSS is low (0.18%), and it is not in CISA KEV.
Path traversal in IzPack's UnpackerBase.unpack() enables arbitrary file writes under victim privileges when a user executes a trojanized installer JAR. The unpacking pipeline calls IoHelper.translatePath(), which performs only file-separator substitution with no canonical-path check, no startsWith(installDir) containment guard, and no normalization of '../' sequences, allowing attacker-controlled PackFile entries to escape the install directory entirely. Because IzPack JARs are standard unsigned ZIPs with no integrity protection, any legitimate IzPack installer can be silently repackaged with malicious entries; a publicly available proof-of-concept confirms the escape. The CVE is not listed in CISA KEV, but the trivial repacking method and social-engineering distribution vector make this a credible supply-chain threat to organizations consuming IzPack-packaged software from untrusted sources.
Path traversal in RansomLook's GroupPost.get API handler allows an attacker controlling a malicious upstream instance to exfiltrate arbitrary files readable by the RansomLook process, including configuration secrets and API credentials. The screen field stored in the database is concatenated directly with the application's source/ directory path without boundary validation, enabling traversal sequences such as ../config/generic.json to escape the intended directory. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the federation import mechanism means a compromised upstream instance can poison a victim's database without holding any account on the victim system.
Host root code execution in Canonical LXD arises from a path-traversal flaw in instance template processing, letting an attacker with container edit permissions - or any user who launches a maliciously crafted image - overwrite arbitrary root-owned files on the host. The root cause is a validate-then-open mismatch: LXD checks template target paths against a confined os.Root handle but then creates the file via os.Create using the raw, unconfined string path. No public exploit has been identified at time of analysis, but the CVSS 9.9 rating and container-to-host scope change make this a critical container-escape.
Null-pointer dereference and promiscuity counter underflow in the Linux kernel bonding driver's ALB monitor can crash the kernel or permanently pin a network interface in promiscuous mode. The bond_alb_monitor() workqueue function reads primary_is_promisc under RCU, drops that lock, then acquires RTNL - allowing the active slave to be removed or changed in the intervening window, leaving the monitor to act on stale state. Linux systems from kernel 2.6.24 through unpatched stable branches (5.10.x, 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, 7.1.x, 7.2) with network bonding explicitly configured in ALB mode are affected. No public exploit identified at time of analysis.
Reference imbalance in the Linux kernel's BPF conntrack kfuncs allows a local attacker with BPF privileges to trigger an unmatched put_net() call that can destroy a live network namespace and cause kernel panic. The flaw affects __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry(), where opts->netns_id is read non-atomically from a shared BPF map value during both namespace acquisition and release. No public exploit code exists and EPSS is low (0.20%, 10th percentile), but the kernel panic outcome is confirmed by a crash trace in the advisory. Exploitation requires local BPF capability and a concurrent writer to the shared map.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Privilege escalation in Ubuntu's accountsservice package allows a local low-privileged user to execute arbitrary shell commands as root (real UID 0) by injecting a GNU sed 'e' flag payload into their ~/.pam_environment LANGUAGE entry, which is then processed unsanitized by Ubuntu-specific helper scripts (save-to-pam-env, update-langlist) when the SetLanguage D-Bus method is invoked. All Ubuntu accountsservice packages before version 23.13.9-8ubuntu7 are affected; this is a Ubuntu-specific packaging defect, not an upstream accountsservice issue. No public exploit code or CISA KEV listing has been identified at time of analysis, though the attack path is well-described and technically straightforward.
Local privilege escalation in Ubuntu's AccountsService (before 23.13.9-8ubuntu7) lets any low-privileged local user gain full root access by exploiting an incomplete privilege-drop in a Canonical-specific patch. The patch sets the effective UID/GID to the target user before launching language helper scripts but neglects to change the real UID, leaving ruid=0. Any shell spawned by a helper script can call setuid(0) to restore root effective privileges, granting complete system compromise. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Grafana OSS's Unified Alerting component allows a low-privileged authenticated organization member to query any datasource - including those they are explicitly denied access to - by setting the client-controlled queryType field to the reserved value __expr__ while supplying the UID of a real datasource in an alert rule. Authorization skips the datasources:query permission check when it sees __expr__, but the evaluator subsequently resolves and executes the query against the real datasource identified by datasourceUid, resulting in full data exfiltration through Grafana's configured credentials. Affected versions span Grafana OSS 8.4.0 through 13.1.1; no public exploit code or CISA KEV listing has been identified at the time of analysis, but the low attack complexity and confirmed reproduction under default OSS permissions make this a credible insider-threat and privilege-escalation vector.
Availability disruption in stigmem-node 0.9.0a1 (pip package by eidetic-labs) allows authenticated federation peers to have their valid peer tokens incorrectly rejected as expired due to a timestamp-handling mismatch in the federation peer-token validation logic. Impacted deployments are Stigmem nodes operating federation peer authentication paths, where authenticated federation flows may fail non-deterministically depending on which token-minting path was used. No active exploitation has been identified (no KEV listing, no public exploit), and the fix is available in 0.9.0a2.
Zip Slip path traversal in Notepad++'s bundled WinGup update component (versions prior to 8.9.7) allows network-delivered malicious ZIP archives to overwrite DLL files outside the intended extraction directory, enabling arbitrary code execution when Notepad++ next loads the affected plugin. The attack requires user interaction to trigger the update workflow (CVSS UI:R) but demands no authentication on the target system. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability is fixed in the vendor-released 8.9.7 build.
Use-After-Free in the Linux kernel's mm/page_reporting subsystem triggers a General Protection Fault during PM suspend and hibernation on systems running virtio_balloon with page reporting enabled. When the PM freezer initiates a suspend or S4 hibernation cycle, the virtio_balloon driver tears down its virtqueues via del_vqs(), but page_reporting_process - scheduled on the non-freezable system_wq workqueue - remains active. If the buddy allocator frees pages during this window (e.g., the balloon shrinker runs during S4 image saving), the reporting worker calls virtballoon_free_page_report() on already-deleted virtqueues, causing kernel memory corruption. No public exploit has been identified at time of analysis; EPSS is 0.18% (8th percentile), reflecting minimal exploitation probability, though this is a confirmed kernel UAF with crash-level impact validated by Google in production virtualization infrastructure.
OCFS2 cluster filesystem dinode validation in the Linux kernel fails to reject inodes with non-canonical i_mode type bits, allowing forged on-disk metadata to propagate into in-core kernel inode structures. Affected kernels accept any non-zero i_mode value and pass it verbatim into ocfs2_populate_inode(), where an unrecognized S_IFMT type falls through to ocfs2_special_file_iops and init_special_inode() - a code path not designed for arbitrary mode inputs. No public exploit has been identified at time of analysis and EPSS sits at only 0.22%, but the kernel-level impact (C:H/I:H/A:H) and the shared-storage attack surface of OCFS2 clusters warrant priority patching on affected systems.
Memory corruption in the Linux kernel network scheduler (net/sched/sch_codel) allows a privileged local user to trigger a wild/dangling pointer dereference by mis-accounting queue length during the CoDel peek operation. When CoDel drops packets during peek it calls qdisc_tree_reduce_backlog before re-incrementing qlen; if qlen momentarily hits zero while peek still returns an skb, the parent qdisc's qlen_notify prematurely deactivates the class, corrupting scheduler state (demonstrated as a KASAN wild-memory-access in qfq_deactivate_agg when qfq parents a codel child). No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and this is not in CISA KEV.
Integer overflow in the Linux kernel's BPF sockmap helper `bpf_msg_pop_data()` enables a local privileged attacker to bypass scatterlist bounds checks, causing an out-of-bounds traversal that dereferences a null or non-canonical page pointer and crashes the kernel. Affected are all kernel stable series from 5.10 through pre-7.2, with patches confirmed across eight stable branches. No public exploit has been identified at time of analysis and the EPSS score of 0.21% (12th percentile) indicates negligible current exploitation activity, though the confirmed kernel crash impact and High CVSS score warrant prompt patching on systems using BPF sockmap.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
Arbitrary host file read and write in Canonical LXD occurs because the image import/unpack routine does not verify whether the bundled metadata.yaml entry is a symbolic link, letting an authenticated user with image-import rights supply a crafted archive whose symlinked metadata.yaml resolves to sensitive host paths. Rated CVSS 9.9 with a scope change (S:C), successful exploitation crosses the container/management boundary to read or overwrite files as the LXD daemon (typically root) on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; details are published only in Canonical advisory GHSA-j825-cg34-5fr5.
Path traversal in Canonical LXD's image metadata template processing enables an authenticated low-privilege attacker to read arbitrary host files or create files in arbitrary host filesystem locations. The flaw resides in the virtual machine/QEMU driver execution path, where LXD fails to sanitize template file paths from escaping the designated instance templates directory. Exploitation crosses the container/VM boundary to the host (scope change, S:C), making this high-severity in environments where host isolation is a security assumption. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Canonical's LXD container and VM manager allows a user with backup import/restore privileges to write or read files outside the intended restore directory by embedding traversal sequences in the instance or storage-volume names stored in a crafted backup archive's metadata. Because LXD does not validate these names on import/restore, an attacker can corrupt or overwrite host files, potentially leading to full host compromise. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; the very high CVSS (9.9) is driven by the scope-changing, high-integrity/availability impact on the host.
Authorization bypass in Canonical LXD lets an authenticated user with instance-migration privileges smuggle high-privilege instance configurations into restricted projects. When an instance is migrated to a target project, LXD applies caller-supplied configuration overrides without re-validating them against the destination project's enforced restrictions, so security controls such as privileged-container or device limits can be defeated. Rated CVSS 9.9 (CWE-863) with a scope-changing impact; no public exploit has been identified at time of analysis.
Authorization bypass in Canonical LXD lets an authenticated user with copy privileges smuggle instances carrying disallowed high-privilege configurations into restricted projects, defeating per-project security controls. The root cause is a time-of-check to time-of-use race in which LXD validates project restrictions before configuration merging finishes during cross-project instance copies. Rated CVSS 9.9 with a scope change; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Canonical LXD's NVIDIA GPU passthrough configuration handler fails to sanitize newline characters in user-supplied `nvidia.driver.capabilities` and `nvidia.require.*` instance config values, enabling an authenticated attacker to inject arbitrary directives into the generated `lxc.conf` file. Any LXD user with instance-creation or configuration-modification privileges can exploit this to escape the container boundary and execute arbitrary commands on the host with the full privileges of the LXD daemon - effectively achieving complete host compromise. No public exploit code or CISA KEV listing exists at time of analysis, but the network-accessible, low-privilege attack path and scope-changed CVSS vector reflect an elevated real-world threat for shared or multi-tenant LXD deployments.
Storage quota bypass in Canonical LXD (5.0.x before 5.0.8, 5.21.x before 5.21.6, and 6.0 before 6.10) lets an authenticated user exceed the disk and volume limits an administrator configured on a project. The flaw stems from two code paths - cross-project volume moves (storagePoolVolumeTypePostMove) and volume snapshot restores with a nil config - that skip the AllowVolumeCreation/AllowVolumeUpdate limit checks, enabling over-allocation of storage. Reported by Canonical with a patch available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authorization bypass in Canonical LXD (6.0 before 6.10, 5.21.x before 5.21.6, 5.0.x before 5.0.8) lets an authenticated user smuggle disallowed instance configurations into a restricted project by triggering a cross-project, cross-cluster-member migration. Because the migration arrives at the destination node as an internal cluster notification, the destination skips all target-project restriction checks (CWE-863), so limits and security restrictions on the target project are not enforced. Rated CVSS 9.9; reported by Canonical with a vendor patch available, but no public exploit identified at time of analysis and it is not listed in CISA KEV.
Project-confinement bypass in Canonical LXD lets an authenticated user holding can_create_instances on a restricted project escape that project's security policy by migrating an instance into it. Because instancePostMigration never re-validated the incoming instance against the target project's enforced restrictions, an attacker could build a high-privilege or otherwise disallowed instance inside an unrestricted project and relocate it into the restricted one, inheriting capabilities (low-level container access, arbitrary devices, unrestricted network access) that the project was configured to forbid. Rated CVSS 9.9 by the vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
URLSecurityValidator SSRF bypass in compliance-trestle <= 4.0.3 allows a network-positioned attacker to reach cloud metadata services, loopback admin interfaces, and RFC 1918 internal networks by embedding IPv4-mapped IPv6 literals (e.g., [::ffff:169.254.169.254]) or the unspecified address 0.0.0.0 in OSCAL artifact import references processed by HTTPSFetcher or SFTPFetcher. Python's ipaddress module silently returns False - rather than raising TypeError - when comparing IPv6Address objects against IPv4Network ranges, so the validator's membership checks pass these forms through to requests.get unchanged. A publicly available proof-of-concept reproduces end-to-end IMDS credential exfiltration; no active exploitation is listed in CISA KEV and EPSS stands at 0.42%.
Portainer CE through 2.44.0 exposes root-level Docker host access to any authenticated low-privileged user via a URL path normalization flaw in the Docker proxy endpoint. The authorization middleware evaluates a non-canonical request path (e.g., percent-encoded slashes, double slashes, or traversal sequences) differently from the proxy layer that ultimately forwards it to the Docker daemon - allowing crafted requests to bypass all access controls while executing with full Docker API privileges. No active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Use-after-free in the Linux kernel's drm/xe Intel Xe GPU driver allows a local low-privileged user to trigger kernel memory corruption with potential for full system compromise (C:H/I:H/A:H). The bug arises because an imported dma-buf buffer object (BO) is created with its reservation object (resv) pointing to the exporter's dma_buf->resv before the importer acquires a reference on that dma-buf - leaving a window in which the exporter can be freed while the TTM workqueue asynchronously accesses the now-dangling pointer. Vendor-released patches are available for Linux 6.12.103, 6.18.42, and 7.1.6; no public exploit has been identified at time of analysis.
Pre-authentication out-of-bounds kernel memory read in the Linux kernel's CephFS client (ceph_handle_caps) allows a malicious or compromised Ceph Metadata Server (MDS) to read beyond the message front buffer. By sending a CEPH_CAP_OP_IMPORT caps message with hdr.version set to 1 and an oversized snap_trace_len (e.g. 0xFFFFFFFF), the server bypasses all version-gated decoders and drives ceph_update_snap_trace() to decode a fake snap realm past the buffer, cascading into further OOB reads via attacker-controlled num_snaps/num_prior_parent_snaps counts. The flaw is present in every kernel since ceph_handle_caps() was introduced; it carries a CVSS 9.8 but currently has no public exploit and a low EPSS score (0.22%), and it is not on CISA KEV.
Route guard bypass in @fastify/static before 10.1.3 exposes protected static files to unauthenticated remote attackers without requiring any credentials. The plugin failed to canonicalize non-standard path forms - including dot segments, duplicate slashes, percent-encoded dots, and backslashes - before matching the request path against route-based guards, allowing crafted URLs to evade the guard while the underlying send layer resolves and serves the protected file. This is an incomplete fix for a prior vulnerability in the same component; no public exploit identified at time of analysis, though the technique is a textbook path normalization bypass requiring no advanced skills.
Path traversal in rclone's `serve restic` REST API allows any attacker with network access to the endpoint to read, create, overwrite, or delete objects outside the operator-configured backend directory. The flaw spans rclone v1.40 through v1.74.4 and affects WebDAV, FTP, SFTP, HTTP, and Memory backends - but not S3-compatible or local filesystem backends, which encode `..` as literal filename characters. A fully functional, step-by-step proof of concept has been publicly released; no CISA KEV listing exists at time of analysis.
Use-after-free race condition in the Linux kernel's RDMA/rxe (SoftRoCE) subsystem allows a local unprivileged user to trigger a kernel crash or achieve page-level memory corruption. The race occurs between rxe_mmap() - which releases pending_lock while a rxe_mmap_info kref is still live - and a concurrent DESTROY_CQ ioctl that drops the kref to zero, causing vfree() to clear vmalloc PTEs mid-walk in remap_vmalloc_range_partial(). No CISA KEV listing exists and EPSS is 0.16% (5th percentile), reflecting the race's very narrow exploitation window; however, the C:H/I:H/A:H impact and confirmed upstream patch make this a priority update for any environment with RDMA/rxe loaded.
Uninitialized stack memory dereference in the Linux kernel's IPv4 nexthop subsystem (net/ipv4/nexthop.c) enables local low-privileged attackers to cause kernel panic or leak sensitive stack contents on systems built with CONFIG_INIT_STACK_NONE. Versions from 5.13 through stable branches prior to 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2-rc5 are affected. No public exploit code has been identified and EPSS stands at 0.16% (5th percentile), placing this in the low-urgency tier despite a CVSS 7.1 score driven by dual high-impact outcomes.
Use-after-free in the Linux kernel mac80211 MLO (Multi-Link Operation) subsystem allows a local attacker with low privileges to corrupt kernel memory by reading stale debugfs entries after a failed ieee80211_vif_update_links() operation. Systems running kernel 6.4 or later with WiFi 7 (IEEE 802.11be) MLO-capable hardware are within the affected code path; patched releases are available across all active stable branches. No public exploit or CISA KEV listing exists and EPSS is 0.16%, but CVSS impact metrics of C:H/I:H/A:H indicate full kernel compromise potential if the vulnerability is successfully triggered, as confirmed by a KASAN slab-use-after-free trace referencing a task named 'exploit/145'.
Use-after-free in the Linux kernel TCP Authentication Option (TCP-AO
Heap-based out-of-bounds read in the Linux kernel's nvmet discovery log page handler allows unauthenticated remote attackers to leak kernel memory or crash the host. Any system acting as an NVMe over Fabrics target with a discovery service exposed via TCP, RDMA, or FC is vulnerable. No active exploitation or public exploit code is reported at this time, and EPSS probability is low (0.25%), but the impact and ease of exploitation make remediation urgent for affected storage targets.
We need to produce a JSON object with specific fields based on the provided CVE data. The user wants a multi-source synthesis. We have the CVE description, CVSS vector (CVSS 4.0), EPSS, patch info, CPE, tags, references, etc. Let's extract relevant details: CVE ID: CVE-2026-66040 Description: FFmpeg through 8.1.2, fixed in commit b506faf, contains a heap out-of-bounds write vulnerability in the native PNG and APNG encoders. Remote attackers can supply a crafted PNG image with a malicious eXIf chunk. Attackers craft an eXIf chunk where multiple IFD entries reference the same large value payload, causing canonical serialization to expand the output far beyond the undersized allocation estimated by add_exif_profile_size(), resulting in png_write_chunk() writing tens of thousands of bytes past the buffer boundary, leading to deterministic heap corruption, process crash, and potentially arbitrary code execution. CVSS Score: 8.7, Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N (with other fields as X). So base score 8.7, high impact, user interaction required (UI:P). Attack vector network, low complexity, no privileges required. CWE: CWE-122 (Heap-based Buffer Overflow) EPSS: 0.55% (43rd percentile) – relatively low exploitation probability. Patch: Available from vendor (commit b506faf). Also EUVD says patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc Reported by: VulnCheck CPE: cpe:2.3:a:ffmpeg:ffmpeg:*:*:*:*:*:*:*:* (all versions prior to fix) Tags: Heap Overflow, Buffer Overflow, RCE, Canonical, Ffmpeg ENISA EUVD ID: EUVD-2026-48742, affected versions: FFmpeg 0 ≤8.1.2, patch: b506fafec9a19fcbc2be5271875fd4a63d6615bc References: pull request, commit, VulnCheck advisory, vuldb advisory. Now we need to fill each field. product_name: "FFmpeg" (primary product, 1-3 words) summary: Start with impact verb and product. Impact: heap out-of-bounds write in PNG/APNG encoder, leading to heap corruption, crash, potential RCE. Affected: FFmpeg through
Unauthenticated denial of service in Gitea's Locale middleware allows any remote attacker to consume ~2 seconds of server CPU per HTTP request by crafting a ~1 MiB Accept-Language header composed of underscore separators, bypassing the existing CVE-2022-32149 guard in golang.org/x/text which only counts dash characters. All Gitea releases from 1.22.x through 1.26.x are affected because the middleware at modules/web/middleware/locale.go:38 passes the raw, unfiltered header directly to the quadratic-time ParseAcceptLanguage parser; ten concurrent attackers consuming ~10 MiB/s of upstream bandwidth can saturate all cores of a ten-core host indefinitely. Publicly available exploit code exists in the GHSA advisory; no active exploitation has been confirmed by CISA KEV at time of analysis.
Local privilege escalation in snap-confine - the SUID/set-capabilities helper snapd uses to build the confinement sandbox for snap applications - lets an unprivileged local user on Ubuntu 22.04, 24.04, and 26.04 LTS gain full root. The flaw only manifests where snap-confine is deployed with file capabilities (set-capabilities) instead of the traditional set-uid-root binary, where incorrect handling of ambient capabilities lets an attacker escape intended privilege boundaries and run arbitrary code as root. Reported by Canonical; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox confinement bypass in Canonical snapd (snap-confine) affects all supported Ubuntu LTS releases (16.04 through 26.04) because the default seccomp templates fail to block system calls that create or set set-user-ID flags on files. A process already running inside a strictly confined snap can compile or drop a binary, mark it setuid, and then execute it to escape confinement assumptions and perform privileged actions within the container namespace. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the CVSS 8.4 (scope-changed) rating reflects a genuine confinement-escape primitive.
We need to process CVE-2026-64189. The user wants a JSON with multiple fields, all plain text strings. We'll synthesize all provided data: description, EPSS, KEV? Not in input, KEV not mentioned, so assume no KEV. EPSS 0.16% low. Patch available from vendor? The patch data says "Patch: Available from vendor" but also shows Linux version ranges and patch commits. Tags: Canonical, Information Disclosure, Linux. CWE: N/A. CVSS: 7.8, vector local. We need to be careful: all fields must be strings, not arrays. The product_name: "Linux" (too generic? The affected product is the ipset subsystem in the Linux kernel's netfilter. So "Linux kernel" or "ipset"? The CPE is "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*" – that's the Linux kernel. I'll choose "Linux kernel". But the instruction says "1-3 words ONLY. The specific product or service name affected." Could be "Linux kernel", "netfilter ipset", maybe "Linux ipset". However, CPE says "linux:linux" which is the kernel. I'll go with "Linux kernel". Summary: need to synthesize description and mention EPSS, active exploitation status (none), POC? No mention of POC. So "no public exploit identified at time of analysis." But description has use-after-free in ipset dump race. So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during dump operations, potentially leading to memory corruption and privilege escalation." Need to mention EPSS low, no active exploitation. The CVSS is 7.8 (local, low privileges). So summary: "Local privilege escalation in the Linux kernel's netfilter ipset subsystem allows a local attacker to trigger a use-after-free during concurrent dump and resize operations, potentially achieving elevated privileges. No public exploit or active exploitation has been identified; EPSS score low (0.16%)." Technical_context: Explain the underlying technology: netfilter, ipset, netlink socket communication. Use-after-free due to missin
Remote denial of service in the Linux kernel's ksmbd in-kernel SMB3 server allows an attacker to trigger a NULL-pointer dereference and kernel panic during SMB2 CREATE lease processing. After a SESSION_LOGOFF, a stale opinfo remains linked in the per-ClientGuid lease list with its conn pointer cleared; a subsequent session reusing the same ClientGuid and taking a lease on a different inode causes compare_guid_key() to dereference the NULL conn->ClientGUID. Exploitation requires only a successful SMB2 SESSION_SETUP against a share with 'durable handles = yes'; no public exploit is identified at time of analysis and EPSS risk is low (0.17%).
Kernel-panic denial of service in the Linux kernel's in-kernel SMB server (ksmbd) allows the file-pointer table to retain a durable-handle file object with a NULL tcon after a client issues SMB2 SESSION_LOGOFF; any subsequent read of /proc/fs/ksmbd/files then dereferences the NULL fp->tcon in proc_show_files() and crashes the host. Affected are kernels running ksmbd on shares configured with 'durable handles = yes'. There is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile), consistent with a stability/robustness bug rather than a weaponizable RCE.
Kernel-level out-of-bounds write in the Linux octeontx2-af driver (Marvell OcteonTX2 admin function) lets a low-privileged VF whose parent PF is in switchdev representor mode corrupt kernel memory. The rvu_mbox_handler_rep_event_notify() handler queues a sender-controlled REP_EVENT_NOTIFY body whose nested event->pcifunc is never bounds-checked, so an out-of-range index reaches rvu_get_pfvf()/rvu_get_pf() and, on RVU_EVENT_MAC_ADDR_CHANGE, becomes a six-byte attacker-chosen OOB ether_addr_copy() write in the AF worker (KASAN slab-out-of-bounds in rvu_rep_wq_handler). No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with niche Marvell SmartNIC hardware rather than mass exposure.
Local privilege escalation or denial of service in the Linux kernel's Intel i915 GPU driver stems from a use-after-free in the TTM object purge path (i915_ttm_purge), where the bo->ttm page-vector container can be replaced by ttm_bo_validate() during eviction, leaving a stale i915_tt pointer that is later dereferenced. A user on DG2 (Intel Arc/discrete) hardware reproduced this as a general protection fault under heavy GPU load during buffer-object eviction. There is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS (0.21%), but the CVSS 7.8 local vector reflects high confidentiality, integrity, and availability impact if the freed memory is groomed and reclaimed.
Extension-denylist bypass in the Flask-Reuploaded (flask_uploads) Python library allows an attacker who controls the name override passed to UploadSet.save() to store dangerous script files by varying letter case (e.g. shell.PHP, evil.pHp), defeating the very script-blocking denylist the library documents. This is an incomplete-fix variant of CVE-2026-27641: the v1.5.0 fix re-validated overridden names through the case-preserving extension() helper instead of the case-normalizing lowercase_ext() used by the default path, so uppercase extensions slip past a lowercase-tokened denylist. Publicly available exploit code exists (a self-contained PoC verified against Flask-Reuploaded==1.5.0), though there is no evidence of active exploitation and no EPSS score was provided.
Unauthenticated Server-Side Request Forgery in the meta-ads-mcp Python package (versions <= 1.0.114) lets remote attackers coerce the server into fetching arbitrary attacker-chosen URLs via the upload_ad_image MCP tool's image_url parameter. The flaw is reachable when the server runs with the officially supported --transport streamable-http mode, because the pre-fetch authorization check only requires a non-empty Bearer token while real Meta credential validation happens after the outbound fetch. Publicly available exploit code exists (a working Docker PoC); this is not in CISA KEV and no EPSS score was provided, so real-world exploitation is unconfirmed, but the vulnerability enables reaching localhost services, RFC 1918 hosts, and cloud metadata endpoints such as 169.254.169.254.
Root-level remote code execution in Canonical's ubuntu-pro-client (formerly ubuntu-advantage-tools) allows an attacker who can spoof or tamper with the Ubuntu Pro contract server response to inject arbitrary APT source lines and install malicious root-owned packages. The client builds /etc/apt/sources.list.d entries from the server's directives.suites[] and directives.aptURL fields via Python str.format() without escaping or newline filtering, and passes additionalPackages[] positionally into a root-run apt-get install. Because the component is preinstalled on supported Ubuntu Server releases and auto-attaches on cloud Ubuntu Pro images the exposure is broad; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Stored CSV formula injection in FacturaScripts (all versions through 2026.1) lets an authenticated low-privilege user plant spreadsheet formula payloads in ordinary text fields (customer/supplier/product names, contacts) that execute when an administrator opens a routine list export. Because Core/Lib/Export/CSVExport.php::writeData() wraps values without neutralising leading =,+,-,@,tab, or carriage-return characters, and Tools::noHtml() only strips HTML metacharacters, the payload reaches the CSV verbatim and Excel/LibreOffice run it (including DDE process spawning) in the admin's OS context. A live PoC was verified on 2026-04-30, so publicly available exploit code exists, though there is no active exploitation confirmed (not in CISA KEV).
Unauthenticated arbitrary file read in FacturaScripts (all versions through v2026.2) lets remote attackers retrieve protected documents by abusing the static file controllers Files.php and Myfiles.php, which authorize requests on the raw URL prefix rather than the resolved filesystem path. A request such as /Plugins/../MyFiles/Private/invoice.pdf passes the prefix allow-list yet resolves to a private file, leaking customer/supplier invoices, attachments, and .sql database backups. A detailed, reproducible exploit is publicly available in the GitHub Security Advisory; there is no vendor-released patch identified at time of analysis and no evidence of active exploitation.
Access key authentication bypass in Apollo ConfigService (com.ctrip.framework.apollo, versions < 2.5.2) lets an unauthenticated remote attacker read raw configuration data even when AccessKey/management-key authentication is enabled. The service mis-parses the appId on the /configfiles/raw/{appId}/{clusterName}/{namespace} endpoint as the literal string 'raw', so no matching secret is found and the signature check is skipped for the real target app. No public exploit identified at time of analysis; the flaw is fixed in Apollo 2.5.2.
Authentication bypass in Apollo (Ctrip apolloconfig) ConfigService allows an unauthenticated remote attacker to read protected configuration data from /configs and /configfiles endpoints even when AccessKey/management-key authentication is enabled. The flaw stems from ConfigService accepting a non-canonical appId variant (e.g. accented or trailing-space forms) that misses the AccessKey secret cache lookup - causing signature verification to be skipped - while the downstream release lookup still resolves the value to the real, protected app under equivalence-treating database collations. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the confidentiality-only impact drives the CVSS 7.5 (High) rating.
Server-side request forgery in NukeViet CMS before 4.6.00 lets a remote unauthenticated attacker coerce the server into issuing outbound HTTP requests to an arbitrary host by spoofing the X-Forwarded-Host and X-Forwarded-Proto headers, which flow unvalidated into the cURL URL built by server_info_update(). Because the __serverInfoUpdate=1 POST handler in includes/ini.php runs before authentication, no credentials are needed. The flaw is blind, HEAD-only and uses a fixed request path, so its practical value is internal host/port discovery and poisoning of the cached server_headers rather than data exfiltration; no public exploit beyond the advisory PoC is identified and it is not in CISA KEV.
Arbitrary Python code execution in BabelDOC (funstory-ai, pip package `babeldoc`) prior to 0.6.3 allows an attacker to run code in the context of the translation process by having a victim process a crafted PDF. The vendored pdfminer CMap loader (`cmapdb.py::_load_data`) strips only NUL bytes from a PDF-controlled CMap/Encoding name and passes it to `pickle.loads()`, so a hex-encoded absolute path in the PDF's `/Encoding` name redirects deserialization to an attacker-planted `.pickle.gz` file. A detailed, working proof-of-concept exists (publicly available exploit code exists); there is no CISA KEV listing and no public evidence of active exploitation at time of analysis.
Server-side request forgery in the Ruby css_parser gem (< 3.0.0) lets a remote unauthenticated attacker force the parsing server to issue arbitrary HTTP/HTTPS GET requests, and via an attacker-controlled 3xx redirect to a file:// URI, escalate to arbitrary local file disclosure. The flaw sits in CssParser::Parser#read_remote_file, reachable through load_uri! and any add_block! call that supplies base_uri: - Premailer being the canonical consumer - so a single attacker-planted @import url(...) in parsed CSS reaches the sink. Publicly available exploit code exists (author-supplied PoC); there is no public exploit identified as being used in active campaigns, and it is not listed in CISA KEV.
Stored cross-site scripting in the lxml_html_clean Cleaner (≤ 0.4.4) and the bundled lxml legacy html.clean module (≤ 6.1.0) lets attackers smuggle javascript: URLs through HTML sanitization on the namespaced xlink:href attribute. When callers configure Cleaner with safe_attrs_only=False, the URL-scheme scrubber never inspects <a xlink:href="javascript:..."> inside SVG or MathML, so the payload survives and executes when a victim clicks the rendered anchor. Publicly available exploit code exists (a working reproducer ships with the advisory), but there is no public exploit identified as being used in active attacks and the issue is not in CISA KEV.
Confidential-client impersonation in better-auth below 1.6.11 lets an attacker who holds any leaked refresh_token and the public client_id mint fresh access tokens and rotated refresh tokens indefinitely. The deprecated oidcProvider() and mcp() plugins expose an OAuth 2.0 token endpoint whose refresh_token grant authenticates solely on the bound refresh-token row plus a matching client_id, never verifying the registered client_secret - a regression, since the same plugins' authorization_code grant does enforce the secret. No public exploit identified at time of analysis; the flaw was reported by @subhanUmer and fixed by the maintainers, with no CISA KEV listing or EPSS score supplied in the input.
Identity/authorization header spoofing in Traefik reverse proxy (before v2.11.51, v3.6.22, and v3.7.6) lets an attacker reaching a protected route smuggle an underscore-variant HTTP header past the BasicAuth, DigestAuth, and ForwardAuth middlewares' sanitization. Traefik strips canonical dashed spoofed headers before setting its own trusted value but ignores underscore forms (e.g. X_Forwarded_User vs X-Forwarded-User) that many backends normalize identically, so the forged header reaches the backend alongside — or, on the ForwardAuth authResponseHeaders path, instead of — Traefik's intended value. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor fix and upstream commit are published.
Canonical URL spoofing in Gitea before 1.25.5 lets remote attackers inject malformed X-Forwarded-Proto values that the server trusts when computing its public-facing URL, causing it to emit attacker-controlled canonical links (e.g. in emails, redirects, and generated absolute URLs). No public exploit identified at time of analysis, and the low EPSS score (0.17%, 6th percentile) reflects minimal in-the-wild interest, but a vendor patch is available in v1.25.5. Note that the published CVSS vector claims availability impact (A:H) while the description describes URL spoofing (an integrity concern), a discrepancy worth verifying with the vendor.
HTTP request smuggling in Ruby's WEBrick HTTP server through v1.9.2 allows remote attackers to desynchronize front-end/back-end request parsing by exploiting how WEBrick reparses a Content-Length value supplied in chunked trailers back into the canonical request state. Any deployment fronting WEBrick with a proxy, load balancer, or CDN that disagrees on message length can have requests smuggled past it, enabling request routing manipulation and information disclosure. Publicly available exploit code exists (SSVC exploitation status: poc), though EPSS remains low at 0.16% and it is not on CISA KEV.
Remote denial of service in the Zebra Zcash full-node (zebrad) up to and including v4.4.1 lets an unauthenticated peer deterministically crash any synced node running the standard Linux dual-stack configuration. By completing a P2P handshake over IPv4 to a `[::]` listener and then advertising a single invalid mempool transaction (e.g. a coinbase), the attacker triggers a reachable-assertion panic in the address book after a 30-second batch flush, and `panic = "abort"` terminates the process. No public exploit has been identified at time of analysis, but the advisory documents the full reproduction path; the crash is repeatable after every restart, enabling persistent downtime.
Block suppression via ZIP-244 transaction malleability in zebrad up to v4.4.1 allows a remote unauthenticated P2P peer to permanently stall a target node at a specific block height by poisoning the sent-hash cache with a validation-rejected block whose hash is never cleaned up. The root cause is that `non_finalized_block_write_sent_hashes` records a block's header hash before contextual validation completes, and on failure the stale entry remains, causing any subsequent delivery of the legitimate canonical block to be discarded as a duplicate. No active exploitation is listed in CISA KEV, but the Zcash Foundation advisory credits two independent researchers with E2E reproduction, confirming the attack is practically executable against all default configurations; vendor-released patch zebrad 4.5.0 is available.
Authentication bypass in the joserfc Python JOSE/JWT library (PyPI, versions <= 1.6.7) lets unauthenticated attackers forge valid HS256/HS384/HS512 tokens whenever the application's verification secret resolves to an empty string or None. Because HMACAlgorithm.verify feeds a zero-length key straight into hmac.new(b"", ...) and OctKey.import_key only warned (never rejected) empty material, an attacker who knows no secret can reproduce the exact digest with HMAC(key=b"") and pass hmac.compare_digest. Publicly available exploit code exists (working PoC in the advisory); the flaw is fixed in 1.6.8. This is the cross-language sibling of ruby-jwt CVE-2026-45363. No EPSS score or CISA KEV listing was provided; no public exploit-in-the-wild is claimed.
Arbitrary file read in Langroid's SQLChatAgent (<= 0.63.0) lets an attacker who can influence the LLM-generated SQL exfiltrate files from the PostgreSQL host even under the strict default config (allow_dangerous_operations=False, allowed_statement_types=['SELECT']). The _validate_query blocklist enumerates dangerous functions by exact name and misses the pg_read_file/pg_stat_file/pg_ls_*/pg_current_logfile family (plus MSSQL OPENDATASOURCE and keyword-less SQLite ATTACH), so these SELECT-shaped payloads pass both the statement-type allowlist and the regex blocklist and reach the live SQLAlchemy engine. Publicly available exploit code exists (a working PoC ships in the GHSA advisory); no public exploit identified as actively exploited and this is not in CISA KEV.
Credential leakage in oras-go v2 (oras.land/oras-go) lets a malicious or compromised OCI registry steal a client's Authorization credentials by returning a cross-host Location header during monolithic blob upload; oras-go follows the redirect and reuses the original bearer/basic credentials on the PUT to the attacker-controlled host, also yielding client-side SSRF to an arbitrary cross-host target. Any Go application that pushes artifacts using oras-go v2.6.0 (and likely earlier v2.x) is affected. Rated CVSS 7.5 (High); no CISA KEV listing and no public exploitation, but the reporter includes a local proof-of-concept reproduction harness (poc.zip), and a fixed release (v2.6.1) is available.
Cross-tenant JWT authentication bypass in Centrifugo (v3 through v6) lets an attacker holding a valid token for one allowed issuer/tenant authenticate as a different issuer/tenant when the server uses dynamic JWKS endpoint templates. The flaw stems from the JWKS cache and singleflight lookup being keyed only by the JWT header 'kid', so a key fetched for tenant A is reused to verify a token claiming tenant B whenever both JWKS documents share the same 'kid' and tenant A's key is cached first. Publicly available exploit code exists in the form of a reporter-supplied Go unit-test PoC; there is no evidence of active exploitation, and the CVSS base score is 8.2 (AC:H, PR:L, scope-changed).
Authentication and authorization bypass in @fastify/middie 9.1.0 through 9.3.2 lets remote unauthenticated attackers reach protected parameterized route handlers by placing an encoded slash (%2F) in a path parameter. The middleware layer decodes %2F before matching while Fastify's router preserves the encoding, so the two disagree on the canonical path and any middie-based auth, authz, rate-limiting, or auditing middleware silently fails to run while the route handler still fires. No public exploit identified at time of analysis; the flaw is method-agnostic and requires no special preconditions, and the vendor rates it CVSS 9.1.
Arbitrary host file write in Incus before 7.1.0 lets a holder of S3 bucket credentials escape the storage volume via a path-traversal-laden multipart upload ID and plant files anywhere the daemon (typically root) can write, escalating to remote code execution. The flaw lives in the local S3 storage backend's multipart upload handling, where the attacker-supplied uploadId is concatenated onto the uploads directory without sanitization. A complete working PoC exists that drops a /etc/cron.d job for root command execution; no CISA KEV listing or EPSS score is provided, so this is publicly available exploit code rather than confirmed active exploitation.
Privilege escalation in Canonical LXD (versions 6.0-6.8, 5.21.0-5.21.4, and 5.0.0-5.0.6) allows an authenticated project operator in a restricted multi-tenant deployment to escape tenant confinement and obtain host root. Because project-restriction policies are not re-validated when an instance backup is imported and its snapshot restored, an operator can smuggle restricted configuration keys into a snapshot, restore them onto the live instance, and start it to gain unauthorized root on the host. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch and the fixing source code are available.
Cross-guest storage-volume hijacking in Canonical LXD 6.6 through 6.8 lets an untrusted guest instance mount, read, and overwrite the custom storage volumes owned by other guests on the same host, breaking tenant isolation. Exploitation requires the non-default security.devlxd.management.volumes option to be enabled, and is fixed in LXD 6.9. Rated CVSS 9.6 with a scope change and CISA SSVC 'total' technical impact; SSVC lists exploitation as proof-of-concept, but EPSS is very low (0.11%, 1st percentile) and it is not in CISA KEV.
Remote denial of service in the Linux kernel's UDP receive path affects systems where a UDP socket is placed in a BPF sockmap with an attached SK_SKB verdict program. Because skb->dev is repurposed as dev_scratch on the UDP path and never cleared before the verdict program runs, a verdict program that calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) causes dev_net() to dereference a stale integer as a net_device pointer, triggering a general protection fault on a non-canonical address in softirq. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and the flaw is fixed; impact is availability only (kernel crash), not the 'Information Disclosure' the input tags suggest.
Local denial of service in the Linux kernel's Intel VT-d (iommu/vt-d) driver lets a privileged user crash the host by terminating a QEMU/VFIO guest, triggering a general-protection-fault oops. The flaw lives in domain_remove_dev_pasid(), which dereferences the global static blocked domain - a dummy iommu_domain with no backing dmar_domain - during PASID teardown on device reset. No public exploit is identified at time of analysis; EPSS is low (0.17%, 7th percentile) and it is not in CISA KEV.
PolymorphicTypeValidator bypass in jackson-databind versions 2.10.0 through 2.18.7, 2.19.0 through 2.21.3, and 3.0.0 through 3.1.3 allows attackers controlling JSON type identifiers to smuggle denied gadget classes through allow-listed generic containers, leading to arbitrary class instantiation and potential remote code execution. The flaw stems from DatabindContext._resolveAndValidateGeneric() validating only the raw container class name while skipping all nested generic type arguments. No public exploit identified at time of analysis, but the GHSA advisory includes a proof-of-concept configuration and payload structure.
Arbitrary file read in motionEye versions before 0.44.0 lets remote attackers retrieve any file readable by the motionEye process by supplying an absolute path to the media playback, download, and preview handlers. The flaw stems from os.path.join() discarding the configured media directory when given an absolute path, compounded by MoviePlaybackHandler deliberately overriding Tornado's StaticFileHandler path-safety checks. A proof-of-concept exists and the CVSS 4.0 exploit-maturity is rated Proof-of-Concept, but there is no public evidence of active exploitation.
Unauthenticated NoSQL operator injection in Budibase server <= 3.39.0 allows anonymous attackers to read or modify all documents in any MongoDB, CouchDB, Elasticsearch, DynamoDB-PartiQL, or REST-with-JSON-body datasource when a builder has published a query with a PUBLIC role. By injecting JSON metacharacters through query parameters, an attacker can override the intended filter, bypass authentication, and exfiltrate sensitive data or mass-update records in a single HTTP request. Exploit code is publicly available, though no active exploitation is confirmed, and the vulnerability has been patched in version 3.39.12.
Unauthenticated S3 pre-signed URL minting in Budibase (npm @budibase/server before 3.39.0) lets anonymous attackers abuse the route POST /api/attachments/:datasourceId/url, which was registered with only a recaptcha middleware and no authorized() gate. An attacker who knows or enumerates a workspace id (app_...) and an S3 datasource id (ds_...) receives a 15-minute AWS SigV4 pre-signed PutObjectCommand URL minted on the victim's stored IAM credentials, and because the bucket is caller-controlled they can write to any bucket those credentials permit. Publicly available exploit code exists (a self-contained Node.js PoC is published in the advisory); this is not listed in CISA KEV and no EPSS score was provided.
TLS trust store poisoning in Canonical ADSys through v0.16.2 allows a network-positioned attacker to inject an arbitrary Root CA certificate into managed Ubuntu hosts during Active Directory Certificate Services auto-enrollment. The vendored Samba GPO extension fetches the CA certificate over plaintext HTTP from the AD CS GetCACert endpoint, and the response is registered into the system trust store via update-ca-certificates without authenticity validation. No public exploit identified at time of analysis, but the impact enables persistent decryption of TLS traffic across the host.
Authorization bypass in Gitea versions 1.22.3 through 1.26.1 allows holders of `public-only` access tokens or OAuth grants to read and modify private account resources via `/api/v1/user/...` self routes, despite the public-only flag being designed to restrict tokens to public data. The flaw is a systemic scope-boundary failure across many self routes (SSH keys, emails, OAuth apps, Actions secrets/variables/runners, private repos, webhooks), publicly available exploit code exists in the form of reproducible Go PoCs in the advisory, and the issue represents an incomplete fix of CVE-2025-68941 in a different route family.
Path traversal in NASA AMMOS AIT-Core's Binary Stream Capture (BSC) component allows unauthenticated remote attackers to direct the ait-bsc process to append attacker-controlled binary data to arbitrary files on the host filesystem, limited only by the OS permissions of the running process. Affected are AIT-Core 3.1.0 and all 2.x versions before 2.6.1, exploitable via a direct HTTP request if the BSC port is network-accessible or via a browser-based CSRF attack that works even against localhost-bound deployments. Publicly available exploit code exists (python_poc.py, attacker_tcp.py, and test1.html), though no CISA KEV listing was identified at time of analysis.
Local privilege escalation in X.Org X server and Xwayland stems from an incomplete fix for CVE-2025-26597, where CheckKeyTypes() fails to clamp non-canonical key types to XkbMaxShiftLevel, enabling stack-based buffer overflows. Authenticated local users on Red Hat Enterprise Linux 6 through 10 can crash the display server or, when X runs as root, escalate to root privileges. No public exploit identified at time of analysis, though the upstream commit reveals the vulnerable code path and the prior CVE-2025-26597 has known exploitation history.
Credential leakage in elixir-tesla (Tesla HTTP client for Elixir) versions 1.4.0 through 1.18.2 allows Authorization and Host headers to be forwarded to attacker-controlled origins during cross-origin HTTP redirects. The Tesla.Middleware.FollowRedirects component compares header names case-sensitively against a lowercase filter list, so headers using the RFC 7235 canonical casing (e.g., 'Authorization') bypass stripping and reach the redirect target. No public exploit identified at time of analysis, but the upstream fix is committed and a patched release (1.18.3) is available.
Out-of-bounds heap read in Ubuntu Linux kernels 6.8, 6.17, and 7.0 stems from AppArmor SAUCE patches miscomputing an internal buffer size during notification handling, allowing an unprivileged local user to feed invalid data into the AppArmor DFA policy engine. The flaw carries a CVSS 7.8 (high) and currently has no public exploit identified at time of analysis, though Canonical has shipped an upstream kernel fix. Impact is limited to local attackers but high-severity given full CIA impact in the CVSS vector.
Local privilege escalation in Ubuntu Linux 6.8 kernel stems from an AppArmor SAUCE patch that omits proper locking when modifying a linked list, enabling a race condition that can be exploited by an unprivileged local user. Successful exploitation leads to a use-after-free condition with theoretical arbitrary code execution in kernel context. No public exploit identified at time of analysis, and the issue is not present on the CISA KEV list.
Virtual machine escape in Canonical Multipass before 1.16.3 allows a root user inside a guest VM to read arbitrary files on the host filesystem by bypassing the host-side sshfs_server path containment. The flaw lives in the validate_path function (CWE-22 path traversal), which uses naive string prefix matching and accepts dot-dot sequences. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV, though the technical write-up in the GHSA advisory provides enough detail to make exploitation reproducible.
Local privilege escalation in Canonical Multipass for macOS before 1.16.3 allows a low-privileged local user to obtain root execution by replacing co-located auxiliary binaries that the multipassd LaunchDaemon invokes via a user-writable PATH directory. The flaw is an incomplete remediation of CVE-2025-5199: while 1.16.0 corrected ownership of the multipassd binary itself, five sibling binaries (multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, sshfs_server) were left owned by the installing user and writable, enabling binary planting. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
TLS server impersonation in Erlang/OTP's public_key library lets a name-constrained subordinate CA forge a trusted identity for hostnames outside its permitted DNS subtree. By chaining a nameConstraints enforcement gap with a legacy CommonName fallback in pkix_verify_hostname/3, an attacker holding a DNS-restricted intermediate (e.g. permitted;DNS:allowed.example.com) can issue a SAN-less leaf whose CN is an out-of-scope host (e.g. victim.example.com) and have a stock ssl:connect client with verify_peer accept it. It affects OTP 19.3 through the fixed releases (public_key 1.4 onward) and is rated CVSS 4.0 7.6; there is no public exploit identified at time of analysis and it is not on CISA KEV.