Canonical
Monthly
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID. Rated high severity (CVSS 7.0). Public exploit code available.
A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available.
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in Artifex Ghostscript before 9.24. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 82.8%.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 34.9%.
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 89.7%.
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev) and public exploit code available.
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. Rated low severity (CVSS 3.7). Public exploit code available and EPSS exploitation probability 11.4%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
OpenVM's OpenVmHalo2Verifier Solidity wrapper accepts non-canonical app commitments: verify() takes appExeCommit and appVmCommit as raw bytes32 without rejecting values greater than or equal to the BN254 scalar field modulus (0x30644e72...f0000001), so the byte-level input a caller supplies can differ from the field element the verifier arithmetic actually consumes. Applications built on the wrapper - OpenVM SDK releases before 1.7.0 in the 1.x line, plus the 2.0 and 2.1 prereleases before 2.0.0-rc.3 and 2.1.0-preview - can therefore accept ambiguous commitments if their own logic assumes a one-to-one mapping between the supplied bytes and the verified elements. This is a moderate input-validation issue (CWE-20) that does not forge or bypass the underlying Halo2 proof check; no public exploit has been identified at time of analysis, and the network-reachable path is unauthenticated per the CVSS vector (PR:N).
The Rust snark-verifier library before 0.2.5 accepts non-canonical KZG accumulator limb encodings at the verifier boundary, and its native verifier path can be panicked by malformed accumulator public inputs rather than returning a verification error. Deployments are only exposed where accumulator limbs are not already constrained in-circuit before the verifier boundary: the vendor states standard SDK aggregation circuits do so, which is the primary limit on practical exploitability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in version 0.2.5.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
ECDSA JWS signature malleability in erlang-jose (potatosalad:jose) 1.0.0 through 1.11.12 lets anyone holding a single legitimately issued ES256/ES256K/ES384/ES512 token produce multiple distinct signature byte strings that all verify against the same key, because verify/4 never checks the RFC 7518 §3.4 fixed signature length. It cannot forge new payloads or impersonate a signer - the underlying (r, s) pair is unchanged - but it defeats controls that assume a token or signature is unique, such as token-revocation-by-hash, replay/idempotency caches and deduplication keyed on raw signature bytes; applications that enforce uniqueness via a claim such as jti are not meaningfully affected. Exploitation requires an already-valid token as input (assessed vector AV:N/PR:L), a demonstration PoC reference ships with the vendor advisory but it is not verified as working exploit code against third-party deployments, EPSS is 0.09% (1st percentile), there is no CISA KEV listing, and the vendor released a fix in 1.11.13.
Catalog ingestion policy bypass in @backstage/plugin-catalog-backend lets an authenticated user holding the catalog.location.create permission register a URL whose raw string matches a trusted catalog.rules prefix (for example https://ghe.example.com/trusted/**) while the URL reader canonicalizes it to a location outside that prefix, so entity content from an untrusted source is ingested as if it came from a trusted one. Versions before 3.9.2 and 4.0.0 through 4.0.1 are affected, fixed in 3.9.2 (Backstage 1.54.10) and 4.0.2 (Backstage 1.56.1). Impact is scoped to the operator-configured ingestion policy boundary, downstream effects depend on deployment configuration, and no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable_free_kernel(), which queues work on system_percpu_wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable_free_kernel() before the workqueue that function relies on exists. Keep putting the table on the list, but don't schedule the work while the system is still booting. A core_initcall schedules it once to free whatever was queued by then.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512 rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.
Node.js releases at or below 22.23.3, 24.22.0 and 26.12.0 contain a flaw in the HTTP Agent's internal data guard, fixed in the v26.12.1 security release so that the guard functions even when no I/O is taking place. Exploitation is network reachable and needs no authentication or user interaction, but the assessed high attack complexity means an attacker must win a narrow timing window, and the resulting impact is bounded to low confidentiality and low integrity effects; the vendor classifies this item as 'Medium' within a release that otherwise bundles several High-severity fixes. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation has been reported, and the current priority places remediation in this month's cycle.
Node.js 26.12.0 can cache invalid ZIP local headers within its zlib handling, so an application that passes attacker-influenced ZIP or zlib data through those APIs may end up with corrupted header state affecting integrity of subsequently processed data. The vendor rates this Low, scope is unchanged, and only integrity impact is assessed (C:N/I:L/A:N) with high attack complexity, meaning exploitation depends on specific application behavior rather than merely running Node.js. The fix ships in Node.js 26.12.1; no public exploit code has been confirmed at time of analysis and EPSS/KEV signals are absent from the available data.
Node.js 26.12.0 mishandles filesystem permission tree nodes for wildcard path grants when the experimental Permission Model is enabled, potentially permitting file access beyond the intended grant scope. The issue is local, requires high attack complexity, and only affects deployments that explicitly enable the Permission Model with wildcard --allow-fs-read/--allow-fs-write specifications and allow an attacker to execute code inside that restricted context. It is rated low severity (CVSS 3.6); no public exploit identified at time of analysis, and Node.js 26.12.1 contains the vendor fix.
Node.js's experimental Permission Model can be bypassed in fs.realpathSync, letting JavaScript already running inside a permission-restricted process resolve filesystem paths that fall outside the granted scope and infer information about them. The flaw is local and low severity (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): it only matters when the process was started with the --permission flag (or --experimental-permission in older releases) and the attacker can execute code inside that process, such as partially trusted plugin, template or sandboxed code; default Node.js deployments without the Permission Model are unaffected, and there is no integrity or availability impact. It is fixed in the 26.12.1 security release (2026-10-21) and is rated 'Low' in the vendor's own list of fixes; a public PoC reference exists as a GitHub gist but is not verified as working exploit code, no active exploitation is confirmed, and priority is monitor.
Node.js TLS identity checking accepts non-canonical textual representations of IP addresses, so a peer certificate carrying an IP subjectAltName in a non-canonical form can pass the check it should fail (CWE-295). The flaw is grouped with CVE-2026-106069 under the Node.js 26.12.1 security release ('tls: reject non-canonical IP addresses') and is rated High by the project; EUVD lists Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3) as affected baselines, and it is fixed by upgrading to 26.12.1 or the corresponding patched 24.x and 22.x releases. Exploitation is not opportunistic: the attacker must be able to intercept or interpose on a TLS connection and present a certificate whose non-canonical IP form is accepted - an on-path/MITM position rather than a plain remote request - and the independent reassessment scores this AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists (a gist linked from exploit-tracking sources) but it is not verified as working exploit code, and the priority label is 'this_month' rather than act-now.
Node.js startup snapshots can carry a stale crypto random cache into restored processes, so processes restored from a snapshot may emit repeated or predictable random values (CVE-2026-106074, CWE-330). Only applications that build or run using the snapshot feature - --build-snapshot / --snapshot-blob workflows or single-executable applications - are in scope, and the affected builds are Node.js 26.12.0, 24.22.0 and 22.23.3; impact is capped at low confidentiality and low integrity with no availability effect. No confirmed active exploitation (not in CISA KEV) has been reported, and while a public PoC reference exists, it is not verified as working exploit code.
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.
Host canonicalization divergence in fast-uri 2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2 can let unauthenticated remote attackers steer traffic past host-based denylists, loopback filters, redirect allow-lists, or outbound proxy routing when an application checks a host representation that differs from fast-uri’s canonical output. The parser’s canonicalizeHost() adopts the WHATWG URL parser hostname without confirming the whole authority was consumed, so an authority with more than one at-sign or embedded tab, carriage return, or line feed is silently rewritten and no parse error is raised. The flaw is fixed in 2.4.8, 3.1.9, and 4.2.3; no public exploit code was identified at time of analysis, and impact is limited to misdirected traffic rather than code execution or availability loss.
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virtio_gpu_init_submit() never checks it. Later, virtio_gpu_init_submit() passes the NULL fence to virtio_gpu_fence_event_create(), which unconditionally dereferences it. Found when fuzzing the virtio driver with Syzkaller: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 1 UID: 0 PID: 9991 Comm: syz.0.121 Not tainted 7.2.0 #4 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:virtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:295 [inline] RIP: 0010:virtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline] RIP: 0010:virtio_gpu_execbuffer_ioctl+0xc78/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505 Code: 85 ed 0f 85 21 09 00 00 e8 05 5a c9 fb 48 8b 44 24 10 48 8d b8 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 0d 00 00 48 8b 44 24 10 4c 89 b0 90 00 00 00 RSP: 0018:ffffc900039dfad0 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: ffffc900039dfdd8 RCX: ffffffff85f6fd3d RDX: 0000000000000012 RSI: ffffffff85f6fd4b RDI: 0000000000000090 RBP: 0000000000000000 R0virtio_gpu_virgl_process_cmd: ctrl 0x102, error 0x1203 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880132c4000 R13: 0000000000000000 R14: ffff888073b6c700 R15: 000000000000003b FS: 00007fab480b96c0(0000) GS:ffff8880eb6e9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007effbf5e55a8 CR3: 0000000048d19000 CR4: 0000000000350ef0 Call Trace: <TASK> drm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x5f4/0xc70 drivers/gpu/drm/drm_ioctl.c:914 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fab471a82bd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fab480b9018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fab47435fa0 RCX: 00007fab471a82bd RDX: 00002000000000c0 RSI: 00000000c0406442 RDI: 0000000000000003 RBP: 00007fab480b9080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fab47436038 R14: 00007fab47435fa0 R15: 00007ffe85ab0740 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:virtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:295 [inline] RIP: 0010:virtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline] RIP: 0010:virtio_gpu_execbuffer_ioctl+0xc78/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505 Code: 85 ed 0f 85 21 09 00 00 e8 05 5a c9 fb 48 8b 44 24 10 48 8d b8 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 0d 00 00 48 8b 44 24 10 4c 89 b0 90 00 00 00 RSP: 0018:ffffc900039dfad0 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: ffffc900039dfdd8 RCX: ffffffff85f6fd3d RDX: 0000000000000012 RSI: ffffffff85f6fd4b RDI: 0000000000000090 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880132c4000 R13: 0000000000000000 R14: ffff888073b6c700 R15: 000000000000003b FS: 00007fab480b96c0(0000) GS:ffff888098ae9000(0000) knlGS:00000000 ---truncated---
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it. rfcomm_recv_disc() forces the dlc state before tearing it down: d->state = BT_CLOSED; __rfcomm_dlc_close(d, err); The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d->session = NULL, while d->defer_setup stays 1. A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk_state is BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional. Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780 Call Trace: <TASK> do_sock_getsockopt+0x3ad/0x7d0 __sys_getsockopt+0x10e/0x1b0 __x64_sys_getsockopt+0xc2/0x160 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> 0x10 is the offset of sock in struct rfcomm_session; rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt(). Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept") fixed the same "a remote DISC clears the session while deferred setup is still flagged" problem in rfcomm_dlc_accept(); this is the remaining instance of it, in the getsockopt path. Deferred setup only leaves a socket usable here once it has reached BT_CONNECT2, so restrict the exception to that state and check that a session is actually present before following it.
Wheels 4.0.0 through 4.1.2 performs case-insensitive path-containment checks on case-sensitive filesystems, so a pre-existing symlink pointing to a case-distinct sibling directory can bypass canonical-path validation for zip entries, package mappings, development assets/docs, guide images, and image tags. This permits limited unauthorized file disclosure outside the intended root; a separate CLI database-dump write path can write outside the application root only when the CLI POST action, loopback access, and password gate are all satisfied, and only to an existing writable case-distinct sibling directory. The issue is fixed in Wheels 4.2.0; exploitation of the primary flaw depends on deployment on a case-sensitive filesystem with the necessary pre-existing symlink, and no public exploit was identified at time of analysis.
Canonical authd before 0.7.1 can silently rebind a recycled identity-provider email address to an existing local account record, so a newly created IdP account inherits the previous user's local UID and home directory - including SSH keys and cloud API tokens - on its first login to the authd-managed host. Exploitation is highly conditional rather than a mass-exploitation priority: it requires an OIDC broker deployment that maps the IdP email address to the local username, an IdP-side reassignment of that email to a new account after the original IdP account is removed, and an administrator who has not locked or deleted the departed user's local authd account; the flaw is local to the managed machine (CVSS:4.0 base 5.9; independently assessed as CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the documented mitigation - locking or deleting the previous user's local authd account when the corresponding IdP account is removed - fully prevents it.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.
Header validation bypass in Fastify 5.12.2 through 5.12.5 can permit unauthenticated remote attackers to smuggle a forbidden header past route schema validation when an application uses a propertyNames subschema containing enum or const header names written in canonical casing. The flaw is low impact, with CVSS 3.7, and is limited to request integrity because the affected schemas are uncommon, default Fastify configurations are not vulnerable, and no public exploit identified at time of analysis. Upgrading to Fastify 5.12.6 or later resolves the issue by correctly lowercasing the nested header-name restrictions.
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf_action_delete() drops the reference held by its lookup before calling tcf_idr_delete_index() with the saved action index. An unlocked classifier can remove that action and reserve the same IDR slot with ERR_PTR(-EBUSY) in between. tcf_idr_delete_index() only checks the lookup result for NULL. It therefore treats the reservation as a tc_action and dereferences tcfa_bindcnt. A hardware execution breakpoint was used to schedule the interleaving without changing the kernel source. KASAN reported this decoded trace: BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010 Read of size 4 at addr 0000000000000010 by task poc/150 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002 RIP: tca_action_gd+0x5c0/0x1010: arch_atomic_read at arch/x86/include/asm/atomic.h:23 raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457 atomic_read at include/linux/atomic/atomic-instrumented.h:33 tcf_idr_delete_index at net/sched/act_api.c:766 tcf_action_delete at net/sched/act_api.c:1859 tcf_del_notify at net/sched/act_api.c:2014 tca_action_gd at net/sched/act_api.c:2064 R13: 0000000000000010 R15: fffffffffffffff0 Kernel panic - not syncing: Fatal exception R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces the address in R13. With the guard applied, the same reproducer returned -ENOENT without a KASAN report or panic. Treat error pointers as absent and return -ENOENT.
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.
Sanitizer bypass in enshrined/svg-sanitize 0.22.0 and earlier lets an attacker smuggle a fully live SVG <use> nesting bomb past the library's useNestingLimit defenses by writing the href attribute with mixed casing, for example xlink:HrEf or HrEf. The resolver builds its reference graph with the case-sensitive XPath predicate use[@href or @xlink:href], so the mixed-case nodes never enter the graph and are never nullified, while Sanitizer::cleanHrefAttributes() runs later in the same pass and re-canonicalizes the attribute to xlink:href - handing back output that would have been stripped entirely had the input used canonical casing. Impact is availability only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): unauthenticated attackers able to upload or paste an SVG into an application that sanitizes and then serves it can cause a denial of service when the output is rendered (UI:R); publicly available exploit code exists (a reproducible proof of concept against tag 0.22.0 ships with the vendor advisory), but no CISA KEV entry indicates active exploitation.
Defense-in-depth bypass in Coraza WAF 3.4.0 through 3.7.0 causes the multipart body processor to silently swallow io.ErrUnexpectedEOF, so a truncated multipart/form-data request neither sets MULTIPART_STRICT_ERROR nor returns a request-body error, and the two canonical defensive rules shipped in coraza.conf-recommended (200003 MULTIPART_STRICT_ERROR and 200002 REQBODY_ERROR) fail open. Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, 5.8) can send a body that omits the closing boundary or cuts off mid-part and have it processed as if well-formed, neutralizing the parser-disagreement catch-all and enabling multipart smuggling or CRS evasion chains against backends whose multipart parser disagrees with Go's mime/multipart reader. No active exploitation is confirmed (not in CISA KEV), though the vendor advisory publishes a working reproduction proof-of-concept and the vendor-released fix is v3.8.0.
Heap exhaustion in the yawkat LZ4 Java library before 1.11.2 allows remote denial of service: net.jpountz.lz4.LZ4BlockInputStream.refill() checks that the compressedLen field of a legacy LZ4Block header is nonnegative but then allocates a compressed-input buffer of exactly that attacker-controlled size before any payload is read. Because each header is only a handful of bytes, a header-only stream can request a near-2 GiB allocation and crash the JVM with OutOfMemoryError, affecting any application that decompresses attacker-influenced LZ4 legacy-block data with the default reader configuration; no public exploit code or active exploitation was identified at time of analysis (CVSS 5.3, availability-only impact). The flaw is fixed in version 1.11.2, which rejects non-canonical oversized blocks by default.
In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT]. iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate. The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline] __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline] ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 Abort the channel switch properly.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Response-body inspection can be silently evaded in the affected Ubuntu-packaged component tracked as GHSA-vmg8-j66p-vgvw when an HTTP response declares its Content-Type using non-canonical character casing, causing the inspecting logic to fail its canonical comparison and skip the body it was meant to examine. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) shows a network-reachable bypass with no confidentiality or availability impact, a low integrity impact, and a Scope-Changed rating that reflects the defeated check protecting resources beyond the vulnerable component itself. Exploitation requires the attacker to influence the Content-Type value of a response, typically by controlling or compromising the upstream/origin server whose traffic flows through the inspecting component; no public exploit code has been identified at time of analysis and no CISA KEV entry was included in the source data, so active exploitation is unconfirmed. The specific affected product name, version range, and configuration preconditions are not established by the available data, and authentication requirements are likewise not confirmed from the input.
Apache APISIX versions 2.14.1 through 3.18.0 can serve requests to protected upstream endpoints without authentication when a permissive (public) route overlaps the path space of a protected route and the client supplies a crafted encoded, non-canonical path. Because authorization is evaluated against the permissive route while the request ultimately resolves to the protected upstream, the protected route's policies are bypassed entirely; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a fully remote, unauthenticated attack that is gated only by the non-default requirement of an overlapping permissive-and-protected route configuration. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is fixed by upgrading to Apache APISIX 3.19.0.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.
smtp_mailaddr in smtp_session.c in OpenSMTPD 6.6, as used in OpenBSD 6.6 and other products, allows remote attackers to execute arbitrary commands as root via a crafted SMTP session, as demonstrated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
Exim 4.92 through 4.92.2 allows remote code execution, a different vulnerability than CVE-2019-15846. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained with the document it is launched from. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
A flaw was found in Exim versions 4.87 to 4.91 (inclusive). Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
In the Linux kernel before 4.20.14, expand_downwards in mm/mmap.c lacks a check for the mmap minimum address, which makes it easier for attackers to exploit kernel NULL pointer dereferences on. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. Public exploit code available and no vendor patch available.
In the Linux kernel 4.15.x through 4.19.x before 4.19.2, map_write() in kernel/user_namespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID. Rated high severity (CVSS 7.0). Public exploit code available.
A flaw was found in xorg-x11-server before 1.20.3. Rated medium severity (CVSS 6.6), this vulnerability is low attack complexity. Public exploit code available.
Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
An integer overflow flaw was found in the Linux kernel's create_elf_tables() function. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in Artifex Ghostscript before 9.24. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all operating-system kernels,. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and potential code execution. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
In the Linux kernel through 4.14.13, the rds_cmsg_atomic function in net/rds/rdma.c mishandles cases where page pinning fails or an invalid address is supplied, leading to an rds_atomic_free_op NULL. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available.
The check_alu_op function in kernel/bpf/verifier.c in the Linux kernel through 4.4 allows local users to cause a denial of service (memory corruption) or possibly have unspecified other impact by. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 82.8%.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Juju before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 uses a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 81.6%.
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRemoteLifecycleListener is used and an. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging the CAP_NET_RAW. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 34.9%.
The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 89.7%.
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on-write (COW) feature to write to a. Rated high severity (CVSS 7.0). Actively exploited in the wild (cisa kev) and public exploit code available.
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain. Rated high severity (CVSS 7.1), this vulnerability is low attack complexity. Public exploit code available.
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to execute arbitrary code. Rated high severity (CVSS 8.4), this vulnerability is no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 94.0%.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 63.0%.
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The slapper function in chkrootkit before 0.50 does not properly quote file paths, which allows local users to execute arbitrary code via a Trojan horse executable. Rated low severity (CVSS 3.7). Public exploit code available and EPSS exploitation probability 11.4%.
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified vectors. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 70.5%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
Use-after-free vulnerability in the serializeToStream implementation in the XMLSerializer component in Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 84.0%.
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 88.0%.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise through malicious Java Web Start applications and untrusted applets exploiting the Scripting component. CISA KEV confirms active exploitation in the wild. EPSS score of 92.59% (100th percentile) indicates extremely high probability of mass exploitation. Public exploit code exists, making this a critical priority for any environment running affected Java versions despite the vulnerability's age.
OpenVM's OpenVmHalo2Verifier Solidity wrapper accepts non-canonical app commitments: verify() takes appExeCommit and appVmCommit as raw bytes32 without rejecting values greater than or equal to the BN254 scalar field modulus (0x30644e72...f0000001), so the byte-level input a caller supplies can differ from the field element the verifier arithmetic actually consumes. Applications built on the wrapper - OpenVM SDK releases before 1.7.0 in the 1.x line, plus the 2.0 and 2.1 prereleases before 2.0.0-rc.3 and 2.1.0-preview - can therefore accept ambiguous commitments if their own logic assumes a one-to-one mapping between the supplied bytes and the verified elements. This is a moderate input-validation issue (CWE-20) that does not forge or bypass the underlying Halo2 proof check; no public exploit has been identified at time of analysis, and the network-reachable path is unauthenticated per the CVSS vector (PR:N).
The Rust snark-verifier library before 0.2.5 accepts non-canonical KZG accumulator limb encodings at the verifier boundary, and its native verifier path can be panicked by malformed accumulator public inputs rather than returning a verification error. Deployments are only exposed where accumulator limbs are not already constrained in-circuit before the verifier boundary: the vendor states standard SDK aggregation circuits do so, which is the primary limit on practical exploitability. No public exploit code and no confirmed active exploitation were identified at time of analysis; the issue is fixed in version 0.2.5.
Crashing 389-ds-base directory servers is possible for an authenticated LDAP user who holds ModifyDN permission on an entry: renaming it with a schema alias such as 'commonName' instead of the canonical 'cn' causes a NULL pointer dereference and denial of service. The flaw affects Red Hat Directory Server 11, 12, and 13 and the 389-ds-base packages in Red Hat Enterprise Linux 6 through 10; exploitation requires valid credentials plus an explicit modrdn ACI, so anonymous or read-only users cannot trigger it. No public exploit identified at time of analysis, and the impact is limited to availability with no data disclosure or modification, making this a moderate-priority availability issue rather than a top-tier emergency.
ECDSA JWS signature malleability in erlang-jose (potatosalad:jose) 1.0.0 through 1.11.12 lets anyone holding a single legitimately issued ES256/ES256K/ES384/ES512 token produce multiple distinct signature byte strings that all verify against the same key, because verify/4 never checks the RFC 7518 §3.4 fixed signature length. It cannot forge new payloads or impersonate a signer - the underlying (r, s) pair is unchanged - but it defeats controls that assume a token or signature is unique, such as token-revocation-by-hash, replay/idempotency caches and deduplication keyed on raw signature bytes; applications that enforce uniqueness via a claim such as jti are not meaningfully affected. Exploitation requires an already-valid token as input (assessed vector AV:N/PR:L), a demonstration PoC reference ships with the vendor advisory but it is not verified as working exploit code against third-party deployments, EPSS is 0.09% (1st percentile), there is no CISA KEV listing, and the vendor released a fix in 1.11.13.
Catalog ingestion policy bypass in @backstage/plugin-catalog-backend lets an authenticated user holding the catalog.location.create permission register a URL whose raw string matches a trusted catalog.rules prefix (for example https://ghe.example.com/trusted/**) while the URL reader canonicalizes it to a location outside that prefix, so entity content from an untrusted source is ingested as if it came from a trusted one. Versions before 3.9.2 and 4.0.0 through 4.0.1 are affected, fixed in 3.9.2 (Backstage 1.54.10) and 4.0.2 (Backstage 1.56.1). Impact is scoped to the operator-configured ingestion policy boundary, downstream effects depend on deployment configuration, and no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: mm: don't schedule deferred kernel page table freeing while booting Booting with a boot-time function tracer and a filter, for example ftrace=function ftrace_filter=pud_free_pmd_page panics on 7.3-rc4 as soon as the tracer starts: [ 23.531178] Starting tracer 'function' [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7] [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef) [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00 [ 25.981629] Call Trace: [ 26.125727] <TASK> [ 26.413912] ? pagetable_free_kernel+0x20/0x120 [ 26.990283] queue_work_on+0x97/0xf0 [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0 [ 27.566662] cpa_flush+0x394/0x620 [ 27.998953] change_page_attr_set_clr+0x321/0x4a0 [ 29.151729] set_memory_rox+0xa2/0xf0 [ 29.584018] create_trampoline+0x431/0x6f0 ... [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task! The boot-time tracer is started from early_trace_init(), which runs before workqueue_init_early(). Making its trampoline read-only splits a large page, and CPA collapses it again right away. The split table has been a kernel page table since commit 9e4a3ec3411b ("x86/mm/pat: Allocate split page tables as kernel page tables"), so the collapse frees it through pagetable_free_kernel(), which queues work on system_percpu_wq - still NULL at that point. That commit is correct in itself; it only lets CPA reach pagetable_free_kernel() before the workqueue that function relies on exists. Keep putting the table on the list, but don't schedule the work while the system is still booting. A core_initcall schedules it once to free whatever was queued by then.
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown syzbot hit a NULL pointer dereference in rfcomm_dev_shutdown() when an RFCOMM tty is closed. rfcomm_dev_add() puts the new device on rfcomm_dev_list first and only then registers the tty device and saves it in dev->tty_dev. If that registration fails, dev->tty_dev is never set at all. The device can be looked up in the meantime, so an open() of /dev/rfcommN gets through rfcomm_tty_install() and attaches to it. When that tty is closed again, rfcomm_dev_shutdown() uses dev->tty_dev without checking it: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000040-0x0000000000000047] RIP: 0010:rfcomm_dev_shutdown+0x48/0xb0 net/bluetooth/rfcomm/tty.c:131 Call Trace: tty_port_shutdown+0x1bf/0x220 drivers/tty/tty_port.c:372 tty_port_close+0x4e/0x150 drivers/tty/tty_port.c:705 tty_release+0x359/0x1670 drivers/tty/tty_io.c:1718 __fput+0x418/0xa50 fs/file_table.c:512 rfcomm_dev_destruct() already copes with a NULL dev->tty_dev. Add the same check to rfcomm_dev_shutdown(), so the tty device is only moved when it was actually registered.
Node.js releases at or below 22.23.3, 24.22.0 and 26.12.0 contain a flaw in the HTTP Agent's internal data guard, fixed in the v26.12.1 security release so that the guard functions even when no I/O is taking place. Exploitation is network reachable and needs no authentication or user interaction, but the assessed high attack complexity means an attacker must win a narrow timing window, and the resulting impact is bounded to low confidentiality and low integrity effects; the vendor classifies this item as 'Medium' within a release that otherwise bundles several High-severity fixes. A public PoC reference exists; it is not verified as working exploit code, no confirmed active exploitation has been reported, and the current priority places remediation in this month's cycle.
Node.js 26.12.0 can cache invalid ZIP local headers within its zlib handling, so an application that passes attacker-influenced ZIP or zlib data through those APIs may end up with corrupted header state affecting integrity of subsequently processed data. The vendor rates this Low, scope is unchanged, and only integrity impact is assessed (C:N/I:L/A:N) with high attack complexity, meaning exploitation depends on specific application behavior rather than merely running Node.js. The fix ships in Node.js 26.12.1; no public exploit code has been confirmed at time of analysis and EPSS/KEV signals are absent from the available data.
Node.js 26.12.0 mishandles filesystem permission tree nodes for wildcard path grants when the experimental Permission Model is enabled, potentially permitting file access beyond the intended grant scope. The issue is local, requires high attack complexity, and only affects deployments that explicitly enable the Permission Model with wildcard --allow-fs-read/--allow-fs-write specifications and allow an attacker to execute code inside that restricted context. It is rated low severity (CVSS 3.6); no public exploit identified at time of analysis, and Node.js 26.12.1 contains the vendor fix.
Node.js's experimental Permission Model can be bypassed in fs.realpathSync, letting JavaScript already running inside a permission-restricted process resolve filesystem paths that fall outside the granted scope and infer information about them. The flaw is local and low severity (assessed CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N): it only matters when the process was started with the --permission flag (or --experimental-permission in older releases) and the attacker can execute code inside that process, such as partially trusted plugin, template or sandboxed code; default Node.js deployments without the Permission Model are unaffected, and there is no integrity or availability impact. It is fixed in the 26.12.1 security release (2026-10-21) and is rated 'Low' in the vendor's own list of fixes; a public PoC reference exists as a GitHub gist but is not verified as working exploit code, no active exploitation is confirmed, and priority is monitor.
Node.js TLS identity checking accepts non-canonical textual representations of IP addresses, so a peer certificate carrying an IP subjectAltName in a non-canonical form can pass the check it should fail (CWE-295). The flaw is grouped with CVE-2026-106069 under the Node.js 26.12.1 security release ('tls: reject non-canonical IP addresses') and is rated High by the project; EUVD lists Node 24.22.0 (≤24.22.0), 26.12.0 (≤26.12.0) and 22.23.3 (≤22.23.3) as affected baselines, and it is fixed by upgrading to 26.12.1 or the corresponding patched 24.x and 22.x releases. Exploitation is not opportunistic: the attacker must be able to intercept or interpose on a TLS connection and present a certificate whose non-canonical IP form is accepted - an on-path/MITM position rather than a plain remote request - and the independent reassessment scores this AV:N/AC:H/PR:N/UI:N with high confidentiality and integrity impact. There is no CISA KEV entry and no confirmed active exploitation; a public PoC reference exists (a gist linked from exploit-tracking sources) but it is not verified as working exploit code, and the priority label is 'this_month' rather than act-now.
Node.js startup snapshots can carry a stale crypto random cache into restored processes, so processes restored from a snapshot may emit repeated or predictable random values (CVE-2026-106074, CWE-330). Only applications that build or run using the snapshot feature - --build-snapshot / --snapshot-blob workflows or single-executable applications - are in scope, and the affected builds are Node.js 26.12.0, 24.22.0 and 22.23.3; impact is capped at low confidentiality and low integrity with no availability effect. No confirmed active exploitation (not in CISA KEV) has been reported, and while a public PoC reference exists, it is not verified as working exploit code.
An authorization bypass in the @apostrophecms/import-export module of ApostropheCMS (versions prior to 3.7.1) lets a low-privilege contributor with draft editing rights cross the publication boundary during a duplicate-import continuation. Because the module accepts a client-supplied replacement choice without binding it to a server-side analysis owned by that user or re-authorizing the canonical target document, the contributor can select a published document for replacement on an import-enabled localized type and modify content they should not be able to touch. The flaw is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) with integrity-only impact; no public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor's current assessment derives from remediation review rather than a repeated end-to-end reproduction.
Host canonicalization divergence in fast-uri 2.4.2-2.4.7, 3.1.3-3.1.8, and 4.0.1-4.2.2 can let unauthenticated remote attackers steer traffic past host-based denylists, loopback filters, redirect allow-lists, or outbound proxy routing when an application checks a host representation that differs from fast-uri’s canonical output. The parser’s canonicalizeHost() adopts the WHATWG URL parser hostname without confirming the whole authority was consumed, so an authority with more than one at-sign or embedded tab, carriage return, or line feed is silently rewritten and no parse error is raised. The flaw is fixed in 2.4.8, 3.1.9, and 4.2.3; no public exploit code was identified at time of analysis, and impact is limited to misdirected traffic rather than code execution or availability loss.
In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCB_HAS_METADATA leaves iocb->private as a uio_meta, while iocb_bio_iopoll() expects a bio. Since 2729a60bbfb9, metadata I/O always uses __blkdev_direct_IO(), which never publishes the bio for polling, so IOPOLL calls bio_poll() on the uio_meta. Reproducer: io_uring IOPOLL plus a PI attribute on an integrity device (scsi_debug dif=1 dix=1). KASAN reports: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004 KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] RIP: 0010:bio_poll+0x9d/0x4b0 Call Trace: iocb_bio_iopoll+0x5b/0x80 io_uring_classic_poll+0xf3/0x140 io_do_iopoll+0x4e3/0xc00 io_iopoll_check+0x275/0x560 __do_sys_io_uring_enter+0x2e5/0x720 Return -EOPNOTSUPP when HIPRI is combined with user metadata.
In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtio_gpu_fence_alloc() can fail due to memory pressure and return NULL, but its caller like virtio_gpu_init_submit() never checks it. Later, virtio_gpu_init_submit() passes the NULL fence to virtio_gpu_fence_event_create(), which unconditionally dereferences it. Found when fuzzing the virtio driver with Syzkaller: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097] CPU: 1 UID: 0 PID: 9991 Comm: syz.0.121 Not tainted 7.2.0 #4 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:virtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:295 [inline] RIP: 0010:virtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline] RIP: 0010:virtio_gpu_execbuffer_ioctl+0xc78/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505 Code: 85 ed 0f 85 21 09 00 00 e8 05 5a c9 fb 48 8b 44 24 10 48 8d b8 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 0d 00 00 48 8b 44 24 10 4c 89 b0 90 00 00 00 RSP: 0018:ffffc900039dfad0 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: ffffc900039dfdd8 RCX: ffffffff85f6fd3d RDX: 0000000000000012 RSI: ffffffff85f6fd4b RDI: 0000000000000090 RBP: 0000000000000000 R0virtio_gpu_virgl_process_cmd: ctrl 0x102, error 0x1203 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880132c4000 R13: 0000000000000000 R14: ffff888073b6c700 R15: 000000000000003b FS: 00007fab480b96c0(0000) GS:ffff8880eb6e9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007effbf5e55a8 CR3: 0000000048d19000 CR4: 0000000000350ef0 Call Trace: <TASK> drm_ioctl_kernel+0x1f4/0x3e0 drivers/gpu/drm/drm_ioctl.c:817 drm_ioctl+0x5f4/0xc70 drivers/gpu/drm/drm_ioctl.c:914 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x116/0x800 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fab471a82bd Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fab480b9018 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fab47435fa0 RCX: 00007fab471a82bd RDX: 00002000000000c0 RSI: 00000000c0406442 RDI: 0000000000000003 RBP: 00007fab480b9080 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007fab47436038 R14: 00007fab47435fa0 R15: 00007ffe85ab0740 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:virtio_gpu_fence_event_create drivers/gpu/drm/virtio/virtgpu_submit.c:295 [inline] RIP: 0010:virtio_gpu_init_submit drivers/gpu/drm/virtio/virtgpu_submit.c:398 [inline] RIP: 0010:virtio_gpu_execbuffer_ioctl+0xc78/0x1aa0 drivers/gpu/drm/virtio/virtgpu_submit.c:505 Code: 85 ed 0f 85 21 09 00 00 e8 05 5a c9 fb 48 8b 44 24 10 48 8d b8 90 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 9a 0d 00 00 48 8b 44 24 10 4c 89 b0 90 00 00 00 RSP: 0018:ffffc900039dfad0 EFLAGS: 00010216 RAX: dffffc0000000000 RBX: ffffc900039dfdd8 RCX: ffffffff85f6fd3d RDX: 0000000000000012 RSI: ffffffff85f6fd4b RDI: 0000000000000090 RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880132c4000 R13: 0000000000000000 R14: ffff888073b6c700 R15: 000000000000003b FS: 00007fab480b96c0(0000) GS:ffff888098ae9000(0000) knlGS:00000000 ---truncated---
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO The RFCOMM_CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if (sk->sk_state != BT_CONNECTED && !rfcomm_pi(sk)->dlc->defer_setup) { err = -ENOTCONN; break; } l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk; dlc->defer_setup is set in rfcomm_sock_init() when rfcomm_connect_ind() creates a child socket for an incoming connection on a listening socket that has BT_DEFER_SETUP enabled. It is never cleared afterwards. The session, however, can go away underneath it. rfcomm_recv_disc() forces the dlc state before tearing it down: d->state = BT_CLOSED; __rfcomm_dlc_close(d, err); The RFCOMM_DEFER_SETUP early return in __rfcomm_dlc_close() only covers BT_CONNECT, BT_CONFIG, BT_OPEN and BT_CONNECT2, so with the state already BT_CLOSED that switch does not match and the function falls through to rfcomm_dlc_unlink(), which sets d->session = NULL, while d->defer_setup stays 1. A getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket after that point therefore skips the -ENOTCONN path -- sk->sk_state is BT_CLOSED, but dlc->defer_setup is still set -- and dereferences the NULL session. No race is needed: once the DISC has been processed, the dereference is unconditional. Reproduced on a KASAN kernel under QEMU with a BR/EDR peer emulated over /dev/vhci: the peer brings up an ACL link, opens L2CAP on the RFCOMM PSM, starts a session and sends SABM for a channel bound with BT_DEFER_SETUP, and sends DISC for that dlci after the socket has been accepted. getsockopt(SOL_RFCOMM, RFCOMM_CONNINFO) on the accepted socket then hits: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017] CPU: 1 UID: 0 PID: 150 Comm: init Tainted: G B 7.3.0-rc3-g5dd1818b15d9 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996) RIP: 0010:rfcomm_sock_getsockopt+0x529/0x780 Call Trace: <TASK> do_sock_getsockopt+0x3ad/0x7d0 __sys_getsockopt+0x10e/0x1b0 __x64_sys_getsockopt+0xc2/0x160 do_syscall_64+0xda/0x4b0 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> 0x10 is the offset of sock in struct rfcomm_session; rfcomm_sock_getsockopt_old() is inlined into rfcomm_sock_getsockopt(). Commit 43a556b2fd43 ("Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept") fixed the same "a remote DISC clears the session while deferred setup is still flagged" problem in rfcomm_dlc_accept(); this is the remaining instance of it, in the getsockopt path. Deferred setup only leaves a socket usable here once it has reached BT_CONNECT2, so restrict the exception to that state and check that a session is actually present before following it.
Wheels 4.0.0 through 4.1.2 performs case-insensitive path-containment checks on case-sensitive filesystems, so a pre-existing symlink pointing to a case-distinct sibling directory can bypass canonical-path validation for zip entries, package mappings, development assets/docs, guide images, and image tags. This permits limited unauthorized file disclosure outside the intended root; a separate CLI database-dump write path can write outside the application root only when the CLI POST action, loopback access, and password gate are all satisfied, and only to an existing writable case-distinct sibling directory. The issue is fixed in Wheels 4.2.0; exploitation of the primary flaw depends on deployment on a case-sensitive filesystem with the necessary pre-existing symlink, and no public exploit was identified at time of analysis.
Canonical authd before 0.7.1 can silently rebind a recycled identity-provider email address to an existing local account record, so a newly created IdP account inherits the previous user's local UID and home directory - including SSH keys and cloud API tokens - on its first login to the authd-managed host. Exploitation is highly conditional rather than a mass-exploitation priority: it requires an OIDC broker deployment that maps the IdP email address to the local username, an IdP-side reassignment of that email to a new account after the original IdP account is removed, and an administrator who has not locked or deleted the departed user's local authd account; the flaw is local to the managed machine (CVSS:4.0 base 5.9; independently assessed as CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). No public exploit code was identified at time of analysis and the issue is not in CISA KEV, but the documented mitigation - locking or deleting the previous user's local authd account when the corresponding IdP account is removed - fully prevents it.
Unsupported or non-canonical HTTP methods sent to Go services built on kin-openapi's openapi3filter.ValidationHandler with the legacy router reach a panic in PathItem.GetOperation before authentication runs, letting an unauthenticated remote client repeatedly abort connections and inflate stack-trace logs in all versions prior to 0.145.0. The access vector is network-only with no privileges or user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), but the effect is bounded: Go recovers per-request panics by default, so the worst case is per-connection denial of service and log growth rather than a full process crash, and the panic requires an exactly-matched static path (a path served only by a templated route does not reach the same sink). No public exploit code was identified at time of analysis, and CISA KEV does not list this issue as confirmed actively exploited.
Header validation bypass in Fastify 5.12.2 through 5.12.5 can permit unauthenticated remote attackers to smuggle a forbidden header past route schema validation when an application uses a propertyNames subschema containing enum or const header names written in canonical casing. The flaw is low impact, with CVSS 3.7, and is limited to request integrity because the affected schemas are uncommon, default Fastify configurations are not vulnerable, and no public exploit identified at time of analysis. Upgrading to Fastify 5.12.6 or later resolves the issue by correctly lowercasing the nested header-name restrictions.
Unauthenticated path traversal in the Contao CMS ImagesController lets remote attackers read files from the project directory by supplying encoded parent-directory segments in the image route's {path} parameter. Affected versions are Contao 5.0.0 through 5.3.49 and 5.7.11 (fixed in 5.3.50 and 5.7.12), with impact constrained by the fact that a returned file must carry an extension listed in contao.image.valid_extensions and files below the upload directory were not demonstrated to be readable, making this extension-restricted disclosure plus path-existence probing rather than arbitrary file read. The CVSS 3.1 score is 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), no public exploit code or confirmed active exploitation has been identified at time of analysis, and the independent assessment rates the issue as moderate rather than critical.
In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcf_action_delete() drops the reference held by its lookup before calling tcf_idr_delete_index() with the saved action index. An unlocked classifier can remove that action and reserve the same IDR slot with ERR_PTR(-EBUSY) in between. tcf_idr_delete_index() only checks the lookup result for NULL. It therefore treats the reservation as a tc_action and dereferences tcfa_bindcnt. A hardware execution breakpoint was used to schedule the interleaving without changing the kernel source. KASAN reported this decoded trace: BUG: KASAN: null-ptr-deref in tca_action_gd+0x5b9/0x1010 Read of size 4 at addr 0000000000000010 by task poc/150 Oops: general protection fault, probably for non-canonical address 0xdffffc0000000002 RIP: tca_action_gd+0x5c0/0x1010: arch_atomic_read at arch/x86/include/asm/atomic.h:23 raw_atomic_read at include/linux/atomic/atomic-arch-fallback.h:457 atomic_read at include/linux/atomic/atomic-instrumented.h:33 tcf_idr_delete_index at net/sched/act_api.c:766 tcf_action_delete at net/sched/act_api.c:1859 tcf_del_notify at net/sched/act_api.c:2014 tca_action_gd at net/sched/act_api.c:2064 R13: 0000000000000010 R15: fffffffffffffff0 Kernel panic - not syncing: Fatal exception R15 contains ERR_PTR(-EBUSY), and adding the tcfa_bindcnt offset produces the address in R13. With the guard applied, the same reproducer returned -ENOENT without a KASAN report or panic. Treat error pointers as absent and return -ENOENT.
In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6t_rpfilter: reject routes without inet6_dev ip6_route_lookup() can return an error-free route whose rt6i_idev is NULL. Lowering an external nexthop device's MTU below IPV6_MIN_MTU tears down its inet6_dev while fib6_ifdown() leaves routes using nexthop objects in the FIB. An unprivileged user can construct this state with rtnetlink in a private user and network namespace, then trigger a NULL dereference through an IPv6 rpfilter lookup: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000 KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] RIP: rpfilter_mt (net/ipv6/netfilter/ip6t_rpfilter.c:75) Call Trace: ip6t_do_table (net/ipv6/netfilter/ip6_tables.c:316) nf_hook_slow (net/netfilter/core.c:619) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6216) process_backlog (net/core/dev.c:6680) __napi_poll (net/core/dev.c:7739) net_rx_action (net/core/dev.c:7959) handle_softirqs (kernel/softirq.c:622) do_softirq.part.0 (kernel/softirq.c:523) __local_bh_enable_ip (kernel/softirq.c:450) __dev_queue_xmit (net/core/dev.c:4913) packet_sendmsg (net/packet/af_packet.c:3139) __sys_sendto (net/socket.c:2252) __x64_sys_sendto (net/socket.c:2259) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Kernel panic - not syncing: Fatal exception in interrupt Reject routes without an inet6_dev immediately after lookup. Such routes are not eligible for reverse-path filtering, and the check protects all later rt6i_idev dereferences.
Sanitizer bypass in enshrined/svg-sanitize 0.22.0 and earlier lets an attacker smuggle a fully live SVG <use> nesting bomb past the library's useNestingLimit defenses by writing the href attribute with mixed casing, for example xlink:HrEf or HrEf. The resolver builds its reference graph with the case-sensitive XPath predicate use[@href or @xlink:href], so the mixed-case nodes never enter the graph and are never nullified, while Sanitizer::cleanHrefAttributes() runs later in the same pass and re-canonicalizes the attribute to xlink:href - handing back output that would have been stripped entirely had the input used canonical casing. Impact is availability only (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H): unauthenticated attackers able to upload or paste an SVG into an application that sanitizes and then serves it can cause a denial of service when the output is rendered (UI:R); publicly available exploit code exists (a reproducible proof of concept against tag 0.22.0 ships with the vendor advisory), but no CISA KEV entry indicates active exploitation.
Defense-in-depth bypass in Coraza WAF 3.4.0 through 3.7.0 causes the multipart body processor to silently swallow io.ErrUnexpectedEOF, so a truncated multipart/form-data request neither sets MULTIPART_STRICT_ERROR nor returns a request-body error, and the two canonical defensive rules shipped in coraza.conf-recommended (200003 MULTIPART_STRICT_ERROR and 200002 REQBODY_ERROR) fail open. Remote unauthenticated attackers (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, 5.8) can send a body that omits the closing boundary or cuts off mid-part and have it processed as if well-formed, neutralizing the parser-disagreement catch-all and enabling multipart smuggling or CRS evasion chains against backends whose multipart parser disagrees with Go's mime/multipart reader. No active exploitation is confirmed (not in CISA KEV), though the vendor advisory publishes a working reproduction proof-of-concept and the vendor-released fix is v3.8.0.
Heap exhaustion in the yawkat LZ4 Java library before 1.11.2 allows remote denial of service: net.jpountz.lz4.LZ4BlockInputStream.refill() checks that the compressedLen field of a legacy LZ4Block header is nonnegative but then allocates a compressed-input buffer of exactly that attacker-controlled size before any payload is read. Because each header is only a handful of bytes, a header-only stream can request a near-2 GiB allocation and crash the JVM with OutOfMemoryError, affecting any application that decompresses attacker-influenced LZ4 legacy-block data with the default reader configuration; no public exploit code or active exploitation was identified at time of analysis (CVSS 5.3, availability-only impact). The flaw is fixed in version 1.11.2, which rejects non-canonical oversized blocks by default.
In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has already set dir[ISER_DIR_OUT]. iser_check_remote_inv() looks at dir[] alone and hands the descriptor to iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate. The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer. Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027] CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211_stop_mesh() leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000003 KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] RIP: 0010:ieee80211_put_srates_elem+0x42/0x640 net/mac80211/util.c:3272 Call Trace: ieee80211_mesh_build_beacon+0xa83/0x1b50 net/mac80211/mesh.c:1093 ieee80211_mesh_rebuild_beacon+0xc7/0x170 net/mac80211/mesh.c:1147 ieee80211_mesh_finish_csa+0x131/0x210 net/mac80211/mesh.c:1542 ieee80211_set_after_csa_beacon net/mac80211/cfg.c:4085 [inline] __ieee80211_csa_finalize net/mac80211/cfg.c:4133 [inline] ieee80211_csa_finalize+0x633/0x1150 net/mac80211/cfg.c:4155 cfg80211_wiphy_work+0x2ab/0x450 net/wireless/core.c:438 Abort the channel switch properly.
Cleartext logging of the monitoring user's password in Canonical's postgresql-operator charm allows an attacker with read access to the Prometheus postgres_exporter logs to recover credentials granting read-only pg_monitor access to PostgreSQL. The flaw (CWE-532) affects charm revisions prior to 1189/1190 on the 14/edge track and prior to 1216/1217 on the 14/stable track, and exploitation additionally requires that a database connection error has occurred so the password is written to logs. This is a modest-severity information-disclosure issue (CVSS 5.3, PR:L) with no public exploit identified at time of analysis, fixed in the specified revisions via upstream patches.
Canonical MAAS exposes the region controller's RPC secret in plaintext through the vendor-data metadata endpoint, letting an unauthenticated attacker who can reach that endpoint and knows or guesses a target machine's MAAS system ID recover the shared secret used for rack-controller RPC authentication (CVSS 5.3 / assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Exposure is conditional: it only affects instances where a machine was deployed with the non-default 'register as rack' (install_rackd) option enabled, and it further requires network reachability to the preseed/metadata server plus knowledge of the system ID. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, but vendor patches exist in MAAS 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0, and the fix disables the vulnerable deploy-as-rack feature entirely.
Response-body inspection can be silently evaded in the affected Ubuntu-packaged component tracked as GHSA-vmg8-j66p-vgvw when an HTTP response declares its Content-Type using non-canonical character casing, causing the inspecting logic to fail its canonical comparison and skip the body it was meant to examine. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N) shows a network-reachable bypass with no confidentiality or availability impact, a low integrity impact, and a Scope-Changed rating that reflects the defeated check protecting resources beyond the vulnerable component itself. Exploitation requires the attacker to influence the Content-Type value of a response, typically by controlling or compromising the upstream/origin server whose traffic flows through the inspecting component; no public exploit code has been identified at time of analysis and no CISA KEV entry was included in the source data, so active exploitation is unconfirmed. The specific affected product name, version range, and configuration preconditions are not established by the available data, and authentication requirements are likewise not confirmed from the input.
Apache APISIX versions 2.14.1 through 3.18.0 can serve requests to protected upstream endpoints without authentication when a permissive (public) route overlaps the path space of a protected route and the client supplies a crafted encoded, non-canonical path. Because authorization is evaluated against the permissive route while the request ultimately resolves to the protected upstream, the protected route's policies are bypassed entirely; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a fully remote, unauthenticated attack that is gated only by the non-default requirement of an overlapping permissive-and-protected route configuration. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV), and the issue is fixed by upgrading to Apache APISIX 3.19.0.
Local information disclosure in the wsl-pro-service component of Ubuntu Pro for WSL (versions before 0.1.19ubuntu3) lets any unprivileged user or process sharing a WSL instance read the Ubuntu Pro attach token while the root-run service executes `pro attach <token> --format=json`; the token sits in cleartext in /proc/<pid>/cmdline, which remains world-readable in WSL because /proc is mounted without hidepid. Because the token is a bearer credential for the subscription, an attacker who wins the short race window can attach their own machines to the victim's Ubuntu Pro subscription and consume its entitlements and services. Exploitation requires a pre-existing local account inside the WSL instance, the WSL-default (non-hardened) /proc mount, and precise timing against a transient process - no public exploit identified at time of analysis, and no evidence of active exploitation.