Information Disclosure
Monthly
Out-of-bounds read in the Linux kernel's SRv6 (Segment Routing for IPv6) subsystem allows a local attacker with BPF program execution capability to read kernel memory past a caller-supplied buffer boundary. The flaw in seg6_validate_srh() - reachable via BPF helpers bpf_lwt_push_encap() and the SEG6 local actions END_B6 and END_B6_ENCAP - permits a crafted 2-byte SEG6 encap header to trigger a kernel out-of-bounds read before any minimum-size validation occurs. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Improper validation of SCTP COOKIE-ECHO data in the Linux kernel's SCTP stack allows a remote peer to have tampered INIT chunk parameters processed by the server when cookie authentication (cookie_auth_enable) is disabled. Because the server previously reconstructed and trusted the INIT embedded in the returned cookie without re-verifying it, a manipulated cookie could drive parameter parsing beyond the embedded INIT's real bounds, risking out-of-bounds reads (information disclosure) or association instability. No public exploit has been identified at time of analysis, EPSS is low (0.25%), and the issue is not in CISA KEV; the fix adds sctp_verify_init() re-validation after cookie unpacking.
Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function `pmbus_data2reg_vid()` hardcoded VR11 encoding for writes while `pmbus_reg2data_vid()` correctly honored the driver-configured `vrm_version` for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Slab-use-after-free in the Linux kernel's True Equalizer (TEQL) traffic scheduler (`net/sched/sch_teql`) enables a local low-privileged attacker to achieve full kernel-level compromise by exploiting an unprotected race on the `master->slaves` linked list. The `teql_master_xmit()` function can retain a stale pointer to a freed qdisc object while concurrent mutations in `teql_destroy()` and `teql_qdisc_init()` proceed without holding any list lock or RCU protection, producing a confirmed KASAN-detected slab-use-after-free. Reported by Trend Micro's ZDI team with a working proof-of-concept trigger, no public exploit code has been confirmed and the vulnerability is not yet listed in the CISA KEV catalog, with an EPSS score of 0.21% indicating low current opportunistic exploitation pressure.
Use-after-free in the Linux kernel bridge STP subsystem allows a local low-privileged attacker to achieve kernel code execution by engineering a specific state involving the topology change timer. The flaw exists in br_topology_change_detection(), which lacks the IFF_UP guard present at all other STP timer-arming call sites, enabling the timer to be armed while the bridge is administratively down; deleting the bridge subsequently frees kernel structures while the timer remains scheduled, triggering a dereference of freed memory when the timer fires. No public exploit is identified and EPSS sits at 0.21% (12th percentile), though the CVSS 7.8 High score with full C/I/A impact correctly reflects the severity of kernel-level UAF if successfully triggered.
Use-after-free in the Linux kernel SCTP subsystem allows a local low-privileged attacker to potentially achieve full kernel compromise (confidentiality, integrity, and availability impact rated High) by triggering a race condition during SCTP address workqueue teardown. The race occurs because `sctp_free_addr_wq()` previously used `timer_delete()`, which does not wait for an in-flight timer handler to complete, permitting `sctp_addr_wq_timeout_handler()` to acquire `addr_wq_lock` and dereference already-freed memory. No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), but kernel UAF primitives have historically been weaponized into privilege escalation; three backport fixes have been merged into multiple stable kernel branches.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Improper re-initialization of the AFS inode's work_struct (`lock_work`) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.
Denial of service in the Linux kernel AFS filesystem client can be triggered by remote attackers sending crafted rxrpc callback notification messages, exploiting a bug where afs_extract_data() inadvertently converts -EAGAIN return values to 0 in callback service message parsers. Systems actively mounting AFS volumes are affected across multiple stable kernel branches prior to patch releases 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS exploitation probability is low at 0.22%, though the unauthenticated network attack vector yields a CVSS 7.5 base score reflecting the potential to crash or destabilize the AFS subsystem on affected hosts.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Memory-ordering (barriering) defect in the Linux kernel's netfs subsystem allows a subrequest that was just added by an application thread to be observed inconsistently while the retry path walks the subrequest list, risking use of partially-initialized data. The flaw affects netfs-backed network filesystems (e.g. AFS, Ceph, CIFS, 9p) in kernels from 6.10 onward and has been resolved upstream. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.20%, 10th percentile), indicating negligible observed exploitation interest despite the NVD's 9.8 rating.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Out-of-bounds read in the Linux kernel's Generic UDP Encapsulation (GUE) tunnel receive path lets remote attackers read adjacent packet memory by sending malformed GUE packets that set the GUE_PFLAG_REMCSUM private flag without carrying the corresponding remote-checksum start/offset bytes. Because guehdr_priv_flags_len() failed to account for GUE_PLEN_REMCSUM, such truncated packets slipped past validate_gue_flags() and were then processed by gue_remcsum()/gue_gro_remcsum(), which read the missing fields from following bytes. There is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV, so despite the headline CVSS 9.8 the realistic impact is information disclosure/instability rather than confirmed remote code execution.
Undefined-shift undefined behavior in the Linux kernel netfilter subsystem (xt_connmark) allows a local attacker with low privileges to trigger kernel crashes, potential memory corruption, and limited information disclosure. The flaw resides in the CONNMARK target revision 2, introduced in Linux 4.17, where user-supplied shift_bits values of 32 or greater are passed unchecked to 32-bit bitshift operations in connmark_tg_shift(), invoking C undefined behavior at packet-processing time. Exploitation is not confirmed active (not in CISA KEV) and EPSS sits at 0.21% (12th percentile), but the kernel-level impact and wide Linux deployment make patching a clear priority for exposed hosts.
Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in `mlx5_lag_create_single_fdb()`. When rule installation fails at index `i`, the cleanup loop incorrectly begins teardown at `i` rather than `i-1`, operating on uninitialized kernel state or double-freeing a rule the `add_one` path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Use-after-free in the Linux kernel Bluetooth MGMT advertising monitor subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially achieving privilege escalation. The flaw arises from a ownership race: hci_add_adv_monitor() publishes a new adv_monitor into the hdev->adv_monitors_idr before the MSFT HCI offload setup step completes, allowing the MSFT callback to free the monitor on failure while the MGMT completion path still holds a dangling pointer. KASAN confirmed the slab-use-after-free in mgmt_add_adv_patterns_monitor_complete; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.21% (12th percentile).
Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.
Use-after-free in the Linux kernel's accel/amdxdna driver exposes systems with AMD XDna NPU hardware to local privilege escalation by a low-privileged attacker. The race condition exists between `aie2_populate_range()` and `amdxdna_umap_release()`, both of which dereference a stale VMA pointer after the underlying virtual memory area may have been freed by the kernel memory manager. With EPSS at 0.20% (10th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, active exploitation is not currently observed - though the CVSS 7.8 score correctly reflects the theoretical potential for full kernel compromise on affected hardware configurations.
Denial of service in the Linux kernel's kernel TLS (kTLS) subsystem allows a remote peer to permanently stall a TLS connection by sending a single zero-length TLS 1.3 application_data record. The `tls_sw_read_sock()` function misinterprets the empty record's zero-length return as a backpressure signal, requeuing the record indefinitely at the head of rx_list and blocking all subsequent TLS data on that connection. No public exploit code exists, the CVE is absent from the CISA KEV catalog, and EPSS sits at 0.21% (11th percentile), indicating low current exploitation interest despite the 7.5 CVSS score.
Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Kernel panic (use-after-free) in the Linux kernel IPv4 IGMP stack allows a network-adjacent attacker to crash the host by racing an inbound IGMP membership query against network-device teardown. The flaw lives in igmp_gq_start_timer(), where in_dev_hold() re-arms the general-query timer on an in_device whose refcount has already dropped to zero during inetdev_destroy(), so the RCU-freed structure is accessed when the timer later fires. The upstream fix is merged and shipped across stable branches; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel's IPv6 multicast stack arises from a use-after-free in the MLD delayed-work path, where a race between network-device teardown and incoming MLD query processing lets igmp6_event_query() take a reference on an inet6_dev whose refcount has already reached zero. Affected systems run kernels across the 2.6.12-through-7.x range prior to the fixed stable releases, and successful triggering causes a refcount 'addition on 0' warning followed by access to freed memory once the scheduled work runs. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Firewall policy bypass in the Linux kernel's netfilter nftables subsystem allows remote attackers to evade packet-filtering rules that use inverted set lookups. The flaw lives in nft_lookup_eval(), where the match result for negated lookups ('!= @set') is computed before the catchall element used by interval sets is folded in, so rules resolve to the wrong verdict. It affects the nf_tables classifier across a wide range of kernel branches; there is no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Improper handling of ICMP error packets in the Linux kernel's IPVS (IP Virtual Server) subsystem allows crafted ICMP errors from tunneled traffic to reference inner IP headers that are not guaranteed to reside in the skb headroom after pskb_pull() strips the outer headers, leading to out-of-bounds access in path-MTU update, icmp_send() and debug paths. The flaw affects hosts using IPVS load balancing with tunnel encapsulation; the practical consequence is an out-of-bounds read (information disclosure per source tags) or kernel crash rather than code execution. No public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.
Use-after-free (refcount_t underflow) in the Linux kernel's SUNRPC TLS connect path lets a failing TLS-secured RPC transport dereference an already-freed upper rpc_clnt, corrupting kernel memory. It affects systems using RPC-with-TLS transports (notably NFS-over-TLS/mTLS mounts) where a fatal handshake failure races the delayed connect_worker. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); the input's 9.8 CVSS reflects Linux's automated scoring rather than the local, config-dependent trigger described.
Linux kernel SMB/CIFS client exposes a race condition between direct I/O (DIO) write completion and filesystem unmount that leaves dentry reference counts unreleased, triggering a kernel BUG warning and potential use-after-free condition. Local users with access to CIFS-mounted shares can trigger this by initiating a DIO write and concurrently unmounting the filesystem, allowing the kernel's shrink_dcache_for_umount() to fire before deferred workqueue cleanup has decremented the dentry refcount. With CVSS 7.8 and C:H/I:H/A:H, the theoretical impact is full kernel compromise, though no public exploit and an EPSS of 0.20% (10th percentile) indicate this remains a low-exploitation-probability vulnerability at time of analysis.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
The octeontx2-af driver in the Linux kernel mishandles SR-IOV mailbox requests for nix_set_rx_mode, allowing a low-privileged user controlling a Virtual Function on Marvell OcteonTX2 hardware to silently delete the Physical Function's MCAM promiscuous and allmulti filtering rules through ordinary interface bringup or teardown operations. Affected Linux kernel versions span 5.14 through multiple stable branches, patched in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with negligible observed exploitation activity and the hardware-specific attack surface.
Kernel memory corruption in the Linux ASoC Sound Open Firmware (SOF) IPC4 control subsystem allows a low-privileged local user to trigger incorrect buffer copy lengths in sof_ipc4_bytes_put(), potentially achieving high confidentiality, integrity, and availability impact. The root cause is a logic error - not a race - where the copy size is sourced from the stale in-kernel buffer's size field rather than from the incoming user-supplied sof_abi_hdr.size in ucontrol, enabling data truncation or stale-byte copying into kernel structures. No public exploit code or active exploitation has been identified at time of analysis; patch commits are available across multiple stable kernel series.
Missing payload size validation in the Linux kernel's ASoC SOF IPC4 control subsystem allows a local low-privileged attacker to trigger out-of-bounds memory access when the kernel processes MODULE_NOTIFICATION messages. Affected systems are those running Linux kernel 7.0 and related stable branches where the SOF IPC4 audio driver is active - typically Intel hardware using Sound Open Firmware. No public exploit or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), indicating low current exploitation interest, though the CVSS 7.8 score reflects real kernel-level impact potential.
Memory corruption and information disclosure in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control subsystem allows local users with low privileges to corrupt kernel memory or leak sensitive data. The flaw affects sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions, where wrong-size memcpy operations and an off-by-sizeof bounds check create exploitable memory safety violations. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.21% (12th percentile) reflects a low but non-negligible near-term exploitation probability.
Out-of-bounds/use-after-free read in the Linux kernel TIPC subsystem occurs when the enqueue-path debug tracepoints in tipc_sk_enqueue() dump sk_receive_queue while only sk->sk_lock.slock is held. Because that spinlock protects only the backlog queue and does not serialize against the socket owner consuming or purging the receive queue, the tracepoint can dereference skbs already dequeued or freed, as caught by KASAN. There is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the issue is only reachable when TIPC debug tracepoints are active.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's KVM/arm64 GICv3 virtualization (vgic) subsystem allows a local attacker on an ARM64 KVM host to trigger a double list removal, corrupting the ap_list and enabling a use-after-free style condition. The flaw lives in vgic_prune_ap_list(), where an interrupt can be pruned from a vCPU's active/pending list a second time after vgic_flush_pending_lpis() already removed it, because the affinity re-check does not confirm the interrupt is still owned by the vCPU. No public exploit is identified at time of analysis, and EPSS is low (0.22%), consistent with a race-condition kernel bug that is difficult to weaponize.
Local privilege escalation / host memory corruption in the Linux kernel's arm64 KVM vGIC subsystem allows a malicious or compromised guest VM to trigger a use-after-free by racing an LPI (Locality-specific Peripheral Interrupt) disable against an interrupt affinity migration across vCPUs. When vgic_prune_ap_list() drops and reacquires the irq and ap_list locks, a concurrent affinity change can free the interrupt out from under it, leading to a kernel UAF that can crash the host or potentially enable host-kernel code execution. This is not in CISA KEV and no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win race rather than a turnkey exploit.
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through `kvm_io_bus_get_dev()`, where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.
Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
CVE-2026-73251 concerns built-in TLS certificate-chain verification involving CA bundles, reported by Ubuntu. The available intelligence is critically sparse - no description of the actual flaw, no CVSS vector, no CWE classification, and no references have been provided. No meaningful synthesis of attacker capability, affected versions, or exploitability is possible from the supplied data alone. Security teams should treat this record as preliminary pending vendor disclosure.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Credential plaintext exposure in Budibase before 3.40.0 allows any authenticated user with table read permissions to retrieve live MongoDB connection strings and Firebase private keys via the standard read API. The root failure is that STRING-typed datasource fields bypass the platform's credential redaction logic entirely, leaving secrets accessible through normal API calls. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.3 correctly reflects that successful exploitation yields persistent access to backend databases and cloud service accounts well beyond the Budibase instance itself.
Root code execution in OpenWrt LuCI via luci-mod-system-mounts allows authenticated users holding only mount-configuration ACL rights to overwrite the system crontab and execute arbitrary commands as root within 60 seconds. The flaw is a misconfigured ACL definition that incorrectly extends write access to /etc/crontabs/root - a file that should be inaccessible to mount-only operators - through the ubus file.write RPC interface. No public exploit has been identified at time of analysis, but the attack path is mechanically trivial and exploitable by any account granted the mount-configuration ACL group, making this a critical privilege escalation risk on internet-facing or multi-tenant OpenWrt deployments.
Privilege escalation in File Browser (filebrowser) through version 2.63.16 lets unauthenticated attackers self-register accounts that inherit the server's root scope with full create, modify, delete, rename, share, and download permissions, granting complete access to every file the server can reach. The flaw only manifests when the optional self-signup feature is enabled together with the default CreateUserDir behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects trivial, unauthenticated exploitation once signup is exposed.
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding a valid environment API key to obtain presigned AWS S3 URLs scoped to another tenant's object-store keys, enabling unauthorized read and write access to task payloads. The flaw combines user-controlled packet path keys written directly into URL.pathname without dot-segment rejection and a stub ownership check (findResource: async () => 1) that unconditionally returns truthy for any requested resource. No public exploit code has been identified at time of analysis, though the mechanism is straightforward to reproduce from the CVE description alone, and the vendor has released a fix in v4.5.0-rc.5.
Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Improper session management in IBM i 7.3 through 7.6 enables remote authenticated attackers to perform unauthorized operations and access sensitive information without elevated privileges. The vulnerability maps to CWE-294 (Authentication Bypass by Capture-replay), meaning valid but low-privileged credentials are sufficient to exploit weaknesses in how sessions are validated or managed. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 8.1 reflects high confidentiality and integrity impact with low attack complexity.
Local privilege escalation in IBM i 7.3 through 7.6 allows an authenticated local attacker with low-level privileges to gain fully elevated access by exploiting improper validation of the LANG environment variable (CWE-73). The failure to sanitize this locale-setting variable enables redirection of file or path resolution to attacker-controlled resources, which the system then processes with elevated authority - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC confirms zero known exploitation activity, though the SSVC technical impact rating of 'total' underscores the severity if successfully triggered by an insider or post-compromise attacker.
Arbitrary file ownership change in IBM i 7.3 through 7.6 enables local authenticated attackers to seize control of files outside their intended access scope by supplying a crafted, attacker-controlled path to a vulnerable ownership-change operation that lacks adequate validation. The flaw is rooted in CWE-73 (External Control of File Name or Path) and carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact, consistent with a local privilege escalation path to system-level control. IBM has released a patch via their support portal; no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at the time of this analysis.
Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the CVSS 7.1 (C:H) rating reflects the severity of full credential exfiltration via an authenticated, network-reachable, low-complexity attack.
Kibana's Machine Learning subsystem fails to enforce space-level authorization, allowing any authenticated low-privilege user in one Kibana space to read ML data from all other spaces and make unauthorized modifications across the entire deployment. The root cause is that ML operations execute with elevated internal Elasticsearch permissions while a subset of ML functionality omitted the per-request space isolation filter that enforces tenancy boundaries. No public exploit has been identified, but the attack requires only a standard user account, making it a realistic internal threat in multi-tenant or shared Kibana deployments. Fixed versions 8.19.20 and 9.4.5 are referenced in the Elastic security advisory ESA-2026-92.
Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. A functional proof-of-concept is published in the GHSA advisory; no special YAML features or non-default configuration options are required to trigger the flaw.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.
Out-of-bounds read in the Linux kernel's SRv6 (Segment Routing for IPv6) subsystem allows a local attacker with BPF program execution capability to read kernel memory past a caller-supplied buffer boundary. The flaw in seg6_validate_srh() - reachable via BPF helpers bpf_lwt_push_encap() and the SEG6 local actions END_B6 and END_B6_ENCAP - permits a crafted 2-byte SEG6 encap header to trigger a kernel out-of-bounds read before any minimum-size validation occurs. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Out-of-bounds array access in the Linux kernel's NXP ENETC Ethernet driver (net/ethernet/freescale/enetc) occurs on the XDP_REDIRECT transmit path when an xdp_frame carries a number of fragments greater than or equal to ENETC_MAX_SKB_FRAGS, overrunning the fixed-size xdp_redirect_arr buffer-descriptor array. Affected are systems using NXP/Freescale ENETC MACs (e.g., LS1028A-class SoCs) with an XDP program that performs redirect on multi-buffer frames, introduced in 5.13 and fixed across current stable branches. No public exploit identified at time of analysis, and EPSS is low (0.21%, 12th percentile), consistent with a driver-specific memory-safety bug rather than a broadly exploited flaw.
Improper validation of SCTP COOKIE-ECHO data in the Linux kernel's SCTP stack allows a remote peer to have tampered INIT chunk parameters processed by the server when cookie authentication (cookie_auth_enable) is disabled. Because the server previously reconstructed and trusted the INIT embedded in the returned cookie without re-verifying it, a manipulated cookie could drive parameter parsing beyond the embedded INIT's real bounds, risking out-of-bounds reads (information disclosure) or association instability. No public exploit has been identified at time of analysis, EPSS is low (0.25%), and the issue is not in CISA KEV; the fix adds sctp_verify_init() re-validation after cookie unpacking.
Incorrect VID encoding in the Linux kernel PMBus hwmon driver causes dangerously wrong voltage commands to be written to PMBus power management chips when non-VR11 VID modes are configured. The function `pmbus_data2reg_vid()` hardcoded VR11 encoding for writes while `pmbus_reg2data_vid()` correctly honored the driver-configured `vrm_version` for reads, creating an asymmetry that sends incorrect PMBUS_VOUT_COMMAND values - for example, a request for 200 mV on a VR12/VR13-mode device results in 1080 mV being delivered instead. No public exploit has been identified at time of analysis, and EPSS probability is 0.20% (10th percentile), reflecting the niche hardware and configuration requirements.
Memory corruption (use-after-free) in the Linux kernel's fbnic Ethernet driver occurs on the transmit path when fbnic_tx_lso() caches a pointer into the skb shared-info region and then calls skb_cow_head(), which may reallocate the skb and free the original buffer. Any host equipped with Meta's fbnic NIC that transmits large-segmentation-offload (LSO/TSO) traffic can trigger a slab-use-after-free, reading freed skbuff memory and potentially crashing the kernel. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%), and the issue is not in CISA KEV.
Slab-use-after-free in the Linux kernel's True Equalizer (TEQL) traffic scheduler (`net/sched/sch_teql`) enables a local low-privileged attacker to achieve full kernel-level compromise by exploiting an unprotected race on the `master->slaves` linked list. The `teql_master_xmit()` function can retain a stale pointer to a freed qdisc object while concurrent mutations in `teql_destroy()` and `teql_qdisc_init()` proceed without holding any list lock or RCU protection, producing a confirmed KASAN-detected slab-use-after-free. Reported by Trend Micro's ZDI team with a working proof-of-concept trigger, no public exploit code has been confirmed and the vulnerability is not yet listed in the CISA KEV catalog, with an EPSS score of 0.21% indicating low current opportunistic exploitation pressure.
Use-after-free in the Linux kernel bridge STP subsystem allows a local low-privileged attacker to achieve kernel code execution by engineering a specific state involving the topology change timer. The flaw exists in br_topology_change_detection(), which lacks the IFF_UP guard present at all other STP timer-arming call sites, enabling the timer to be armed while the bridge is administratively down; deleting the bridge subsequently frees kernel structures while the timer remains scheduled, triggering a dereference of freed memory when the timer fires. No public exploit is identified and EPSS sits at 0.21% (12th percentile), though the CVSS 7.8 High score with full C/I/A impact correctly reflects the severity of kernel-level UAF if successfully triggered.
Use-after-free in the Linux kernel SCTP subsystem allows a local low-privileged attacker to potentially achieve full kernel compromise (confidentiality, integrity, and availability impact rated High) by triggering a race condition during SCTP address workqueue teardown. The race occurs because `sctp_free_addr_wq()` previously used `timer_delete()`, which does not wait for an in-flight timer handler to complete, permitting `sctp_addr_wq_timeout_handler()` to acquire `addr_wq_lock` and dereference already-freed memory. No public exploit code has been identified and EPSS is low at 0.21% (11th percentile), but kernel UAF primitives have historically been weaponized into privilege escalation; three backport fixes have been merged into multiple stable kernel branches.
A use-after-free in the Linux kernel's in-kernel SMB3 server (ksmbd) durable-handle path lets a concurrent SMB2 durable reconnect (DH2C/DHnC) read the freed fp->owner.name buffer via strcmp() in ksmbd_vfs_compare_durable_owner(), as caught by KASAN. Only systems that enable and export shares over ksmbd are affected, and exploitation requires winning a tight race between two reconnects on the same persistent_id. No public exploit identified at time of analysis, and EPSS is low (0.21%), consistent with a hard-to-time kernel race rather than a turnkey remote exploit despite the 9.8 input score.
Incorrect error code propagation in the Linux kernel's AFS (Andrew File System) subsystem allows a remote attacker capable of influencing AFS Volume Location server responses to trigger incorrect error handling in `afs_extract_vl_addrs()`, potentially causing availability impact on affected kernels. Systems running AFS-enabled Linux kernels from version 4.20 through the unpatched stable branches are affected, with all known impact limited to availability (C:N/I:N in CVSS). No public exploit code exists and this vulnerability is not listed in CISA KEV; EPSS probability is 0.22%, consistent with low current exploitation interest.
Improper re-initialization of the AFS inode's work_struct (`lock_work`) in the Linux kernel allows a low-privileged local user to trigger a kernel-level bug during file locking operations on AFS-mounted filesystems, potentially causing a kernel crash or enabling privilege escalation. The vulnerability affects Linux kernels from v2.6.23 (commit e8d6c554126b) through all stable branches prior to 6.18.40 and 7.1.5. No public exploit code exists and no active exploitation has been reported; EPSS is 0.21% (11th percentile), consistent with a kernel bug requiring specific subsystem use.
Denial of service in the Linux kernel AFS filesystem client can be triggered by remote attackers sending crafted rxrpc callback notification messages, exploiting a bug where afs_extract_data() inadvertently converts -EAGAIN return values to 0 in callback service message parsers. Systems actively mounting AFS volumes are affected across multiple stable kernel branches prior to patch releases 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, and 7.1.5. No public exploit code exists and EPSS exploitation probability is low at 0.22%, though the unauthenticated network attack vector yields a CVSS 7.5 base score reflecting the potential to crash or destabilize the AFS subsystem on affected hosts.
Race condition in the Linux kernel's AFS (Andrew File System) subsystem allows local low-privileged users to corrupt kernel memory by exploiting unsynchronized writes to net->cells_dyn_ino, with potential for privilege escalation to root. The flaw exists because cell lifecycle operations modified shared kernel state without holding net->cells_lock exclusively, and RCU cleanup context constraints in afs_cell_destroy() prevented a straightforward fix - requiring cell removal to be relocated to afs_destroy_cell_work() in a workqueue context. No public exploit exists and EPSS sits at 0.21% (11th percentile), though the 7.8 CVSS score is technically justified by the potential kernel-level impact on affected configurations.
The AFS subsystem in the Linux kernel misassigns the AFS_VOLUME_RM_TREE flag during volume insertion, marking the newly inserted volume for tree removal instead of the replaced one. This logic inversion causes the old volume to be processed for removal twice - creating a double-free or use-after-free condition - while the new volume is never properly cleaned up from the cell's volume tree. Locally authenticated users on systems with AFS filesystems mounted could exploit this to corrupt kernel heap memory, with CVSS assessing potential full confidentiality, integrity, and availability impact; however, with EPSS at 0.21% (12th percentile), no CISA KEV listing, and no public exploit identified, the near-term exploitation probability is low.
Double-unlock of an inode's rwsem in the Linux kernel cachefiles subsystem corrupts kernel locking state when start_creating() fails with ENOMEM during directory creation. Local attackers with low-privilege access on systems using network filesystem caching via cachefiles can exploit the corrupted rwsem to achieve privilege escalation or kernel crash, reflecting the high CIA impact in the CVSS 7.8 score. No public exploit has been identified and EPSS is very low (0.20%, 10th percentile), but upstream patches are confirmed available via the kernel stable tree.
Unsigned integer underflow in the Linux kernel iomap writeback subsystem allows a low-privileged user to corrupt filesystem EOF metadata and on-disk size tracking. The flaw occurs in the io_size EOF trim path when a concurrent truncate shrinks the file after end_pos is sampled, causing end_pos to fall below ioend->io_offset; the resulting negative subtraction wraps to a huge value in the size_t io_size field. This corrupted io_size is then consumed by end_io paths for decisions including on-disk EOF updates, unwritten extent completion, and COW range handling. No public exploit has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), though the official CVSS scores this 8.8 High with full C/I/A impact.
Improper handling of asynchronous fscache cache-object creation in the Linux kernel's netfs subsystem affects kernels from 6.11 up to the fixed 6.18.40, 7.1.5 and 7.2-rc2 releases. In netfs_create_write_req(), caching is skipped when the fscache cookie appears disabled, but a still-in-progress async cache object may not yet have enabled it, causing fscache_begin_write_operation() to be bypassed and write operations to the local cache to be mishandled. The issue is a local netfs/fscache correctness bug (tagged Information Disclosure); it is not remotely reachable, and there is no public exploit identified at time of analysis.
Improper error handling in the Linux kernel's netfs (network filesystem) subsystem allows a local user with low privileges to corrupt kernel folio state or trigger a kernel hang. The writeback_iter() loop fails to re-invoke itself with the error code set when a write operation fails, leaving folios unlocked and non-redirtied, which produces incorrect iteration state with high integrity and availability consequences. No public exploit code has been identified, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with a constrained local kernel defect rather than a broadly weaponized vulnerability.
Integrity and availability compromise in the Linux kernel's Intel Xe GPU Physical Function (PF) driver allows a low-privileged local user operating within a guest Virtual Function (VF) environment to trigger PF-side assertion failures and ABI protocol breakage by sending FAST_REQUEST or EVENT relay messages - message types the PF handler is not designed to process. The vulnerability crosses a privilege boundary from guest to host, reflected in the CVSS scope-changed rating of 8.4. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.21% (11th percentile). Vendor-released patches are available across multiple stable kernel branches.
Invalid cursor access in the Linux kernel's Intel Xe GPU (drm/xe) page table subsystem allows local low-privileged users to trigger kernel warnings and potentially exploit uninitialized memory during page table binding walks involving purged buffer objects. Affected kernel versions span Linux 7.1 up to the fix points in 7.1.5 and 7.2-rc2, and only systems equipped with Intel Xe GPU hardware are at risk. No public exploit identified at time of analysis; EPSS at 0.20% (10th percentile) reflects minimal current exploitation interest, though the kernel memory-management context elevates the theoretical impact ceiling.
Context confusion in the Linux kernel's uprobes/x86 subsystem allows a local attacker with low privileges to trigger incorrect VMA lookups by exploiting the use of `current->mm` (the tracer's memory map) instead of the traced process's `mm_struct` during uprobe unregistration. Affected are kernel versions in the 6.18.x, 7.1.x, and pre-rc2 7.2 branches originating from commit ba2bfc97b462. Patches are confirmed in 6.18.40, 7.1.5, and 7.2-rc2; no public exploit code has been identified and the vulnerability is not listed in CISA KEV, with EPSS at a low 0.21% (11th percentile).
Credit resource leak in the Linux kernel CIFS client function cifs_issue_read() enables a server-side actor to exhaust the SMB flow-control credit pool on a connected Linux host, producing a denial of service for all I/O on the affected CIFS mount. Linux kernel versions from commit 69c3c023af25edb5433a2db824d3e7cc328f0183 onward are affected until stable-tree patches landing in 6.12.97, 6.18.40, 7.1.5, and 7.2-rc2. No public exploit identified at time of analysis; EPSS of 0.21% (11th percentile) confirms very low real-world exploitation probability and no CISA KEV listing exists.
Memory-ordering (barriering) defect in the Linux kernel's netfs subsystem allows a subrequest that was just added by an application thread to be observed inconsistently while the retry path walks the subrequest list, risking use of partially-initialized data. The flaw affects netfs-backed network filesystems (e.g. AFS, Ceph, CIFS, 9p) in kernels from 6.10 onward and has been resolved upstream. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.20%, 10th percentile), indicating negligible observed exploitation interest despite the NVD's 9.8 rating.
Use-after-free in the Linux kernel's legacy NTFS filesystem driver (ntfs_mft_writepages) allows a local low-privileged attacker to corrupt kernel slab memory by winning a timing race between MFT writeback and concurrent MFT allocation extension. Affected kernels span the Linux 7.1 stable series up through 7.1.4; fix commits are confirmed in the upstream stable tree targeting 7.1.5 and 7.2-rc3. No public exploit is identified at time of analysis and EPSS is low (0.20%), but the confirmed slab-use-after-free in ring-0 writeback code represents a high-severity memory safety defect warranting scheduled patching.
Use-after-free race condition in the Linux kernel's legacy NTFS driver (ntfs.ko) exposes systems with NTFS-mounted volumes to kernel heap memory corruption, enabling local privilege escalation, information disclosure, or kernel panic. The flaw in ntfs_attr_fallocate() releases a read lock before consuming a borrowed runlist pointer, while a concurrent mmap page_mkwrite path can simultaneously reallocate and free the underlying array - confirmed by a KASAN slab-use-after-free trace in the CVE description. No public exploit or CISA KEV entry exists; EPSS of 0.20% (10th percentile) reflects the difficulty of reliably winning this race, though successful exploitation carries severe kernel-level impact.
Out-of-bounds read in the Linux kernel's Generic UDP Encapsulation (GUE) tunnel receive path lets remote attackers read adjacent packet memory by sending malformed GUE packets that set the GUE_PFLAG_REMCSUM private flag without carrying the corresponding remote-checksum start/offset bytes. Because guehdr_priv_flags_len() failed to account for GUE_PLEN_REMCSUM, such truncated packets slipped past validate_gue_flags() and were then processed by gue_remcsum()/gue_gro_remcsum(), which read the missing fields from following bytes. There is no public exploit identified at time of analysis; EPSS is low (0.22%, 13th percentile) and the flaw is not in CISA KEV, so despite the headline CVSS 9.8 the realistic impact is information disclosure/instability rather than confirmed remote code execution.
Undefined-shift undefined behavior in the Linux kernel netfilter subsystem (xt_connmark) allows a local attacker with low privileges to trigger kernel crashes, potential memory corruption, and limited information disclosure. The flaw resides in the CONNMARK target revision 2, introduced in Linux 4.17, where user-supplied shift_bits values of 32 or greater are passed unchecked to 32-bit bitshift operations in connmark_tg_shift(), invoking C undefined behavior at packet-processing time. Exploitation is not confirmed active (not in CISA KEV) and EPSS sits at 0.21% (12th percentile), but the kernel-level impact and wide Linux deployment make patching a clear priority for exposed hosts.
Off-by-one memory corruption in the Linux kernel's mlx5 LAG (Link Aggregation) subsystem exposes systems with Mellanox/NVIDIA ConnectX NICs to local privilege escalation via a defective error rollback loop in `mlx5_lag_create_single_fdb()`. When rule installation fails at index `i`, the cleanup loop incorrectly begins teardown at `i` rather than `i-1`, operating on uninitialized kernel state or double-freeing a rule the `add_one` path already rolled back - resulting in heap corruption with C:H/I:H/A:H impact potential. No public exploit or CISA KEV listing exists at time of analysis; EPSS probability stands at 0.20% (10th percentile), and upstream fix commits are confirmed available.
Memory corruption in the Linux kernel mlx5e driver's Hyper-V VHCA statistics subsystem causes a kernel fault when running as a Hyper-V guest with a Mellanox/NVIDIA ConnectX NIC. The driver initializes the stats buffer with a zero-size allocation that returns ZERO_SIZE_PTR (0x10) instead of NULL, bypasses the NULL guard, and stores the sentinel pointer; once channels open and the hypervisor enables stats reporting, a subsequent memset on address 0x10 faults the kernel. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), reflecting minimal real-world exploitation likelihood despite the high official CVSS score.
The mlx5e HV VHCA stats agent registration in the Linux kernel contains an initialization race condition that can produce NULL pointer dereferences or kernel timer list corruption, crashing a Hyper-V guest VM. Affected systems are those running Linux on Microsoft Hyper-V with a Mellanox mlx5e NIC across stable kernel trees spanning 6.1 through 7.1, with the root cause being that mlx5_hv_vhca_agent_create() publishes the agent and triggers an asynchronous workqueue callback before the caller has initialized the associated delayed_work structure and agent pointer. No public exploit code has been identified and EPSS exploitation probability is 0.21% (12th percentile); vendor patches have been released across all active stable branches and upstream commit references are available via kernel.org.
Race condition in the Linux kernel's Microchip VCAP network driver corrupts hardware forwarding table entries on systems using sparx5 or lan969x switching ASICs. A local authenticated user can simultaneously trigger a debugfs VCAP rule dump and a tc-flower rule write to different Super VCAP instances, causing shared cache registers to be overwritten mid-transaction and committing corrupt data directly into hardware forwarding entries. No public exploit code or CISA KEV listing exists; EPSS is 0.21%, reflecting low exploitation likelihood in practice.
Use-after-free in the Linux kernel Bluetooth MGMT advertising monitor subsystem allows a local attacker with low privileges to corrupt kernel heap memory, potentially achieving privilege escalation. The flaw arises from a ownership race: hci_add_adv_monitor() publishes a new adv_monitor into the hdev->adv_monitors_idr before the MSFT HCI offload setup step completes, allowing the MSFT callback to free the monitor on failure while the MGMT completion path still holds a dangling pointer. KASAN confirmed the slab-use-after-free in mgmt_add_adv_patterns_monitor_complete; no public exploit or active exploitation (CISA KEV) has been identified, and EPSS is 0.21% (12th percentile).
Bluetooth ISO packet reassembly in the Linux kernel mishandles malformed ISO_CONT and ISO_END packets, exposing adjacent attackers to three distinct kernel-level impacts: a conn->rx_skb memory leak via abnormal ISO_START sequences, a kernel panic triggered by an unchecked skb_put call on oversized ISO_END frames, and silent acceptance of undersized ISO_END packets. All Linux kernel versions from 6.0 through the fix commits on affected stable branches are impacted, with fixes confirmed in 7.1.5 and 7.2-rc3. No public exploit or CISA KEV listing exists at time of analysis, but the CVSS 8.8 AV:A/PR:N vector and the availability of upstream fix commits make this an actionable patching priority for any Bluetooth-enabled Linux deployment.
Use-after-free in the Linux kernel's accel/amdxdna driver exposes systems with AMD XDna NPU hardware to local privilege escalation by a low-privileged attacker. The race condition exists between `aie2_populate_range()` and `amdxdna_umap_release()`, both of which dereference a stale VMA pointer after the underlying virtual memory area may have been freed by the kernel memory manager. With EPSS at 0.20% (10th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, active exploitation is not currently observed - though the CVSS 7.8 score correctly reflects the theoretical potential for full kernel compromise on affected hardware configurations.
Denial of service in the Linux kernel's kernel TLS (kTLS) subsystem allows a remote peer to permanently stall a TLS connection by sending a single zero-length TLS 1.3 application_data record. The `tls_sw_read_sock()` function misinterprets the empty record's zero-length return as a backpressure signal, requeuing the record indefinitely at the head of rx_list and blocking all subsequent TLS data on that connection. No public exploit code exists, the CVE is absent from the CISA KEV catalog, and EPSS sits at 0.21% (11th percentile), indicating low current exploitation interest despite the 7.5 CVSS score.
Kernel-memory corruption in the Linux kernel's net/liquidio (Marvell/Cavium LiquidIO SmartNIC) SR-IOV driver stems from caching virtual-function pci_dev pointers that hold no reference; the stale pointer is later dereferenced when servicing an OCTEON_VF_FLR_REQUEST, yielding a use-after-free reachable from a virtual function. Affected systems are hosts running the liquidio PF driver with SR-IOV enabled and VFs assigned to guests. Successful triggering can crash the host or corrupt kernel memory (potential privilege/scope escalation from a VF into the host); this is no public exploit identified at time of analysis, EPSS is low (0.20%), and a vendor fix is available.
Use-after-free race condition in the Linux kernel's AMD XDNA accelerator driver (accel/amdxdna) allows a local, low-privileged attacker on systems with AMD XDNA hardware to corrupt kernel memory, potentially achieving full privilege escalation. The race window opens because amdxdna_umap_release() calls the blocking mmu_interval_notifier_remove() before removing the object from abo->mem.umap_list, permitting aie2_populate_range() to obtain a stale reference concurrently. No public exploit has been identified at time of analysis, and an EPSS of 0.21% (11th percentile) signals minimal current exploitation interest.
Kernel panic (use-after-free) in the Linux kernel IPv4 IGMP stack allows a network-adjacent attacker to crash the host by racing an inbound IGMP membership query against network-device teardown. The flaw lives in igmp_gq_start_timer(), where in_dev_hold() re-arms the general-query timer on an in_device whose refcount has already dropped to zero during inetdev_destroy(), so the RCU-freed structure is accessed when the timer later fires. The upstream fix is merged and shipped across stable branches; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile).
Kernel panic (and potential memory corruption) in the Linux kernel's IPv6 multicast stack arises from a use-after-free in the MLD delayed-work path, where a race between network-device teardown and incoming MLD query processing lets igmp6_event_query() take a reference on an inet6_dev whose refcount has already reached zero. Affected systems run kernels across the 2.6.12-through-7.x range prior to the fixed stable releases, and successful triggering causes a refcount 'addition on 0' warning followed by access to freed memory once the scheduled work runs. There is no public exploit identified at time of analysis, EPSS risk is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Firewall policy bypass in the Linux kernel's netfilter nftables subsystem allows remote attackers to evade packet-filtering rules that use inverted set lookups. The flaw lives in nft_lookup_eval(), where the match result for negated lookups ('!= @set') is computed before the catchall element used by interval sets is folded in, so rules resolve to the wrong verdict. It affects the nf_tables classifier across a wide range of kernel branches; there is no public exploit identified at time of analysis and EPSS probability is low (0.21%).
Improper handling of ICMP error packets in the Linux kernel's IPVS (IP Virtual Server) subsystem allows crafted ICMP errors from tunneled traffic to reference inner IP headers that are not guaranteed to reside in the skb headroom after pskb_pull() strips the outer headers, leading to out-of-bounds access in path-MTU update, icmp_send() and debug paths. The flaw affects hosts using IPVS load balancing with tunnel encapsulation; the practical consequence is an out-of-bounds read (information disclosure per source tags) or kernel crash rather than code execution. No public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) affects hosts that mount SMB shares involving DFS referrals. A malicious or man-in-the-middle SMB server can return a referral whose server-supplied string offsets point beyond the received response buffer; the unchecked offset yields a negative max_len that reaches kstrndup()/strnlen() as a size_t, causing an out-of-bounds read that can leak adjacent kernel memory or crash the client. CVSS is 9.4, but there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 12th percentile), indicating no observed exploitation.
Use-after-free (refcount_t underflow) in the Linux kernel's SUNRPC TLS connect path lets a failing TLS-secured RPC transport dereference an already-freed upper rpc_clnt, corrupting kernel memory. It affects systems using RPC-with-TLS transports (notably NFS-over-TLS/mTLS mounts) where a fatal handshake failure races the delayed connect_worker. There is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile); the input's 9.8 CVSS reflects Linux's automated scoring rather than the local, config-dependent trigger described.
Linux kernel SMB/CIFS client exposes a race condition between direct I/O (DIO) write completion and filesystem unmount that leaves dentry reference counts unreleased, triggering a kernel BUG warning and potential use-after-free condition. Local users with access to CIFS-mounted shares can trigger this by initiating a DIO write and concurrently unmounting the filesystem, allowing the kernel's shrink_dcache_for_umount() to fire before deferred workqueue cleanup has decremented the dentry refcount. With CVSS 7.8 and C:H/I:H/A:H, the theoretical impact is full kernel compromise, though no public exploit and an EPSS of 0.20% (10th percentile) indicate this remains a low-exploitation-probability vulnerability at time of analysis.
The regulator subsystem in the Linux kernel contains a deadlock-handling defect where `regulator_lock_two()` compares the return value of `ww_mutex_lock()` against `-EDEADLOCK` instead of the correct `-EDEADLK` constant. On MIPS architecture - the only platform where the regulator core is active and these two error constants carry different numeric values - the mismatch causes the kernel to skip the mandatory unlock-and-retry backoff sequence, fire `WARN_ON`, and return to the caller with only one of the two regulators locked, producing corrupted locking state. No public exploit has been identified and EPSS is very low (0.22%, 13th percentile), but the high CVSS impact ratings (C:H/I:H/A:H) reflect the potential for kernel panic or local privilege escalation on affected MIPS systems.
The octeontx2-af driver in the Linux kernel mishandles SR-IOV mailbox requests for nix_set_rx_mode, allowing a low-privileged user controlling a Virtual Function on Marvell OcteonTX2 hardware to silently delete the Physical Function's MCAM promiscuous and allmulti filtering rules through ordinary interface bringup or teardown operations. Affected Linux kernel versions span 5.14 through multiple stable branches, patched in 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, and 7.2-rc3. No public exploit identified at time of analysis; EPSS is 0.21% (12th percentile), consistent with negligible observed exploitation activity and the hardware-specific attack surface.
Kernel memory corruption in the Linux ASoC Sound Open Firmware (SOF) IPC4 control subsystem allows a low-privileged local user to trigger incorrect buffer copy lengths in sof_ipc4_bytes_put(), potentially achieving high confidentiality, integrity, and availability impact. The root cause is a logic error - not a race - where the copy size is sourced from the stale in-kernel buffer's size field rather than from the incoming user-supplied sof_abi_hdr.size in ucontrol, enabling data truncation or stale-byte copying into kernel structures. No public exploit code or active exploitation has been identified at time of analysis; patch commits are available across multiple stable kernel series.
Missing payload size validation in the Linux kernel's ASoC SOF IPC4 control subsystem allows a local low-privileged attacker to trigger out-of-bounds memory access when the kernel processes MODULE_NOTIFICATION messages. Affected systems are those running Linux kernel 7.0 and related stable branches where the SOF IPC4 audio driver is active - typically Intel hardware using Sound Open Firmware. No public exploit or CISA KEV listing exists, and EPSS sits at 0.20% (10th percentile), indicating low current exploitation interest, though the CVSS 7.8 score reflects real kernel-level impact potential.
Memory corruption and information disclosure in the Linux kernel's ASoC Sound Open Firmware (SOF) IPC3 control subsystem allows local users with low privileges to corrupt kernel memory or leak sensitive data. The flaw affects sof_ipc3_bytes_put() and sof_ipc3_bytes_get() functions, where wrong-size memcpy operations and an off-by-sizeof bounds check create exploitable memory safety violations. No public exploit or CISA KEV listing exists at time of analysis; the EPSS score of 0.21% (12th percentile) reflects a low but non-negligible near-term exploitation probability.
Out-of-bounds/use-after-free read in the Linux kernel TIPC subsystem occurs when the enqueue-path debug tracepoints in tipc_sk_enqueue() dump sk_receive_queue while only sk->sk_lock.slock is held. Because that spinlock protects only the backlog queue and does not serialize against the socket owner consuming or purging the receive queue, the tracepoint can dereference skbs already dequeued or freed, as caught by KASAN. There is no public exploit identified at time of analysis, EPSS is very low (0.21%, 11th percentile), and the issue is only reachable when TIPC debug tracepoints are active.
Out-of-bounds array indexing in the Linux kernel's KVM irqfd routing for LoongArch allows a local user with KVM access to index past the routing table's chip array boundary, potentially exposing host kernel memory or enabling a hypervisor boundary breach with full triad impact. Patches are available in stable releases 6.18.40, 7.1.5, and 7.2-rc1 across three upstream commits. No public exploit code exists and EPSS sits at 0.21% (11th percentile), indicating negligible active exploitation probability despite the elevated CVSS 8.8 score.
Missing interrupt request (IRQ) validity checking in the LoongArch KVM subsystem of the Linux kernel allows a local low-privileged user with access to KVM device nodes to pass malformed IRQ values via the kvm_vcpu_ioctl_interrupt() ioctl, potentially causing memory corruption or privilege escalation that crosses the guest-to-host boundary. The CVSS scope change (S:C) signals that successful exploitation could compromise the hypervisor host, making this significant for LoongArch-based virtualization environments. No public exploit code has been identified and EPSS probability sits at 0.21%, suggesting exploitation remains theoretical at this time.
Local privilege/information-disclosure risk in the Linux kernel's s390 KVM subsystem stems from an unlikely race in try_get_locked_pte(), where puds or pmds can be unmapped between the p?dp_get() and p?d_offset() calls, leaving code operating on a stale or freed page-table entry. The flaw affects s390 (IBM Z mainframe) systems running KVM virtualization and has now been patched upstream; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).
Memory corruption in the Linux kernel's KVM/arm64 GICv3 virtualization (vgic) subsystem allows a local attacker on an ARM64 KVM host to trigger a double list removal, corrupting the ap_list and enabling a use-after-free style condition. The flaw lives in vgic_prune_ap_list(), where an interrupt can be pruned from a vCPU's active/pending list a second time after vgic_flush_pending_lpis() already removed it, because the affinity re-check does not confirm the interrupt is still owned by the vCPU. No public exploit is identified at time of analysis, and EPSS is low (0.22%), consistent with a race-condition kernel bug that is difficult to weaponize.
Local privilege escalation / host memory corruption in the Linux kernel's arm64 KVM vGIC subsystem allows a malicious or compromised guest VM to trigger a use-after-free by racing an LPI (Locality-specific Peripheral Interrupt) disable against an interrupt affinity migration across vCPUs. When vgic_prune_ap_list() drops and reacquires the irq and ap_list locks, a concurrent affinity change can free the interrupt out from under it, leading to a kernel UAF that can crash the host or potentially enable host-kernel code execution. This is not in CISA KEV and no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile), consistent with a hard-to-win race rather than a turnkey exploit.
Improper state unwinding in the Linux kernel KVM nested VMX (nVMX) subsystem allows a low-privileged local attacker operating within an L1 guest to potentially escape the virtualization boundary and gain control over the host hypervisor's page table base register (CR3). When EPT is disabled and the deferred vTPR-vs-TPR Threshold consistency check fails, KVM does not restore vmcs01.GUEST_CR3 to its own value, leaving it set to an L1-controlled address - enabling a malicious guest to redirect hypervisor memory mappings to attacker-controlled structures. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.20% (10th percentile) confirms currently low observed exploitation probability.
Incomplete SEV-SNP state handling in the Linux kernel's KVM subsystem breaks AMD Secure Encrypted Virtualization isolation when intra-host VM migration or mirroring is attempted on SNP guests, potentially exposing encrypted guest memory to confidentiality and integrity breaches. The vulnerability affects multiple stable kernel branches from commit 1dfe571c12cf99244b933208fb77f29471ded677 onward, with fixes backported to 6.12.97, 6.18.40, 7.1.5, and 7.2-rc4. No public exploit code exists at time of analysis, and the EPSS score of 0.21% at the 11th percentile places real-world exploitation probability as very low despite the high official CVSS score of 8.8.
Out-of-bounds kernel memory access in Linux KVM's Intel TDX subsystem allows a local, low-privileged user to exploit a TOCTOU race condition during TD virtual machine initialization, potentially achieving kernel memory disclosure, corruption, or denial of service. The vulnerable path exists in tdx_td_init(), where the cpuid.nent field is read once to size a flexible allocation and then again from the copied structure - allowing userspace to change the count between those two references. No active exploitation has been confirmed and EPSS probability is very low (0.20%, 10th percentile), limiting immediate real-world risk to TDX-enabled production environments.
Improper locking scope in the Linux kernel KVM subsystem exposes a use-after-free race condition through `kvm_io_bus_get_dev()`, where the function drops the SRCU lock before returning a device pointer, leaving a window in which the referenced object may be freed before the caller can safely inspect it. All Linux kernel versions from the introducing commit (approximately 4.8) through the 7.1 and 6.x stable series are affected until patched releases across eight stable branches are applied. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% reflects a low current probability of exploitation despite the High CVSS severity rating.
Denial of service in the Linux kernel's KVM arm64 nested virtualization subsystem allows a guest to crash the host hypervisor by writing to the ZCR_EL2 system register alias during a nested context. Affected systems run arm64 Linux kernel builds where FEAT_NV2 is advertised to an L1 guest hypervisor; the write is architecturally legitimate in this context, but a misplaced WARN triggers a hyp_panic, taking down the KVM hypervisor layer. No public exploit or CISA KEV listing exists, and EPSS probability sits at 0.21% (11th percentile), reflecting low observed exploitation activity.
Improper permission handling in the KVM ARM64 nested-virtualization (NV) subsystem of the Linux kernel (6.16 through fixes in 6.18.40/7.1.5) lets a malicious L1 guest hypervisor write to a read-only backing page and trigger a page reference leak on the host. When mapping the L1 VNCR page into the host stage-1, KVM trusted only the guest stage-1 permissions and ignored that the backing PFN may be read-only (e.g. a read-only memslot), permitting writes to memory that should be immutable and leaking pages on the read-only early-return path. There is no public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and the issue is not in CISA KEV.
Red Hat Quay 3's exported action logs download endpoint fails to enforce authorization, permitting any network-accessible party who holds a valid file ID to retrieve full audit log exports without authenticating. The file IDs, while complex and not publicly guessable, are transmitted in plaintext via email notifications and webhook callbacks - creating a realistic interception pathway for adversaries with network positioning. No active exploitation or public POC has been identified; EPSS at 0.31% (23rd percentile) reflects low automated exploitation probability, though targeted disclosure remains credible wherever log export notifications traverse unencrypted channels.
External control of file name or path (CWE-73) in Johnson Controls Airwall before version 4.1 enables file manipulation via network-accessible endpoints, with the primary impact being high confidentiality exposure alongside limited integrity and availability effects. The CVSS 4.0 vector (AV:N/UI:A/PR:N) indicates no privileges are required but user interaction must occur, and the SSVC assessment confirms no observed exploitation and a non-automatable attack path. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Hard-coded cryptographic key exposure in Johnson Controls Airwall before version 4.1 enables local attackers to conduct cryptanalytic attacks against the product's cryptographic protections. Because the same key material is embedded across all product instances, reverse engineering one installation yields a key applicable to all deployments. No public exploitation has been identified (SSVC: Exploitation none), and the vendor has confirmed a patch is available in version 4.1, limiting the urgency window. The CVSS 4.0 score of 7.0 reflects high confidentiality impact with low integrity exposure, constrained by a local attack vector.
IBM Db2 Mirror for i versions 7.4, 7.5, and 7.6 exposes a network-accessible pathway through which an unauthenticated remote attacker can externally influence system configuration settings (CWE-15), enabling disclosure of sensitive information and - per the CVSS vector - potential integrity and availability compromise as well. The changed scope (S:C) in the CVSS vector indicates the vulnerability can propagate impact beyond the directly affected component, consistent with how mirror configuration alterations can affect the paired IBM i high-availability node. A vendor-released patch is available via IBM Support; no public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Horizontal privilege escalation / cross-account file access in FileBrowser before 2.63.19 lets a self-registering user take over another user's files when the server runs on a case-insensitive filesystem (e.g. Windows/NTFS). Because the home-directory ownership scope is persisted and compared as an exact case-sensitive string, two signups differing only in letter case (e.g. CaseVictim vs casevictim) become separate accounts that map to the same physical directory, giving the second registrant read, overwrite, and delete access to the first user's data over authenticated HTTP. Reported by VulnCheck; a vendor patch is available and no public exploit has been identified at time of analysis.
CVE-2026-73251 concerns built-in TLS certificate-chain verification involving CA bundles, reported by Ubuntu. The available intelligence is critically sparse - no description of the actual flaw, no CVSS vector, no CWE classification, and no references have been provided. No meaningful synthesis of attacker capability, affected versions, or exploitability is possible from the supplied data alone. Security teams should treat this record as preliminary pending vendor disclosure.
Account takeover in NextAuth.js / Auth.js email (magic-link) sign-in lets a remote unauthenticated attacker who knows a victim's address hijack the passwordless login. The built-in defaultNormalizer checks for a single ASCII '@' before applying Unicode NFKC normalization, so a homoglyph such as U+FF20 (FULLWIDTH COMMERCIAL AT) passes validation but canonicalizes to a second '@' in a downstream SMTPUTF8/internationalized mailer, misrouting the sign-in link to an attacker mailbox. No public exploit is identified at time of analysis, but a regression test and full commit-level detail are public, and vendor-released patches exist (@auth/core 0.41.3, next-auth 4.24.15 and 5.0.0-beta.32).
Credential plaintext exposure in Budibase before 3.40.0 allows any authenticated user with table read permissions to retrieve live MongoDB connection strings and Firebase private keys via the standard read API. The root failure is that STRING-typed datasource fields bypass the platform's credential redaction logic entirely, leaving secrets accessible through normal API calls. No public exploit code or active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.3 correctly reflects that successful exploitation yields persistent access to backend databases and cloud service accounts well beyond the Budibase instance itself.
Root code execution in OpenWrt LuCI via luci-mod-system-mounts allows authenticated users holding only mount-configuration ACL rights to overwrite the system crontab and execute arbitrary commands as root within 60 seconds. The flaw is a misconfigured ACL definition that incorrectly extends write access to /etc/crontabs/root - a file that should be inaccessible to mount-only operators - through the ubus file.write RPC interface. No public exploit has been identified at time of analysis, but the attack path is mechanically trivial and exploitable by any account granted the mount-configuration ACL group, making this a critical privilege escalation risk on internet-facing or multi-tenant OpenWrt deployments.
Privilege escalation in File Browser (filebrowser) through version 2.63.16 lets unauthenticated attackers self-register accounts that inherit the server's root scope with full create, modify, delete, rename, share, and download permissions, granting complete access to every file the server can reach. The flaw only manifests when the optional self-signup feature is enabled together with the default CreateUserDir behavior. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 9.3 reflects trivial, unauthenticated exploitation once signup is exposed.
Cross-tenant path traversal in Trigger.dev versions 4.4.2 through pre-4.5.0-rc.5 allows any authenticated tenant holding a valid environment API key to obtain presigned AWS S3 URLs scoped to another tenant's object-store keys, enabling unauthorized read and write access to task payloads. The flaw combines user-controlled packet path keys written directly into URL.pathname without dot-segment rejection and a stub ownership check (findResource: async () => 1) that unconditionally returns truthy for any requested resource. No public exploit code has been identified at time of analysis, though the mechanism is straightforward to reproduce from the CVE description alone, and the vendor has released a fix in v4.5.0-rc.5.
Privilege escalation in IBM i versions 7.3 through 7.6 allows a local authenticated attacker to abuse improper authorization controls in the Navigator for i debugger component to access or manipulate sensitive system data, or create new profiles with elevated privileges. The vulnerability is classified under CWE-285 (Improper Authorization), indicating the debugger fails to enforce sufficient privilege checks before granting access to sensitive operations. No public exploit or CISA KEV listing exists at time of analysis, though SSVC assesses the technical impact as total should exploitation occur.
Improper transparency log verification in the Go module checksum database (GOSUMDB) client allows a coordinating malicious GOPROXY and GOSUMDB pair to serve arbitrary, tampered module content to developers without triggering any client-side integrity error. All cmd/go versions before 1.25.13, 1.26.6, and 1.27.0-rc.3, as well as golang.org/x/mod/sumdb before 0.40.0, are affected. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV, but the supply chain attack surface means developers may have silently pulled poisoned dependencies before patching, making retrospective verification via re-fetching module sums mandatory.
Arbitrary file read in HashiCorp Vault Secrets Operator versions 1.3.0 through 1.4.1 lets a low-privileged Kubernetes tenant abuse the AppRole authentication's SecretIDPath configuration to read files from the operator pod's filesystem and exfiltrate their contents to an attacker-controlled endpoint, enabling privilege escalation across the cluster. Because the operator pod typically holds credentials and tokens spanning multiple tenants, a single limited-RBAC tenant can cross trust boundaries (CVSS scope change), yielding a 9.6 rating. No public exploit identified at time of analysis, but the low attack complexity and multi-tenant blast radius make this a high-priority patch.
Improper session management in IBM i 7.3 through 7.6 enables remote authenticated attackers to perform unauthorized operations and access sensitive information without elevated privileges. The vulnerability maps to CWE-294 (Authentication Bypass by Capture-replay), meaning valid but low-privileged credentials are sufficient to exploit weaknesses in how sessions are validated or managed. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS score of 8.1 reflects high confidentiality and integrity impact with low attack complexity.
Local privilege escalation in IBM i 7.3 through 7.6 allows an authenticated local attacker with low-level privileges to gain fully elevated access by exploiting improper validation of the LANG environment variable (CWE-73). The failure to sanitize this locale-setting variable enables redirection of file or path resolution to attacker-controlled resources, which the system then processes with elevated authority - resulting in complete compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA SSVC confirms zero known exploitation activity, though the SSVC technical impact rating of 'total' underscores the severity if successfully triggered by an insider or post-compromise attacker.
Arbitrary file ownership change in IBM i 7.3 through 7.6 enables local authenticated attackers to seize control of files outside their intended access scope by supplying a crafted, attacker-controlled path to a vulnerable ownership-change operation that lacks adequate validation. The flaw is rooted in CWE-73 (External Control of File Name or Path) and carries a CVSS 7.8 High score with full confidentiality, integrity, and availability impact, consistent with a local privilege escalation path to system-level control. IBM has released a patch via their support portal; no public exploit code has been identified and the vulnerability does not appear in the CISA KEV catalog at the time of this analysis.
Out-of-bounds read in IBM i 7.3 through 7.6 exposes sensitive memory contents to unauthenticated remote attackers over the network, with additional limited availability impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U) confirms exploitation requires no authentication and no user interaction, lowering the barrier for opportunistic targeting. No public exploit code or CISA KEV listing has been identified at time of analysis, though a vendor patch is available.
Elasticsearch API key leakage in Kibana Fleet exposes enrolled agent credentials to any low-privileged authenticated user through a filter-based side channel. Fleet's agent listing endpoint accepts caller-supplied filter expressions evaluated under Kibana's own elevated internal Elasticsearch privileges rather than the caller's, and the match count in each response functions as a boolean oracle, enabling character-by-character reconstruction of the full API key value across all Kibana versions prior to 8.19.20, 9.4.5, and 9.5.1. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the CVSS 7.1 (C:H) rating reflects the severity of full credential exfiltration via an authenticated, network-reachable, low-complexity attack.
Kibana's Machine Learning subsystem fails to enforce space-level authorization, allowing any authenticated low-privilege user in one Kibana space to read ML data from all other spaces and make unauthorized modifications across the entire deployment. The root cause is that ML operations execute with elevated internal Elasticsearch permissions while a subset of ML functionality omitted the per-request space isolation filter that enforces tenancy boundaries. No public exploit has been identified, but the attack requires only a standard user account, making it a realistic internal threat in multi-tenant or shared Kibana deployments. Fixed versions 8.19.20 and 9.4.5 are referenced in the Elastic security advisory ESA-2026-92.
Exponential parsing time in js-yaml 5.0.0 through 5.2.1 enables unauthenticated remote denial of service via a crafted YAML payload under 200 bytes. The parser's flow-collection logic re-parses nested flow-sequence keys rather than caching results, producing O(2^n) work per nesting level - approximately 30 levels suffices to stall a Node.js process for over two minutes on a single CPU. A functional proof-of-concept is published in the GHSA advisory; no special YAML features or non-default configuration options are required to trigger the flaw.
Entity expansion limit bypass in fast-xml-parser 5.9.3-5.10.0 enables remote unauthenticated denial of service against any Node.js service parsing untrusted XML. The parser's OrderedObjParser.js passes each encountered DOCTYPE declaration through addInputEntities(), which reinitializes the entity-expansion safety counters (maxTotalExpansions, maxExpandedLength) on every call - a crafted document with multiple DOCTYPE blocks therefore resets these guards to zero repeatedly within a single parse operation, nullifying protections against billion-laughs-style exponential entity expansion. The result is excessive CPU consumption, event-loop blocking, memory exhaustion, and process termination. No active exploitation has been confirmed (not in CISA KEV), but exploitation requires zero authentication or special configuration beyond the default entity-processing behavior.
Predictable SM2 private-key and signing-nonce generation in the sm-crypto npm library (versions prior to 0.5.0) lets an attacker recover keys generated in Node.js. Because jsbn's SecureRandom checks window.crypto rather than Node's globalThis.crypto, the default sm2.generateKeyPairHex() falls back to seeding an ARC4 stream from Math.random() and the wall clock, so an adversary who observes a few Math.random() outputs and estimates the generation time can reconstruct private keys and forge signatures. Publicly available exploit code exists (reproduced end-to-end against the real npm packages), but no public exploit is identified as being used in active attacks and there is no CISA KEV listing.
Remote denial of service in frp's optional SSH Tunnel Gateway (versions 0.53.0 through 0.70.0) allows any unauthenticated network attacker to terminate the entire frps server process with a single five-byte crafted message, instantly dropping all active tunnels for every connected client. The root cause is an integer overflow in the SSH exec-channel request parser in pkg/ssh/server.go: an attacker-controlled length value of 0xFFFFFFFF wraps to 3 on uint32 addition, defeating the only bounds check and triggering an unrecovered Go panic that kills the process. No confirmed active exploitation or formal public exploit code has been identified at time of analysis, though the GHSA advisory discloses the exact code path and payload arithmetic sufficient for trivial reproduction; vendor-released patch v0.70.1 is available.
Supply-chain compromise of the Ninja Tables Pro WordPress plugin (version 5.2.11) delivered a tampered build through a decommissioned vendor update server, embedding a backdoor that gives attackers full control of affected WordPress sites. Once installed, the rogue code stands up an unauthenticated REST API endpoint, plants a passwordless administrator account, and drops persistent PHP payloads that survive plugin removal. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no CISA KEV listing and no public exploit code identified at time of analysis, though the backdoor itself constitutes weaponized malicious code shipped to victims.
Supply-chain backdoor in Fluent Forms Pro (Add-On Pack) 6.2.7 for WordPress was delivered as a tampered plugin build through a decommissioned update server, embedding malicious code (CWE-506) rather than a coding flaw. Any site that installed the poisoned 6.2.7 package gains a rogue license-sync PHP file that stands up an unauthenticated backdoor REST endpoint, creates a passwordless administrator, and drops persistent payloads that survive plugin removal. No CISA KEV entry or public exploit code is referenced, but the malicious build itself constitutes distributed attacker code, and VulnCheck plus the vendor (WPManageNinja) have publicly confirmed the incident.
Persistent denial-of-service in Absolute Security Secure Access servers prior to version 14.57 is achievable by network attackers who have established a man-in-the-middle position, exploiting an out-of-bounds read triggered by specially crafted data. The impact is described as persistent, meaning the service does not self-recover and requires manual intervention, making this operationally disruptive for organizations that depend on Secure Access for network connectivity. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis.
Out-of-bounds read in PostGIS before 3.7.0beta2 enables low-privileged database users to disclose server process memory or crash the PostgreSQL backend by passing malformed FlatGeobuf geometry data to the extension's property metadata decoder. The decoder validates that a string length prefix is present but omits a bounds check confirming the string body falls within the supplied buffer before materializing it as a SQL-visible value, creating both a memory disclosure and denial-of-service path. A publicly available exploit demonstrates successful memory disclosure against managed PostgreSQL platforms including NeonDB and Supabase; exploitation is not confirmed in CISA KEV but the public proof-of-concept and multi-tenant exposure substantially elevate real-world risk.
Privilege escalation via symlink following in Lenovo Vantage and Lenovo Commercial Vantage allows a local authenticated user to execute arbitrary code with elevated privileges on affected Lenovo systems. Discovered during an internal Lenovo security assessment, the flaw (CWE-59) arises when a privileged Vantage component resolves attacker-controlled symbolic links without validation, enabling redirection of file operations to security-sensitive targets. No public exploit code or active exploitation has been confirmed at time of analysis; CVSS 4.0 scores this at 7.3 with a local attack vector and specific attack requirements present.