Information Disclosure
Monthly
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe.
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted.
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex.
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer.
CVE-2025-71077 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations.
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.
In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object.
In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields.
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange().
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors.
Local privilege-adjacent memory corruption in the Linux kernel ublk (userspace block driver) subsystem allows a ublk server process to trigger use-after-free-style access on completed I/O requests by exiting while requests are still in flight. The regression, introduced by commit e63d2228ef83 which stopped decrementing the request reference count in __ublk_fail_req(), leaves a leaked UBLK_REFCOUNT_INIT reference that permits illegitimate user-copy and zero-copy operations on already-completed requests and trips WARN_ON_ONCE reference-count assertions during queue teardown. It carries a CVSS 7.8 (high) with local vector and low privileges, EPSS is negligible at 0.03% (7th percentile), and there is no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array.
Local privilege escalation in the Linux kernel's ETS (net/sched) packet scheduler arises from a use-after-free on a struct Qdisc object, caused by a race between ets_qdisc_dequeue and ets_qdisc_change. When bands are reconfigured, a class can retain its entry on the active list after its child qdisc is freed and nulled, letting a concurrent dequeue operate on freed memory. Trend Micro ZDI reports a working reproducer and that an attacker able to create user and network namespaces can trigger the flaw and, per their analysis, control RIP; there is no CISA KEV listing and EPSS is very low (0.05%), so no public evidence of active exploitation.
In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. [CVSS 5.5 MEDIUM]
Local privilege-escalation-capable memory corruption in the Linux kernel's ALPS PS/2 touchpad driver (drivers/input/mouse/alps.c) lets a use-after-free be triggered when an ALPS touchpad is detached while the dev3_register_work delayed work item is still pending. Because psmouse_disconnect() only flushes work already queued, alps_register_bare_ps2_mouse() can run and dereference the alps_data structure (priv->dev3) after alps_disconnect() has kfree()'d it, corrupting freed kernel heap memory. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the flaw was found by static analysis rather than in-the-wild activity.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. [CVSS 7.8 HIGH]
Local privilege escalation and kernel memory corruption in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc allows a user with network-configuration capability to corrupt an internal linked list by toggling a scheduling class between DRR and strict modes. When an active DRR class is reconfigured to strict, ets_qdisc_change() fails to remove it from the active list, so switching it back to DRR performs a double list_add, corrupting kernel list pointers. No public exploit has been identified at time of analysis and the EPSS score is very low (0.05%), but the flaw is a classic kernel list-corruption primitive that can escalate to arbitrary write and full compromise.
Kernel memory corruption in the Linux svcrdma transport (server-side NFS-over-RDMA) arises because svc_rdma_copy_inline_range() added the page index (rc_curpage) instead of the byte offset (rc_pageoff) when computing the memcpy destination, so inline payload copies land at the wrong location within the receive pages. On systems exporting NFS over RDMA, a client on the RDMA fabric can drive copies that miscalculate their target offset, leading to out-of-bounds reads/writes in kernel page memory and potential information disclosure or corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not in CISA KEV, but distro fixes (Ubuntu USN-8177-1) and upstream stable commits are available.
Local privilege escalation and memory corruption in the Linux kernel's KVM subsystem allows a user with VM control (e.g. a QEMU/hypervisor process) to trigger a use-after-free by clearing the KVM_MEM_GUEST_MEMFD flag on a memslot that was created with a guest_memfd binding. KVM blocks enabling the flag on an existing memslot but never blocked disabling it, leaving the guest_memfd instance bound to freed memory that is later written during kvm_gmem_release. The flaw carries a CVSS of 7.8 and has a vendor-released fix; it is not in CISA KEV and no public exploit has been identified at time of analysis, with an EPSS of 0.02%.
Concurrent SMB delete-on-close handling in the Linux kernel's in-kernel SMB3 server (ksmbd) mishandles locking on the ksmbd_inode->m_flags field, letting racing open/close/delete operations corrupt delete-on-close and pending-delete state. Affected builds ship the pre-fix ksmbd vfs_cache code where helpers such as ksmbd_inode_pending_delete() and ksmbd_fd_set_delete_on_close() read and modify m_flags without holding ci->m_lock. The result is inconsistent delete semantics - files that persist after a delete-on-close or vanish while still in use - with no public exploit identified at time of analysis and a very low EPSS score (0.03%).
Local privilege escalation risk in the Linux kernel's vidtv (Virtual Digital TV) media test driver stems from a double-free and use-after-free condition in vidtv_channel_si_init(), where local pointers are not reset to NULL after ownership of program/service/event list memory is transferred to the PAT/SDT/EIT tables. When vidtv_psi_pmt_create_sec_for_each_pat_entry() fails and control jumps to the free_eit error path, already-freed memory is destroyed a second time. Publicly this is patched upstream and shipped via Ubuntu USN-8096-1, but with EPSS at 0.05% and no public exploit identified at time of analysis, real-world exploitation is unlikely and confined to systems that actually load this virtual test driver.
Out-of-bounds buffer handling in the Linux kernel's ksmbd (in-kernel SMB3 server) Extended Attribute code allows a remote attacker to disclose adjacent kernel memory by sending a crafted SMB2 SET_INFO request. The smb2_set_ea() function validated the request buffer without accounting for the null-terminator byte of the EA name, so the size check under-counted the required length and permitted reads past the intended boundary. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but a vendor/upstream fix is available and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel FUSE subsystem's io-uring path allows an unprivileged local user to trigger list corruption and a resulting use-after-free. The flaw stems from a terminated-but-not-committed FUSE io-uring request never being unlinked from the queue's list, leaving a dangling entry that corrupts kernel memory. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; a fix has been merged upstream and shipped by distributions such as Ubuntu.
Incorrect access-control enforcement in the Linux kernel's NFSv4 server (nfsd) causes POSIX ACLs supplied during file creation to be silently discarded, so a client that sets an ACL with a named principal ends up with only a default mode-derived ACL instead. This violates RFC 8881 6.4.1.3 and means files intended to carry restrictive or explicitly-granted permissions are instead governed by permissive default mode bits, potentially exposing their contents to unintended principals on the export. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and it is not on CISA KEV - this is a security-relevant correctness defect rather than an actively exploited threat.
Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.
Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.
Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.
Out-of-bounds read range miscalculation in the Linux kernel iomap subsystem allows a local attacker who can mount a crafted filesystem image (demonstrated against erofs via syzbot) to trigger a length underflow that returns a read position beyond the folio, leading to information disclosure or memory corruption during buffered reads. The flaw lives in iomap_adjust_read_range(), which incorrectly assumed block-aligned positions and lengths. No public exploit identified at time of analysis; EPSS exploitation probability is very low (0.03%), and it is not listed in CISA KEV.
Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.
Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).
Denial of service in the Linux kernel's HFS+ (hfsplus) filesystem driver allows a local user with access to a mounted HFS+ volume to crash the kernel via a reference-counting race in __hfs_bnode_create(). When sync() and link() operations run concurrently, two threads can both attempt to create the same B-tree node; the thread that loses the race reuses the already-hashed node without incrementing its refcount, so a later put trips BUG_ON(!atomic_read(&node->refcnt)) and panics the system. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-E) affects systems running an XDP program that uses the XDP_TX action. Incorrect clearing of NAPI event flags in the XDP_TX path causes the TX doorbell to be skipped when the TX ring is full, stalling the associated RX ring so it is never refilled and all subsequent packets are silently dropped. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile); an upstream fix is available in mainline and stable kernels.
fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts. [CVSS 6.4 MEDIUM]
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. [CVSS 6.5 MEDIUM]
Firefox and Thunderbird versions before 147 contain an information disclosure vulnerability in their XML processing component that allows unauthenticated attackers to access sensitive data over the network with minimal attack complexity. The vulnerability requires no user interaction and affects the confidentiality of information without impacting system integrity or availability. No security patch is currently available.
The PDF Viewer component in Firefox and Thunderbird is vulnerable to clickjacking attacks that enable information disclosure through UI redressing techniques. Attackers can manipulate user interactions to trick victims into unintentionally revealing sensitive information, affecting Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available for this vulnerability.
Memory corruption in Firefox and Thunderbird's JavaScript garbage collection engine allows remote attackers to crash the application or potentially leak sensitive information without user interaction. The vulnerability affects Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7, with no patch currently available.
The Networking component in Firefox and Thunderbird discloses sensitive information to unauthenticated remote attackers over the network. Affected versions include Firefox below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available to remediate this vulnerability.
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. [CVSS 5.3 MEDIUM]
Hermes versions up to 0.9.1 is affected by insertion of sensitive information into log file (CVSS 5.9).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Wlc versions prior to 1.17.0 fail to restrict unscoped API keys, allowing them to be transmitted to unintended Weblate servers and potentially leaked to attackers with local access or through compromised credentials. A local attacker with user privileges could exploit this information disclosure to gain unauthorized access to Weblate instances across multiple servers. A patch is available in version 1.17.0 and later.
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. [CVSS 6.4 MEDIUM]
Acora CMS v10.7.1 uses a static, predictable password reset token. Attackers can replay this token to reset any user's password and take over their account, including admin accounts. Maximum CVSS 10.0 with scope change.
Xz-G12 Firmware versions up to 2.1.17 contains a vulnerability that allows attackers to undetected intrusions or failure to trigger safety alerts (CVSS 6.5).
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on its 433 MHz sensor channel. No rolling codes, authentication, or anti-replay protection – attackers can record and replay alarm/control frames to trigger false alarms or disable sensors.
Broadcom DX NetOps Spectrum (24.3.8 and earlier) exposes session tokens in URL query strings, enabling session hijacking through browser history, referer headers, or proxy logs.
A-Plus Video Technologies NVR devices expose an unauthenticated debug page that allows remote attackers to retrieve sensitive device status information without authentication. The vulnerability requires no user interaction and can be exploited over the network, enabling reconnaissance attacks against affected systems. No patch is currently available to remediate this exposure.
which provide authentication of data using public-key cryptography. versions up to 0.1.0 contains a security vulnerability (CVSS 6.4).
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. [CVSS 4.3 MEDIUM]
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. [CVSS 5.3 MEDIUM]
OpenProject is an open-source, web-based project management software. [CVSS 5.3 MEDIUM]
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. [CVSS 3.5 LOW]
CryptoLib versions prior to 1.4.3 suffer from an out-of-bounds heap read in the cryptography_encrypt() function when processing malformed JSON metadata from KMC servers, allowing remote attackers to trigger a denial of service condition. The vulnerability stems from improper buffer boundary checking during string parsing in spacecraft-ground station communications secured by the SDLS-EP protocol. Public exploit code exists for this medium-severity flaw, though a patch is available.
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions. [CVSS 6.5 MEDIUM]
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. [CVSS 6.5 MEDIUM]
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. [CVSS 5.4 MEDIUM]
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. [CVSS 2.7 LOW]
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-based administrative interface.
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface.
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected t...
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface.
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initial login or post-factory reset setup through the web-based administrative interface.
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible ...
libimagecodec.quram.so in Android devices prior to the January 2026 Security Maintenance Release 1 contains an out-of-bounds read vulnerability that allows remote attackers to access sensitive memory without authentication. The vulnerability has a network attack vector with low complexity, enabling potential information disclosure through specially crafted input. No patch is currently available.
Android versions up to 13.0 contains a vulnerability that allows attackers to access file with system privilege (CVSS 5.5).
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. [CVSS 6.5 MEDIUM]
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. [CVSS 5.3 MEDIUM]
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker can directly query the backup endpoint and download a full configuration archive. [CVSS 8.8 HIGH]
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. [CVSS 5.6 MEDIUM]
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file write is a severe privilege escalation with scope change.
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? before 0.31.
An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5.
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format.
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. [CVSS 8.5 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring allows PHP Local File Inclusion.This issue affects Wellspring: from n/a through < 2.8. [CVSS 8.1 HIGH]
Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulletProof Security: from n/a through <= 6.9. [CVSS 7.5 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion.This issue affects Corpkit: from n/a through <= 2.0. [CVSS 8.1 HIGH]
Neo Ocular WordPress theme (before 1.2) allows PHP Local File Inclusion through improper filename control in include/require statements.
Typify WordPress theme (through 3.0.2) allows PHP Local File Inclusion via improper filename control.
Mitech WordPress theme (through 2.3.4) allows PHP Local File Inclusion through improper filename control in include/require statements.
Moody WordPress theme (through 2.7.3) allows PHP Local File Inclusion through improper filename control.
Atlas WordPress theme (through 2.1.0) allows PHP Local File Inclusion through improper filename control in PHP include statements.
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. [CVSS 5.3 MEDIUM]
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. [CVSS 5.3 MEDIUM]
Navian WordPress theme (through 1.5.4) allows PHP Local File Inclusion through improper filename control.
Brook WordPress theme (through 2.8.9) allows PHP Local File Inclusion via improper filename control in PHP include statements.
In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe.
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted.
In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex.
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer.
CVE-2025-71077 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations.
In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.
In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object.
In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields.
In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange().
In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors.
Local privilege-adjacent memory corruption in the Linux kernel ublk (userspace block driver) subsystem allows a ublk server process to trigger use-after-free-style access on completed I/O requests by exiting while requests are still in flight. The regression, introduced by commit e63d2228ef83 which stopped decrementing the request reference count in __ublk_fail_req(), leaves a leaked UBLK_REFCOUNT_INIT reference that permits illegitimate user-copy and zero-copy operations on already-completed requests and trips WARN_ON_ONCE reference-count assertions during queue teardown. It carries a CVSS 7.8 (high) with local vector and low privileges, EPSS is negligible at 0.03% (7th percentile), and there is no public exploit identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array.
Local privilege escalation in the Linux kernel's ETS (net/sched) packet scheduler arises from a use-after-free on a struct Qdisc object, caused by a race between ets_qdisc_dequeue and ets_qdisc_change. When bands are reconfigured, a class can retain its entry on the active list after its child qdisc is freed and nulled, letting a concurrent dequeue operate on freed memory. Trend Micro ZDI reports a working reproducer and that an attacker able to create user and network namespaces can trigger the flaw and, per their analysis, control RIP; there is no CISA KEV listing and EPSS is very low (0.05%), so no public evidence of active exploitation.
In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. [CVSS 5.5 MEDIUM]
Local privilege-escalation-capable memory corruption in the Linux kernel's ALPS PS/2 touchpad driver (drivers/input/mouse/alps.c) lets a use-after-free be triggered when an ALPS touchpad is detached while the dev3_register_work delayed work item is still pending. Because psmouse_disconnect() only flushes work already queued, alps_register_bare_ps2_mouse() can run and dereference the alps_data structure (priv->dev3) after alps_disconnect() has kfree()'d it, corrupting freed kernel heap memory. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the flaw was found by static analysis rather than in-the-wild activity.
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. [CVSS 7.8 HIGH]
Local privilege escalation and kernel memory corruption in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc allows a user with network-configuration capability to corrupt an internal linked list by toggling a scheduling class between DRR and strict modes. When an active DRR class is reconfigured to strict, ets_qdisc_change() fails to remove it from the active list, so switching it back to DRR performs a double list_add, corrupting kernel list pointers. No public exploit has been identified at time of analysis and the EPSS score is very low (0.05%), but the flaw is a classic kernel list-corruption primitive that can escalate to arbitrary write and full compromise.
Kernel memory corruption in the Linux svcrdma transport (server-side NFS-over-RDMA) arises because svc_rdma_copy_inline_range() added the page index (rc_curpage) instead of the byte offset (rc_pageoff) when computing the memcpy destination, so inline payload copies land at the wrong location within the receive pages. On systems exporting NFS over RDMA, a client on the RDMA fabric can drive copies that miscalculate their target offset, leading to out-of-bounds reads/writes in kernel page memory and potential information disclosure or corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not in CISA KEV, but distro fixes (Ubuntu USN-8177-1) and upstream stable commits are available.
Local privilege escalation and memory corruption in the Linux kernel's KVM subsystem allows a user with VM control (e.g. a QEMU/hypervisor process) to trigger a use-after-free by clearing the KVM_MEM_GUEST_MEMFD flag on a memslot that was created with a guest_memfd binding. KVM blocks enabling the flag on an existing memslot but never blocked disabling it, leaving the guest_memfd instance bound to freed memory that is later written during kvm_gmem_release. The flaw carries a CVSS of 7.8 and has a vendor-released fix; it is not in CISA KEV and no public exploit has been identified at time of analysis, with an EPSS of 0.02%.
Concurrent SMB delete-on-close handling in the Linux kernel's in-kernel SMB3 server (ksmbd) mishandles locking on the ksmbd_inode->m_flags field, letting racing open/close/delete operations corrupt delete-on-close and pending-delete state. Affected builds ship the pre-fix ksmbd vfs_cache code where helpers such as ksmbd_inode_pending_delete() and ksmbd_fd_set_delete_on_close() read and modify m_flags without holding ci->m_lock. The result is inconsistent delete semantics - files that persist after a delete-on-close or vanish while still in use - with no public exploit identified at time of analysis and a very low EPSS score (0.03%).
Local privilege escalation risk in the Linux kernel's vidtv (Virtual Digital TV) media test driver stems from a double-free and use-after-free condition in vidtv_channel_si_init(), where local pointers are not reset to NULL after ownership of program/service/event list memory is transferred to the PAT/SDT/EIT tables. When vidtv_psi_pmt_create_sec_for_each_pat_entry() fails and control jumps to the free_eit error path, already-freed memory is destroyed a second time. Publicly this is patched upstream and shipped via Ubuntu USN-8096-1, but with EPSS at 0.05% and no public exploit identified at time of analysis, real-world exploitation is unlikely and confined to systems that actually load this virtual test driver.
Out-of-bounds buffer handling in the Linux kernel's ksmbd (in-kernel SMB3 server) Extended Attribute code allows a remote attacker to disclose adjacent kernel memory by sending a crafted SMB2 SET_INFO request. The smb2_set_ea() function validated the request buffer without accounting for the null-terminator byte of the EA name, so the size check under-counted the required length and permitted reads past the intended boundary. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but a vendor/upstream fix is available and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel FUSE subsystem's io-uring path allows an unprivileged local user to trigger list corruption and a resulting use-after-free. The flaw stems from a terminated-but-not-committed FUSE io-uring request never being unlinked from the queue's list, leaving a dangling entry that corrupts kernel memory. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; a fix has been merged upstream and shipped by distributions such as Ubuntu.
Incorrect access-control enforcement in the Linux kernel's NFSv4 server (nfsd) causes POSIX ACLs supplied during file creation to be silently discarded, so a client that sets an ACL with a named principal ends up with only a default mode-derived ACL instead. This violates RFC 8881 6.4.1.3 and means files intended to carry restrictive or explicitly-granted permissions are instead governed by permissive default mode bits, potentially exposing their contents to unintended principals on the export. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and it is not on CISA KEV - this is a security-relevant correctness defect rather than an actively exploited threat.
Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.
Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.
Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.
Out-of-bounds read range miscalculation in the Linux kernel iomap subsystem allows a local attacker who can mount a crafted filesystem image (demonstrated against erofs via syzbot) to trigger a length underflow that returns a read position beyond the folio, leading to information disclosure or memory corruption during buffered reads. The flaw lives in iomap_adjust_read_range(), which incorrectly assumed block-aligned positions and lengths. No public exploit identified at time of analysis; EPSS exploitation probability is very low (0.03%), and it is not listed in CISA KEV.
Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.
Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.
Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).
Denial of service in the Linux kernel's HFS+ (hfsplus) filesystem driver allows a local user with access to a mounted HFS+ volume to crash the kernel via a reference-counting race in __hfs_bnode_create(). When sync() and link() operations run concurrently, two threads can both attempt to create the same B-tree node; the thread that loses the race reuses the already-hashed node without incrementing its refcount, so a later put trips BUG_ON(!atomic_read(&node->refcnt)) and panics the system. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the issue is not in CISA KEV.
Denial of service in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-E) affects systems running an XDP program that uses the XDP_TX action. Incorrect clearing of NAPI event flags in the XDP_TX path causes the TX doorbell to be skipped when the TX ring is full, stalling the associated RX ring so it is never refilled and all subsequent packets are silently dropped. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile); an upstream fix is available in mainline and stable kernels.
fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts. [CVSS 6.4 MEDIUM]
A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. [CVSS 6.5 MEDIUM]
Firefox and Thunderbird versions before 147 contain an information disclosure vulnerability in their XML processing component that allows unauthenticated attackers to access sensitive data over the network with minimal attack complexity. The vulnerability requires no user interaction and affects the confidentiality of information without impacting system integrity or availability. No security patch is currently available.
The PDF Viewer component in Firefox and Thunderbird is vulnerable to clickjacking attacks that enable information disclosure through UI redressing techniques. Attackers can manipulate user interactions to trick victims into unintentionally revealing sensitive information, affecting Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available for this vulnerability.
Memory corruption in Firefox and Thunderbird's JavaScript garbage collection engine allows remote attackers to crash the application or potentially leak sensitive information without user interaction. The vulnerability affects Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7, with no patch currently available.
The Networking component in Firefox and Thunderbird discloses sensitive information to unauthenticated remote attackers over the network. Affected versions include Firefox below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available to remediate this vulnerability.
The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. [CVSS 5.3 MEDIUM]
Hermes versions up to 0.9.1 is affected by insertion of sensitive information into log file (CVSS 5.9).
Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. No vendor patch available.
Wlc versions prior to 1.17.0 fail to restrict unscoped API keys, allowing them to be transmitted to unintended Weblate servers and potentially leaked to attackers with local access or through compromised credentials. A local attacker with user privileges could exploit this information disclosure to gain unauthorized access to Weblate instances across multiple servers. A patch is available in version 1.17.0 and later.
Espressif ESP-IDF USB Host HID (Human Interface Device) Driver allows access to HID devices. Prior to 1.1.0, calls to hid_host_device_close() can free the same usb_transfer_t twice. [CVSS 6.4 MEDIUM]
Acora CMS v10.7.1 uses a static, predictable password reset token. Attackers can replay this token to reset any user's password and take over their account, including admin accounts. Maximum CVSS 10.0 with scope change.
Xz-G12 Firmware versions up to 2.1.17 contains a vulnerability that allows attackers to undetected intrusions or failure to trigger safety alerts (CVSS 6.5).
D3D Wi-Fi Home Security System ZX-G12 v2.1.1 is vulnerable to RF replay attacks on its 433 MHz sensor channel. No rolling codes, authentication, or anti-replay protection – attackers can record and replay alarm/control frames to trigger false alarms or disable sensors.
Broadcom DX NetOps Spectrum (24.3.8 and earlier) exposes session tokens in URL query strings, enabling session hijacking through browser history, referer headers, or proxy logs.
A-Plus Video Technologies NVR devices expose an unauthenticated debug page that allows remote attackers to retrieve sensitive device status information without authentication. The vulnerability requires no user interaction and can be exploited over the network, enabling reconnaissance attacks against affected systems. No patch is currently available to remediate this exposure.
which provide authentication of data using public-key cryptography. versions up to 0.1.0 contains a security vulnerability (CVSS 6.4).
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 8.7.2. [CVSS 4.3 MEDIUM]
XWiki Full Calendar Macro displays objects from the wiki on the calendar. Prior to version 2.4.6, users with the rights to view the Calendar.JSONService page (including guest users) can exploit the data leak vulnerability by accessing database info, with the exception of passwords. [CVSS 5.3 MEDIUM]
OpenProject is an open-source, web-based project management software. [CVSS 5.3 MEDIUM]
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. [CVSS 3.5 LOW]
CryptoLib versions prior to 1.4.3 suffer from an out-of-bounds heap read in the cryptography_encrypt() function when processing malformed JSON metadata from KMC servers, allowing remote attackers to trigger a denial of service condition. The vulnerability stems from improper buffer boundary checking during string parsing in spacecraft-ground station communications secured by the SDLS-EP protocol. Public exploit code exists for this medium-severity flaw, though a patch is available.
In Area9 Rhapsode 1.47.3, an authenticated attacker can exploit the operation, url, and filename parameters via POST request to read arbitrary files from the server filesystem. Fixed in 1.47.4 (#7254) and further versions. [CVSS 6.5 MEDIUM]
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. [CVSS 6.5 MEDIUM]
In TIM BPM Suite/ TIM FLOW through 9.1.2 multiple Hibernate Query Language injection vulnerabilities exist which allow a low privileged user to extract passwords of other users and access sensitive data of another user. [CVSS 5.4 MEDIUM]
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.0.0, LTS2025 release version 8.3.1.10, LTS2024 release versions 7.13.1.0 through 7.13.1.40, LTS 2023 release versions 7.10.1.0 through 7.10.1.70, contain an Exposure of Sensitive Information to an Unauthorized Actor vulnerability. [CVSS 2.7 LOW]
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the use of login credentials as the session ID through its web-based administrative interface.
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the missing HTTPOnly flag for session cookies associated with the web-based administrative interface.
Vivotek IP7137 camera with firmware version 0200a is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized users with network access to view the camera's feed, potentially compromising user privacy and security. The vendor has not replied to the CNA. Possibly all firmware versions are affected. Since the product has met End-Of-Life phase, a fix is not expected t...
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the transmission of credentials encoded using reversible Base64 encoding through the web-based administrative interface.
This vulnerability exists in Tenda wireless routers (300Mbps Wireless Router F3 and N300 Easy Setup Router) due to the plaintext transmission of login credentials during the initial login or post-factory reset setup through the web-based administrative interface.
The Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 10.14.10 via the `WPBC_FLEXTIMELINE_NAV` AJAX action. This is due to the nonce verification being conditionally disabled by default (`booking_is_nonce_at_front_end` option is `'Off'` by default). When the `booking_is_show_popover_in_timeline_front_end` option is enabled (which is the default in demo installations and can be enabled by administrators), it is possible ...
libimagecodec.quram.so in Android devices prior to the January 2026 Security Maintenance Release 1 contains an out-of-bounds read vulnerability that allows remote attackers to access sensitive memory without authentication. The vulnerability has a network attack vector with low complexity, enabling potential information disclosure through specially crafted input. No patch is currently available.
Android versions up to 13.0 contains a vulnerability that allows attackers to access file with system privilege (CVSS 5.5).
The BetterDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.3 via the scripts() function. [CVSS 6.5 MEDIUM]
The weDocs plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.15 via the `/wp-json/wp/v2/docs/settings` REST API endpoint. [CVSS 5.3 MEDIUM]
KAYSUS KS-WR3600 routers with firmware 1.0.5.9.1 mishandle configuration management. Once any user is logged in and maintains an active session, an attacker can directly query the backup endpoint and download a full configuration archive. [CVSS 8.8 HIGH]
The ECDSA implementation of the Elliptic package generates incorrect signatures if an interim value of 'k' (as computed based on step 3.2 of RFC 6979 https://datatracker.ietf.org/doc/html/rfc6979 ) has leading zeros and is susceptible to cryptanalysis, which can lead to secret key exposure. [CVSS 5.6 MEDIUM]
Veeam allows Backup or Tape Operators to write files as root on the server. An operator-level role achieving root file write is a severe privilege escalation with scope change.
A Improper Neutralization of Argument Delimiters vulnerability in Foomuuri can lead to integrity loss of the firewall configuration or further unspecified impact by manipulating the JSON configuration passed to `nft`. This issue affects Foomuuri: from ? before 0.31.
An External Control of File Name or Path vulnerability in smb4k allowsl ocal users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba shareThis issue affects smb4k: from ? before 4.0.5.
Asseco InfoMedica is a comprehensive solution used to manage both administrative and medical tasks in the healthcare sector. Passwords of all users are stored in a database in an encoded format.
A flaw was found in Ansible Automation Platform (AAP). Read-only scoped OAuth2 API Tokens in AAP, are enforced at the Gateway level for Gateway-specific operations. [CVSS 8.5 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Mikado-Themes Wellspring wellspring allows PHP Local File Inclusion.This issue affects Wellspring: from n/a through < 2.8. [CVSS 8.1 HIGH]
Insertion of Sensitive Information Into Sent Data vulnerability in AITpro BulletProof Security bulletproof-security allows Retrieve Embedded Sensitive Data.This issue affects BulletProof Security: from n/a through <= 6.9. [CVSS 7.5 HIGH]
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zozothemes Corpkit corpkit allows PHP Local File Inclusion.This issue affects Corpkit: from n/a through <= 2.0. [CVSS 8.1 HIGH]
Neo Ocular WordPress theme (before 1.2) allows PHP Local File Inclusion through improper filename control in include/require statements.
Typify WordPress theme (through 3.0.2) allows PHP Local File Inclusion via improper filename control.
Mitech WordPress theme (through 2.3.4) allows PHP Local File Inclusion through improper filename control in include/require statements.
Moody WordPress theme (through 2.7.3) allows PHP Local File Inclusion through improper filename control.
Atlas WordPress theme (through 2.1.0) allows PHP Local File Inclusion through improper filename control in PHP include statements.
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts *not present* in the specified file if they were added as recognized in the libssh *global* known_hosts file. [CVSS 5.3 MEDIUM]
When doing TLS related transfers with reused easy or multi handles and altering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally reuse a CA store cached in memory for which the partial chain option was reversed. Contrary to the user's wishes and expectations. [CVSS 5.3 MEDIUM]
Navian WordPress theme (through 1.5.4) allows PHP Local File Inclusion through improper filename control.
Brook WordPress theme (through 2.8.9) allows PHP Local File Inclusion via improper filename control in PHP include statements.