Information Disclosure
Monthly
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Use-after-free in the Linux kernel's libceph (Ceph client) authentication code lets a stale pointer to a freed ceph_buffer be transmitted during a msgr1 reconnect, triggering a KASAN slab-use-after-free in _copy_from_iter() as tcp_sendmsg() copies the authorizer. The flaw affects hosts acting as Ceph clients (RBD, CephFS, rados) and can crash the client kernel and potentially leak freed slab memory over the wire. It is patched upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).
Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Local kernel memory corruption in the Linux net/x25 subsystem allows an attacker to trigger a slab-use-after-free in x25_kill_by_neigh() by racing a neighbour (X.25 link) teardown against a socket close. The function drops x25_list_lock before calling lock_sock() without holding a socket reference, so a concurrent x25_release() can free the struct sock/x25_sock that the teardown path then dereferences, leading to a crash or potential privilege escalation. No public exploit identified at time of analysis; a KASAN reproducer under QEMU confirmed the flaw, and EPSS exploitation probability is very low (0.18%).
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.
Integer underflow in the Linux kernel mac802154 link-layer security subsystem allows any unauthenticated IEEE 802.15.4 peer within radio range to corrupt kernel memory by transmitting a crafted secured frame with a payload shorter than the AEAD authentication tag. The flaw in llsec_do_decrypt_auth() causes an unsigned integer wraparound that passes an approximately 4 GiB associated-data length to the crypto subsystem, driving the AEAD scatterwalk far beyond the actual frame buffer and producing a general-protection-fault or exploitable kernel memory corruption. No public exploit is identified at time of analysis and EPSS is very low at 0.21%, but full kernel-level impact (C:H/I:H/A:H) is rated given confirmed KASAN reproduction; real-world exposure is constrained to embedded Linux deployments with 802.15.4 hardware and LLSEC explicitly configured.
Length-underflow in the Linux kernel's Open vSwitch (openvswitch) datapath lets a truncation delta be reused across GSO segments, so a segment can reach queue_userspace_packet() with a stored cutlen larger than skb->len and pass an underflowed length to skb_zerocopy(). The affected code is the OVS_ACTION_ATTR_TRUNC (packet truncate) path feeding userspace upcalls, and the flaw is tagged Information Disclosure, consistent with an out-of-bounds copy of adjacent kernel memory into the userspace listener (and/or a kernel crash). It is fixed in stable kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
TCP connection disruption in the Linux kernel exposes systems handling SYN-RECEIVED state connections to blind RST injection attacks that bypass RFC 5961 and RFC 9293 challenge ACK protections. The tcp_check_req() function accepts in-window RST segments with non-exact sequence numbers, allowing a remote unauthenticated attacker to abort half-open connections without meeting the exact SEQ match requirement mandated by RFC 9293 section 3.10.7.4. Exploitation probability remains low (EPSS 0.17%, 6th percentile) and no public exploit or KEV listing has been identified, though the CVSS 8.2 score reflects the ease of network access (AV:N/AC:L/PR:N) combined with a high availability impact from connection disruption.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.
Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Directory-traversal / share escape in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client create files, directories, or hardlinks outside the exported share. The SMB2 open lookup is correctly rooted at the share with LOOKUP_BENEATH, but ksmbd_vfs_kern_path_create() built an absolute path via convert_to_unix_name() and resolved it from AT_FDCWD, so a '..' component walked from the real filesystem root and escaped the export. It is exploited through a TOCTOU race and has no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitive traffic via man-in-the-middle attacks against all deployments running version 2.8.0 or earlier. The client fails to validate that a server's TLS certificate hostname matches the actual server being contacted (CWE-297), meaning a forged or mismatched certificate will be accepted silently. A vendor-released patch is available in version 2.9.0; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and including 2.8.0, because the authentication endpoint imposes no rate limiting, account lockout, or anti-automation controls (CWE-307). Any deployment that has explicitly configured UnixAuth - a configuration the vendor labels as not recommended for production - exposes its Ranger admin interface to automated password-guessing from unauthenticated network attackers. No active exploitation is recorded in CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network vector (AV:N/PR:N/AC:L) makes automated credential attacks trivially executable against any network-reachable instance.
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
WPC Order Tip for WooCommerce plugin (all versions before 3.3.1) exposes sensitive customer order data to unauthenticated remote attackers via an unprotected reporting feature that performs no authorization or nonce verification. Any unauthenticated party with network access to the WordPress store can query the endpoint and retrieve billing names, order IDs, statuses, fee amounts, and order dates for any customer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at the 4th percentile, indicating low current exploitation activity despite a high CVSS score.
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Cryptographic key material in Bouncy Castle for Java FIPS (BC-FJA) persists in the JVM heap far beyond its intended lifetime on Java 12 and later runtimes because the library's zeroisation scheme relies on Object.finalize(), a mechanism progressively de-emphasized since Java 9 and deprecated for removal in Java 18. Under load, the single finalizer thread cannot retire pending objects as fast as they are allocated, causing the queue to grow without bound - resulting in an OutOfMemoryError that crashes the application and defeating the cryptographic hygiene goal of prompt key zeroisation. No public exploit is identified at time of analysis; however, any network-accessible application built on BC-FJA prior to the fixed versions is exposed to both a remotely triggerable denial-of-service and prolonged in-memory residence of sensitive key material.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., `pathling:search`) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., `pathling:read:Patient`), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with `@OperationAccess(...)` and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.
Credential exfiltration in Pathling Server prior to 2.0.0 allows an allowed submitter to hijack the bulk-submit OAuth flow by supplying an attacker-controlled `oauthMetadataUrl` parameter that is never validated against the server's configured `pathling.bulkSubmit.allowableSources` allowlist. Pathling blindly fetches OAuth metadata from the caller-supplied URL, trusts the returned `token_endpoint`, and transmits stored OAuth client credentials directly to the attacker's infrastructure. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the credential theft impact is severe for any healthcare organization running FHIR bulk data pipelines on this platform.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side password files - via direct filesystem access or through the companion 'Random File Read' vulnerability - to reverse the obfuscation applied to locally-created user passwords and recover plaintext credentials. All TeamDavid deployments through Rollout 524 using locally created accounts are affected, making this a critical identity compromise risk for organizations relying on TeamDavid as an M365 alternative. No public exploit has been independently confirmed, but InfoGuard Labs published a 22-CVE research campaign against this product that likely includes technical detail enabling exploitation.
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote attackers harvest sensitive server memory - including user passwords - by repeatedly requesting the malformed endpoint "/.well-known/mta-sts.", which causes the application to return raw memory contents in its response. The flaw resembles a Heartbleed-style over-read affecting a self-hosted Microsoft 365 alternative, and no public exploit identified at time of analysis, though it was disclosed as part of a broader research batch (22 CVEs) by InfoGuard Labs and reported via NCSC.ch. With CVSS 4.0 9.2 (Critical), network-reachable and requiring no authentication or user interaction, it is a high-priority disclosure risk wherever David is internet-exposed.
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. No public exploit has been identified at time of analysis, though this vulnerability is part of a multi-CVE research disclosure of 22 issues in the David platform by Infoguard.
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Local privilege escalation in StableBit DrivePool 2.3.13.1687 allows a low-privileged local user to achieve high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability resides in DrivePool.Service.exe and stems from CWE-275 permission issues, with the publicly available exploit reference explicitly identifying insecure deserialization as the attack mechanism enabling escalation. No active exploitation has been confirmed by CISA KEV, but a public proof-of-concept exists and the CVSS 4.0 vector includes E:P (exploit proof-of-concept), elevating real-world risk above theoretical.
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged Windows user to exploit permission misconfigurations in Scanner.Service.exe - the Windows service component of the disk health monitoring tool - to achieve high confidentiality, integrity, and availability impact on the local system. The exploit reference titles the technique as 'local privilege escalation via insecure deserialization,' suggesting the ScannerService's IPC or communication surface deserializes attacker-controlled data without adequate permission enforcement. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists per VulDB and the referenced PoC page, though no CISA KEV listing confirms active in-production exploitation.
Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor.
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
NoSQL injection in Dgraph prior to 25.3.8 enables unauthenticated remote attackers to inject DQL operators through unvalidated regexp filter arguments in GraphQL queries and mutations, bypassing intended node-level access controls. The `maybeQuoteArg` function in `graphql/resolve/query_rewriter.go` writes regexp arguments verbatim into generated DQL without validating the `/pattern/flags` structure, allowing a crafted filter value like `/x/) OR has(pred` to close the regexp call and append attacker-controlled DQL expressions. No confirmed active exploitation at time of analysis and no CISA KEV listing, but the fix commit includes a working injection payload as a regression test, confirming ease of exploitation against accessible endpoints.
Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
Unlimited passphrase brute-force is possible against any known account in OpenReception's appointment booking platform prior to version 1.0.2, because the `/api/auth/login` endpoint's passphrase branch never invokes the existing `challengeThrottleService` that correctly rate-limits the WebAuthn path. The asymmetry - confirmed by the fix commit wiring the same throttle infrastructure into the passphrase branch - means an unauthenticated remote attacker can sustain roughly 10 passphrase guesses per second per account, bounded only by Argon2 verification cost. Combined with a 12-character minimum policy that enforces no entropy or dictionary checks, accounts using common base patterns are realistically compromised in days on a single CPU or hours on a small GPU cluster. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
OpenReception's appointment booking platform (prior to v1.0.2) leaves server-side sessions active for up to one week after a user explicitly logs out, due to an operation-ordering bug in the SvelteKit logout route. An attacker who has already obtained a copy of the victim's access token - through network interception, browser storage access on a shared device, or another independent theft vector - can continue making fully authenticated API calls against the platform even after the victim believes their session has ended. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the C:H/I:H impact reflects unrestricted access to the victim's appointment API surface for the duration of the unexpired session.
Improper resource teardown in the Linux kernel's SCTP subsystem leaves per-net UDP tunnel sockets installed when a network namespace is destroyed, creating a use-after-free/dangling-socket condition once the control socket is released. The flaw affects systems where SCTP UDP encapsulation (net.sctp.udp_port) has been enabled inside a namespace before that namespace exits. There is no public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the fix has already been merged to multiple stable trees. Note: the supplied 9.8/AV:N CVSS is inconsistent with the local, namespace-scoped nature of the actual defect.
Use-after-free in the Linux kernel's libceph (Ceph client) authentication code lets a stale pointer to a freed ceph_buffer be transmitted during a msgr1 reconnect, triggering a KASAN slab-use-after-free in _copy_from_iter() as tcp_sendmsg() copies the authorizer. The flaw affects hosts acting as Ceph clients (RBD, CephFS, rados) and can crash the client kernel and potentially leak freed slab memory over the wire. It is patched upstream; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory access in the Linux kernel's libceph client (crush_decode) lets a malformed CRUSH map drive the CRUSH mapper into indexing the OSD weight array with a negative value. Because bucket type 0 is reserved for leaf devices, a bucket wrongly decoded with type 0 causes a negative bucket ID to be treated as a device and passed to is_out(), yielding an out-of-bounds read that can leak kernel memory or crash the host. Exploitation requires the kernel Ceph client to process the crafted map (i.e., connection to a malicious or compromised Ceph cluster); there is no public exploit identified at time of analysis and EPSS is low (0.20%).
Use-after-free race condition in the Linux kernel's libceph subsystem allows a local low-privileged user to corrupt kernel memory during Ceph client teardown. The flaw exists because `ceph_destroy_client()` frees `monc->monmap` via `ceph_monc_stop()` before removing the associated debugfs entries, enabling a concurrent reader of `/sys/kernel/debug/ceph/*/monmap` to invoke `monmap_show()` on freed memory. No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) confirms this remains unexploited in the wild, but the theoretical impact is kernel memory corruption or crash on any Ceph-connected Linux host.
ACL cache state corruption in the Linux kernel's FUSE filesystem driver allows a local low-privileged attacker to receive stale POSIX ACL values from get_acl(), potentially bypassing access controls on files. The flaw resides in forget_cached_acl(), which can silently overwrite the ACL_DONT_CACHE sentinel for FUSE mounts where the userspace server has not negotiated FUSE_POSIX_ACL, re-enabling caching that the filesystem explicitly opted out of. No public exploit exists and EPSS sits at 0.18% (7th percentile), but the CVSS 8.4 score reflects high confidentiality and integrity impact from ACL policy bypass under specific FUSE configurations.
Use-after-free in the Linux kernel fscrypt subsystem's `find_or_insert_direct_key()` function allows a low-privileged local attacker to potentially read sensitive kernel memory, corrupt data structures, or crash the system. The global `fscrypt_direct_keys` hash table-used exclusively by the legacy v1 encryption policy path with `FSCRYPT_POLICY_FLAG_DIRECT_KEY`-matched cached master-key entries by cryptographic material without comparing the `super_block` pointer, enabling inodes from distinct filesystems to share a single `fscrypt_direct_key` and extend its lifetime past superblock teardown. No public exploit is identified at time of analysis, and EPSS stands at 0.12% (2nd percentile), indicating negligible observed exploitation activity.
Use-after-free in the Linux kernel fscrypt subsystem allows a local low-privileged user to potentially escalate privileges or corrupt kernel memory on systems running f2fs with inline encryption. The flaw surfaces in fscrypt_destroy_inline_crypt_key() during inode eviction under direct memory reclaim: when the dynamic heap allocation inside fscrypt_get_devices() fails under memory pressure, the function skips the mandatory blk_crypto_evict_key() call and immediately frees the blk_crypto_key structure while block device drivers still hold references to it. No public exploit code exists and EPSS is 0.18% (7th percentile), but the underlying kernel use-after-free primitive carries serious privilege-escalation potential on affected configurations; patches are available across multiple stable branches.
Use-after-free in the Linux kernel's Phonet PEP (Pipe End Point) receive path lets an attacker trigger memory corruption via crafted Phonet packets. In pep_get_sb(), a call to pskb_may_pull() can reallocate the skb data buffer, but the code keeps dereferencing the now-stale header pointer, producing a slab use-after-free read confirmed under KASAN. The flaw affects kernels from 2.6.28 through the fixed stable releases and is tagged as an information-disclosure issue; no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS score (0.18%).
Cross-namespace privilege escalation in the Linux kernel GENEVE tunnel driver allows a locally authenticated attacker holding CAP_NET_ADMIN in a device network namespace to reconfigure the tunnel's underlay sockets in a separate, more privileged network namespace where they hold no such capability. Affected are kernels from version 4.14 through current stable branches prior to 7.1.6, 6.18.42, 6.12.101, and 6.6.148. With the Changed scope confirmed by NVD's CVSS vector (S:C, C:H/I:H/A:H), an attacker can redirect or disrupt overlay tunnel traffic crossing namespace boundaries; no public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.
Use-after-free in the Linux kernel's IUCV (Inter-User Communication Vehicle) networking subsystem exposes IBM z/VM mainframe guests to kernel memory corruption via a malicious peer. When a remote peer severs an IUCV connection, the kernel frees the iucv_path object but leaves raw, non-reference-counted pointers to it in the pending message notification queue; a subsequent recvmsg() call dereferences the freed memory, enabling heap corruption with full confidentiality, integrity, and availability impact. The vulnerability has existed since kernel 2.6.24, carries no public exploit code, and has not been added to CISA KEV, with EPSS at 0.18% reflecting its narrow IBM mainframe deployment scope.
Use-after-free in the Linux kernel net/sched subsystem allows local, low-privileged attackers to corrupt kernel heap memory or escalate privileges by racing concurrent RTM_NEWTFILTER netlink requests against an unprotected global rate-table list. The flaw arises because cls_flower's TCF_PROTO_OPS_DOIT_UNLOCKED flag causes tcf_police_init() to call qdisc_get_rtab()/qdisc_put_rtab() without the RTNL mutex, exposing the process-global qdisc_rtab_list and a non-atomic refcnt to concurrent mutation across CPUs. EPSS is low at 0.16% (6th percentile) and the vulnerability does not appear in CISA KEV, but the kernel-level use-after-free impact and the system-wide scope of the corrupted object demand prompt patching.
Local kernel memory corruption in the Linux net/x25 subsystem allows an attacker to trigger a slab-use-after-free in x25_kill_by_neigh() by racing a neighbour (X.25 link) teardown against a socket close. The function drops x25_list_lock before calling lock_sock() without holding a socket reference, so a concurrent x25_release() can free the struct sock/x25_sock that the teardown path then dereferences, leading to a crash or potential privilege escalation. No public exploit identified at time of analysis; a KASAN reproducer under QEMU confirmed the flaw, and EPSS exploitation probability is very low (0.18%).
Missing hardware facility validation in the Linux kernel's ptp_s390 driver exposes IBM System z (s390x) mainframes to potential kernel crashes and hardware register state disclosure when the driver registers the physical clock without confirming that Facility 28 is installed and that PTFF QPT is available. The vulnerability affects kernel versions from commit 2d7de7a3010d713fb89b7ba99e6fdc14475ad106 through the respective fix commits across multiple stable branches, with patched releases at 6.18.42, 7.1.6, and 7.2-rc5. No public exploit has been identified and EPSS probability stands at 0.17%, consistent with the niche IBM mainframe hardware dependency that sharply constrains the exploitable population.
Permanent network Rx queue stall in the Linux kernel GVE (Google Virtual Ethernet) driver allows denial of service under extreme memory pressure conditions affecting Google Cloud VM instances. When page allocations fail during the Rx buffer refill loop, posted buffers can drop below the 32-descriptor threshold, causing the device to drop incoming packets; because no Rx completions are generated, NAPI is never rescheduled, creating a self-reinforcing deadlock that persists even after memory is freed. No public exploit has been identified and EPSS is 0.18% (7th percentile), but the availability impact is total network loss for the affected VM - the assigned CVSS 7.5 reflects the severity of that outcome, not ease of triggering it.
Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.
Integer underflow in the Linux kernel mac802154 link-layer security subsystem allows any unauthenticated IEEE 802.15.4 peer within radio range to corrupt kernel memory by transmitting a crafted secured frame with a payload shorter than the AEAD authentication tag. The flaw in llsec_do_decrypt_auth() causes an unsigned integer wraparound that passes an approximately 4 GiB associated-data length to the crypto subsystem, driving the AEAD scatterwalk far beyond the actual frame buffer and producing a general-protection-fault or exploitable kernel memory corruption. No public exploit is identified at time of analysis and EPSS is very low at 0.21%, but full kernel-level impact (C:H/I:H/A:H) is rated given confirmed KASAN reproduction; real-world exposure is constrained to embedded Linux deployments with 802.15.4 hardware and LLSEC explicitly configured.
Length-underflow in the Linux kernel's Open vSwitch (openvswitch) datapath lets a truncation delta be reused across GSO segments, so a segment can reach queue_userspace_packet() with a stored cutlen larger than skb->len and pass an underflowed length to skb_zerocopy(). The affected code is the OVS_ACTION_ATTR_TRUNC (packet truncate) path feeding userspace upcalls, and the flaw is tagged Information Disclosure, consistent with an out-of-bounds copy of adjacent kernel memory into the userspace listener (and/or a kernel crash). It is fixed in stable kernels 6.6.148, 6.12.101, 6.18.42 and 7.1.6; there is no public exploit identified at time of analysis and EPSS is low (0.18%).
Memory corruption in the Linux kernel PPPoE driver allows a local low-privilege attacker to write six bytes through a stale pointer into freed kernel memory, with potential for privilege escalation to root. The flaw exists in pppoe_sendmsg(), which saves a direct pointer to the PPPoE header before calling dev_hard_header() - a callback that may reallocate the socket buffer head, invalidating the saved pointer. This vulnerability is not confirmed actively exploited (not in CISA KEV), no public exploit is known, and EPSS stands at 0.18% (7th percentile); however, patches are available across multiple stable kernel series.
TX hang vulnerability in the Linux kernel rtase driver allows denial of service by causing the Realtek RTASE hardware packet parser to stall when it encounters incomplete IPv4, IPv6, TCP, or UDP transport headers, or undersized UDP packets on PTP ports 319/320. Systems running kernels from commit d6e882b89fdf80be0ab4f914ec10f75215e49495 through the respective patched releases and equipped with Realtek RTASE network hardware are affected. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) indicates extremely low real-world exploitation probability.
Uninitialized kernel memory disclosure via TCP-AO padding bytes affects Linux kernels since v6.7 (commit decde2586b34). When constructing standalone TCP responses - ACKs and RSTs - with TCP Authentication Option (TCP-AO) enabled, one to three alignment padding bytes following a non-four-byte-aligned MAC are left uninitialized and transmitted on the wire, leaking small amounts of kernel memory to on-path observers. No public exploit exists and EPSS is 0.17% (6th percentile), making this low-urgency despite the vendor-assigned CVSS 7.5 score; the C:H rating is likely overstated given the 1-3 byte disclosure boundary.
TCP connection disruption in the Linux kernel exposes systems handling SYN-RECEIVED state connections to blind RST injection attacks that bypass RFC 5961 and RFC 9293 challenge ACK protections. The tcp_check_req() function accepts in-window RST segments with non-exact sequence numbers, allowing a remote unauthenticated attacker to abort half-open connections without meeting the exact SEQ match requirement mandated by RFC 9293 section 3.10.7.4. Exploitation probability remains low (EPSS 0.17%, 6th percentile) and no public exploit or KEV listing has been identified, though the CVSS 8.2 score reflects the ease of network access (AV:N/AC:L/PR:N) combined with a high availability impact from connection disruption.
Source list corruption in the Linux kernel's VXLAN Multicast Database (MDB) subsystem can be triggered by a local low-privileged user during a failed MDB remote entry replace operation, silently corrupting multicast forwarding state across affected kernel branches. The logic flaw in vxlan_mdb_remote_srcs_add() incorrectly tears down pre-existing (S,G) source entries during an error rollback, rather than restricting the rollback to entries added during the current failed call. EXCLUDE-mode multicast filters subsequently forward traffic that should be blocked, and INCLUDE-mode filters drop traffic that should be forwarded; no public exploit is identified at time of analysis.
Time-of-check to time-of-use (TOCTOU) race condition in the Linux kernel's AMDGPU VCN4 video encoder driver allows a local low-privileged user with GPU device access to corrupt the IB (Indirect Buffer) parameter length between driver reads, potentially achieving out-of-bounds kernel memory access. Affected systems must run AMD RDNA3-class GPU hardware; the official CVSS 3.1 score of 8.8 with scope change (S:C) and High C/I/A ratings implies a local privilege escalation path to kernel level. No public exploit code has been identified and EPSS is 0.17% (6th percentile), indicating low real-world exploitation activity despite the high theoretical severity.
Division by zero in the Linux kernel's amdgpu DRM subsystem (drm/amdgpu UVD driver) allows a local attacker with access to AMD GPU render nodes to crash the kernel or potentially escalate privileges by submitting H264 video decode requests with frame dimensions below 16 pixels. Affected stable branches span kernel versions prior to 6.6.148, 6.12.101, 6.18.42, and 7.1.6, all of which now have upstream patches committed. No public exploit code and no CISA KEV listing have been identified; EPSS at 0.17% (6th percentile) indicates negligible near-term automated exploitation probability.
Use-after-free in the Linux kernel's drm/amdgpu driver arises from freeing the ACP (Audio CoProcessor) generic power domain memory before unregistering it from the kernel's global power domain list via pm_genpd_remove(), leaving a dangling pointer in that list. Systems running a vulnerable kernel with AMD GPU hardware present are exposed to a local privilege escalation path - an attacker with low-privileged local access could trigger kernel memory corruption during driver teardown. No public exploit code exists and EPSS is 0.17% (6th percentile), but the CVSS 7.8 score reflects potential for full system compromise if exploited.
Doorbell mapping corruption in the Linux kernel amdgpu DRM driver allows a local low-privileged user with AMD GPU access to overwrite another queue's doorbell entry by creating a second user-queue sharing the same Buffer Object handle and offset. The root cause is use of `xa_store_irq()`, which permits silent overwrites in the XArray, replaced by the patch with `xa_insert_irq()`. Consequences include fence IRQ misrouting to wrong queues and destructive cleanup that erases a live queue's mapping, yielding high integrity and availability impact. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating negligible real-world exploitation activity.
Out-of-bounds memory read in the Linux kernel's ksmbd (in-kernel SMB server) allows authenticated network attackers to trigger kernel memory disclosure via a crafted NT ACL. The flaw resides in set_ntacl_dacl(), which validates sid.num_subauth before copying an ACE but fails to verify the declared ACE size can contain all declared SID sub-authorities, permitting undersized ACEs through. The subsequent POSIX ACL deduplication walk then reads beyond the copied ACE's legitimate boundary. No active exploitation is confirmed (not in CISA KEV), and the EPSS probability is 0.17% (6th percentile), indicating low real-world exploitation activity at time of analysis.
Resource mismanagement in the Linux kernel Wacom HID driver leaves hardware running after failed initialization, creating a potential use-after-free condition in kernel memory. Affects a broad range of stable Linux kernel branches from 4.19 through 6.8, requiring a Wacom HID device and a specific probe failure to trigger. Despite a CVSS score of 8.8, EPSS sits at 0.18% (7th percentile) and no public exploit exists; the vulnerability was discovered via static analysis, not active exploitation.
Race condition and state management bug in the Linux kernel Bluetooth HCI UART driver (hci_uart) allows an adjacent attacker with low privileges to block all future writes to a Bluetooth UART device after it is closed and reopened, with potential for kernel memory corruption via an unsafely cleared tx_skb pointer. Affected versions span multiple stable branches from 5.10.x through 6.18.x. No public exploit has been identified at time of analysis and EPSS is very low (0.17%), though the CVSS score of 8.0 with high C/I/A impact signals potential for use-after-free conditions beyond pure denial of service.
Directory-traversal / share escape in the Linux kernel's in-kernel SMB3 server (ksmbd) lets an authenticated SMB client create files, directories, or hardlinks outside the exported share. The SMB2 open lookup is correctly rooted at the share with LOOKUP_BENEATH, but ksmbd_vfs_kern_path_create() built an absolute path via convert_to_unix_name() and resolved it from AT_FDCWD, so a '..' component walked from the real filesystem root and escaped the export. It is exploited through a TOCTOU race and has no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.
Out-of-bounds read in Redis Cluster Bus PING message parsing affects Redis through version 8.8.1, enabling adjacent unauthenticated attackers to trigger denial of service or extract limited heap memory contents. The root cause is in the getPingExtLength() function, which fails to validate extension length fields against the actual remaining buffer size, allowing a crafted gossip-protocol PING packet to drive the parser past the allocated buffer boundary. No public exploit has been identified at time of analysis, and this vulnerability has not been confirmed in the CISA KEV catalog.
Unauthenticated classpath asset disclosure in Apache Tapestry 5.5.0 through 5.9.0 exposes arbitrary files on the Java classpath to remote attackers via specially crafted HTTP URLs. The tapestry-core component fails to restrict URL-based access to classpath resources, meaning attackers can retrieve sensitive files such as configuration files, properties files containing credentials, and compiled .class files. No public exploit code has been identified at time of analysis, but the attack requires no authentication, no user interaction, and minimal complexity - lowering the bar for exploitation significantly.
TLS hostname verification failure in Apache Ranger Client Code allows network-positioned attackers to intercept sensitive traffic via man-in-the-middle attacks against all deployments running version 2.8.0 or earlier. The client fails to validate that a server's TLS certificate hostname matches the actual server being contacted (CWE-297), meaning a forged or mismatched certificate will be accepted silently. A vendor-released patch is available in version 2.9.0; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Brute-force credential attacks against Apache Ranger's UnixAuth component are possible in all versions up to and including 2.8.0, because the authentication endpoint imposes no rate limiting, account lockout, or anti-automation controls (CWE-307). Any deployment that has explicitly configured UnixAuth - a configuration the vendor labels as not recommended for production - exposes its Ranger admin interface to automated password-guessing from unauthenticated network attackers. No active exploitation is recorded in CISA KEV and no public POC has been identified at time of analysis, but the unauthenticated network vector (AV:N/PR:N/AC:L) makes automated credential attacks trivially executable against any network-reachable instance.
WebSocket authentication failure in Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums exposes private key material through network traffic analysis, enabling a man-in-the-middle attacker to decrypt and tamper with the device's WebSocket communications. Both affected models implement CWE-327 (broken or risky cryptographic algorithm) in their WebSocket authentication layer, meaning the key exchange or storage mechanism does not adequately protect the session secret from passive or active interception. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but a vendor firmware update was published on March 31, 2026, referenced via the hellohas.co.jp advisory.
Enabled telnet services on the Ecovacs Robotics DEEBOT PRO M1 and DEEBOT PRO K1VAC robot vacuums expose a network-accessible shell interface that authenticated low-privilege users can leverage to log into the device. Rooted in CWE-489 (Active Debug Code), the telnet daemon was never disabled before shipping production firmware, leaving a legacy unencrypted remote access protocol open on the device. Reported by JPCERT/CC with a CVSS 4.0 score of 8.7, no public exploit code or CISA KEV listing has been identified, though the network-accessible nature and low attack complexity represent meaningful risk in home and SMB environments.
Unauthenticated remote access to a production-enabled debug web server on Ecovacs DEEBOT PRO M1 and K1VAC robot vacuums exposes sensitive floor map data and operational logs to any network-reachable attacker. The flaw (CWE-489: Active Debug Code) means the devices ship with a debugging HTTP interface left enabled, serving home layout and usage data without any authentication gate. No active exploitation has been confirmed and no public exploit exists, but the CVSS 4.0 score of 8.7 reflects the high real-world privacy impact of floor plan exposure - a detailed map of a victim's home interior.
Unencrypted data transmission in Samsung Smart Switch prior to version 3.7.72.6 exposes sensitive personal data to interception by adjacent network attackers. An attacker positioned on the same network segment can passively capture data flowing between devices during an active Smart Switch wireless transfer session. No public exploit has been identified and no CISA KEV listing exists, but the adjacent-network vector and low attack complexity make this a realistic threat on shared or untrusted Wi-Fi networks.
Authentication bypass in Tegalog (Fumy Otegaru Memo Logger) by Nishishi Factory permits remote unauthenticated attackers to access the management console by exploiting a permissive regular expression (CWE-625) used during login validation. Once inside the console, an attacker can perform any operation the management interface exposes - including creating, modifying, or deleting memo log entries. No public exploit code has been identified at time of analysis, and the product is absent from CISA's Known Exploited Vulnerabilities catalog.
Unauthenticated booking record disclosure in the Salon Booking System WordPress plugin (through version 10.30.33) exposes other customers' personal information via sequential identifier enumeration. The booking-wizard confirmation flow loads booking records using a numeric booking ID without properly verifying that the requestor holds the associated ownership token, enabling any unauthenticated remote attacker to iterate through IDs and retrieve arbitrary bookings. A publicly available exploit exists per WPScan, and the vulnerability is trivially automatable, making mass customer PII harvesting a realistic outcome.
File enumeration and unauthorized download is possible in the Contact Form to Any API WordPress plugin (all versions before 3.0.7) because uploaded contact form attachments are stored in a publicly accessible directory using predictable, non-random filenames. Unauthenticated remote attackers can discover the upload path by submitting a form themselves, then systematically enumerate filenames to retrieve files - potentially containing PII, identity documents, or sensitive business attachments - submitted by other users. A publicly available proof-of-concept exists, and a vendor patch (3.0.7) has been released.
Unauthenticated access to saved form draft data in the HT Contact Form WordPress plugin (versions before 2.9.3) exposes personally identifiable information - including names, email addresses, phone numbers, and physical addresses - to any remote attacker without credentials. The plugin's draft-retrieval endpoint performs no authorization check, meaning any unauthenticated HTTP request can enumerate or retrieve stored draft submissions. A publicly available exploit exists, though EPSS remains low at 0.16%, suggesting limited widespread automated scanning to date but real feasibility for targeted data harvesting against sites using this plugin.
Unauthenticated email enumeration in the Login & Register Forms WordPress plugin (versions 3.0.0 through 4.0.1) exposes all registered user email addresses, including administrator accounts, via a flawed password reset mechanism. The plugin neither verifies that a reset request originates from the account owner nor adequately redacts email addresses in its HTTP response, allowing any unauthenticated attacker to harvest a site's full user roster through repeated requests. A publicly available proof-of-concept exploit exists, though EPSS remains low at 0.16%, indicating limited observed exploitation at time of analysis despite the trivial attack complexity.
DLL hijacking in the LINE for Windows installer (LineInst.exe) enables arbitrary code execution when a victim runs the installer after an attacker has pre-positioned a malicious Msftedit.dll in the same directory. All LINE for Windows versions prior to 26.4.0 load this Microsoft Rich Edit control library via a relative path, bypassing Windows secure DLL loading practices and allowing the installer's current directory - commonly a user-writable location such as Downloads - to shadow the legitimate System32 copy. No public exploit code has been identified and no active exploitation has been confirmed; the vulnerability is transient, existing only during the installation phase and not in the running application.
Missing capability checks in the File Manager WordPress plugin before version 6.9.1 expose the entire WordPress installation directory to any authenticated user, including low-privilege subscribers. Exploitation allows traversal of server-side directories and download of sensitive file types such as archives and documents, which frequently contain database credentials, configuration backups, and private documents. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting opportunistic rather than widespread automated exploitation at this time; no CISA KEV listing is present.
Unauthenticated information disclosure in the File Manager WordPress plugin before 6.9.1 exposes a REST API route without any authorization controls, allowing any remote user to retrieve the plugin's complete file activity log. The leaked log reveals filesystem paths within the WordPress installation and the usernames of administrators who performed file operations, providing reconnaissance data useful for chaining further attacks. A publicly available proof-of-concept exploit exists per WPScan's disclosure, though EPSS at 0.16% (5th percentile) indicates limited observed exploitation activity; the vulnerability is not listed in CISA KEV.
Integer overflow and underflow flaws in GStreamer's gst-plugins-ugly ASF demuxer expose systems to denial of service and limited heap data disclosure when processing attacker-controlled media files. The asfdemux plugin fails to adequately validate length and size fields inside ASF/WMV/WMA header objects, allowing arithmetic overflows to bypass bounds checks and trigger out-of-bounds heap reads. Any application or user that opens an untrusted media file through a GStreamer pipeline - browsers, media players, thumbnailers - is exposed; no public exploit or CISA KEV listing has been identified at time of analysis.
WPC Order Tip for WooCommerce plugin (all versions before 3.3.1) exposes sensitive customer order data to unauthenticated remote attackers via an unprotected reporting feature that performs no authorization or nonce verification. Any unauthenticated party with network access to the WordPress store can query the endpoint and retrieve billing names, order IDs, statuses, fee amounts, and order dates for any customer. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; EPSS sits at the 4th percentile, indicating low current exploitation activity despite a high CVSS score.
Unauthenticated column enumeration in the WP Data Access WordPress plugin (all versions before 5.5.79) allows remote attackers to read arbitrary database column values from any table bound to a public front-end form, with the most critical exposure occurring when that table is the WordPress users table - enabling retrieval of all stored password hashes. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms zero-barrier network exploitation with no authentication required. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) indicates negligible observed exploitation activity, though the attack surface is straightforward once a vulnerable form is located.
GeoDirectory WordPress plugin versions before 2.8.169 leak the title and exact geographic coordinates of non-public (pending or draft) listings to unauthenticated HTTP requests due to a missing authorization check on the map marker data endpoint. Any internet-accessible WordPress site running an affected version inadvertently exposes private listing location data to anonymous callers. No public exploit code has been identified at time of analysis, and the vendor has released a fix in version 2.8.169.
WP Directory Kit versions before 1.5.5 expose the plugin's full settings - including sensitive API keys and third-party secrets - to any authenticated WordPress user, including low-privileged Subscribers, due to missing authorization and nonce validation on an AJAX endpoint. A vendor-released patch (version 1.5.5) is available, and a publicly available proof-of-concept exploit has been published by WPScan. Despite POC availability, EPSS sits at 0.14% (4th percentile), suggesting limited opportunistic exploitation at this time though the technical barrier to abuse is very low.
Unauthenticated user enumeration in the Admin Safety Guard WordPress plugin (versions before 1.4.0) exposes the full registered user list - including usernames, email addresses, assigned roles, and two-factor authentication enrollment status - to any unauthenticated HTTP caller via an unprotected REST API endpoint. The irony is significant: a plugin marketed specifically for login security and brute-force protection inadvertently facilitates credential-stuffing and targeted attack preparation by leaking the exact user data attackers need. A publicly available proof-of-concept exploit exists, though EPSS sits at only 0.18% and CISA has not added this to the Known Exploited Vulnerabilities catalog.
Cryptographic key material in Bouncy Castle for Java FIPS (BC-FJA) persists in the JVM heap far beyond its intended lifetime on Java 12 and later runtimes because the library's zeroisation scheme relies on Object.finalize(), a mechanism progressively de-emphasized since Java 9 and deprecated for removal in Java 18. Under load, the single finalizer thread cannot retire pending objects as fast as they are allocated, causing the queue to grow without bound - resulting in an OutOfMemoryError that crashes the application and defeating the cryptographic hygiene goal of prompt key zeroisation. No public exploit is identified at time of analysis; however, any network-accessible application built on BC-FJA prior to the fixed versions is exposed to both a remotely triggerable denial-of-service and prolonged in-memory residence of sensitive key material.
Consensus quorum bypass in Klever-Go prior to v1.7.20 allows a low-privileged block producer to satisfy the two-thirds validator signature threshold using phantom padding bits in the PubKeysBitmap rather than genuine validator signatures. Because the BLS aggregate-signature check ignores bits beyond the consensus group size while the quorum counter does not, a crafted block header with set padding bits appears validly signed without a real supermajority, undermining blockchain finality and consensus safety. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 1.7.20.
Authorization bypass in Pathling Server (prior to 2.0.0) allows an authenticated caller holding only coarse operation-level permissions (e.g., `pathling:search`) to access arbitrary FHIR resource types without possessing the required per-resource authority (e.g., `pathling:read:Patient`), enabling unauthorized disclosure of clinical health records across the FHIR repository. The root cause is that typed search, update, and related FHIR handlers are annotated solely with `@OperationAccess(...)` and omit the second-layer per-resource authority check mandated by the documented authorization model. No public exploit has been identified at time of analysis and a vendor-released patch is available in version 2.0.0.
Credential exfiltration in Pathling Server prior to 2.0.0 allows an allowed submitter to hijack the bulk-submit OAuth flow by supplying an attacker-controlled `oauthMetadataUrl` parameter that is never validated against the server's configured `pathling.bulkSubmit.allowableSources` allowlist. Pathling blindly fetches OAuth metadata from the caller-supplied URL, trusts the returned `token_endpoint`, and transmits stored OAuth client credentials directly to the attacker's infrastructure. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the credential theft impact is severe for any healthcare organization running FHIR bulk data pipelines on this platform.
Remote denial of service in gopacket through version 1.7.0 can crash any Go application that processes untrusted network packets via DecodingLayerParser or direct DecodeFromBytes calls. Eleven protocol decoders - including TLS, DHCPv4, GTPv1U, IPSec AH, Diameter, and RadioTap - consume attacker-controlled length, count, or offset fields from raw packet headers before verifying them against the actual buffer size, causing an unrecovered Go runtime panic that terminates the processing goroutine or application. No active exploitation has been confirmed (not listed in CISA KEV), but the zero-privilege network attack surface makes this a credible operational risk for Go-based network monitoring, packet capture, and security tooling.
Insufficient-entropy secret generation in the crypto-js npm library (all 3.x releases except 3.2.0/3.2.1, i.e. versions < 4.0.0) collapses CryptoJS.lib.WordArray.random() to effective search spaces of only ~2^39 (128-bit request) and ~2^47 (256-bit request), letting attackers brute-force any long-term secret produced by it. Downstream cryptocurrency wallets used this function as the entropy source for BIP39 recovery phrases; Coinspect's 'Ill Bloom' investigation reproduced full key recovery and documented coordinated drain waves that stole a lower-bound of ~$5M in assets as of 13 July 2026. This is not in CISA KEV, but a proof of concept exists and real-world theft has been documented by the researchers.
Heap-use-after-free in the Ruby json gem's native C extension (versions 2.20.0 through 2.21.1) allows an unauthenticated remote attacker to crash the Ruby process by supplying a crafted truncated JSON stream with duplicate object keys to any application using JSON::ResumableParser. The root cause is that the parser's input buffer is freed without resetting the state.start, state.cursor, and state.end pointers, which are subsequently dereferenced when partial_value processes the duplicate-key warning path via cursor_position, producing a heap-use-after-free confirmed by AddressSanitizer and a native SIGSEGV on official RubyGem releases. Impact is limited to availability - no code execution or information disclosure is claimed - and no public exploit code has been identified at time of analysis, though a private end-to-end TCP proof-of-concept was submitted with the advisory.
Heap memory disclosure in Imager for Perl (versions 0.45_02 through < 1.034) exposes adjacent heap bytes to any application that processes attacker-supplied JPEG or WEBP images and surfaces EXIF tag values. The root cause is a signed integer underflow in copy_string_tags() that causes strlen() to scan past a zero-count ASCII EXIF entry, copying arbitrary heap contents into the exif_* tag returned to the caller. Publicly available exploit code exists (confirmed by the exifattack.bin fixture in the upstream patch commit), and SSVC rates exploitation as automatable; no CISA KEV listing indicates active mass exploitation has not yet been confirmed.
Out-of-bounds buffer read in ClamAV's Mach-O file format parser allows remote unauthenticated attackers to crash the scanning process, producing a denial-of-service condition on any Cisco Secure Endpoint deployment that processes Mach-O binaries. The flaw stems from missing boundary validation when parsing Mach-O file content, and Cisco explicitly acknowledges the possibility of expanded impacts beyond DoS due to the underlying memory corruption primitive. No public exploit code or active exploitation confirmed in CISA KEV at time of analysis, but the zero-authentication, network-accessible attack surface demands prompt patching for gateway and mixed-OS endpoint deployments.
Out-of-bounds read in ClamAV's PDF file format parser, embedded within Cisco Secure Endpoint, enables unauthenticated remote attackers to crash the scanning process by submitting a specially crafted PDF file. The improper boundary validation during PDF content parsing causes memory corruption that terminates the ClamAV process, resulting in a denial-of-service condition; Cisco's own advisory acknowledges 'possibly other expanded impacts' from the memory corruption, leaving the full impact scope incompletely characterized at publication time. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV, though the zero-privilege network vector makes automated exploitation mechanically straightforward.
Double-free memory corruption in ClamAV's zip archive parser allows an unauthenticated remote attacker to crash the ClamAV scanning process, producing a denial-of-service condition on Cisco Secure Endpoint. Exploitation requires only submitting a crafted zip file to any scanning interface backed by ClamAV, with no authentication or user interaction necessary per the AV:N/AC:L/PR:N/UI:N CVSS vector. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and ubiquitous file-submission attack surface make this a credible operational risk.
Symlink traversal in go-git's worktree filesystem layer allows a maliciously crafted repository to cause write operations to escape the intended worktree boundary when cloned and operated upon. Affected are all filesystem-backed go-git deployments using v5 prior to 5.19.2 and v6 prior to 6.0.0-alpha.5. An attacker who controls a repository can plant symlinks such that a victim's go-git worktree operations (checkout, add, status) silently overwrite files outside the working directory - including critical Git metadata like .git/config - enabling repository poisoning or arbitrary local file corruption. No public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
Hard-coded cryptographic key exposure in Tobit Laboratories TeamDavid Webbox allows any attacker who obtains server-side password files - via direct filesystem access or through the companion 'Random File Read' vulnerability - to reverse the obfuscation applied to locally-created user passwords and recover plaintext credentials. All TeamDavid deployments through Rollout 524 using locally created accounts are affected, making this a critical identity compromise risk for organizations relying on TeamDavid as an M365 alternative. No public exploit has been independently confirmed, but InfoGuard Labs published a 22-CVE research campaign against this product that likely includes technical detail enabling exploitation.
Remote denial-of-service in Tobit Laboratories AG TeamDavid's Webbox application allows unauthenticated network attackers to crash the server by crafting an HTTP password-change request with a non-INI target file of excessive size. The handler activates solely on the presence of the string "(editini)" in the request path with no further validation, triggering a buffer overflow that terminates the server process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the trigger mechanism is fully detailed in the InfoGuard coordinated disclosure.
Unauthenticated NTLM credential theft is possible against Tobit Laboratories AG TeamDavid's Webbox component through Rollout 524 via Server-Side Request Forgery using UNC paths. The search endpoint's 'pathnameroot' parameter accepts network location strings (e.g., \\Server\Share) without sanitization, causing the server to initiate outbound SMB authentication to attacker-controlled infrastructure and leak NTLM hashes or session tokens. Where outbound port 445 is not filtered, an unauthenticated remote attacker can exploit this for SMB relay attacks or offline credential cracking, potentially enabling lateral movement into Active Directory environments. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated memory disclosure in Tobit Laboratories' David (TeamDavid) groupware through Rollout 524 lets remote attackers harvest sensitive server memory - including user passwords - by repeatedly requesting the malformed endpoint "/.well-known/mta-sts.", which causes the application to return raw memory contents in its response. The flaw resembles a Heartbleed-style over-read affecting a self-hosted Microsoft 365 alternative, and no public exploit identified at time of analysis, though it was disclosed as part of a broader research batch (22 CVEs) by InfoGuard Labs and reported via NCSC.ch. With CVSS 4.0 9.2 (Critical), network-reachable and requiring no authentication or user interaction, it is a high-priority disclosure risk wherever David is internet-exposed.
File disclosure in Tobit Laboratories AG's TeamDavid Webbox (through Rollout 524) allows authenticated network users to bypass server-side path filters using NTFS alternate data stream (ADS) notation, enabling access to highly sensitive files including other users' credential files containing plaintext passwords and the server's private key. The flaw exists in the Webbox messaging component where the proprietary '@@attach' directive, supplied via the 'scjob' form field, is processed without adequate path canonicalization - the filter blocking access to David configuration and user directories is bypassed entirely by ADS-encoded paths. No public exploit has been identified at time of analysis, though this vulnerability is part of a multi-CVE research disclosure of 22 issues in the David platform by Infoguard.
Arbitrary file deletion in Tobit TeamDavid's Webbox component allows authenticated users to permanently delete any file on the underlying server by injecting the internal @@COMMENTFILE directive into the scjob form field of the messaging interface. All deployments through Rollout 524 are affected per NVD and NCSC.ch reporting. No public exploit has been identified at time of analysis, though this CVE is one of 22 vulnerabilities disclosed by infoguard.ch in the same research campaign, indicating broad systemic security weaknesses in the product.
Out-of-bounds heap read in Apache Fory C++ versions 0.14.0 through 1.4.x allows attackers supplying crafted deserialization payloads to trigger information disclosure or denial of service. The flaw resides specifically in the tagged integer fast-path deserializer and only manifests when the application processes structs with tagged integer fields. No public exploit or active exploitation has been identified at time of analysis, and a vendor-released patch is available in version 1.5.0.
Unauthenticated REST API bypass in the 'Password Protected - Lock Entire Site' WordPress plugin (versions 2.6.8 through 2.8.3) exposes all password-gated content and account identifiers to unauthenticated visitors when the plugin's REST API restriction option is enabled. This is a confirmed regression of CVE-2024-0437, which was originally patched in version 2.6.7 but silently reintroduced in the very next release (2.6.8), leaving sites unprotected for any version in that range. A publicly available proof-of-concept exists per WPScan, though EPSS sits at 0.15% (4th percentile), indicating limited observed exploitation at time of analysis.
Account takeover in the TrueBooker Appointment Booking and Scheduler System plugin for WordPress (all versions through 1.2.3) lets unauthenticated attackers reset the password of any account, including administrators, because the plugin's password-reset flow never verifies the requester's identity. Successful exploitation yields full control of the targeted account and, via an admin takeover, the entire WordPress site. No public exploit identified at time of analysis, but the CVSS 9.8 rating and trivial network exploitability make this a high-priority patch.
Local privilege escalation in StableBit DrivePool 2.3.13.1687 allows a low-privileged local user to achieve high-impact compromise of confidentiality, integrity, and availability on the affected system. The vulnerability resides in DrivePool.Service.exe and stems from CWE-275 permission issues, with the publicly available exploit reference explicitly identifying insecure deserialization as the attack mechanism enabling escalation. No active exploitation has been confirmed by CISA KEV, but a public proof-of-concept exists and the CVSS 4.0 vector includes E:P (exploit proof-of-concept), elevating real-world risk above theoretical.
Local privilege escalation in StableBit Scanner 2.6.13.4088 allows a low-privileged Windows user to exploit permission misconfigurations in Scanner.Service.exe - the Windows service component of the disk health monitoring tool - to achieve high confidentiality, integrity, and availability impact on the local system. The exploit reference titles the technique as 'local privilege escalation via insecure deserialization,' suggesting the ScannerService's IPC or communication surface deserializes attacker-controlled data without adequate permission enforcement. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists per VulDB and the referenced PoC page, though no CISA KEV listing confirms active in-production exploitation.
Out-of-bounds kernel memory read and GPU use-after-free in Imagination Technologies Graphics DDK exposes systems to kernel memory disclosure and potential arbitrary page corruption by local, non-privileged users. Incorrect array index validation in the GPU driver stack allows crafted GPU system calls to bypass kernel memory safety boundaries, resulting in both information disclosure (kernel memory read) and high-availability impact (UAF of arbitrary GPU-managed pages). No public exploit code or active exploitation has been identified; EPSS sits at 0.14% (4th percentile), indicating very low current exploitation probability.
Untrusted pointer dereference in Imagination Technologies Graphics DDK allows a local attacker with Rich Execution Environment (REE) kernel control to corrupt GPU Firmware data across the TEE security boundary. The GPU Firmware blindly dereferences a pointer sourced from non-secure memory when moving internal data between tightly coupled private memory and main memory - a trust boundary violation that undermines the fundamental isolation guarantee of Trusted Execution Environment platforms. No active exploitation has been confirmed (CISA KEV absent), and EPSS sits at 0.15% (5th percentile), but the cross-domain nature of this flaw makes it relevant for embedded, mobile, and automotive threat models where TEE integrity is a security anchor.
Remote code execution in Azure Confidential Ledger allows an authorized attacker with elevated privileges to invoke an exposed dangerous method over the network and run arbitrary code, with a scope change (S:C) that lets the impact reach beyond the initially compromised component. Microsoft rates it CVSS 9.1 (Critical); there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because Azure Confidential Ledger is a managed cloud service, remediation is delivered server-side by Microsoft rather than by customer patching.
Privilege escalation in the Microsoft Entra Provisioning Service (SyncFabric) allows an already-authorized, low-privileged network attacker to elevate privileges via a path-traversal sequence ('.../...//'), with a scope change (S:C) that lets impact cross into other security domains such as the underlying identity/provisioning tenant. Rated CVSS 9.9, the flaw yields high confidentiality, integrity, and availability impact and requires no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the near-maximum score and low attack complexity make it a high-priority issue for the affected cloud service.
Privilege elevation in Microsoft Azure Active Directory (Entra ID) lets an already-authenticated, low-privileged attacker tamper with data the platform treats as immutable to gain higher-privileged access over a network. The CVSS 3.1 score of 9.9 reflects a scope change (S:C), meaning the compromise crosses the security boundary of the low-privilege account into the broader identity tenant. No public exploit identified at time of analysis and the issue is not currently listed in CISA KEV; note that despite Microsoft's 'Information Disclosure' tag, the CWE and CVSS impact metrics actually describe an elevation-of-privilege condition.
Out-of-bounds read in TimescaleDB's bulk text dictionary decompressor allows authenticated database users with DML access to crash PostgreSQL backends or produce corrupt aggregation results by injecting a crafted Simple8b selector-11 value into a compressed hypertable. The defect bypasses Arrow dictionary-index validation and is reached through the VectorAgg single-text hashing aggregation path, making it exploitable via ordinary SQL DML and SELECT operations against an affected compressed chunk. No public exploit code has been identified at time of analysis, and the fix is available as upstream commit 517c13e (PR #10360) but has not been confirmed in a tagged release.
Out-of-bounds read in TimescaleDB's Dictionary compression reverse row iterator (versions through 2.29.1) allows an authenticated database user with DML privileges on a compressed hypertable to exfiltrate backend process memory-including the PostgreSQL shared buffer pool-as ordinary column values that bypass SQL access controls. The vulnerability arises because the forward decompression path validates the Simple8b-encoded dictionary index while the reverse path relied solely on a debug assertion stripped from release builds, leaving the read offset fully attacker-controlled. No public exploit has been identified at time of analysis, and a fix is available upstream via commit 517c13e and PR #10360, though a tagged release version has not been independently confirmed from the available data.
Denial of service in TimescaleDB through 2.29.1 allows authenticated database users holding DML privileges on a compressed hypertable to permanently crash the PostgreSQL backend on any reverse-order scan. The root cause is an unsigned integer underflow in the Gorilla compression reverse row iterator's bucket index computation when decompressing a crafted BitArray with zero elements, triggering a SIGSEGV that recurs on every subsequent reverse scan of the affected chunk until the malicious datum is removed or the database is patched. No public exploit has been identified at time of analysis and CISA KEV listing is absent, but the persistence of the malicious datum and low attack complexity make this a high-priority patch for any TimescaleDB deployment exposing DML access to untrusted users.
NoSQL injection in Dgraph prior to 25.3.8 enables unauthenticated remote attackers to inject DQL operators through unvalidated regexp filter arguments in GraphQL queries and mutations, bypassing intended node-level access controls. The `maybeQuoteArg` function in `graphql/resolve/query_rewriter.go` writes regexp arguments verbatim into generated DQL without validating the `/pattern/flags` structure, allowing a crafted filter value like `/x/) OR has(pred` to close the regexp call and append attacker-controlled DQL expressions. No confirmed active exploitation at time of analysis and no CISA KEV listing, but the fix commit includes a working injection payload as a regression test, confirming ease of exploitation against accessible endpoints.
Out-of-bounds write in the Contiki-NG MQTT client (os/net/app-layer/mqtt/mqtt.c) lets a malicious or compromised MQTT broker overflow a 65-byte topic[] buffer and corrupt the adjacent payload_chunk pointer, producing an arbitrary-pointer-write primitive that can escalate to remote code execution on embedded targets lacking memory protection. The flaw stems from parse_publish_vhdr() setting topic_len_received=1 before enforcing the 64-byte topic length limit, so an over-length topic split across TCP segments bypasses the guard on parser re-entry and reaches a memcpy() that trusts the unvalidated 16-bit topic_len. Because the stack has no TLS, the plaintext channel also exposes devices to network man-in-the-middle injection; there is no public exploit identified at time of analysis and it is not in CISA KEV.
Out-of-bounds memory read in Contiki-NG's DNS/mDNS resolver exposes adjacent device memory and can crash the resolver on constrained IoT hardware. The root defect is in `skip_name()` within `os/services/resolv/resolv.c`, which traverses DNS wire-format name labels with no packet-boundary guard; the caller `newdata()` drives iteration using an attacker-controlled `nquestions` field from the DNS header before the transaction ID is validated, enabling an attacker to force the function past the end of `uip_buf`. On mDNS-enabled builds, any local-segment peer can trigger this unauthenticated with a single multicast UDP packet to port 5353 and no outstanding query required; on standard DNS builds, an attacker able to inject a spoofed DNS response during an active query achieves the same effect. No public exploit has been identified at time of analysis.
Out-of-bounds heap read in Contiki-NG's LwM2M TLV parser discloses adjacent heap memory - including cryptographic key material and peer IP addresses - to any unauthenticated network attacker. The flaw in `lwm2m_tlv_read()` (os/services/lwm2m/lwm2m-tlv.c) is triggered by a single crafted CoAP WRITE request whose final TLV supplies exactly one byte, causing the parser to read up to five bytes beyond the buffer boundary. Because LwM2M NoSec mode is the default for constrained IoT devices, no authentication is required, and the upstream fix is confirmed in commit f1673b5766d4d4d514cefb8a0350f43653574997 (PR #3165) but a tagged release has not been independently confirmed. No public exploit or CISA KEV listing has been identified at time of analysis.
Unlimited passphrase brute-force is possible against any known account in OpenReception's appointment booking platform prior to version 1.0.2, because the `/api/auth/login` endpoint's passphrase branch never invokes the existing `challengeThrottleService` that correctly rate-limits the WebAuthn path. The asymmetry - confirmed by the fix commit wiring the same throttle infrastructure into the passphrase branch - means an unauthenticated remote attacker can sustain roughly 10 passphrase guesses per second per account, bounded only by Argon2 verification cost. Combined with a 12-character minimum policy that enforces no entropy or dictionary checks, accounts using common base patterns are realistically compromised in days on a single CPU or hours on a small GPU cluster. No public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exfiltration via the tenant API in OpenReception appointment-booking-software prior to v1.0.2 allows any authenticated TENANT_ADMIN to retrieve the full PostgreSQL connection string - including plaintext password - for the shared database instance. In default docker-compose.prod.yml deployments, those credentials belong to the postgres superuser (rolsuper=true), granting the attacker read-write access to every tenant's database, all GLOBAL_ADMIN password hashes and session records, and superuser-level PostgreSQL functions (pg_read_server_files, COPY FROM PROGRAM) usable for container-level escalation. No public exploit code or CISA KEV entry exists at time of analysis; EPSS data was not provided, but the CVSS S:C scope change and the cross-tenant blast radius make this a high-priority patch target for any operator running the affected version.
OpenReception's appointment booking platform (prior to v1.0.2) leaves server-side sessions active for up to one week after a user explicitly logs out, due to an operation-ordering bug in the SvelteKit logout route. An attacker who has already obtained a copy of the victim's access token - through network interception, browser storage access on a shared device, or another independent theft vector - can continue making fully authenticated API calls against the platform even after the victim believes their session has ended. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the C:H/I:H impact reflects unrestricted access to the victim's appointment API surface for the duration of the unexpired session.