Information Disclosure
Monthly
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Denial of service in Apache Thrift Ruby bindings before 0.24.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed data. No active exploitation or public exploit code has been observed at time of analysis. Upgrading to version 0.24.0 resolves the vulnerability.
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or tamper with communications by presenting a valid certificate for a different hostname. The vulnerability affects all c_glib bindings prior to version 0.24.0 and can lead to complete compromise of confidentiality and integrity of Thrift RPC traffic. No active exploitation or public exploit code has been reported, but the fix is available in version 0.24.0.
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.
Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
TLS certificate validation is entirely disabled in epa4all (med-united, all releases prior to 2026-05-20), allowing any network-adjacent attacker positioned on the path between the epa4all service and its healthcare backends to intercept and modify sensitive traffic using a self-signed certificate. For Konnektor and IDP connections, this exposes smartcard PIN operations and OIDC authentication exchanges in plaintext; for the ePA Aktensystem backend, the absent transport-layer verification directly enables the chained VAU-protocol MITM attack documented in the related advisory GHSA-vvh7-x6c7-46gh. No public exploit has been identified and no KEV listing exists; the vendor released a fix in the 2026-05-20 tag.
Memory corruption in libssh2's publickey response parser allows a malicious SSH server to leak heap pointers and corrupt the heap, potentially leading to remote code execution. The issue affects libssh2 versions up to 1.11.1 and is triggered when a client connects to an attacker-controlled SSH server and fetches public keys, with no authentication required on the server side. A patch is available in commit a13bb6c, though no tagged release includes the fix yet; no active exploitation or public exploit code is currently reported.
Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.
Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.
A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Remote code execution in Microsoft Surface Management Services exposes networks to exploitation by authenticated low-privilege users who can send malformed input over the network to trigger arbitrary code execution. Affecting all tracked versions per CPE cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:*, the vulnerability carries a CVSS 8.8 High rating with full confidentiality, integrity, and availability impact. No public exploits identified at time of analysis and EPSS at 0.71% suggests low current exploitation probability; the vulnerability is absent from the CISA KEV catalog.
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Predictable cryptographic randomness in Silicon Labs' Matter implementation for the SiWx917 wireless SoC allows attackers to reconstruct DRBG output because an entropy-initialization bug seeds the deterministic random bit generator with a predictable value, so every device produces the same stream of 'random' numbers. Any keys, nonces, or session material derived from this generator in the affected Matter code are therefore guessable, undermining confidentiality of secured communications on affected devices. The issue was found only after the repository was deprecated; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves sessions valid longer than they should be, so an attacker who obtains a still-active session token can access the managed file transfer application without re-authenticating. Progress rates this CVSS 9.8 with total technical impact, though the CWE-613 root cause makes the unauthenticated network vector worth verifying. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Unauthenticated information disclosure in the Convert Forms extension for Joomla (versions 2.5.0 through 5.2.2) lets any anonymous visitor enumerate and read a form's stored submissions because the front-end Submissions view fails to enforce access control. Submitted data frequently contains PII such as names, email addresses, phone numbers, and free-text messages, so exposure can be significant. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate-revocation bypass in Netty's OcspServerCertificateValidator (netty-handler-ssl-ocsp, versions <4.1.136.Final and 4.2.0.Final-4.2.16.Final) allows a malicious server presenting a revoked certificate to receive sensitive client data during a race window. The validator forwards the SslHandshakeCompletionEvent to downstream handlers before the asynchronous OCSP check finishes, so client applications treat the connection as trusted and may transmit or process application data before the revoked channel is closed. Publicly available exploit code exists (PoC in the GHSA advisory); no public active exploitation has been reported and the vulnerability is not in CISA KEV.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.
Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling a signed zone to inject validly-signed NSEC records whose 'Next Domain Name' field points outside the signer's own zone, letting forged proofs of non-existence be applied to names the zone was never authorized to speak for. Because BIND fails to enforce that the NSEC chain stays within the signer's authority, an attacker can assert that arbitrary names in other zones do not exist, poisoning resolver behavior across zone boundaries (CVSS 8.6, Scope:Changed, integrity impact). There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing and content of authoritative responses to paired queries. When a client asks named to resolve a DNAME plus an A record beneath it (or a CNAME plus an A record for the same name) and the attacker-controlled authoritative server answers the A query positively but delays the DNAME/CNAME response before returning a negative or self-referential answer, named hits a fatal assertion and terminates. The flaw is unauthenticated and network-reachable (CVSS 7.5, availability-only); there is no public exploit identified at time of analysis and it is not on CISA KEV.
Local privilege escalation in the Linux kernel FUSE subsystem allows a low-privileged attacker to corrupt kernel memory
Local privilege escalation in the Linux kernel's fuse-uring subsystem allows a local attacker to trigger a use-after-free condition by racing with the async stop queues function, potentially resulting in arbitrary code execution and complete system compromise. The vulnerability affects Linux kernel versions 6.14 through 6.18.x (patched in 6.18.39, 7.1.4,
A race condition in the Linux kernel's fuse-uring subsystem allows a local user to achieve privilege escalation and full system compromise. The vulnerability, triggered by concurrent operations on the queue->stopped flag outside of locking, leads to a use-after
Use-after-free in the Linux kernel’s fuse-uring subsystem allows a local authenticated attacker to escalate privileges. The race condition occurs when a malicious userspace sends a commit SQE before the kernel completes the memcpy of request data, triggering a freed fuse_req to be reused. CVSS base score is 7.8 but EPSS probability is low (0.21%), and no public exploit or active exploitation has been reported.
Memory exposure and denial of service in the Linux kernel SMB client allows remote attackers to read kernel memory or crash the system via crafted SMB2 responses. The vulnerability exists in versions prior to the patched releases, affecting all systems mounting SMB shares from untrusted servers. No authentication or user interaction is required, and while no active exploitation is reported, the high CVSS score reflects the serious confidentiality and availability impact.
HTTP request smuggling in libsoup (GNOME's HTTP client/server library) enables network-accessible attackers to inject hidden requests into backend streams by exploiting a parsing differential between libsoup's permissive chunked transfer encoding parser and strict RFC 9112-compliant frontend proxies. All libsoup versions are affected as tracked under CPE cpe:2.3:a:gnome:libsoup, with confirmed vendor impact across Red Hat Enterprise Linux 6.0 through 10.0. No public exploit code or active exploitation has been identified at time of analysis; SSVC classifies exploitation as none with non-automatable, partial technical impact.
Apache Thrift C++ library's THeaderTransport::readString() fails to properly validate info-header length, allowing an out-of-bounds read. An attacker sending a specially crafted Thrift message can trigger this to read beyond the buffer, potentially leaking sensitive memory contents. Remote unauthenticated exploitation is possible against any service using vulnerable bindings, and the issue is fixed in version 0.24.0.
Denial of service in Apache Thrift Node.js server bindings before 0.24.0 allows remote attackers to exhaust server CPU resources via crafted requests that trigger quadratic-time processing in the receive transport. No active exploitation or public exploit is known at
Denial of service in Apache Thrift Ruby bindings before 0.24.0 allows unauthenticated remote attackers to exhaust server resources by sending highly compressed data. No active exploitation or public exploit code has been observed at time of analysis. Upgrading to version 0.24.0 resolves the vulnerability.
Data amplification vulnerability in Apache Thrift's TZlibTransport allows remote attackers to exhaust server resources by sending highly compressed data that decompresses to disproportionate sizes. Affecting all language bindings before version 0.24.0, the flaw enables denial of service via ZIP-bomb-style attacks. Upgrading to Thrift 0.24.0 provides a fix.
TLS hostname verification bypass in Apache Thrift C++ bindings allows man-in-the-middle interception of Thrift RPC communications. The vulnerability resides in the TSSLSocket matchName() function's handling of wildcard certificates per RFC 6125, permitting an attacker with a crafted certificate to impersonate a legitimate server. Upgrading to version 0.24.0 fixes the flaw; no active exploitation or public exploit has been identified at this time.
Improper certificate validation in Apache Thrift c_glib TLS clients allows man-in-the-middle attackers to intercept or tamper with communications by presenting a valid certificate for a different hostname. The vulnerability affects all c_glib bindings prior to version 0.24.0 and can lead to complete compromise of confidentiality and integrity of Thrift RPC traffic. No active exploitation or public exploit code has been reported, but the fix is available in version 0.24.0.
Denial of service in Apache Thrift 0.x before 0.24.0 allows remote attackers to exhaust server memory via crafted zlib-compressed payloads in the Python THeaderTransport layer. The flaw permits a small compressed request to decompress into an excessively large memory allocation, causing service disruption. No public exploit code or active exploitation is known, and the vulnerability is rated important by the Apache project.
Privilege escalation in Weintek cMT3092X HMI and EasyWeb allows authenticated non-privileged users to modify cookies to gain elevated privileges. Affected firmware versions before 20210218 and EasyWeb versions before v2.1.20 are susceptible, with no public exploit code or active exploitation reported. EPSS probability is low (0.32%), indicating limited real-world exploitation likelihood.
Plaintext storage of user account passwords in Weintek cMT3092X HMI firmware and EasyWeb exposes credentials to any network-based attacker with low-privileged authenticated access. Successful exploitation leads to full confidentiality compromise as stored passwords can be read directly. No active exploitation or public exploit code has been identified, and a vendor patch is available.
Unauthorized data modification in Weintek EasyWeb allows authenticated low-privilege attackers to alter read‑only data, compromising system integrity. Affected versions are EasyWeb prior to v2.1.20 and cMT3092X firmware prior to 20210218. No active exploitation is known, and low EPSS score indicates limited real‑world risk.
Memory corruption and information disclosure in Imagination Graphics DDK allows remote unauthenticated attackers to exploit an integer overflow when calculating physical offsets for sparse PMRs larger than 4 GB, causing GPU MMU mapping errors that grant access to unintended physical memory. The vulnerability has a CVSS score of 9.8 and is considered automatable, but EPSS indicates low exploitation probability (0.14%) and no active exploitation or public exploit code is known at this time.
Uninitialized heap memory disclosure in FFmpeg's LCL/ZLIB video decoder (lcldec.c, through version 8.1.2) allows a remote attacker to exfiltrate heap contents - including pointer-derived allocator metadata - by supplying a crafted media file containing a syntactically valid zlib stream that inflates to fewer bytes than the declared frame size. The zlib_decomp() function treats a short-decompress result as non-fatal and falls through to the RGB24 conversion path, which reads full-frame-dimension rows from the partially-filled allocation buffer, copying uninitialized bytes into the attacker-observable AVFrame output. The practical threat is ASLR bypass in long-lived media processing services, making this a potential stepping stone in a multi-stage exploit chain rather than a standalone critical issue. No public exploit code exists and EPSS is 0.26% (17th percentile); CISA SSVC rates exploitation as none at time of analysis.
TLS certificate validation is entirely disabled in epa4all (med-united, all releases prior to 2026-05-20), allowing any network-adjacent attacker positioned on the path between the epa4all service and its healthcare backends to intercept and modify sensitive traffic using a self-signed certificate. For Konnektor and IDP connections, this exposes smartcard PIN operations and OIDC authentication exchanges in plaintext; for the ePA Aktensystem backend, the absent transport-layer verification directly enables the chained VAU-protocol MITM attack documented in the related advisory GHSA-vvh7-x6c7-46gh. No public exploit has been identified and no KEV listing exists; the vendor released a fix in the 2026-05-20 tag.
Memory corruption in libssh2's publickey response parser allows a malicious SSH server to leak heap pointers and corrupt the heap, potentially leading to remote code execution. The issue affects libssh2 versions up to 1.11.1 and is triggered when a client connects to an attacker-controlled SSH server and fetches public keys, with no authentication required on the server side. A patch is available in commit a13bb6c, though no tagged release includes the fix yet; no active exploitation or public exploit code is currently reported.
Double-free heap corruption in libssh2's SFTP client allows a malicious SSH server to corrupt the memory of any authenticated client that opens an SFTP session. This vulnerability, present in libssh2 through 1.11.1, can be triggered via a crafted server response during the `sftp_open()` operation, leading to tcache poisoning and potential arbitrary code execution on the client. No active exploitation has been confirmed, and no public PoC is known at this time, though the EPSS score is low (0.29%).
Out-of-bounds memory access in the Linux kernel’s iwlwifi wireless driver allows a remote attacker on the same WiFi network to corrupt kernel memory, potentially leading to code execution or system crash. The flaw occurs in Block Acknowledgment session handlers where the sta_mask field is not checked before being used to index an array, causing a wrap-around when the mask is zero. Affected are kernel versions prior to 6.18.38 and 7.1.3; no active exploitation or public exploit code is known at this time, and EPSS indicates a low probability of exploitation.
Use-after-free in the Linux kernel's power sequence (pwrseq) debugfs seq_file handler allows a local attacker with low privileges to achieve privilege escalation or system compromise. The flaw arises from incorrect device reference counting in the seq_next callback, leading to reuse of a freed pointer. Affected kernels include versions since commit 249ebf3f65f8530beb2cbfb91bff1d83ba88d23c; no active exploitation or public exploit has been confirmed at the time of analysis.
Use-after-free in the Linux kernel FPGA region subsystem allows a local authenticated attacker with low privileges to corrupt kernel memory, potentially achieving full confidentiality, integrity, and availability impact. The flaw in `child_regions_with_firmware()` stems from `of_node_put(child_region)` freeing the node before `pr_err()` dereferences the same pointer on an error path - a deterministic UAF triggered by a specific error condition in FPGA device tree enumeration. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), placing this firmly as a maintenance-priority fix for most environments rather than an emergency response item.
Out-of-bounds read in KVM's x86 Hyper-V paravirtualization layer allows a guest attacker with L2 nested VM control to read host kernel memory or trigger a hypervisor crash. The VP (Virtual Processor) ID field from the enlightened VMCS is used without bounds validation in `hv_is_vp_in_sparse_set()` when servicing paravirtual TLB flush hypercalls for L2 guests; the TLFS defines a maximum of 4096 VP IDs (64 banks × 64 vCPUs), but an L2 guest can supply an arbitrary value, causing an out-of-bounds array read confirmed by a KASAN use-after-free splat in the commit. No public exploit code exists at time of analysis, and EPSS sits at 0.16% (5th percentile), reflecting niche real-world exposure.
Use-after-free in the Linux kernel's linkstation-poweroff driver exposes systems running affected kernel versions on Buffalo LinkStation NAS hardware to local privilege escalation. The flaw resides in linkstation_poweroff_init(), where of_node_put(dn) was called before of_match_node() finished using the pointer, producing a kernel-space use-after-free that can corrupt slab-allocated memory. No public exploit has been identified and the EPSS score of 0.16% (6th percentile) indicates very low observed exploitation probability, though the official CVSS base severity is 7.8 (High) with confirmed high impact to confidentiality, integrity, and availability.
Use-after-free in the Linux kernel fbdev subsystem's fb_find_mode() function allows a local attacker with low privileges to read freed kernel heap memory, potentially achieving information disclosure, memory corruption, or privilege escalation. The flaw exists when mode_option is NULL: a heap-allocated buffer (mode_option_buf) is freed while the local alias name still references it during the name_matches() comparison loop. Patched versions are available across multiple stable branches (6.6.144, 6.12.95, 6.18.38, 7.1.3, 7.2-rc1). No public exploit exists and EPSS sits at the 6th percentile, but the CVSS 7.8 High score correctly reflects the maximum-impact potential of kernel-level heap memory corruption.
Improper bounds checking in the Linux kernel's ASoC simple-mux driver allows a local attacker with low privileges to cause an out-of-bounds array index, leading to kernel memory disclosure and system crash. The driver erroneously accepts the maximum enum value (2) as valid for a two-entry mux, enabling an invalid mux state to propagate into GPIO and DAPM operations. Vendor patches are available for affected stable kernels, and no public exploit or active exploitation is known at this time.
Double free corruption in the Linux kernel's net2280 USB gadget driver probe error path enables local low-privilege users to corrupt kernel heap memory, potentially escalating privileges or triggering a system crash. The flaw affects all Linux kernel stable branches from 5.10 through 7.x prior to their respective patch releases (5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, 7.1). Discovered by static analysis rather than active exploitation - no public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.17% (6th percentile), consistent with the niche hardware dependency of the affected driver.
Use-after-free in the Linux kernel DAMON (Data Access Monitor) sysfs subsystem allows a local, low-privileged user with sysfs write access to corrupt kernel memory structures, potentially escalating to full kernel-level code execution. The DAMOS tried-region directory removal function (damon_sysfs_scheme_regions_rm_dirs()) decrements kobject reference counts but omits removing region objects from the tracking linked list; asynchronous execution of the kobj release callback leaves dangling list entries that a concurrent list rebuild can write into freed memory. No public exploit or active exploitation has been identified - EPSS is 0.16% (5th percentile) and the vulnerability is absent from CISA KEV - consistent with a hardening fix rather than an actively weaponized flaw.
Out-of-bounds read in the Linux kernel elan_i2c touchpad driver allows a local authenticated user to leak kernel memory or crash the system by supplying a malformed firmware blob. The driver fails to validate that the firmware file is large enough to contain the expected number of pages plus the trailing signature before accessing them, affecting all stable kernel branches from 5.10.x through 7.x prior to their respective fix versions. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.17% (6th percentile), indicating this is a local hardware-driver concern rather than an imminent widespread threat.
A kernel crash (BUG_ON) in the block layer's integrity segment handling can be triggered on systems using dm-multipath over NVMe/RDMA with data integrity protection. The vulnerability arises when a cloned request inherits an incorrect nr_integrity_segments count from the upper queue, causing a mismatch that panics the kernel during dispatch. Only local authenticated users with the ability to issue I/O to the affected stacked device can exploit this, leading to a denial of service.
Local privilege escalation in the Linux kernel's sched_ext subsystem allows a low-privileged local attacker to achieve root access via a use-after-free error in the scx_root_enable_workfn() initialization failure path. The vulnerability is fixed by reordering the put_task_struct() call after scx_error() to prevent premature freeing of the task structure. No active exploitation or public exploit has been reported, and EPSS indicates low exploitation likelihood.
Double free memory corruption in the Linux kernel's OcteonTX2 PF representor driver allows a local low-privileged user on hardware-equipped systems to corrupt kernel slab allocator state via rvu_rep_rsrc_init(), potentially enabling privilege escalation to root. The defect was identified by an experimental static analysis tool during review of v6.13-rc1 and confirmed present through v7.1-rc3 via manual inspection. No active exploitation is confirmed (not in CISA KEV), no public exploit code exists, and vendor-released patches are available across multiple stable kernel branches.
Out-of-bounds heap read in the Linux kernel mac80211 WiFi stack allows an adjacent wireless attacker with no authentication to trigger a slab-out-of-bounds read by sending a crafted 802.11be negotiated TTLM element with a sparse link-map presence bitmap. Affected kernels from 6.9 through 6.12.91, 6.18.33, and 7.0.10 advance the TTLM parser cursor for every TID regardless of whether a presence bit is set, reading past the validated element allocation. The raw read bytes are gated by valid_links before any driver state change, limiting direct policy impact; the primary risk is kernel crash (availability). No public exploit or CISA KEV listing exists; EPSS is 0.17%.
Double free in the Linux kernel's octeontx2-pf driver allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw is in the error-handling paths of otx2_pool_aq_init() and cn20k_pool_aq_init(), where a freed stack pointer is not set to NULL and is subsequently freed again during cleanup. Exploitation requires a system with OcteonTX2 or
Local privilege escalation in the Linux kernel's ti-qspi SPI driver results from a use-after-free when DMA setup fails, allowing a local attacker to potentially execute arbitrary code or crash the system. The vulnerability affects Linux kernels from version 4.12 up to the patched stable releases 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1. No active exploitation has been confirmed (CISA KEV not listed), and the EPSS probability is low (0.18%), indicating limited real-world likelihood.
Use-after-free in the Linux kernel's batman-adv BLA backbone gateway purging allows local attackers to escalate privileges. When stale backbone_gw entries are freed without properly synchronizing or canceling their pending `report_work` items, a race condition can cause the worker to access freed memory, leading to memory corruption and potential code execution with kernel privileges. Exploitation requires local low-privilege access and a system running the batman-adv module with backbone gateways active; no public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel’s netfs library allows a local attacker to escalate privileges or cause denial of service. The race condition occurs when unlocking abandoned read folios after a netfs request completes, potentially corrupting kernel memory. No active exploitation or public exploit is known at this time.
Out-of-bounds read in the Qualcomm QMP USB-C PHY driver (`phy: qcom: qmp-usbc`) of the Linux kernel allows a local low-privileged user to read kernel memory beyond the bounds of the `swing_tbl` and `pre_emphasis_tbl` DisplayPort signal-tuning arrays, risking kernel memory disclosure or a kernel panic. The root cause is an off-by-one error where the boundary guard uses `> 4` instead of `>= 4`, permitting array index 4 on 4-element (0-3) rows. Exploitation is constrained to Qualcomm SoC hardware with USB-C DisplayPort capability; EPSS at 0.15% (5th percentile) and the absence of a KEV listing indicate no public exploit and very low current exploitation probability.
A remote denial-of-service vulnerability in the Linux kernel's AF_RXRPC subsystem allows unauthenticated attackers to crash the system by sending malicious RxGK-secured DATA packets. The flaw stems from missing length checks in the Kerberos 5 crypto library before message decryption or verification. While the CVSS score is 7.5 (High), no active exploitation or public proof-of-concept exists, and EPSS predicts a low exploitation probability (0.17%), suggesting limited immediate real-world risk.
Bundled-dependency exposure in the Image::WebP Perl module (versions 0 through 0.2, distributed by CPAN author ZAPAD) ships a statically compiled copy of libwebp 0.3.0 from 2013, which contains multiple known decoder flaws including the critical CVE-2023-4863 heap buffer overflow. Any Perl application that uses this module to decode an attacker-supplied WebP image reaches the outdated internal decoder, potentially enabling memory corruption and remote code execution. There is no public exploit identified for this specific repackaging, EPSS is low at 0.17%, and CISA SSVC records exploitation status as none - but the embedded CVE-2023-4863 was historically a high-impact, widely-abused decoder bug.
Credential exposure in the Loytec LWEB-802 browser-based management interface allows an unauthenticated remote attacker to steal management credentials stored in the browser's localStorage by tricking a logged-in user into clicking a crafted link. All platforms running LWEB-802 before version 5.0.8 are affected. Because the stolen credentials provide full access to the building automation management system, SSVC rates the technical impact as total - meaning successful exploitation effectively hands an attacker complete control over the managed facility systems.
Improper certificate validation in Apereo CAS Client 4.1.0 and Jasig CAS Client 3.6.4 allows a man-in-the-middle attacker to intercept Ticket-Granting Tickets (TGTs) by presenting any CA-signed certificate for a hostname matching the client's allowlist. An attacker with a network interception position can then obtain service tickets on behalf of the victim. No active exploitation or public exploit code is confirmed, and EPSS indicates low exploitation probability (0.17%).
Memory corruption and use-after-free in Imagination Technologies Graphics DDK allows local attackers to escalate privileges. The vulnerability stems from improper reference counting on synchronization primitives during fence export, enabling a low-privileged user to achieve kernel read/write and full system compromise. No active exploitation or public exploit is confirmed, and EPSS indicates low exploitation probability.
Local privilege/code execution in GeoVision's GV-IP Device Utility is possible via DLL hijacking (CWE-427): the Windows desktop application loads one or more DLLs from an unsafe search path, letting a local attacker who can plant a malicious DLL run code in the context of the user who launches the utility. Exploitation requires the victim to execute the application (UI:R) and the attacker to already have a foothold with low privileges on the host (PR:L). There is no public exploit identified at time of analysis and it is not listed in CISA KEV; CVSS is 7.3 (High).
Remote code execution in Microsoft Surface Management Services exposes networks to exploitation by authenticated low-privilege users who can send malformed input over the network to trigger arbitrary code execution. Affecting all tracked versions per CPE cpe:2.3:a:microsoft:surface_management_services:*:*:*:*:*:*:*:*, the vulnerability carries a CVSS 8.8 High rating with full confidentiality, integrity, and availability impact. No public exploits identified at time of analysis and EPSS at 0.71% suggests low current exploitation probability; the vulnerability is absent from the CISA KEV catalog.
Sensitive information disclosure in Pronetiqs IntraVUE (marketed as Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to read the underlying host and network share filesystem through the industrial-network visualization application. Rated CVSS 4.0 9.2 (Critical) by ICS-CERT, the flaw exposes files outside the application's intended access boundary. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the network-facing, no-authentication profile makes it a high-priority patch for OT environments.
Credential theft in Pronetiqs/Panduit IntraVUE (versions 3.2.1a14 and prior) stems from the use of a cryptographically weak password hash, allowing an attacker who obtains the stored or transmitted hash to recover or replay administrator credentials via a pass-the-hash attack. The flaw affects the IntraVUE industrial network visualization platform and can yield full administrative access to the console. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the vulnerability was coordinated through CISA ICS-CERT (advisory ICSA-26-204-04).
Cleartext credential exposure in Pronetiqs IntraVUE (Panduit IntraVUE) versions 3.2.1a14 and prior allows an attacker to retrieve stored passwords in plaintext via the product's API, because credentials are never hashed or encrypted at rest. This industrial-network visualization tool is affected across all builds up to and including 3.2.1a14, and per the CVSS 4.0 vector the disclosure is reachable over the network without authentication (VC:H). There is no public exploit identified at time of analysis, and it is not listed in CISA KEV, but the ICS-CERT advisory (ICSA-26-204-04) confirms the flaw.
Predictable cryptographic randomness in Silicon Labs' Matter implementation for the SiWx917 wireless SoC allows attackers to reconstruct DRBG output because an entropy-initialization bug seeds the deterministic random bit generator with a predictable value, so every device produces the same stream of 'random' numbers. Any keys, nonces, or session material derived from this generator in the affected Matter code are therefore guessable, undermining confidentiality of secured communications on affected devices. The issue was found only after the repository was deprecated; no public exploit identified at time of analysis and it is not in CISA KEV.
Denial-of-service in MZ Automation's lib60870, an open-source IEC 60870-5-101/104 telecontrol protocol library used in ICS/SCADA systems, allows remote attackers to crash the message-parsing process via a malformed protocol frame that triggers an out-of-bounds read (CWE-125). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) indicates unauthenticated network exploitation with high availability impact and limited confidentiality exposure. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Session-handling weakness in Progress MOVEit Transfer (all builds before 2025.1.5, and 2026.0.0 before 2026.0.3) leaves sessions valid longer than they should be, so an attacker who obtains a still-active session token can access the managed file transfer application without re-authenticating. Progress rates this CVSS 9.8 with total technical impact, though the CWE-613 root cause makes the unauthenticated network vector worth verifying. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems from an overly permissive cross-domain (CORS) security policy that trusts untrusted origins, allowing a malicious website to read sensitive responses from an authenticated victim's MOVEit session. The vendor rates it CVSS 9.8, though the underlying weakness (CWE-942) and vendor tags point squarely at cross-origin data leakage rather than direct server compromise. No public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile).
Out-of-bounds heap read in PyTorch torchvision's native GIF decoder (versions through 0.28.0) lets attackers who supply a malicious or truncated GIF trigger a segmentation-fault denial of service or leak adjacent heap memory. The flaw sits in the libgif read_from_tensor callback, which passes an unclamped length to memcpy. A public exploit and reproducer exist and an upstream fix is available (commit 4e05dc2), but there is no public exploit identified in the sense of confirmed active exploitation - it is not on CISA KEV. Applications that decode untrusted GIFs via torchvision are affected.
Broken access control in JoomShaper's EasyStore extension for Joomla (versions 1.0.0 through 2.0.1) lets any authenticated Joomla user enumerate and read the orders and customer records belonging to other customers. Because order objects are returned without an ownership/authorization check, a single low-privilege account can harvest names, contact details and purchase data across the entire store. No public exploit has been identified at time of analysis and the flaw is not listed in CISA KEV, but the disclosure is public via a third-party security writeup.
Session replay in Logto IdP-initiated SAML sessions allows unauthenticated remote attackers to reuse captured session tokens, leading to unauthorized account access. Affected versions 1.21.0 through 1.37.1 silently fail to delete sessions, enabling replay within the session's validity window. No active exploitation confirmed but the attack requires no user interaction, and EPSS indicates very low exploitation likelihood.
Arbitrary file read in PostCSS (npm postcss <= 8.5.11) lets an attacker who controls CSS input embed a `/*# sourceMappingURL=PATH */` comment that the PreviousMap parser dereferences directly against the local filesystem with no scheme, allowlist, or traversal check. Because the read fires under default options (no `from`, `map`, or plugins), any pipeline that processes untrusted CSS is reachable; when the resulting `JSON.parse` SyntaxError is surfaced to the caller it leaks roughly the first 10 bytes of the targeted file, and the same code path yields a file-existence oracle and a DoS primitive. Publicly available exploit code exists (POC), but there is no public evidence of active exploitation, and EPSS is low at 0.50% (40th percentile).
Out-of-bounds memory access in Apple swift-nio-ssl allows information disclosure and denial of service when parsing X.509 certificates with non-ASN1_STRING Subject Alternative Names. The vulnerability affects versions prior to 2.37.2 and can be triggered locally by a crafted certificate, leading to potential data leakage or process crash. Public proof-of-concept code exists, but no active exploitation has been reported at this time.
Local File Inclusion in the Vino WordPress theme (elated-themes) affects all versions up to and including 1.9, letting an attacker holding a low-privileged Contributor account cause the theme to include and disclose arbitrary local files (e.g. wp-config.php) on the server. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw was reported through Patchstack's WordPress vulnerability program. Because it requires a valid Contributor login and Patchstack rated attack complexity as high, real-world exploitation is gated behind account access rather than being fully open to the internet.
Local File Inclusion in the Tonda Core WordPress plugin (versions 2.1.2 and earlier by Select Themes) allows an authenticated user with only Contributor-level privileges to force the PHP application to include arbitrary local files, exposing sensitive server-side content and potentially escalating to code execution. The flaw was reported by Patchstack and is classified as CWE-98 (PHP file inclusion). No public exploit identified at time of analysis, and it is not listed in CISA KEV; the CVSS 3.1 base score is 7.5 with high attack complexity.
Broken authentication in the Ziina WordPress payment plugin (versions <= 1.2.21) lets remote unauthenticated attackers bypass authentication controls, with the CVSS integrity-high rating indicating attackers can manipulate protected state or actions they should not be able to reach. Reported by Patchstack and classified under CWE-1390 (Weak Authentication), the issue is network-reachable with low complexity and no user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in the miniOrange Discord Integration plugin for WordPress (versions 2.2.4 and earlier) lets remote unauthenticated attackers defeat the plugin's identity verification (CWE-288) and assume the identity of legitimate WordPress users, including potentially privileged accounts. Rated CVSS 8.1 (High) by Patchstack, the flaw carries full confidentiality, integrity, and availability impact but a high attack complexity that tempers real-world exploitability. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Authentication bypass in the odh-dashboard web console of Red Hat OpenShift AI (RHOAI) lets a low-privileged actor already inside the cluster impersonate any user — including cluster administrators — by supplying an arbitrary access token to a component that was incorrectly bound to a reachable network interface. Because the impersonated identity is honored against the Kubernetes API, this escalates to arbitrary code execution, privilege escalation, and information disclosure across the cluster. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided, but the CVSS 8.8 (High) rating and full C/I/A impact make it a serious internal-threat priority.
Unauthenticated information disclosure in the Convert Forms extension for Joomla (versions 2.5.0 through 5.2.2) lets any anonymous visitor enumerate and read a form's stored submissions because the front-end Submissions view fails to enforce access control. Submitted data frequently contains PII such as names, email addresses, phone numbers, and free-text messages, so exposure can be significant. There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Information disclosure in Regular Labs Articles Anywhere and Users Anywhere extensions for Joomla allows unauthenticated remote attackers to view content that should be expired or unpublished. Date-sensitive query caching generates cache keys lacking a bounded time component, so results cached during a valid period persist and can be served after content becomes unavailable. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low probability of widespread exploitation.
Exposure of CDN credentials in administrator request URLs in the Cache Cleaner Pro extension for Joomla versions 1.0.0 through
Information disclosure in the GeoIP extension for Joomla 1.0.0 through 6.3.8 exposes MaxMind API credentials directly in request URLs. Unauthenticated remote attackers can intercept these credentials from network traffic or server logs, gaining unauthorized access to the victim’s MaxMind geolocation service. No active exploitation or public exploit code is known, and EPSS probability of exploitation is very low (0.19%).
Denial of service in Next.js App Router with Server Actions allows remote attackers to exhaust CPU resources and block request processing. Affected versions include all 13.0.0–15.5.20 and 16.0.0–16.2.10 releases. No active exploitation or public exploit code has been identified at time of analysis.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework within Oracle Fusion Middleware, is possible for a low-privileged attacker positioned on the same physical communication segment as the host. Disclosed in Oracle's July 2026 Critical Patch Update, the flaw carries a CVSS 3.1 score of 8.0 and a scope change, meaning successful exploitation can significantly impact additional products beyond OPSS itself. Exploitation is rated difficult (AC:H) and there is no public exploit identified at time of analysis, so risk is elevated by potential blast radius rather than by ease of attack.
Full takeover of Oracle Platform Security for Java (OPSS) is possible in Fusion Middleware versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged attacker with network access can compromise the component via crafted SOAP requests. Oracle rates this CVSS 8.8 with high confidentiality, integrity, and availability impact, meaning successful exploitation yields complete control of the OPSS component rather than mere data exposure. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS certificate-revocation bypass in Netty's OcspServerCertificateValidator (netty-handler-ssl-ocsp, versions <4.1.136.Final and 4.2.0.Final-4.2.16.Final) allows a malicious server presenting a revoked certificate to receive sensitive client data during a race window. The validator forwards the SslHandshakeCompletionEvent to downstream handlers before the asynchronous OCSP check finishes, so client applications treat the connection as trusted and may transmit or process application data before the revoked channel is closed. Publicly available exploit code exists (PoC in the GHSA advisory); no public active exploitation has been reported and the vulnerability is not in CISA KEV.
Predictable persistent login keys in IP Login extension for Joomla allow unauthenticated attackers to compromise accounts. Versions 1.0.0 through 6.2.5 generate keys using a non-cryptographic random generator with insufficient entropy, enabling brute-force guessing. No public exploit is known, but the low-entropy PRNG makes key prediction feasible.
Information disclosure in multiple Regular Labs Joomla extensions allows unauthenticated visitors to retrieve administrator-only content indexed via Smart Search. Affected extensions include Articles Anywhere, Conditional Content, Modules Anywhere, ReReplacer, Sourcerer, Snippets Pro, and Tabs & Accordions Pro. No public exploit or active exploitation is known, and EPSS probability is low (0.19%).
Denial of service in MongoDB Server allows an authenticated user to crash the database process by submitting a query whose sort specification embeds a `$meta` expression in raw BSONObj form. Because query planning fails to explicitly handle the meta-expression case when reading the sort pattern, it performs an incorrect transformation that trips an internal invariant, terminating the mongod process. No public exploit identified at time of analysis; the issue is tracked in MongoDB's Jira as SERVER-128341 and reported by MongoDB's own CNA.
Persistent authentication bypass in Question2Answer through 1.8.8 lets an attacker holding a stolen 'Remember me' (qa_session) cookie keep authenticated access to an account even after its password is reset via the forgot-password flow. The reset handler qa_finish_reset_user() fails to clear the user's sessioncode field, so previously issued persistent cookies remain valid - defeating the primary account-recovery defense used after a compromise. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the fix is an upstream GitHub pull request rather than a tagged release.
Out-of-bounds heap read in MongoDB Server's BSON CodeWScope element accessors lets an authenticated user disclose adjacent heap memory or crash the server (denial of service) by submitting a crafted aggregation pipeline. The exploit path abuses malformed BSONColumn (columnar/compressed BSON) data whose CodeWScope element bypasses the normal wire-level BSON validation, so an unchecked size field is trusted during decompression. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS 4.0 base score is 7.1, driven mainly by high availability impact.
Denial of service in MongoDB's mongod server allows any authenticated user holding only read privileges to crash the database by submitting aggregation pipeline expressions that invoke server-side JavaScript, triggering a use-after-free (CWE-416) during document processing. The flaw affects availability only and requires valid low-privilege credentials; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure in MongoDB's server-side JavaScript engine allows authenticated database users to read fragments of internal server process memory. The flaw stems from improper handling of DBPointer objects during BSON serialization, causing uninitialized or adjacent memory contents to be returned to the client. Only deployments that enable server-side JavaScript are affected; no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Integrity corruption in MongoDB's Queryable Encryption on sharded clusters lets an authenticated user with write access to a QE-enabled collection tamper with server-controlled encryption metadata by routing crafted write commands through the mongos router, breaking the correctness of encrypted queries. The CVSS 4.0 vector (VI:H, VC:N, VA:N) confirms this is an integrity-only issue despite the input's 'Information Disclosure' tag, which appears mislabeled. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory read in FFmpeg's S/PDIF muxer (spdifenc.c) affects versions 0.7.1 through 8.1.2 when re-muxing DTS-HD audio to an S/PDIF (IEC 61937) container. The spdif_header_dts4 function trusts an attacker-controlled core_size field from a crafted DTS stream without validating it against the actual packet length, letting a malicious input read memory past the packet buffer to leak small amounts of adjacent process memory or crash the process. Reported by VulnCheck with an upstream fix available; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Information disclosure and potential data corruption in the Linux kernel's XFS filesystem can allow a local attacker with low privileges to achieve high integrity, confidentiality, and availability impact. The vulnerability resides in the reflink copy-on-write logic where stale data fork mappings are used after cycling the ILOCK, leading to inaccurate shared-extent tracking. No active exploitation or public exploit code has been identified at time of analysis, and a vendor patch is available.
Remote code execution in Dell PowerProtect Data Manager versions prior to 20.2.0.0 stems from improper input validation in the product's REST API, allowing a high-privileged, remotely authenticated attacker to escalate into arbitrary code execution on the data-protection appliance. Dell (the reporting vendor) rates it CVSS 7.2 (High) with full confidentiality, integrity, and availability impact but requiring high privileges (PR:H). There is no public exploit identified at time of analysis, the EPSS probability is low (0.61%, 46th percentile), and CISA SSVC marks exploitation status as none.
Elevation of privilege in Dell PowerProtect Data Manager (all versions prior to 20.2.0.0) stems from the Identity and Access Management (IAM) subsystem generating incorrect security tokens, letting an already-authenticated low-privileged user obtain rights beyond those granted to their account. The flaw is remotely reachable over the network and requires no user interaction, and while the CVSS base score is 8.8 (High), there is no public exploit identified at time of analysis and it is not listed in CISA KEV. Because the impact is full compromise of confidentiality, integrity and availability of the data-protection platform, it should be prioritized in any environment running affected versions.
Elevation of privilege in Dell PowerProtect Data Manager versions prior to 20.2.0.0 allows an already high-privileged, remotely authenticated attacker to abuse improper input validation in the REST API to gain further control over the appliance. Exploitation yields total technical impact (full confidentiality, integrity, and availability compromise) but requires existing high privileges, keeping practical risk moderate. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Elevation of privilege in Dell PowerProtect Data Manager before 20.2.0.0 lets an already high-privileged, remote authenticated attacker abuse an improperly validated REST API input to gain further control over the backup and recovery appliance. Per the CVSS vector the attacker starts with high privileges (PR:H), yet the flaw yields total confidentiality, integrity, and availability impact on the affected system. There is no public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation as 'none' with a low EPSS probability of 0.50%.
Elevation of privilege in Dell PowerProtect Data Manager (versions prior to 20.2.0.0) allows a remote, high-privileged attacker to abuse improper input validation and gain elevated privileges, with full confidentiality, integrity, and availability impact per the CVSS vector. The flaw was reported by Dell, which has published advisory DSA-2026-287 and a fixed release. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently limited by the requirement for pre-existing high privileges.
DNSSEC validation bypass in ISC BIND 9 resolvers (9.11.0 through 9.21.23 and S-editions) allows an attacker controlling a signed zone to inject validly-signed NSEC records whose 'Next Domain Name' field points outside the signer's own zone, letting forged proofs of non-existence be applied to names the zone was never authorized to speak for. Because BIND fails to enforce that the NSEC chain stays within the signer's authority, an attacker can assert that arbitrary names in other zones do not exist, poisoning resolver behavior across zone boundaries (CVSS 8.6, Scope:Changed, integrity impact). There is no public exploit identified at time of analysis and the issue is not in CISA KEV.
Remote denial of service in ISC BIND 9 lets an off-path attacker crash a recursive resolver by controlling the timing and content of authoritative responses to paired queries. When a client asks named to resolve a DNAME plus an A record beneath it (or a CNAME plus an A record for the same name) and the attacker-controlled authoritative server answers the A query positively but delays the DNAME/CNAME response before returning a negative or self-referential answer, named hits a fatal assertion and terminates. The flaw is unauthenticated and network-reachable (CVSS 7.5, availability-only); there is no public exploit identified at time of analysis and it is not on CISA KEV.