Information Disclosure
Monthly
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Sandboxed applications on Apple macOS can break out of their App Sandbox because of a logic error in the sandbox's validation checks, and Apple has fixed the issue in macOS 27 "Golden Gate". Any Mac running a macOS release earlier than 27 is affected, and successful exploitation gives a malicious app access to files, services, and resources it should never have been able to reach, matching the integrity-only impact (C:N/I:H) in the published vector. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the EPSS score of 0.15% (5th percentile) suggests the flaw is not currently being exploited at scale.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Local privilege escalation in Apple macOS allows a malicious or compromised application already running on the system to obtain root privileges. The flaw is a permissions-handling defect (CWE-280) that Apple addressed by adding additional restrictions, with fixes shipping in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local code execution as a normal user (AV:L, PR:L) and, per CISA SSVC, is not automatable with no known exploitation activity; no public exploit code or EPSS signal was provided at time of analysis.
A use-after-free flaw in Apple's kernel affects iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Golden Gate before 27, allowing a locally running app to corrupt kernel memory or cause unexpected system termination. The issue is a local, low-privilege memory-safety defect (CWE-416) rated CVSS 7.8, and Apple has shipped fixes in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27 and macOS Sequoia 15.8. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified, with EPSS at 0.19% (9th percentile) suggesting low near-term exploitation likelihood at scale.
Unexpected system termination is possible on unpatched Apple macOS hosts because of an out-of-bounds read that a remote attacker can trigger without authentication or user interaction. Apple addressed the flaw with improved bounds checking in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27, but the affected system component is not named in the public advisories. No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' while flagging the issue as automatable with partial technical impact; the CVSS 7.5 score is driven entirely by availability loss, with no confidentiality or integrity impact.
Parsing a maliciously crafted file on an unpatched Mac can crash the affected application or leak contents of process memory, caused by an out-of-bounds read (CWE-125) in Apple's file-handling code. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, with advisories published at support.apple.com. There is no public exploit code identified at time of analysis and no CISA KEV listing, and the EPSS probability is low at 0.19% (9th percentile), so this rates as a patch-on-schedule issue rather than an emergency.
Authenticated arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker who already holds valid DataStage credentials to write files to attacker-chosen locations on the server, because a feature that accepts a file path fails to properly validate it. The vendor scores this 9.9, but our independent assessment rates it as a scope-unchanged high-severity issue (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), since the attacker must already be authenticated and the immediate confidentiality impact is limited although integrity and availability can be fully compromised. There is no evidence of active exploitation: CISA's SSVC rates exploitation as 'none', EPSS is low at 0.61% (48th percentile), and no public exploit code has been identified at time of analysis. A vendor patch is available per IBM's advisory.
IBM Cloud Pak for Data System (Yosemite 1.0) version 3.0.5.2 exposes sensitive information to remote attackers because it continues to negotiate weak or deprecated cryptographic protocols, rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N) with a high confidentiality impact. Any deployment running the affected 3.0.5.2 build on a reachable network segment is in scope, and per CISA's SSVC evaluation the flaw is automatable though no active exploitation has been observed. There is no public exploit code identified at time of analysis, and the vendor has published a fix via IBM support documentation.
Let me synthesize the analysis. Key facts: - CVE-2026-82049: CPython tarfile module's data and tar extraction filters vulnerable to crafted archives containing a hard link to a symbolic link. Affects CPython 3.13 and earlier (EUVD says CPython 0 <3.14.0). - CVSS 4.0: 8.4, AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CWE-59: Link Following - Patch available from vendor (commits in GitHub) - SSVC: Exploitation none, Automatable no, Technical Impact total - Tags: Information Disclosure - No KEV, no POC noted. The source code evidence relates to os.link follow_symlinks fix (gh-81793 / issue 85527). Interesting — the diff relates to os.link following symlinks, which is related infrastructure for the tarfile fix. Hmm, the diff is about os.link's follow_symlinks default. And test_inspect unsupported signatures {'chmod', 'link', 'utime'}. So the fix likely involved making tarfile hard link extraction use follow_symlinks=False... Actually the root cause: tarfile creating hard links to symlinks, which resolves outside destination. Wait — actually the CVE description says hard link to a symbolic link can modify perms/mtime of a file outside the destination directory, or expose contents of that file within extracted tree. The fix in os.link enables follow_symlinks=False so that link extraction doesn't follow symlink targets. Actually the diff makes os.link follow symlinks by default on Linux (a behavior change, aligning Linux with macOS). Hmm, that seems the opposite. Let's think: Prior to the change, on Linux, os.link() did NOT follow symlinks (like linkat without AT_SYMLINK_FOLLOW), creating a hard link to the symlink itself. The change makes it follow symlinks by default. Hmm. So the fix makes the link point to the target file... That could actually be the vulnerability: a hard link to a symlink → link created to symlink itself → chmod/utime on the hard link modifies the target of the symlink? Wait. Actually: if you hard link the symlink itself, then chmod/ex
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Privilege escalation in Microsoft Windows 11 version 26H1 stems from a double-free (CWE-415) in Secure Kernel Mode that lets a locally authenticated attacker holding high privileges corrupt kernel memory and reach an execution context above the normal kernel boundary. Successful exploitation yields complete loss of confidentiality, integrity, and availability for the affected component and the assets it protects (CVSS 8.2, S:C), effectively bypassing VBS-backed protections. No public exploit code or active exploitation is currently identified, and SSVC rates exploitation as 'none' and automatable as 'no'; Microsoft has released a patch in the 10.0.28000.2956 servicing build.
Timing side-channel in pay-rails Pay (≤ 11.6.1) allows unauthenticated remote attackers to recover the Paddle Billing webhook HMAC signature byte-by-byte and forge webhook events. The Pay::Webhooks::PaddleBillingController compares the computed SHA-256 HMAC against the attacker-supplied h1 header value with Ruby's non-constant-time String#==, so response timing leaks how much of the digest prefix matches. A forged, correctly signed webhook is accepted and enqueued as a Pay::Webhooks::ProcessJob, letting the attacker drive billing state changes such as provisioning paid features, recording refunds, or triggering customer notifications; public exploit code / PoC-level analysis exists per the SSVC exploitation status, and the flaw is fixed in 11.6.2.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
PraisonAI's WhatsApp and Linear bot webhook handlers fail open when their shared-secret environment variables are unset: HMAC signature verification is skipped entirely and the raw JSON body is parsed and dispatched as a trusted platform event. Any remote client that can reach the bot's webhook route (default /webhook) can forge WhatsApp messages or Linear AgentSession/Comment events without authentication, impersonating platform users and injecting attacker-controlled content into agent prompts and actions. The flaw affects releases before 4.6.59, is trivially automatable with a single unsigned HTTP POST, and no public exploit code or active exploitation has been identified at time of analysis.
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. No public exploit code or active exploitation has been identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is primarily an endpoint-hardening and asset-inventory concern rather than an urgent patch-emergency.
IMAP command injection in the PraisonAI praisonaiagents email tools before 1.6.59 lets LLM-controlled arguments (from_addr, subject, query, message_id) break out of quoted IMAP SEARCH criteria and inject arbitrary IMAP commands, giving access to, modification of, or deletion of mailbox data. Exploitation requires an agent deployed with email credentials configured (EMAIL_ADDRESS and EMAIL_PASSWORD) and with the search_emails, reply_email, or archive_email tools exposed, plus an attacker able to steer the tool-call arguments — typically via crafted or indirect prompt injection reaching the agent. The advisory includes a static proof-of-concept data-flow trace, and CISA's SSVC assessment records exploitation status as 'poc'; the flaw is not listed in CISA KEV, and no EPSS score was supplied.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads in their own user attributes. When an administrator exports users to CSV and opens the file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the stored formula is evaluated in the spreadsheet's execution context - enabling data exfiltration from the spreadsheet or arbitrary command execution on the administrator's workstation. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none and not automatable.
Apache Syncope 3.0.x, 4.0.x and 4.1.x expose signed JWT access tokens through a REST endpoint to an administrator holding sufficient entitlements, letting that actor replay the stolen tokens to impersonate more privileged users. The vulnerable ranges are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; upgrading to 4.0.8 or 4.1.3 resolves the issue. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Privilege escalation in Apache Syncope's internal JWT authentication (CWE-266) lets a low-privileged authenticated user obtain full administrator rights when the JWKS settings used to sign internal JWTs are disclosed. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the flaw is assessed as automatable with total technical impact.
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configurations - including OAuth 2.0 client secrets - via the SSO provider listing API, regardless of the caller's assigned entitlements or role. Affected versions span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit has been identified at time of analysis, and vendor-released patches are available as versions 4.0.8 and 4.1.3 per the Apache advisory.
Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration condition. When an operator configures an AES key whose byte length deviates from standard values (16, 24, or 32 bytes), Syncope silently pads it with random characters to reach a valid length - and then logs the resulting padded key value. Any party with access to the application logs (e.g., log aggregation systems, monitoring personnel, or local server access) can recover the full AES encryption key, potentially allowing decryption of data protected by that key. No public exploit has been identified at time of analysis; vendor-released patches exist in versions 4.0.8 and 4.1.3.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Credential disclosure in Contec's Remote I/O Coupler Unit (Server Type) CPSN-MCB271 enables an attacker who obtains a device backup file to recover sensitive credentials stored within it in an insufficiently protected form. The root cause (CWE-522) means credentials are not rendered unrecoverable within backup archives, so any party who accesses a backup file can extract usable authentication material. Reported by JPCERT/CC with a CVSS 4.0 score of 8.2, no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Cleartext credential exposure in Suprema BioStar 2 (before 2.9.12) and BioStar X (before 1.0.2) allows any authenticated API user to retrieve Active Directory service account credentials in plaintext via a single GET request to the /api/v2/setting/adserversetting endpoint. The CVSS scope change (S:C) reflects that the real impact extends far beyond BioStar 2 itself - the exposed AD credentials can grant an attacker access to the entire Windows domain, enabling lateral movement and privilege escalation. A public proof-of-concept exploit is available on GitHub (mda1r/biostar2-ad-credential-exposure), significantly lowering the bar for exploitation.
Cross-tenant blob deletion and cluster-wide denial of service in Apache Storm Nimbus 3.0.0 allow authenticated topology submitters to arbitrarily delete blobstore keys owned by other tenants or permanently disable cluster leadership. Nimbus accepts `dependency_jars` and `dependency_artifacts` lists without validating their contents at submission time: during topology cleanup Nimbus deletes listed keys as itself (bypassing ACL checks), and on acquiring leadership Nimbus surrenders leadership for any topology whose dependency keys are absent - allowing a single malicious submission to loop all Nimbus daemons into perpetual leader-election, leaving the cluster inoperable. No public exploit has been identified at time of analysis, but the DoS path requires only valid topology submission credentials.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
ZooKeeper credential disclosure in Apache Storm 3.0.0 exposes `storm.zookeeper.topology.auth.payload` through two independent channels: Nimbus serves the full topology configuration verbatim to any caller holding read-only permissions, and the submission client logs the same payload at INFO level on every submission while SASL handlers emit it at DEBUG. An authenticated user with only read-only topology view rights can recover the ZooKeeper write credential and use it to forge or suppress worker heartbeats, backpressure, and error state for the affected topology, or indirectly obtain it via log aggregation pipelines or support bundles. No public exploit has been identified; vendor-released patch version 3.1.0 is available.
Local privilege escalation in Apache Storm Worker Launcher 3.0.0 allows an authenticated Storm topology tenant to gain root on supervisor nodes by exploiting a TOCTOU race in the setuid-root worker-launcher binary: the binary chowns the entire worker directory to the untrusted topology user before re-reading the supervisor-written command file, creating a window in which the tenant can substitute attacker-controlled content. For Docker workers, the injected command executes with real uid 0 through an insufficiently constrained argument sanitizer that passes -v, --device, --cap-add, --security-opt, --user, --net, and positional arguments verbatim; for OCI workers, arbitrary host paths can be bind-mounted read-write and execution can be forced as another tenant's uid. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 3.1.0.
HTTP request smuggling in HAProxy 3.3.0-3.4.4 affects deployments running an HTTP/3 (QUIC) frontend forwarding traffic to HTTP/1.1 backends over reused pooled connections with chunked transfer encoding. The H3 multiplexer in src/h3.c emits an untrusted client-declared DATA frame length verbatim as the HTTP/1.1 chunk size before payload bytes arrive; when a remote unauthenticated attacker under-delivers payload then ends the stream, HAProxy returns the desynchronized backend connection to the idle pool, enabling bypass of path-based frontend deny rules and exposure of concurrent clients' Authorization headers as attacker-visible request body. No public exploit code has been identified, though the attack is probabilistic and freely retryable.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 exposes JVM-based applications to service termination and partial memory disclosure when attacker-controlled offset or length values are passed to the ZstdDictDecompress constructor without bounds validation. The missing guard allows values that exceed the backing byte array, causing the JNI layer to read past the array boundary into native memory, which can abort the JVM process. A vendor-released patch is confirmed in v1.5.7-14; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Unauthenticated credential token disclosure in the Zonify WordPress plugin before 1.0.5 exposes the site's stored service account login token to any remote attacker without authentication. The plugin fails to perform any WordPress capability check or authentication verification before returning the stored token, allowing retrieval by any network-reachable actor. An attacker who obtains the token can then authenticate to the site owner's linked third-party service account, effectively achieving full account takeover of the integrated service. No public exploit code has been identified at time of analysis, and EPSS stands at 0.18%, but the zero-barrier exploitation profile - unauthenticated, low complexity, network-accessible - makes the vulnerability trivial to abuse once discovered.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
A use-after-free in the Linux kernel's NFSv4 server (NFSD) admin-state revocation path lets a client structure be freed while still in use, introduced in 6.9 and fixed in 6.18.51, 7.2.4, and 7.3-rc1. When an administrator revokes NFSv4 state, nfsd4_revoke_states() temporarily drops the client_lock while revoke_one_stid() dereferences a stateid's bare (non-pinning) pointer to its nfs4_client; a concurrent client teardown via force_expire_client() can free that client first, causing NFSD to read freed memory. No public exploit is identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; the practical impact is server crash/DoS on the NFS server rather than remote code execution.
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. No public exploit is identified at time of analysis and EPSS is low (0.20%); impact is a client-side crash/memory corruption rather than remote code execution.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. No public exploit is identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a local, race-dependent memory-safety bug rather than a remotely weaponizable one.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). The fix simply sets ce->tgthint to NULL after freeing the list. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Use-after-free in the Linux kernel MPLS forwarding path allows a crafted packet to trigger a slab read of freed memory during multipath nexthop selection. mpls_select_multipath()/mpls_multipath_hash() cache a header pointer, then call pskb_may_pull(), which can invoke pskb_expand_head() and free the old skb head - leaving the cached pointer dangling and read afterward. Confirmed by a KASAN slab-use-after-free report reproduced in 2 of 2 unpatched runs via a legal Geneve packet over a bareudp/MPLS multipath setup; no public weaponized exploit and no KEV listing, with EPSS at 0.20% (10th percentile).
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Improper state management in Apple's operating systems (iOS/iPadOS, tvOS, visionOS, watchOS) allows a locally installed app to read a persistent account identifier that should have remained isolated, resulting in information disclosure. Affected platforms are all versions prior to the 27 release train on each OS. Vendor patches are available (iOS 27, iPadOS 27, tvOS 27, visionOS 27, watchOS 27), no public exploit code has been identified at time of analysis, and EPSS is very low (0.15%, 5th percentile). The supplied CVSS vector (AV:N/PR:N) does not match the description's local-app precondition, so treat the 7.5 score with caution.
Improper state management in Apple iOS, iPadOS, and watchOS allows an installed app to track a user across other apps and websites without the user's permission, effectively defeating the platform's cross-app tracking consent controls. The flaw affects iOS/iPadOS releases before 26.7 and before 27, plus watchOS before 27, and is remediated by the iOS 26.7/iPadOS 26.7, iOS 27/iPadOS 27, and watchOS 27 updates. Exploitation requires a hostile app on the device rather than remote network access; EPSS is 0.15% (5th percentile), there is no CISA KEV listing or public exploit identified, and SSVC rates exploitation as 'none' with partial technical impact.
Sandboxed applications on Apple macOS can break out of their App Sandbox because of a logic error in the sandbox's validation checks, and Apple has fixed the issue in macOS 27 "Golden Gate". Any Mac running a macOS release earlier than 27 is affected, and successful exploitation gives a malicious app access to files, services, and resources it should never have been able to reach, matching the integrity-only impact (C:N/I:H) in the published vector. No public exploit code and no CISA KEV entry were identified at the time of analysis, and the EPSS score of 0.15% (5th percentile) suggests the flaw is not currently being exploited at scale.
Apple iOS and iPadOS before version 27 leak cross-application information through the handling of user preferences, allowing a locally installed app to enumerate which other apps are present on the device. Apple addressed the privacy flaw in iOS 27 and iPadOS 27; EPSS is only 0.17% (7th percentile), there is no CISA KEV listing, and no public exploit code identified at time of analysis. The practical impact is user profiling and device fingerprinting rather than code execution or data theft.
A race condition in Apple macOS (fixed in macOS Tahoe 26.6) allows a locally executed malicious application to escalate privileges and gain root on the host. The flaw is reachable by a low-privileged local process without user interaction beyond running the app, and it has a 7.8 CVSS base score reflecting total loss of confidentiality, integrity and availability for the vulnerable component. There is no CISA KEV listing, no vendor confirmation of in-the-wild exploitation, and no public exploit code identified at time of analysis; CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', indicating a targeted rather than wormable threat.
An out-of-bounds read in Apple's kernel (CWE-125) lets an app already running on the device read past the end of a kernel buffer, potentially leaking kernel memory or crashing the system. Affected platforms span iOS/iPadOS before 26.6.1, macOS Sequoia before 15.8, macOS Tahoe before 26.6.2, and tvOS, visionOS and watchOS before 27, with a CVSS 3.1 base of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), so this is a local, app-mediated kernel hardening issue rather than a remotely exploitable emergency.
Race condition in Apple's kernel allows a local user on iOS 27, iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27 and watchOS 27 to cause unexpected system termination or read kernel memory. Apple fixed the flaw with additional validation, publishing advisories 149034-149038; there is no public exploit code and no confirmed active exploitation (EPSS 0.16%, SSVC exploitation: none).
Local privilege escalation in Apple macOS allows a malicious or compromised application already running on the system to obtain root privileges. The flaw is a permissions-handling defect (CWE-280) that Apple addressed by adding additional restrictions, with fixes shipping in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27. Exploitation requires local code execution as a normal user (AV:L, PR:L) and, per CISA SSVC, is not automatable with no known exploitation activity; no public exploit code or EPSS signal was provided at time of analysis.
A use-after-free flaw in Apple's kernel affects iOS and iPadOS before 26.7, macOS Sequoia before 15.8, and macOS Golden Gate before 27, allowing a locally running app to corrupt kernel memory or cause unexpected system termination. The issue is a local, low-privilege memory-safety defect (CWE-416) rated CVSS 7.8, and Apple has shipped fixes in iOS 26.7, iPadOS 26.7, macOS Golden Gate 27 and macOS Sequoia 15.8. There is no indication of active exploitation (no CISA KEV listing) and no public exploit code identified, with EPSS at 0.19% (9th percentile) suggesting low near-term exploitation likelihood at scale.
Unexpected system termination is possible on unpatched Apple macOS hosts because of an out-of-bounds read that a remote attacker can trigger without authentication or user interaction. Apple addressed the flaw with improved bounds checking in macOS Tahoe 26.7, macOS Sequoia 15.8, and macOS Golden Gate 27, but the affected system component is not named in the public advisories. No public exploit code has been identified and CISA's SSVC assessment records exploitation as 'none' while flagging the issue as automatable with partial technical impact; the CVSS 7.5 score is driven entirely by availability loss, with no confidentiality or integrity impact.
Parsing a maliciously crafted file on an unpatched Mac can crash the affected application or leak contents of process memory, caused by an out-of-bounds read (CWE-125) in Apple's file-handling code. Apple has fixed the flaw in macOS Sequoia 15.8, macOS Tahoe 26.7, and macOS Golden Gate 27, with advisories published at support.apple.com. There is no public exploit code identified at time of analysis and no CISA KEV listing, and the EPSS probability is low at 0.19% (9th percentile), so this rates as a patch-on-schedule issue rather than an emergency.
Authenticated arbitrary file write in IBM DataStage on Cloud Pak for Data 5.4.0.0 allows a remote attacker who already holds valid DataStage credentials to write files to attacker-chosen locations on the server, because a feature that accepts a file path fails to properly validate it. The vendor scores this 9.9, but our independent assessment rates it as a scope-unchanged high-severity issue (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H), since the attacker must already be authenticated and the immediate confidentiality impact is limited although integrity and availability can be fully compromised. There is no evidence of active exploitation: CISA's SSVC rates exploitation as 'none', EPSS is low at 0.61% (48th percentile), and no public exploit code has been identified at time of analysis. A vendor patch is available per IBM's advisory.
IBM Cloud Pak for Data System (Yosemite 1.0) version 3.0.5.2 exposes sensitive information to remote attackers because it continues to negotiate weak or deprecated cryptographic protocols, rated CVSS 8.2 (AV:N/AC:L/PR:N/UI:N, C:H/I:L/A:N) with a high confidentiality impact. Any deployment running the affected 3.0.5.2 build on a reachable network segment is in scope, and per CISA's SSVC evaluation the flaw is automatable though no active exploitation has been observed. There is no public exploit code identified at time of analysis, and the vendor has published a fix via IBM support documentation.
Let me synthesize the analysis. Key facts: - CVE-2026-82049: CPython tarfile module's data and tar extraction filters vulnerable to crafted archives containing a hard link to a symbolic link. Affects CPython 3.13 and earlier (EUVD says CPython 0 <3.14.0). - CVSS 4.0: 8.4, AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - CWE-59: Link Following - Patch available from vendor (commits in GitHub) - SSVC: Exploitation none, Automatable no, Technical Impact total - Tags: Information Disclosure - No KEV, no POC noted. The source code evidence relates to os.link follow_symlinks fix (gh-81793 / issue 85527). Interesting — the diff relates to os.link following symlinks, which is related infrastructure for the tarfile fix. Hmm, the diff is about os.link's follow_symlinks default. And test_inspect unsupported signatures {'chmod', 'link', 'utime'}. So the fix likely involved making tarfile hard link extraction use follow_symlinks=False... Actually the root cause: tarfile creating hard links to symlinks, which resolves outside destination. Wait — actually the CVE description says hard link to a symbolic link can modify perms/mtime of a file outside the destination directory, or expose contents of that file within extracted tree. The fix in os.link enables follow_symlinks=False so that link extraction doesn't follow symlink targets. Actually the diff makes os.link follow symlinks by default on Linux (a behavior change, aligning Linux with macOS). Hmm, that seems the opposite. Let's think: Prior to the change, on Linux, os.link() did NOT follow symlinks (like linkat without AT_SYMLINK_FOLLOW), creating a hard link to the symlink itself. The change makes it follow symlinks by default. Hmm. So the fix makes the link point to the target file... That could actually be the vulnerability: a hard link to a symlink → link created to symlink itself → chmod/utime on the hard link modifies the target of the symlink? Wait. Actually: if you hard link the symlink itself, then chmod/ex
Gallery - Private Photo Vault 1.0.41 (Android, by Brain Trust) exposes an unauthenticated HTTP server on TCP port 8080 that is reachable by any device on the same local network, serving full directory listings and file contents from Android external storage - the very media the app is marketed to protect. Any network-adjacent attacker can trivially enumerate and exfiltrate photos, videos, and other files without credentials or user interaction. No public exploit code is required beyond a standard web browser or curl; Fluid Attacks' advisory confirms a proof-of-concept exists, but no CISA KEV listing has been identified at time of analysis.
Race condition in Microsoft Edge (Chromium-based) builds prior to 152.0.4191.66 lets an attacker who already holds low-privileged code execution inside the browser win a narrow timing window and elevate to full privileges outside the Chromium sandbox. The flaw is CWE-362 (concurrent execution on a shared resource with improper synchronization) and carries a CVSS 3.1 score of 7.8 with a Scope:Changed rating, indicating a successful exploit crosses a security boundary rather than simply corrupting the renderer. Exploitation is local, timing-dependent (AC:H) and non-automatable per CISA SSVC; no public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and a vendor patch is available.
Privilege escalation in Microsoft Windows 11 version 26H1 stems from a double-free (CWE-415) in Secure Kernel Mode that lets a locally authenticated attacker holding high privileges corrupt kernel memory and reach an execution context above the normal kernel boundary. Successful exploitation yields complete loss of confidentiality, integrity, and availability for the affected component and the assets it protects (CVSS 8.2, S:C), effectively bypassing VBS-backed protections. No public exploit code or active exploitation is currently identified, and SSVC rates exploitation as 'none' and automatable as 'no'; Microsoft has released a patch in the 10.0.28000.2956 servicing build.
Timing side-channel in pay-rails Pay (≤ 11.6.1) allows unauthenticated remote attackers to recover the Paddle Billing webhook HMAC signature byte-by-byte and forge webhook events. The Pay::Webhooks::PaddleBillingController compares the computed SHA-256 HMAC against the attacker-supplied h1 header value with Ruby's non-constant-time String#==, so response timing leaks how much of the digest prefix matches. A forged, correctly signed webhook is accepted and enqueued as a Pay::Webhooks::ProcessJob, letting the attacker drive billing state changes such as provisioning paid features, recording refunds, or triggering customer notifications; public exploit code / PoC-level analysis exists per the SSVC exploitation status, and the flaw is fixed in 11.6.2.
Cisco Secure Email Gateway and Cisco Secure Email and Web Manager ship a hardening release that fixes multiple internally discovered input-validation defects grouped under CVE-2026-76442 (CWE-1284, improper validation of specified quantity in input). Successful exploitation by an unauthenticated remote attacker degrades availability (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) on the affected appliances, potentially interrupting mail flow and administrative access. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CISA's SSVC assessment rates exploitation as none and automatable as no, so weaponization is not currently expected.
Improper-neutralization flaws (CWE-707) in Cisco Secure Email Gateway and Cisco Secure Email and Web Manager - disclosed by Cisco as an internally discovered hardening release covering affected 12.8.x through 16.x builds - could allow an attacker to compromise confidentiality or integrity of the appliances, but the published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is unsupported by any of the technical detail Cisco actually provides. The advisory cisco-sa-hardening-esa-dfCrfXkm names no vulnerable feature, endpoint, protocol, or configuration setting and does not state whether authentication is required, so the unauthenticated PR:N claim is unverified; our assessment lowers the vector to CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N and treats exposed management interfaces as the most plausible attack surface. There is no public exploit code and no evidence of exploitation (CISA SSVC Exploitation: none), and EPSS is low at 0.37% (30th percentile), so this should be handled as a routine patch-cadence item rather than an emergency pre-auth remote compromise.
Unauthenticated remote attackers who can reach a Cisco Secure Email Gateway or Secure Email and Web Manager deployment can trigger improper resource-lifetime handling (CWE-664) that degrades availability and can leak limited information. Cisco's own advisory scores the issue 9.8 (C:H/I:H/A:H), while independent assessment scores it considerably lower at C:L/I:N/A:H; the two sources conflict sharply over whether integrity and full confidentiality are actually at risk, but both agree the availability impact is high and that no privileges or user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, no exploitation has been observed (SSVC Exploitation: none), and EPSS is low at 0.37% (31st percentile), though the flaw is classified as automatable with total technical impact in CISA's SSVC framework.
Ekia File Manager 1.2.7 for Android ships an exported ContentProvider (com.ekia.filecontrolmanager.OpenFileProvider) that declares no android:permission, readPermission, or writePermission, so any other app on the same device can invoke it. The provider maps the caller-supplied URI path straight to a filesystem path and passes it to new File(...), letting a malicious local app make the File Manager process read, create, overwrite, or delete every file that process can reach. The issue is not in CISA KEV, EPSS is only 0.11% (2nd percentile), and no public exploit tooling was identified in the supplied data, so real-world priority depends almost entirely on whether untrusted apps can be installed on the target device.
PraisonAI's WhatsApp and Linear bot webhook handlers fail open when their shared-secret environment variables are unset: HMAC signature verification is skipped entirely and the raw JSON body is parsed and dispatched as a trusted platform event. Any remote client that can reach the bot's webhook route (default /webhook) can forge WhatsApp messages or Linear AgentSession/Comment events without authentication, impersonating platform users and injecting attacker-controlled content into agent prompts and actions. The flaw affects releases before 4.6.59, is trivially automatable with a single unsigned HTTP POST, and no public exploit code or active exploitation has been identified at time of analysis.
A pre-installed peer application on the same device can abuse the Zscaler Client Connector to tear down the Zscaler tunnel, force the user to be logged out, and toggle packet capture on affected ChromeOS and Android builds prior to 4.2.0.152. The flaw is rated CVSS 7.5 with a local attack vector, high complexity and low privileges, reflecting that an attacker must already have a separate app installed on the managed endpoint rather than reaching the connector over the network. No public exploit code or active exploitation has been identified, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', so this is primarily an endpoint-hardening and asset-inventory concern rather than an urgent patch-emergency.
IMAP command injection in the PraisonAI praisonaiagents email tools before 1.6.59 lets LLM-controlled arguments (from_addr, subject, query, message_id) break out of quoted IMAP SEARCH criteria and inject arbitrary IMAP commands, giving access to, modification of, or deletion of mailbox data. Exploitation requires an agent deployed with email credentials configured (EMAIL_ADDRESS and EMAIL_PASSWORD) and with the search_emails, reply_email, or archive_email tools exposed, plus an attacker able to steer the tool-call arguments — typically via crafted or indirect prompt injection reaching the agent. The advisory includes a static proof-of-concept data-flow trace, and CISA's SSVC assessment records exploitation status as 'poc'; the flaw is not listed in CISA KEV, and no EPSS score was supplied.
Missing authorization on the `/sys/user/list` admin endpoint in novel-plus ≤5.3.3 allows any authenticated user to retrieve password hashes and sensitive PII - including email addresses and phone numbers - for users within their data scope. The root cause is the absence of proper Spring Security permission annotations on the endpoint, meaning authorization checks are never enforced at the API layer. A publicly available POC exploit script confirms exploitability; successful hash retrieval enables offline cracking and downstream account takeover.
CSV formula injection in Apache Syncope allows authenticated low-privilege users to embed spreadsheet formula payloads in their own user attributes. When an administrator exports users to CSV and opens the file in a spreadsheet application such as Microsoft Excel or LibreOffice Calc, the stored formula is evaluated in the spreadsheet's execution context - enabling data exfiltration from the spreadsheet or arbitrary command execution on the administrator's workstation. No public exploit code has been identified at time of analysis, and SSVC classifies exploitation status as none and not automatable.
Apache Syncope 3.0.x, 4.0.x and 4.1.x expose signed JWT access tokens through a REST endpoint to an administrator holding sufficient entitlements, letting that actor replay the stolen tokens to impersonate more privileged users. The vulnerable ranges are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2; upgrading to 4.0.8 or 4.1.3 resolves the issue. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS data was not provided.
Privilege escalation in Apache Syncope's internal JWT authentication (CWE-266) lets a low-privileged authenticated user obtain full administrator rights when the JWKS settings used to sign internal JWTs are disclosed. It affects Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2, and is fixed in 4.0.8 and 4.1.3. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the flaw is assessed as automatable with total technical impact.
OIDC client secret exposure in Apache Syncope enables any authenticated user to retrieve complete OIDC provider configurations - including OAuth 2.0 client secrets - via the SSO provider listing API, regardless of the caller's assigned entitlements or role. Affected versions span 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. No public exploit has been identified at time of analysis, and vendor-released patches are available as versions 4.0.8 and 4.1.3 per the Apache advisory.
Sensitive information disclosure in Hiperdino's REST v1.0 API lets a caller holding a valid static bearer token query the public 'customer/check' endpoint with a phone number or email and confirm whether it belongs to a registered customer, returning that customer's email and telephone. The endpoint enforces no per-user authentication beyond a shared static token, applies no rate limiting, and returns distinguishable responses, enabling bulk enumeration of contact details. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sensitive AES key material is written in plaintext to Apache Syncope application logs under a specific misconfiguration condition. When an operator configures an AES key whose byte length deviates from standard values (16, 24, or 32 bytes), Syncope silently pads it with random characters to reach a valid length - and then logs the resulting padded key value. Any party with access to the application logs (e.g., log aggregation systems, monitoring personnel, or local server access) can recover the full AES encryption key, potentially allowing decryption of data protected by that key. No public exploit has been identified at time of analysis; vendor-released patches exist in versions 4.0.8 and 4.1.3.
MISP's interactive CLI shell (≤2.5.45) enforces access control independently from the web application, creating at least six distinct authorization gaps that allow authenticated local users to retrieve sensitive credentials and bypass record-level ACLs. Feed HTTP authorization headers (Feed.headers), server synchronization authkeys, sharing-group memberships, and feed visibility restrictions are all enforced correctly in the web tier but not in the CLI, while the `use` command allows a user to establish an unauthorized record context without proving read rights. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but the combination of plaintext credential disclosure and authorization bypass makes this a high-priority patch for any MISP deployment where non-site-admin personnel have shell access to the host.
Credential disclosure in Contec's Remote I/O Coupler Unit (Server Type) CPSN-MCB271 enables an attacker who obtains a device backup file to recover sensitive credentials stored within it in an insufficiently protected form. The root cause (CWE-522) means credentials are not rendered unrecoverable within backup archives, so any party who accesses a backup file can extract usable authentication material. Reported by JPCERT/CC with a CVSS 4.0 score of 8.2, no public exploit code has been identified and the vulnerability is not listed in CISA KEV.
Cleartext credential exposure in Suprema BioStar 2 (before 2.9.12) and BioStar X (before 1.0.2) allows any authenticated API user to retrieve Active Directory service account credentials in plaintext via a single GET request to the /api/v2/setting/adserversetting endpoint. The CVSS scope change (S:C) reflects that the real impact extends far beyond BioStar 2 itself - the exposed AD credentials can grant an attacker access to the entire Windows domain, enabling lateral movement and privilege escalation. A public proof-of-concept exploit is available on GitHub (mda1r/biostar2-ad-credential-exposure), significantly lowering the bar for exploitation.
Cross-tenant blob deletion and cluster-wide denial of service in Apache Storm Nimbus 3.0.0 allow authenticated topology submitters to arbitrarily delete blobstore keys owned by other tenants or permanently disable cluster leadership. Nimbus accepts `dependency_jars` and `dependency_artifacts` lists without validating their contents at submission time: during topology cleanup Nimbus deletes listed keys as itself (bypassing ACL checks), and on acquiring leadership Nimbus surrenders leadership for any topology whose dependency keys are absent - allowing a single malicious submission to loop all Nimbus daemons into perpetual leader-election, leaving the cluster inoperable. No public exploit has been identified at time of analysis, but the DoS path requires only valid topology submission credentials.
Unauthenticated remote memory exhaustion in Apache Storm Worker (org.apache.storm:storm-client 3.0.0-3.0.x) allows any TCP peer reachable to a worker slot port to drive arbitrarily large JVM heap allocations with a single crafted frame. The Netty pipeline installs the message decoder ahead of SASL authentication handlers, and the default value of storm.messaging.netty.authentication is false, meaning no credentials are required regardless of configuration. Impact is availability-only - worker process crash or severe GC pressure at the 768 MB default heap - with no code execution or data exfiltration path. No public exploit has been identified at time of analysis; the vulnerability was discovered via automated Claude agent security research and validated by the Apache Storm project.
ZooKeeper credential disclosure in Apache Storm 3.0.0 exposes `storm.zookeeper.topology.auth.payload` through two independent channels: Nimbus serves the full topology configuration verbatim to any caller holding read-only permissions, and the submission client logs the same payload at INFO level on every submission while SASL handlers emit it at DEBUG. An authenticated user with only read-only topology view rights can recover the ZooKeeper write credential and use it to forge or suppress worker heartbeats, backpressure, and error state for the affected topology, or indirectly obtain it via log aggregation pipelines or support bundles. No public exploit has been identified; vendor-released patch version 3.1.0 is available.
Local privilege escalation in Apache Storm Worker Launcher 3.0.0 allows an authenticated Storm topology tenant to gain root on supervisor nodes by exploiting a TOCTOU race in the setuid-root worker-launcher binary: the binary chowns the entire worker directory to the untrusted topology user before re-reading the supervisor-written command file, creating a window in which the tenant can substitute attacker-controlled content. For Docker workers, the injected command executes with real uid 0 through an insufficiently constrained argument sanitizer that passes -v, --device, --cap-add, --security-opt, --user, --net, and positional arguments verbatim; for OCI workers, arbitrary host paths can be bind-mounted read-write and execution can be forced as another tenant's uid. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 3.1.0.
HTTP request smuggling in HAProxy 3.3.0-3.4.4 affects deployments running an HTTP/3 (QUIC) frontend forwarding traffic to HTTP/1.1 backends over reused pooled connections with chunked transfer encoding. The H3 multiplexer in src/h3.c emits an untrusted client-declared DATA frame length verbatim as the HTTP/1.1 chunk size before payload bytes arrive; when a remote unauthenticated attacker under-delivers payload then ends the stream, HAProxy returns the desynchronized backend connection to the idle pool, enabling bypass of path-based frontend deny rules and exposure of concurrent clients' Authorization headers as attacker-visible request body. No public exploit code has been identified, though the attack is probabilistic and freely retryable.
Insecure direct object reference in Rhymix CMS before 2.1.31 allows authenticated users to access and potentially delete uploaded files belonging to other documents by supplying arbitrary file serial numbers in document extra variable fields. The root cause is missing ownership validation in the extravar module: file-type extra variables accepted any file SRL from user input and rendered or deleted the referenced file without confirming it belonged to the current document. No public exploit code is identified; vendor patch is available in version 2.1.31, tracked as RVE-2026-1.
Out-of-bounds read in zstd-jni versions 1.2.0 through 1.5.7-13 exposes JVM-based applications to service termination and partial memory disclosure when attacker-controlled offset or length values are passed to the ZstdDictDecompress constructor without bounds validation. The missing guard allows values that exceed the backing byte array, causing the JNI layer to read past the array boundary into native memory, which can abort the JVM process. A vendor-released patch is confirmed in v1.5.7-14; no public exploit code or CISA KEV listing has been identified at time of analysis.
Local file inclusion and remote code execution in GEO my WP WordPress plugin (≤4.5.5.3) allow unauthenticated attackers to include arbitrary PHP files via the `gmw_posts_locator_ajax_info_window_loader` AJAX handler, which accepted attacker-controlled template paths and passed them to a PHP `require` statement without adequate allowlist enforcement. At minimum this exposes sensitive PHP files such as wp-config.php; when PEAR is installed with `register_argc_argv` enabled, attackers can leverage pearcmd.php to write and execute arbitrary PHP code, achieving full unauthenticated RCE. No public exploit has been identified at time of analysis, though the Wordfence advisory and vulnerable source code are publicly available, substantially reducing the development effort for a proof-of-concept.
Unauthenticated credential token disclosure in the Zonify WordPress plugin before 1.0.5 exposes the site's stored service account login token to any remote attacker without authentication. The plugin fails to perform any WordPress capability check or authentication verification before returning the stored token, allowing retrieval by any network-reachable actor. An attacker who obtains the token can then authenticate to the site owner's linked third-party service account, effectively achieving full account takeover of the integrated service. No public exploit code has been identified at time of analysis, and EPSS stands at 0.18%, but the zero-barrier exploitation profile - unauthenticated, low complexity, network-accessible - makes the vulnerability trivial to abuse once discovered.
Unauthenticated arbitrary file read in the Yogeta WP Cloud WordPress plugin (through version 1.0) allows any remote attacker to download arbitrary files from the server, including sensitive credential files such as wp-config.php, database configuration, and OS-level files like /etc/passwd. The plugin exposes a public endpoint that passes a user-supplied file path directly to a file-read function with no path validation and no authorization check, enabling full server-side file disclosure. Reported by WPScan with no patch available at time of analysis; no public exploit is identified at time of analysis, and EPSS stands at a low 0.16%, though the unauthenticated network-accessible nature makes this easily exploitable when the plugin is active.
Use-after-free in the Linux kernel NFSD server's NFSv4.1+ callback channel lets a slab object be read after it is freed when a client's session is torn down. After a DESTROY_SESSION, the teardown path can kfree() a session while an inflight callback rpc_task on rpciod still dereferences clp->cl_cb_session, because flushing the callback workqueue does not wait for tasks already handed to rpc_call_async() and the 1-second rpc_shutdown_client() drain can be outlived by tasks parked in rpc_delay() during NFS4ERR_DELAY retries. The fix RCU-protects cl_cb_session and switches session freeing to kfree_rcu(); no public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a race-dependent server-side kernel bug rather than a mass-exploitation target.
NFSD's seq-lock-like rq_status_counter protocol in nfsd_dispatch() is broken on three non-success exit paths - cache-hit (RC_REPLY), drop (RC_DROPIT/RQ_DROPME), and encode-error - leaving the counter permanently odd and exposing actively-mutating kernel fields to the lockless reader in nfsd_nl_rpc_status_get_dumpit(). A local low-privileged user on an NFS server who can poll NFSD RPC status via the netlink interface while requests traverse these paths can trigger out-of-bounds reads past the 8-element inline ops array embedded in the rqstp structure, disclosing kernel memory or causing a kernel panic. No public exploit exists (EPSS 0.19%), but the 6.12 LTS series appears unpatched, with fixes confined to 7.2.4 and 7.3-rc1.
Out-of-bounds ring-buffer write and stale-memory disclosure in the Linux kernel NFSD server affects the nfsd_fh_verify and nfsd_fh_verify_err tracepoints, which reserve a server-address trace slot sized by the transport's remote-address length (xpt_remotelen) but populate it from the local address using xpt_locallen. On NFSv2/v3-over-UDP, xpt_remotelen stays zero for the transport's lifetime, so every file-handle verification copies 16 or 28 bytes past a zero-byte slot; in the reverse case an oversized slot leaks prior ring-buffer contents to trace consumers. Exploitation requires the tracepoint to be enabled by a local administrator, and there is no public exploit identified at time of analysis (EPSS 0.17%).
Stale opcnt in nfsd4_release_compoundargs() enables an out-of-bounds slab read that leaks kernel memory to userspace via the netlink RPC status interface on Linux NFS servers. When nfsd_dispatch() hits an error path that leaves rq_status_counter at an odd value, the RPC status dumpit handler reads up to 16 entries from args->ops[] - but the inline iops[] array has only 8 elements and is the last field in the struct, so indices 8-15 access adjacent slab memory belonging to whatever object follows in the allocator. The fix zeroes opcnt unconditionally at compound-args release time. No public exploit or active exploitation has been identified; EPSS is 0.17%.
Use-after-free in the Linux kernel's NFS server (nfsd4_create_file, the NFSv4 OPEN-with-create path) allows a stale dentry to be dereferenced after being freed. When the exported filesystem is itself NFS (an NFS re-export), dentry_create() can return a different dentry than the one passed in, so the original 'child' dentry already recorded in resfhp may be freed and later dereferenced via fh_compose(), leading to memory corruption and likely a server crash. No public exploit identified at time of analysis; EPSS is low at 0.16% (6th percentile), and the fix is available upstream in stable kernels.
Unintended ACL deletion in the Linux kernel NFSD server affects the NFSACL v2 SETACL path, where nfsacld_proc_setacl() passes both the access and default ACL pointers to set_posix_acl() unconditionally even when the request mask omits one of them. Because set_posix_acl(..., NULL) is the VFS 'remove this ACL type' operation, an NFS client sending a SETACL that carries only NFS_ACL silently strips the directory's default ACL, and a mask of 0 strips both, corrupting on-disk access controls. This is the NFSACL v2 counterpart of the same defect already fixed in nfsd3_proc_setacl(); it is a fixed upstream integrity bug with no public exploit identified at time of analysis and a low EPSS score (0.21%).
Use-after-free in the Linux kernel NFSD server (nfsd4_copy_notify) lets a racing OFFLOAD_CANCEL operation free a copy-notify stateid before the COPY_NOTIFY caller finishes initializing and reading it, corrupting kernel memory on NFSv4.2 servers with inter-server copy offload. Affected are kernels from 5.6 up to the fixed 6.12.109/6.18.50/7.2.4/7.3-rc1 releases. The flaw requires an authenticated NFS client and a tight race window, and there is no public exploit identified at time of analysis (EPSS 0.20%, 10th percentile).
A use-after-free in the Linux kernel's NFSv4 server (NFSD) admin-state revocation path lets a client structure be freed while still in use, introduced in 6.9 and fixed in 6.18.51, 7.2.4, and 7.3-rc1. When an administrator revokes NFSv4 state, nfsd4_revoke_states() temporarily drops the client_lock while revoke_one_stid() dereferences a stateid's bare (non-pinning) pointer to its nfs4_client; a concurrent client teardown via force_expire_client() can free that client first, causing NFSD to read freed memory. No public exploit is identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not on CISA KEV; the practical impact is server crash/DoS on the NFS server rather than remote code execution.
Use-after-free in the Linux kernel's NFS server (NFSD) NFSv4.0 revoked-state cleanup path lets a race between the periodic laundromat sweep and administrative client expiry free an NFS client structure while it is still being dereferenced. In nfs40_clean_admin_revoked(), a stateid reference is held but does not pin the owning client, so nfsd4_drop_revoked_stid() can dereference s->sc_client after another thread frees the client. It is a server-side memory-corruption bug affecting hosts running NFSD with NFSv4.0 state, fixed in stable releases; there is no public exploit identified at time of analysis and EPSS is low at 0.20%.
Use-after-free in the Linux kernel CephFS client (__kick_flushing_caps) lets a race between cap-flush transmission and FLUSH_ACK handling corrupt kernel memory on a mounted CephFS client. Because the iterator drops i_ceph_lock to send cap messages, a fast-responding MDS can cause handle_cap_flush_ack() to detach and free the current cap-flush entry before the loop advances, dereferencing freed memory. No public exploit is identified at time of analysis and EPSS is low (0.20%); impact is a client-side crash/memory corruption rather than remote code execution.
Use-after-free in the Linux kernel CephFS client (check_new_map()) lets a freed ceph_mds_session be dereferenced during MDS map processing, enabling memory corruption and likely denial of service on machines with a mounted CephFS. When check_new_map() releases mdsc->mutex to handle a session's address change, reconnect, or active transition, it fails to take a reference on the session (unlike the forced-close path), so a concurrent thread can unregister and kfree that session before the original thread touches s->s_mutex. This is no public exploit identified at time of analysis; EPSS is low at 0.16%.
Out-of-bounds write in the Linux kernel CephFS client (ceph module) lets a malicious or compromised Ceph monitor corrupt kernel memory on any client with a mounted CephFS. The MDSMap decoder failed to bound export_targets rank values against CEPH_MAX_MDS, and check_new_map() then used each attacker-controlled rank as a bit index into a fixed-size stack bitmap, causing set_bit() to write past the array. No public exploit is identified at time of analysis and EPSS is low (0.17%), but the fix ships across multiple stable trees.
Kernel heap information disclosure in the Linux CephFS client (fs/ceph) lets a malicious or compromised Ceph metadata server (MDS) leak adjacent kernel heap bytes to a local user. __build_xattrs() fails to bounds-check the value length of the final xattr in an MDS-supplied blob, so an oversized length is stored verbatim and later copied out of bounds by getxattr(2). No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile) and the flaw is not in CISA KEV.
Use-after-free in the Linux kernel audit subsystem lets a local privileged operator free an audit tree while another rule still references it, later dereferencing a freed pathname. The flaw is in audit_del_rule(), which unconditionally calls audit_put_tree() as if handling a netlink deletion template; when invoked via fsnotify autoremove for mixed AUDIT_DIR plus AUDIT_EXE rules it instead drops the installed rule's live tree reference. No public exploit is identified at time of analysis, and the EPSS score is low (0.20%, 10th percentile), consistent with a local, race-dependent memory-safety bug rather than a remotely weaponizable one.
Stale fscache data exposure in the Linux kernel CIFS client allows a local low-privileged user with access to a mounted SMB share to read file data that should have been discarded after an O_TRUNC open. When cifs_do_truncate() is called from cifs_open() without holding i_rwsem, the fscache cookie invalidation step is skipped - meaning previously cached file contents remain readable via fscache_use_cookie() even after the file has been truncated to zero. This produces both confidentiality and integrity violations: a process can obtain pre-truncation data and the kernel cache becomes inconsistent with actual file state. No public exploit is identified at time of analysis; EPSS is 0.17%.
A use-after-free and memory leak in the Linux kernel's CIFS/SMB client (cifs_check_trans2 in the SMB1 TRANSACT2 reassembly path) can be triggered when a malicious or man-in-the-middle SMB server sends a malformed secondary TRANSACT2 response after a valid primary one. Because handle_mid() overwrites mid->resp_buf and skips clearing the server's smallbuf/bigbuf pointers when multiRsp is set, the demux thread later reuses a freed buffer, corrupting kernel memory. Despite a 9.8 CVSS rating, EPSS is only 0.20% and no public exploit is identified; the flaw is DoS/memory-corruption-leaning and requires the client to mount a share from an attacker-controlled server plus a demux-thread timing race.
Use-after-free in the Linux kernel's SMB/CIFS client DFS referral cache lets a dangling target-hint pointer be dereferenced after the backing structures are freed. In free_tgts(), all cache_dfs_tgt entries on ce->tlist are freed but ce->tgthint is left pointing at one of them, so a subsequent lookup of the preferred DFS target reads freed slab memory (CWE-416). The fix simply sets ce->tgthint to NULL after freeing the list. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and it is not in CISA KEV.
A use-after-free in the Linux kernel's ksmbd in-kernel SMB server allows an authenticated SMB client to trigger a slab-use-after-free write and likely kernel crash by abusing durable file-handle reconnection. When two sessions hold durable-v2 handles on the same file under different AppInstanceIds, ksmbd_reopen_durable_fd() rebinds every detached oplock on that inode to the reconnecting session instead of only the file's own, so one session adopts another's oplock without a session reference; after the adopted session is destroyed, ksmbd_close_fd_app_instance_id() dereferences the freed session. No public exploit is identified at time of analysis; EPSS is 0.20% (10th percentile), and the fix is present in kernels 7.2.4 and 7.3-rc1.
Out-of-bounds read in the Linux kernel SMB client's reparse_buf_ptr() function allows a malicious or MITM-positioned SMB server to trigger a kernel-level OOB memory read by returning a crafted IOCTL response with OutputCount below 6 bytes. The function reads ReparseDataLength at byte offset 4-5 of struct reparse_data_buffer before verifying that count covers the full 8-byte fixed header, exposing unvalidated memory and potentially crashing the client kernel. No public exploit code exists and EPSS is 0.15%, consistent with the network-positioning requirement and absence of weaponized tooling.
Kernel-memory disclosure in the Linux kernel's SMB/CIFS client (cifs.ko) lets a malicious or compromised SMB server leak up to ~65535 bytes of adjacent slab memory to userspace. CIFSTCon() computes its string-parsing bound from the server-supplied ByteCount minus two; a ByteCount of 0 or 1 underflows to a negative int that converts to a huge size_t and wraps the __u16 bytes_left, so cifs_strndup_from_utf16() reads far past the ~16 KB cifs_req_poolp slab object, and the leaked bytes surface via tcon->nativeFileSystem in /proc/fs/cifs/DebugData. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Kernel memory disclosure in the Linux ntfs3 driver's ni_read_frame() function exposes uninitialized kernel heap content to userspace via a plain read(2) call on a crafted NTFS compressed file. The LZNT decompressor returns early when it encounters a zero chunk header, writing fewer bytes than frame_size, but the residual gap in the vmapped pages is never zeroed before being marked uptodate and copied to userspace - leaking whatever kernel memory previously occupied those pages. A crafted NTFS image containing a short-decompressing compressed stream is sufficient to recover kernel pointers and defeat KASLR, making this a viable first-stage primitive for a chained kernel privilege-escalation attack. No public exploit has been identified at time of analysis and EPSS stands at 0.17%.
Improper metadata validation in the Linux kernel's NTFS3 filesystem driver allows a crafted NTFS image to pass consistency checks when an attribute declares empty mapping pairs while carrying an inconsistent highest VCN and size. Parsing such an attribute can drive out-of-bounds memory access during runlist decoding, leading to memory corruption or a denial of service when the malicious image is mounted. The fix rejects attributes whose empty mapping pairs contradict their highest VCN/size fields; no public exploit identified at time of analysis and EPSS is low (0.20%).
Out-of-bounds kernel memory write in the Linux kernel ntfs3 driver allows a local attacker to corrupt memory by mounting a crafted NTFS image. ntfs_attr_update_meta() shifts an attribute name forward by eight bytes when converting a non-sparse attribute to sparse (to insert the compressed_size field), but the record validator never confirms name_offset is within bounds, that the name does not overlap the mapping pairs, or that eight free bytes exist after mapping_pairs_offset - so a malicious MFT record can force a write past the attribute boundary. No public exploit identified at time of analysis; EPSS is low at 0.15% (5th percentile) and the issue is fixed in kernel 7.2.4 and 7.3-rc1.
Out-of-bounds read in the Linux kernel's eCryptfs filesystem packet parser allows a local low-privileged attacker to leak kernel memory or trigger a denial of service by opening a crafted encrypted file with a version 1 header. The root cause is that ecryptfs_parse_packet_set() computes remaining buffer space using a fixed PAGE_SIZE - 8 formula instead of the actual packet-set buffer length, overstating available bytes for version 1 headers where the packet set begins later. Patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit or active exploitation has been identified.
Use-after-free in the Linux kernel fanotify subsystem (introduced in 6.14) copies stale kernel stack memory to userspace and may enable local privilege escalation on unpatched 6.18.x and 7.x kernels. When a signal interrupts the triggering task precisely after the event reader sets FAN_EVENT_REPORTED but before it finishes preparing the file descriptor, fanotify_get_response() unwinds the stack-allocated file_range frame while the reader retains a dangling pointer to range.pos; the subsequent copy_range_info_to_user() dereferences freed stack memory, confirmed by KASAN. No public exploit code exists and EPSS is very low (0.17%), but vendor patches are available in 6.18.50, 7.2.4, and 7.3-rc1.
Out-of-bounds read in Linux kernel ACPI APEI GHES ARM hardware error handler arises from using pointer size instead of structure size when accounting for remaining CPER buffer after skipping the cper_sec_proc_arm header. Affected are stable branches 6.12.x through 6.12.109, 6.18.x through 6.18.50, 7.x through 7.2.4, and pre-7.3-rc1, on ARM systems with ACPI APEI support. No public exploit identified at time of analysis; EPSS is 0.20% (10th percentile), and there is no CISA KEV listing, consistent with a low automated exploitation probability.
Out-of-bounds read in the Linux kernel Bluetooth subsystem's eir_get_service_data() leaks kernel heap memory into userspace for ISO broadcast sink configurations. When an ISO broadcast sink processes periodic advertising (PA) reports from a remote Bluetooth broadcaster, a PA payload packed with multiple mismatching Service Data fields causes eir_len to undercount by 2 bytes per field iteration - the subtraction uses only the data length (dlen), omitting the 2-byte length+type header - so the pointer eventually reads past hcon->le_per_adv_data[] into the surrounding struct hci_conn; a drifted field matching the BAA UUID causes those bytes to be copied into iso_pi(sk)->base, recoverable by a local or remote-assisted userspace process via getsockopt(BT_ISO_BASE). No public exploit or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects low opportunistic risk, though the Bluetooth adjacent-network constraint caps mass exploitation potential.
Out-of-bounds kernel memory read in the Linux device-mapper dm-array subsystem allows a local attacker to trigger an OOB read from a dm-bufio buffer by presenting crafted dm-cache metadata with an oversized on-disk nr_entries field, exploitable during dm-cache activation. The flaw exists because array_block_check() validated only block number and checksum while omitting structural field bounds - unlike the sibling node_check() function - leaving dm_array_cursor_next() to bound its iteration directly from the unvalidated on-disk header and element_at() to perform unguarded pointer arithmetic past the buffer end. Vendor-released patches are available for stable branches 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1; no public exploit code exists and EPSS is 0.20% at the 10th percentile.
Use-after-free in the Linux kernel MPLS forwarding path allows a crafted packet to trigger a slab read of freed memory during multipath nexthop selection. mpls_select_multipath()/mpls_multipath_hash() cache a header pointer, then call pskb_may_pull(), which can invoke pskb_expand_head() and free the old skb head - leaving the cached pointer dangling and read afterward. Confirmed by a KASAN slab-use-after-free report reproduced in 2 of 2 unpatched runs via a legal Geneve packet over a bareudp/MPLS multipath setup; no public weaponized exploit and no KEV listing, with EPSS at 0.20% (10th percentile).
Memory-safety corruption in the Linux kernel SUNRPC layer allows a malicious NFS peer to trigger an unsigned integer underflow of the XDR stream length. When gss_krb5_unwrap_v2() decrypts a Kerberos-privacy (krb5p) message, it sets buf->len to a small wire-derived value while the underlying iovec lengths are at page scale; xdr_buf_trim() then subtracts more consumed bytes than buf->len records, wrapping the unsigned length to near UINT_MAX. That corrupted length becomes the authoritative bound for every downstream XDR decoder, enabling out-of-bounds reads and denial of service. A vendor patch is available; this is one of a cluster of related SUNRPC krb5 fixes. There is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Denial of service (and minor out-of-bounds read) in the Linux kernel's server-side SUNRPC GSS/krb5 code allows a client holding a valid Kerberos GSS context to crash an NFS server exporting with sec=krb5p. svcauth_gss_unwrap_priv() validated only an upper bound on the wire-supplied opaque token length, so a truncated sealed token (len 0-16) reached gss_krb5_unwrap_v2(), which read RFC 4121 header fields past the buffer and hit a divide-by-zero in _rotate_left() (shift %= buf->len with buf->len driven to zero). No public exploit identified at time of analysis; EPSS is low at 0.17% (6th percentile).
Denial of service (and short out-of-bounds read) in the Linux kernel's SUNRPC RPCSEC_GSS Kerberos privacy layer affects gss_krb5_unwrap_v2(), which parses the EC/RRC fields at ptr+4/ptr+6 before confirming the token is at least the 16-byte GSS_KRB5_TOK_HDR_LEN. A malicious NFS-with-krb5p peer supplying a sub-16-byte or malformed wrap token triggers an OOB header read, an unsigned wrap in rotate_left()/xdr_buf_subsegment(), a divide-by-zero in the modulo shift, and a dead BUG_ON that fails to stop a movelen underflow driving a ~UINT_MAX-byte memmove(). There is no public exploit identified at time of analysis; EPSS is 0.17% (6th percentile). The upstream fix adds four defense-in-depth length guards.
Out-of-bounds slab read in the Linux kernel SUNRPC Kerberos GSS layer allows a malicious NFS peer to make gss_krb5_verify_mic_v2() read past an undersized buffer when verifying an RFC 4121 MIC token. The function dereferences the token header, flags, and padding and builds a scatterlist over the checksum without ever checking that the wire-supplied token is at least GSS_KRB5_TOK_HDR_LEN (16) plus the enctype checksum length; all callers only enforce loose upper bounds, so a short checksum opaque produces a small allocation the verifier reads beyond. Exploitation is limited to deployments using RPCSEC_GSS Kerberos (NFS sec=krb5); there is no public exploit identified at time of analysis and EPSS is low (0.19%).
Use-after-free in the Linux kernel NFS-over-RDMA server (svcrdma) allows an adjacent-network attacker to trigger kernel memory corruption when an RDMA_CM_EVENT_ADDR_CHANGE event coincides with a replacement listener cm_id allocation failure, leaving sc_cm_id pointing to a destroyed object. Subsequent kernel operations that dereference sc_cm_id - most immediately rdma_disconnect() in svc_rdma_detach() - read or write freed kernel memory, with potential impacts on confidentiality, integrity, and availability. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.15% (5th percentile), consistent with the niche NFS-over-RDMA server attack surface.
Denial-of-service (and potential memory corruption) in the Linux kernel's NFS-over-RDMA server (svcrdma) arises from offset arithmetic defects in svc_rdma_read_chunk_range(). A malicious or malformed RDMA client can craft Read-chunk segment lists whose offset/length values trigger a u32 underflow, producing a near-UINT_MAX per-segment length that propagates an enormous nr_bvec into svc_rdma_build_read_segment() and a multi-MiB kmalloc_array_node() allocation, while also silently dropping bytes from rebuilt chunks. Affected kernels are those with NFS-over-RDMA serving enabled from v5.11 onward; there is no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).
Out-of-bounds slab memory disclosure in the Linux kernel's svcrdma (NFS-over-RDMA server) transport allows a connected RDMA client to leak adjacent kernel heap contents. The RPC/RDMA Read chunk position field is taken verbatim from the remote client and only alignment-checked, never bounded against the received inline body length, so a malicious client can drive kvec/gap-length integer underflows that expose adjacent slab memory to the XDR decoder or copy past the receive buffer into reply pages returned to the client. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile), and a vendor patch is available in the stable trees.
Integer underflow in the ath6kl WiFi driver's ath6kl_cfg80211_connect_event() allows an adjacent-network attacker controlling a rogue access point to trigger disclosure of kernel slab memory to userspace via nl80211. When a crafted association response shorter than 6 bytes (or request shorter than 4 bytes) is received from firmware, the u8 length fields wrap around to approximately 250, causing cfg80211_connect_result() or cfg80211_roamed() to copy ~250 bytes of adjacent slab data through netlink to any listening userspace process. Patches are available across all active stable branches; no public exploit exists at time of analysis.
Race condition in Linux kernel's core scheduler pick_next_task() path allows a local low-privileged attacker to exploit a TOCTOU window when pick_task() releases the rq (run queue) lock mid-selection, potentially leaking information across SMT sibling threads, corrupting forceidle accounting, and destabilizing the scheduler. The vulnerability breaks the cookie-based SMT isolation guarantee of Core Scheduling: an uncookied task can be committed as the sibling of a cookied task during the lock-release window, violating the trust boundary the feature is designed to enforce. No public exploit exists (EPSS 0.19%), and fixes are available in Linux 7.2.4, 7.3-rc1, and 6.19.
Memory order mismatch in the Linux kernel ring-buffer subsystem exposes a race condition between ring_buffer_alloc_read_page() and ring_buffer_subbuf_order_set() that can corrupt the bpage->order metadata field relative to actual allocated memory size. When subbuf_order changes mid-allocation, subsequent operations using bpage->order to calculate buffer boundaries may read or write outside the allocated slab region, enabling a low-privileged local attacker with access to tracefs/debugfs interfaces to potentially disclose kernel memory contents or destabilize the kernel. No public exploit code exists and EPSS is low at 0.20%, indicating limited exploitation interest despite the fix being available in stable kernel releases.
Page-list corruption in the Linux kernel ring-buffer subsystem allows a local low-privileged attacker to trigger undefined memory behavior by exploiting improper handling of a failed remote reader page swap. When the tracing ring-buffer's `swap_reader_page` callback returns `-EBUSY` - which occurs during an event storm on a small buffer - `__rb_get_reader_page_from_remote()` incorrectly proceeds as though the swap succeeded, splicing the same physical page as both the previous and new reader entry simultaneously. This corrupted page-list state can result in confidentiality loss from stale kernel memory reads, integrity violations from writes to a doubly-referenced page, or kernel panic. No public exploit or active KEV listing exists; EPSS is 0.15%, consistent with a low-likelihood local kernel race condition.
Use-after-free in the Linux kernel's lockd (NFS Network Lock Manager) service allows freed-memory access during hash-bucket file traversal. The nlm_traverse_files() iterator pinned the current file but not the saved 'next' pointer across a mutex_unlock window, so a concurrent nlm_release_file() could kfree the next file and cause the iterator to dereference freed memory on its next step. Fixed across stable kernels; no public exploit identified at time of analysis and EPSS is low (0.20%), consistent with a hard-to-time race rather than a turnkey exploit.
Uninitialized kernel memory disclosure in the Linux kernel NVMe subsystem affects all kernels from commit 530436c45ef2 through fixed releases 6.12.109, 6.18.50, 7.2.4, and 7.3-rc1. When a discard (TRIM/DSM) operation is issued and the GFP_ATOMIC allocation for the 4096-byte DSM payload fails under memory pressure, the kernel falls back to the per-controller ctrl->discard_page, which was allocated with alloc_page(GFP_KERNEL) in nvme_init_ctrl() but never zeroed - causing up to 4080 bytes of stale kernel data (vmemmap struct page pointers and other heap residue) to be transmitted to the NVMe controller. No public exploit exists and EPSS is 0.20%; the input CVSS vector AV:N/AC:L/PR:N significantly overstates exploitability for what requires local privileged access under specific memory pressure conditions.
Kernel memory disclosure in the Linux kernel's nvme-tcp driver allows a malicious or compromised NVMe-TCP storage controller to exfiltrate arbitrary stale kernel memory pages from a connected host. The flaw in `nvme_tcp_handle_r2t()` - which fails to validate that an incoming R2T (Ready to Transfer) PDU corresponds to a WRITE command - causes the host to respond to R2T PDUs targeting READ commands by transmitting the READ destination buffer (uninitialized kernel memory) back to the controller via H2CData PDUs. Exploitation produces no error log and the READ command completes normally, making the disclosure silent. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17%, consistent with the infrastructure-level attacker positioning required.
Information disclosure in the Linux kernel's NVMe-over-TCP (nvme-tcp) transport driver allows a malicious or compromised NVMe-TCP storage controller to serve a truncated read response - for example, answering a 4 096-byte read with only 512 bytes while asserting DATA_SUCCESS - causing the kernel to complete the request without detecting the shortfall and deliver a buffer whose unfilled portion contains stale kernel page contents to userspace. Affected kernels include all releases from the introduction of nvme-tcp support (commit 3f2304f8c6d6ed97849057bd16fee99e434ca796) through Linux 6.12.108, 6.18.49, and 7.2.3. No public exploit or CISA KEV listing has been identified; EPSS is 0.17 % at the 6th percentile, reflecting low community exploitation activity at time of analysis.
Use-after-free in the Linux kernel SCTP stack (net/sctp) allows a peer in an established, authenticated SCTP association to trigger a stale transport reference by removing an IP address via ASCONF DEL-IP while an inbound packet is still being processed. sctp_rcv() caches the resolved transport in chunk->transport, but a concurrent sctp_assoc_rm_peer()/sctp_transport_free() can free it during the backlog window or before bh_lock_sock(), after which a delayed SACK causes sctp_outq_select_transport() to read freed memory. Fix drops such chunks in sctp_inq_push(); no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile).