Information Disclosure
Monthly
Local privilege escalation potential in the Linux kernel netfilter nf_tables tunnel module (nft_tunnel) stems from a use-after-free triggered when a tunnel object is destroyed while packets still hold a reference to its metadata_dst. The flawed nft_tunnel_obj_destroy() path calls metadata_dst_free(), which kfree()s the structure while ignoring the dst_entry refcount, so packets queued in a qdisc (e.g. netem) later call dst_release() on freed memory. CVSS is 7.8 (high) with CVSS:3.1 vector AV:L/PR:L; EPSS is low at 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Execute-permission bypass in the Linux kernel's KVM arm64 nested-virtualization (NV) code allows a nested guest to receive unintended execute permissions on stage-2 mappings when the host CPU lacks FEAT_XNX. The root cause is a misuse of FIELD_PREP() on the XN[0] mask after XN had already been shifted out of its bitfield position, which unconditionally grants execute rights instead of conditionally clearing them. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and the issue is not in CISA KEV, but the assigned CVSS of 8.8 reflects the hypervisor scope-change and potential for a guest to bypass non-executable memory enforcement.
Denial of service in the Linux kernel's Hyper-V netvsc network driver (hv_netvsc) allows a system crash when transmitting packets whose skb fragments reference high memory. On 32-bit x86 builds with CONFIG_HIGHMEM=y, netvsc_copy_to_send_buf() calls phys_to_virt() on fragment PFNs that may live above the LOWMEM boundary, producing an address outside the kernel direct map; the following memcpy() faults fatally on the transmit softirq path. No public exploit has been identified, the EPSS probability is low (0.18%), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client corrupt kernel slab memory by sending a second SMB2_CANCEL for the same AsyncId of a blocking byte-range lock. The first cancel frees the struct file_lock but takes an early-exit that never unlinks the async work or clears its cancel callback, leaving a live cancel_fn pointing at freed memory in the file_lock_cache (size 192) slab; a racing second cancel re-runs smb2_remove_blocked_lock() on the dangling pointer. The flaw was reproduced on mainline with KASAN by an authenticated client, EPSS is low (0.18%), and there is no public exploit identified at time of analysis.
Local privilege escalation via use-after-free in the Linux kernel ALSA timer subsystem (sound/core/timer.c) allows an authenticated local user to corrupt kernel memory by triggering dangling references to a freed snd_timer object. When snd_timer_free() unlinked pending instances it left slave timer instances still pointing at the freed master timer; the flaw is readily reachable through the userspace-driven timer interface (CONFIG_SND_UTIMER), where opening/closing a file creates and destroys timer objects while other processes keep accessing them. EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis, but kernel UAF bugs of this class are historically a strong primitive for local privilege escalation.
Local privilege escalation or memory corruption in the Linux kernel's ALSA timer subsystem stems from a use-after-free in snd_timer_user_params() reachable via the SNDRV_TIMER_IOCTL_PARAMS ioctl. A low-privileged local user with access to a timer device (notably userspace timers under CONFIG_SND_UTIMER) can race a concurrent ioctl against timer object release to access freed memory. No public exploit identified at time of analysis, and EPSS is low (0.18%), reflecting the local-only, race-dependent nature of the bug.
Improper completion-flag handling in the Linux kernel's io_uring networking layer (io_uring/net) causes IORING_CQE_F_BUF_MORE to be dropped when a bundled recv operation retries while using incremental provided buffer rings (IOU_PBUF_RING_INC). Local applications using io_uring can be misled into advancing a buffer ring head past an entry the kernel is still using, leading to buffer reuse, data corruption, and potential information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and a vendor patch is available across stable trees.
Use-after-free in the Linux kernel's transparent huge page code (mm/huge_memory) lets a local low-privileged process read freed folio state when __split_huge_pmd_locked() updates the file/shmem RSS counter only after dropping the PMD mapping's folio reference. On affected kernels (introduced around the 4.19 era through to fixes in 6.x/7.x stable trees), a final folio_put() can free the folio before mm_counter_file() inspects it via folio_test_swapbacked(), enabling reads of freed kernel memory. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a hard-to-win race rather than turnkey exploitation.
Privilege/capability boundary bypass in the Linux kernel RDMA/core subsystem (ib_get_ucaps) lets a local low-privileged user masquerade as an authentic user-capability (ucap) character-device file descriptor. Because char and block devices share the dev_t namespace, the kernel previously validated only the device number, so a block device with a matching dev_t could be passed to ib_get_ucaps() to impersonate a legitimate ucap cdev and obtain RDMA capabilities the user should not hold. The fix validates the file's f_ops to accept only genuine cdevs. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; a stable-tree vendor patch is available.
Out-of-bounds read in the Linux kernel's RDMA/SRP initiator (ib_srp) driver lets a malicious or compromised SRP storage target that an initiator has logged into trigger a kernel memory over-read by returning an SRP_RSP with SRP_RSP_FLAG_SNSVALID and an attacker-controlled 32-bit resp_data_len that is never validated against the bytes actually received. With resp_data_len near 0xFFFFFFFF the sense-copy source lands gigabytes past the receive buffer, faulting the kernel for a denial of service and potentially disclosing adjacent kernel memory into the sense buffer. No public exploit is identified at time of analysis and EPSS is low (0.18%), but exploitation requires the privileged position of a trusted SRP target on the InfiniBand/RoCE fabric.
Use-after-free in the Linux kernel zram block-device driver allows local attackers to corrupt freed kernel page memory when a zram device is configured with a writeback (ZRAM_WB) backing device. The flaw is in zram_bvec_write_partial(), which passes its parent bio into zram_read_page(), causing the backing-device read to be dispatched asynchronously and return before completion; the buffer is then copied, rewritten, and freed while the in-flight read still writes into it. With a CVSS of 7.8 (high) but a low EPSS of 0.18% (7th percentile) and no public exploit identified at time of analysis, this is a memory-corruption primitive with potential for privilege escalation but no evidence of real-world abuse.
Remote denial of service in the Linux kernel's UDP receive path affects systems where a UDP socket is placed in a BPF sockmap with an attached SK_SKB verdict program. Because skb->dev is repurposed as dev_scratch on the UDP path and never cleared before the verdict program runs, a verdict program that calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) causes dev_net() to dereference a stale integer as a net_device pointer, triggering a general protection fault on a non-canonical address in softirq. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and the flaw is fixed; impact is availability only (kernel crash), not the 'Information Disclosure' the input tags suggest.
Resource exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem lets a remote peer drive incoming traffic past the receiver's configured rcvbuf size by breaking receive-window accounting. The defect arises because the TCP-level receive window is prevented from shrinking while the MPTCP-level window is independently constrained, so when data is acked at the TCP level but is out-of-order in MPTCP sequence space (or backlogged), the advertised MPTCP window is artificially inflated. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis and no KEV listing; the issue is corrected upstream and carries availability impact (CVSS A:H) despite a source 'Information Disclosure' tag.
Heap buffer overflow in the Linux kernel's nl80211 WiFi configuration subsystem (cfg80211) allows a local user with network-configuration privileges to corrupt kernel memory by supplying an oversized EMA (Enhanced Multiple BSSID Advertisement) RNR element list. The parser nl80211_parse_rnr_elems() stores its element count in a u8 field and uses it to size a flexible-array allocation, so submitting 256 or more nested NL80211_ATTR_EMA_RNR_ELEMS attributes wraps the counter and produces an undersized allocation that is then overrun. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel timer migration subsystem allows the global timer hierarchy to enter an indefinite livelock, hanging the affected CPU. The flaw is in tmigr_handle_remote_up(), where tmigr_handle_remote_cpu() skipped timer_expire_remote() for the local CPU on the assumption that the softirq path already serviced its timers; when jiffies advance between local timer processing and remote evaluation, a newly expired timer is never run and is re-queued with expires==now, spinning the goto-again loop forever. The CVSS 3.1 base score is 7.5 (availability only) but EPSS is just 0.18% (7th percentile), there is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's rtl8723bs staging Wi-Fi driver (Realtek RTL8723BS SDIO) lets a local low-privileged actor read past the intended information-element (IE) buffer. rtw_update_protection() receives a pointer already offset into the ies buffer while still being passed the full ie_length, so parsing walks beyond the valid data. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 7th percentile), it is not in CISA KEV, and fixed kernel releases are available.
Memory-safety flaw in the Linux kernel's staging rtl8723bs Realtek SDIO Wi-Fi driver allows an adjacent (radio-range) attacker to trigger an unsigned-integer underflow in the rtw_mlme information-element parsing path, leading to out-of-bounds reads that can disclose kernel memory or crash the system. The bug occurs because ie_length was not validated before fixed IE offsets were subtracted from it. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but a vendor (upstream kernel) fix is available.
Slab use-after-free in the Linux kernel's IP fragment reassembly (inet frags) layer occurs during network namespace teardown: fqdir_pre_exit() flushes incomplete fragment queues via inet_frag_queue_flush() without clearing q->fragments_tail/last_run_head, so a fragment reassembly already in flight resumes after the flush and dereferences freed skbs. IPv4, IPv6, nf_conntrack_reasm6, and 6lowpan reassembly all share the affected flush path. There is no public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile); NVD scores it CVSS 9.8 (AV:N), but the bug is fundamentally a teardown-vs-reassembly race, so the network-unauthenticated framing overstates practical reachability.
Improper error handling in the Linux kernel's overlayfs (ovl) directory-iteration code causes ovl_iterate_merged() to return a truncated cache pointer as a bogus non-zero error code after a successful ovl_cache_get(). The flaw is reachable by a local user performing a getdents64/readdir on a stacked overlay-on-overlay mount, as demonstrated by a syzbot reproducer; there is no public exploit and it is not actively exploited. EPSS is very low (0.16%, 6th percentile), consistent with a hard-to-leverage local logic bug rather than a broadly weaponizable flaw.
Heap out-of-bounds write in the Linux kernel's Arm Ethos-U NPU accelerator driver (accel/ethosu) lets a local user with access to the NPU device corrupt adjacent kernel heap memory. The command-stream parser masks the IFM region index with 0x7f (max 127) instead of 0x7 (max 7) like every other region assignment, so a crafted NPU_SET_IFM_REGION opcode with param > 7 indexes far past the 8-entry region_size[]/output_region[] arrays, writing up to ~1016 bytes beyond the allocation. No public exploit identified at time of analysis, and EPSS is low (0.16%), but the bug is a classic exploitable heap-overflow primitive in privileged kernel context.
Local privilege/availability weakness in the Linux kernel memory cgroup (memcg) subsystem stems from refill_stock() calling get_random_u32_below() for victim selection, a routine that is neither reentrant- nor NMI-safe. Because memcg charge draining can occur in NMI context, an NMI landing mid-update of the per-CPU batched_entropy_u32 ChaCha state could corrupt the random subsystem's per-CPU local_lock state. The fix replaces the random pick with a per-CPU round-robin counter serialized by the existing local_trylock; EPSS is very low (0.17%, 7th percentile), this is not in CISA KEV, and no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's Qualcomm FastRPC misc driver (drivers/misc/fastrpc) arises from a use-after-free of the fastrpc_user structure during concurrent file-descriptor close and DSP response processing. A local user with access to the FastRPC device can race fastrpc_device_release() against the put_work workqueue so that fastrpc_context_free() dereferences an already-freed user object, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a hard-to-win kernel race on Qualcomm-only hardware.
Local privilege escalation and memory corruption in the Linux kernel's fastrpc misc driver allows an attacker with local low-privileged access to a FastRPC device to trigger a use-after-free in fastrpc_map_create by racing a concurrent MEM_UNMAP against map lookup. The flaw stems from fastrpc_map_lookup returning an unprotected raw pointer after dropping fl->lock, which a concurrent unmap can free before the reference is taken. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a kernel race condition requiring local access and precise timing.
Slab use-after-free in the Linux kernel's Phonet subsystem (net/phonet) allows a local privileged actor to trigger memory corruption when a phonet_device is torn down. phonet_device_destroy() unlinks the object from the per-net device list with list_del_rcu() but frees it immediately, so concurrent RCU readers can still dereference the freed object; the fix converts the free to kfree_rcu(). No public exploit identified at time of analysis, EPSS is very low (0.17%, 7th percentile), and it is not on CISA KEV, but the CVSS 3.1 base score is 7.8 (High) reflecting full confidentiality, integrity and availability impact from local exploitation.
Local privilege escalation and memory corruption in the Linux kernel's nvmem core subsystem arises from use-after-free bugs in multiple error paths where __nvmem_device_put() releases the nvmem device (and its backing memory/resources) but the code continues to dereference the freed structure before returning. A local, low-privileged user able to trigger these error paths can corrupt kernel memory, potentially leading to code execution or information disclosure. Fix is upstream in stable kernel trees; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%).
Kernel memory corruption in the Linux memory-management list_lru subsystem (memory cgroup reparenting path) allows a local user to corrupt linked-list pointers and destabilize or potentially escalate privileges on the system. The flaw is a race condition in memcg_reparent_list_lrus(), affecting kernels from 6.13 onward; it carries CVSS 7.8 (High) with full confidentiality, integrity and availability impact but a low EPSS of 0.17% (7th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds buffer access in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem allows a remote attacker who can send crafted RxRPC-over-UDP traffic to trigger improper reads of the SACK table when an incoming ACK packet is deliberately fragmented. AF_RXRPC wrongly assumes skb_condense() always linearizes the packet before parsing soft-ACKs in rxrpc_input_soft_acks(), but skb_condense() can silently no-op, leading to access of a non-flat buffer and in-place modification of the received skbuff. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and this is not in CISA KEV.
Out-of-bounds read in the Linux kernel Thunderbolt (thunderbolt) property parser lets a crafted property directory from a connected Thunderbolt/USB4 device cause the kernel to read past an allocated property block, potentially disclosing adjacent kernel memory or crashing the system. The flaw lives in __tb_property_parse_dir(), which fails to validate that content_offset + content_len stays within block_len for the root directory. It affects a broad range of stable kernel series and is fixed upstream; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.18% (7th percentile).
Out-of-bounds memory read in the Linux kernel's Thunderbolt (thunderbolt) XDomain driver allows an adjacent peer connected over a Thunderbolt link to leak kernel heap memory or crash the host. The flaw lives in tb_xdp_handle_request(), which casts a received XDomain packet to protocol-specific structs without confirming the kmemdup allocation is large enough, so a deliberately undersized packet that still passes the generic header-length check triggers reads past the buffer. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and it is not CISA KEV-listed.
Information disclosure in the Linux kernel's Thunderbolt XDomain driver allows a malicious peer device to read stale kernel DMA-pool memory from prior transactions. The tb_xdomain_copy() function copies the full expected response_size from a received packet buffer without bounding it to the actual frame size, so a deliberately short response causes the kernel to leak adjacent buffer contents. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel DRM/GEM subsystem stems from a race condition in the GEM change_handle ioctl when it runs concurrently with gem_close, where botched two-stage idr_replace handling against the wrong idr slot allows a concurrent close to steal the object's only inherited reference. The flaw affects systems using the DRM graphics stack (notably AMD GPU paths, per source tags) and an unprivileged local user with access to a DRM render/card device can trigger a use-after-free, with the upstream resolution disabling the change_handle ioctl entirely until the locking can be proven correct. No public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile), consistent with a local-only, hard-to-win race rather than mass exploitation.
Out-of-bounds read and unbounded-iteration denial of service in the Linux kernel's AMD Display (amdgpu DC) driver arises when the bios_parser/bios_parser2 code walks VBIOS record chains that lack a proper 0xFF terminator record. A local attacker able to supply a malformed VBIOS image can force hundreds of thousands of probe-time iterations (with record_size=1) and, near the image boundary, trigger struct casts that read past the 2-byte header validated by GET_IMAGE. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 6th percentile), consistent with a local, firmware-dependent memory-safety bug rather than a broadly exploited remote flaw.
Denial of service in the Linux kernel's virtio vsock transport allows a local actor to exhaust kernel memory by flooding the socket with zero-length packets flagged VIRTIO_VSOCK_SEQ_EOM, which bypass receive-buffer accounting and grow the skb receive queue without bound. The flaw affects the vsock/virtio guest-host communication path and carries CVSS 7.1 (A:H, scope-changed); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. Note a data conflict: the input tags it 'Information Disclosure', but the CVSS vector (C:N/I:N/A:H) and the description describe a memory-exhaustion availability issue, not disclosure.
Out-of-bounds memory access in the Linux kernel's netfilter subsystem allows attackers to leak adjacent kernel memory or crash the host by sending packets that traverse MAC-based matching paths (`xt_mac`, `ip6t_eui64`, the `bitmap:ip,mac`/`hash:ip,mac`/`hash:mac` ipset types, and `nf_log_syslog`) which call `eth_hdr(skb)` without first confirming the skb carries a full Ethernet header. Affected kernels span the 5.15 through 7.1 stable trees prior to the fixed releases, and the impact is information disclosure and denial of service rather than code execution. There is no public exploit identified at time of analysis, and the EPSS score is low at 0.17% (7th percentile).
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Information disclosure in GitLab Enterprise Edition 19.1 (before 19.1.1) lets a user retrieve sensitive data previously committed to a project because Duo Workflows fails to adequately filter its output under certain conditions. The flaw exposes confidential repository content through GitLab's AI workflow feature without altering or destroying data. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as 'none', though EPSS sits at a modest 0.33% (25th percentile).
Information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers read sensitive data exposed through the named pipe MSI_SERVICE_2, which is configured with overly permissive access controls. The flaw scores CVSS 7.5 (high) for confidentiality-only impact with no authentication required; publicly available exploit code exists in a GitHub proof-of-concept, though there is no evidence of active exploitation and the EPSS probability is low (0.22%, 13th percentile).
Sensitive information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers recover confidential data protected by the service's weak 3DES-ECB encryption scheme. The ECB cipher mode leaks structural patterns and, combined with insecure permissions (CWE-200), exposes data an attacker can decrypt or infer without authentication. No public exploit is identified at time of analysis, though a GitHub research repository is referenced and EPSS remains low (0.15%).
Information disclosure in MSI's NBFoundation Service version 2.0.2506.1201 lets a remote attacker read sensitive data exposed by the bundled MSIAPService.exe component due to insecure permissions (CWE-200). Publicly available exploit code exists (GitHub, LittleSuRii/CVE-2026-MSIAPService), but there is no public evidence of active exploitation and the EPSS score is low at 0.22% (13th percentile). Rated CVSS 7.5 for a high-confidentiality, no-integrity, no-availability impact against MSI notebook systems running the affected service.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected installations by abusing a path-traversal weakness in the writeFileToHttpServletResponse method. Because the underlying service runs with SYSTEM privileges, an attacker can exfiltrate sensitive files including configuration, credentials, and OS-level data. Cataloged via ZDI (ZDI-26-380 / ZDI-CAN-28505) with no public exploit identified at time of analysis; not listed in CISA KEV and no EPSS score was provided.
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Insecure object property modification (mass assignment) in Rocket.Chat's file-upload completion flow allows a low-privileged authenticated user to overwrite arbitrary fields on their own upload record, including the storage backend (store) and store-specific path fields. The flaw stems from sendFileMessage passing the entire attacker-controlled file object into Uploads.updateFileComplete, which Object.assigns it into a MongoDB $set with no writable-field allow-list, enabling an attacker to repoint their upload metadata at arbitrary storage locations and disclose sensitive data. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue affects all releases prior to the fixed 8.5.0/8.4.1/8.3.3/8.2.3/8.1.4/8.0.5/7.13.7/7.10.11 builds.
Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick the privileged virt-handler into applying file ownership or permission changes to unintended host paths. The OpenAtNoFollow safeguard is defeated because downstream helpers re-open the descriptor through /proc/self/fd/N with link-following syscalls, so a symlink at the path leaf is dereferenced. There is no public exploit identified at time of analysis, EPSS is very low (0.12%), and CISA SSVC marks exploitation as none.
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. No CISA KEV listing and no evidence of active exploitation were provided.
Denial of service in Mastodon affects all self-hosted instances prior to 4.5.11, 4.4.18, and 4.3.24, where the math content sanitizer fails to handle exceptions raised while processing malformed `<math>` nodes (MathML). A remote attacker can craft content containing broken math markup that propagates an uncaught exception, crashing whole-server services or disrupting service for targeted users depending on which component processes the malformed node. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; CVSS is 7.5 with availability-only impact.
Server-side request forgery in Mastodon (versions before 4.5.10, 4.4.17, and 4.3.23) lets an attacker who controls authoritative DNS for a hostname bypass Mastodon's private-network filter and force the server to connect to internal IPv4 endpoints. The flaw stems from PrivateAddressCheck.private_address? returning false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) on Ruby releases older than 3.4, so a malicious AAAA record can redirect any outbound fetch to loopback (127.0.0.1), RFC1918 hosts, or cloud-metadata services like 169.254.169.254. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed, high confidentiality) rating reflects direct exposure of internal services and instance credentials.
Sandbox escape in Google Chrome's DevTools component (versions prior to 149.0.7827.197) lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page that triggers a race condition. Rated High by Chromium with a scope-changing CVSS 8.3, it requires a prior renderer compromise plus user interaction, and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, indicating no observed in-the-wild use despite the total technical impact.
Remote code execution in Google Chrome's Blink rendering engine (InterestGroups component, part of the Privacy Sandbox/Protected Audience ad-auction API) affects all desktop versions prior to 149.0.7827.197. A crafted HTML page triggers an out-of-bounds read and write that a remote attacker can leverage to execute arbitrary code in the renderer; Chromium rates this Critical and assigns CVSS 8.8. There is no public exploit identified at time of analysis, but a vendor patch is already available, making prompt updating the priority.
Arbitrary file write and information disclosure in Jellyfin self-hosted media server (all versions prior to 10.11.10) arise from FFmpeg argument injection in the subtitle conversion path. Because SubtitleController.GetSubtitle carries no [Authorize] attribute, an attacker who can place a maliciously named file into a Jellyfin media library directory (e.g., via a shared NAS, Samba share, or guest upload) can break FFmpeg's argument quoting on Linux and inject arbitrary FFmpeg flags. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated endpoint and high CVSS (8.8) make it a meaningful concern for exposed instances.
Web cache poisoning in the Ghost Node.js CMS before 6.37.0 lets an unauthenticated attacker inject an x-ghost-preview header that alters the rendered frontend response, which a shared caching layer then stores and serves to other visitors of the same page. When Ghost's public frontend and admin panel share a single domain, this request-specific preview output can be weaponized to hijack staff accounts; separate-domain deployments are not exposed. No public exploit is identified at time of analysis, and the issue carries a vendor CVSS of 9.6.
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026.05.06.15.42.stable_01) arises because the Markdown link handler routes resolved local-file links to the operating system's default file opener. A malicious Markdown document or project repository can embed a benign-looking local-file link that, when clicked, hands an executable (such as an extensionless shell script) to the platform file opener (e.g. NSWorkspace.openURL on macOS) instead of a safe viewer/editor, executing it. There is no public exploit identified at time of analysis, but the fix is confirmed in 0.2026.05.06.15.42.stable_01 and the root cause is documented in the upstream commit and GHSA advisory.
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stable_01) lets malicious terminal output silently drop attacker-controlled files onto disk. Warp honored non-inline OSC 1337;File (and multipart MultipartFile) iTerm2 escape sequences by base64-decoding the payload and writing it to the active block's current working directory using the attacker-supplied filename, with no confirmation prompt. Because shell startup files such as .zshenv can be overwritten this way, the write converts into code execution on the victim's host; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Cross-origin credential leakage in libcurl (curl 7.10.6 through 8.20.0) causes the HTTP Digest 'Authorization:' header computed for one origin (hostA) to be wrongly reused on a subsequent transfer to a different origin (hostB) when an application reuses the same easy handle. This exposes Digest authentication credentials to an unintended, potentially attacker-controlled host, and is tracked as an Information Disclosure issue (EUVD-2026-41501). No public exploit identified at time of analysis; EPSS is low at 0.25% (16th percentile) and it is not in CISA KEV, so this is a latent credential-exposure bug rather than a demonstrated mass-exploitation threat.
Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. Publicly available exploit-flow details exist via the originating HackerOne report; EPSS is low (0.20%, 9th percentile) and it is not in CISA KEV.
Use-after-free in libcurl's HTTP/2 stream-dependency handling affects a wide range of curl releases (7.88.0 through 8.20.0) when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset() before curl_easy_cleanup(); the reset frees an internal priority structure that cleanup later re-accesses. Despite the NVD 9.8 CVSS rating, the flaw is only reachable through a specific application-controlled API call sequence rather than remote attacker input, and is tagged Information Disclosure. No public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Information disclosure in libcurl (versions 8.18.0 through 8.20.0) causes the HTTP Referer header to persist on a reused easy handle even after an application explicitly clears it by passing NULL to CURLOPT_REFERER. Because the internal referrer state is not reset, a previously set referrer string is silently re-sent on later requests, potentially leaking sensitive URL data (paths, tokens, or query parameters) to unintended destination servers. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Proxy-credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear previously set proxy authentication credentials is silently ignored, so the stale username/password remain attached to the reused easy handle and are sent on later transfers that were never meant to use them. This is an information-disclosure defect (tagged Information Disclosure, EUVD-2026-41510) affecting applications that reuse libcurl handles across multiple proxied requests. No public exploit identified at time of analysis and EPSS is low (0.25%, 16th percentile), consistent with a coding/logic flaw rather than a directly weaponizable remote bug.
Information disclosure and integrity exposure in curl/libcurl occurs when a new transfer that uses STARTTLS to upgrade a connection may reuse an already-established live connection whose TLS configuration does not match the requested one, so data intended for a strictly-configured secure channel can traverse a connection negotiated under different (potentially weaker or unverified) TLS settings. The flaw affects a very wide range of curl releases from 7.30.0 through 8.20.0 and is tagged as Information Disclosure with high confidentiality and integrity impact (CVSS 8.1). It is not listed in CISA KEV, EPSS is low (0.20%, 9th percentile), and no public exploit code is identified at time of analysis.
Use-after-free in libcurl 8.13.0 through 8.20.0 occurs when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a flag through a struct pointer whose backing memory was just freed. Affected are applications built on the curl multi interface using event-based socket callbacks; the flaw can lead to memory corruption or limited information disclosure (tagged Information Disclosure) with low confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), consistent with a niche triggering pattern rather than mass exploitation.
Incorrect mTLS connection reuse in libcurl (curl releases through 8.16.0) causes the library to reuse a pooled TLS connection even after client-certificate options - notably the private key - were changed in a way that should have forced a fresh handshake. Because those client-certificate settings were omitted from the connection-match logic, a later transfer can be sent over a connection authenticated with the wrong client identity, an integrity failure tagged as information disclosure. Rated CVSS 7.5 (C:N/I:H/A:N); EPSS is only 0.13% and there is no public exploit identified at time of analysis, though a HackerOne report (#3733910) drove the private disclosure.
Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the `Proxy-Authorization:` header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. EPSS is low (0.25%, 16th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis - this is a credential-confidentiality issue rather than a code-execution flaw.
TLS certificate-trust confusion in libcurl (curl 8.17.0 through 8.20.0) lets a reused pooled connection retain trust in the native platform CA store even after the application reconfigures the same easy handle to use custom CA material for a later transfer. An attacker positioned to intercept traffic could present a certificate valid under the native store - which the application intended to no longer trust - to silently intercept or spoof the connection. Rated CVSS 9.1, but EPSS is only 0.20% (9th percentile) and there is no public exploit identified at time of analysis, reflecting the narrow application-usage prerequisite rather than a broadly weaponizable flaw.
Information disclosure in libcurl (curl 8.11.0 through 8.20.0) allows a network man-in-the-middle to capture sensitive request data when TLS early data (0-RTT) is combined with SSL session ID caching. If an application enables the CURLSSLOPT_EARLYDATA bit and leaves the session cache active, libcurl can transmit a resumed request's bytes on a reconnection before it enforces a certificate verification failure, so an attacker who impersonates the original host without a valid certificate may receive the leaked data. No public exploit identified at time of analysis, and EPSS is low (0.13%), reflecting the non-default configuration and active-MITM prerequisite.
Memory-safety defect (double-free) in curl's SASL authentication path affects versions 8.15.0 through 8.20.0 when built with GSASL support: the GSASL context is cleaned up twice without the intervening pointer being cleared, causing the same allocation to be free()'d twice. A malicious or malfunctioning mail/auth server exercising the SASL handshake could trigger the condition, potentially corrupting heap memory and at minimum crashing the client. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile) despite the headline CVSS of 9.8.
Host key verification bypass in libcurl affects applications using the CURLOPT_SSH_KEYFUNCTION callback for SCP:// or SFTP:// transfers, where a server presenting a host key of a different type than the one already recorded in known_hosts is silently accepted instead of rejected. This lets a network-positioned attacker impersonate a trusted SSH server and mount a man-in-the-middle attack, exposing and tampering with transferred data. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile), reflecting the specific application configuration and attacker positioning required.
Out-of-bounds kernel memory write in the Linux kernel's OMFS filesystem driver (fs/omfs) allows a local attacker to corrupt kernel memory by mounting a crafted OMFS image. omfs_fill_super() validates that s_sys_blocksize is not larger than PAGE_SIZE but fails to enforce a lower bound, so a value below OMFS_DIR_START (0x1b8 = 440) triggers an unsigned integer underflow in omfs_make_empty(), driving a roughly 4 GiB memset() that overwrites kernel memory far beyond the block buffer. There is no public exploit identified at time of analysis, the EPSS score is low (0.18%), and it is not listed in CISA KEV; the fix has been backported across many stable kernel branches.
Local privilege-dependent use-after-free in the Linux kernel's fs/mbcache subsystem allows a privileged user (root or CAP_SYS_ADMIN) to trigger memory corruption when unmounting an ext2, ext4, or ocfs2 filesystem. mb_cache_destroy() frees the cache without cancelling the pending c_shrink_work item, so a still-running mb_cache_shrink_worker() accesses freed memory (CWE-416), potentially leading to kernel code execution or crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and it is not on CISA KEV.
Use-after-free in the Linux kernel PCI subsystem allows a local low-privileged attacker to corrupt memory by racing driver probe operations that access the driver_override field without holding the device lock. The flaw stems from __driver_attach() invoking the bus match() callback without the device lock, exposing an unlocked read of driver_override; exploitation could lead to memory corruption and privilege escalation. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 5th percentile), consistent with a hard-to-trigger local race rather than a widely-weaponized bug.
Local privilege escalation via memory corruption in the Linux kernel's platform/x86 WMI subsystem arises from an unlocked access to the driver_override field during driver probing, producing a use-after-free (CWE-416). Authenticated local users on affected kernels (introduced around 6.11 and backported into stable trees) can trigger the race through the WMI bus to corrupt kernel memory, with high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is low at 0.16% (5th percentile), indicating no observed weaponization.
Local privilege escalation and memory corruption in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem stems from an unlocked access to the driver_override field during device-to-driver matching, producing a use-after-free (CWE-416). Affected kernels from 5.17 up to the fixed 6.18.33, 7.0.10, and 7.1 releases allow a local user with the ability to interact with vDPA devices to corrupt kernel memory, with full confidentiality, integrity, and availability impact. EPSS is low (0.15%, 5th percentile) and there is no public exploit identified at time of analysis, so this is a patch-on-schedule kernel hardening fix rather than an emergency.
Local privilege-relevant memory corruption in the Linux kernel's s390 channel-I/O (cio) subsystem allows a use-after-free when a device driver is probed via __driver_attach() and the bus match() callback reads the unprotected driver_override field. The flaw affects Linux on IBM Z (s390) mainframes and is resolved by switching to the driver-core's generic driver_override infrastructure, which handles locking internally. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Local privilege-adjacent memory corruption in the Linux kernel's s390 Adjunct Processor (AP) crypto bus driver allows a use-after-free when AP adapter/queue masks are updated concurrently with a driver_override write. When apmask_store()/aqmask_store() trigger ap_bus_revise_bindings(), __ap_revise_reserved() reads the driver_override string without a lock, racing a concurrent driver_override_store() that can free the old string, yielding a UAF (CWE-416) with high confidentiality, integrity, and availability impact on IBM Z (s390) systems. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile); the fix migrates the driver to the driver-core's internally-locked driver_override infrastructure.
Local privilege escalation via a use-after-free in the Linux kernel's fsl-mc bus driver (drivers/bus/fsl-mc) allows a low-privileged local attacker to corrupt kernel memory when the bus match() callback accesses the unlocked driver_override field during __driver_attach() probing. The flaw affects NXP/Freescale Management Complex bus code and is fixed by switching to the driver-core's generic driver_override infrastructure that locks internally. No public exploit identified at time of analysis and EPSS is low (0.16%), but the CVSS 7.8 high severity reflects full confidentiality, integrity, and availability impact on a successful local attack.
Use-after-free in the Linux kernel's rtlwifi PCI driver (drivers/net/wireless/realtek/rtlwifi) lets a freed ieee80211_hw structure be accessed after teardown, because irq_prepare_bcn_tasklet is scheduled on the RTL_IMR_BCNINT beacon interrupt but never killed in rtl_pci_deinit(). When a Realtek PCIe Wi-Fi card fails to probe or is detached, the still-running or pending beacon tasklet dereferences the freed structure in _rtl_pci_prepare_bcn_tasklet(), enabling potential memory corruption and local privilege escalation. The flaw was found via static analysis; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Memory-safety and information-disclosure risk in the Linux kernel s390 (IBM Z) eBPF JIT compiler stems from incomplete ABI compliance: the JIT sign-extended values but never zero-extended unsigned BPF program return values and kfunc arguments as the s390x calling convention requires. On s390x hosts, a local user able to load BPF programs can cause the JIT to emit code that leaves stale upper register bits, producing incorrect computation that can leak kernel data or corrupt execution. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not in CISA KEV; it is fixed in multiple stable releases.
Use-after-free / bad page state in the Linux kernel's PowerPC page-table fragment allocator (powerpc/pgtable-frag) allows a local user on affected POWER systems to trigger kernel memory corruption and instability during process teardown. The flaw manifests when a cached PTE fragment folio retains an unused reference at process exit, so pte_frag_destroy() frees the folio without clearing its active flag, producing a PAGE_FLAGS_CHECK_AT_FREE bad-page state. There is no public exploit identified at time of analysis and EPSS is very low (0.16%, 6th percentile); a vendor patch is available.
Local privilege/denial-of-service exposure in the Linux kernel BPF subsystem allows a low-privileged user who can load a device-bound XDP program to trigger a use-after-free during network namespace teardown. When constant blinding is enabled (bpf_jit_harden=2), JIT compilation of a BPF_F_XDP_DEV_BOUND_ONLY program clones the program and frees the original, but offload->prog is left pointing at the freed buffer; later netns cleanup dereferences it. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.17%), consistent with a config-dependent, non-default code path.
Privilege-relevant memory corruption in the Linux kernel eBPF verifier (introduced around v6.11) lets a local user with BPF-loading capability defeat the verifier's range tracking when a register adds to itself (rX += rX), because adjust_reg_min_max_vals() mutates dst_reg in place and then reads the already-modified src_reg, recording a wrong delta that sync_linked_regs() propagates to linked registers. The result is a verifier-vs-runtime mismatch - the verifier reasons about register bounds that differ from actual execution, the classic precursor to out-of-bounds kernel memory access and local privilege escalation. CVSS is 7.8 (High); EPSS is low (0.17%, 6th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.
Improper simulation of BPF ld_{abs,ind} failure paths in the Linux kernel verifier allows a local attacker with BPF loading capability to bypass security checks and achieve full system compromise (C:H/I:H/A:H).
Local privilege-adjacent memory corruption in the Linux kernel's BPF offload subsystem allows a use-after-free triggered when querying info for an offloaded BPF map or program while the associated network namespace is being torn down. The bug lives in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(), where get_net() increments a netns refcount that may already have reached zero, corrupting freed memory. No public exploit is identified at time of analysis, and EPSS is very low (0.14%), consistent with a hard-to-win kernel race rather than a broadly exploited flaw.
Memory mishandling in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver stems from an off-by-one error in bcmgenet_put_txcb(), where the function returned the wrong transmit control block (tx_cb) because the write pointer was rewound after reading instead of before, causing incorrect cleanup of TX descriptors. The flaw affects systems using Broadcom GENET network controllers (notably Raspberry Pi 4/5 and various Broadcom SoCs) running affected kernels prior to the stable fixes. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.16% (6th percentile); despite the NVD CVSS 9.8 rating, the realistic impact is local denial-of-service or limited information disclosure rather than remote unauthenticated code execution.
Denial-of-service via resource leak in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver allows the transmit buffer-descriptor (BD) pool to be slowly exhausted. When the driver reclaims a TX queue and fast-forwards the write pointer to drop in-flight frames, those dropped frames' buffer descriptors are never returned to the free_bds pool and the netdev is not told the frames were dropped, gradually starving the TX ring until the interface can no longer transmit. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and a vendor (stable-tree) patch is available; the impact is availability-only (CVSS A:H, C:N/I:N).
Denial of service in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver arises because the bcmgenet_timeout handler tears down all transmit queues when only a single queue times out, racing against queues still actively transmitting. The flaw affects systems using Broadcom GENET NICs (e.g. Raspberry Pi 4/CM4 and Broadcom set-top-box SoCs) and can lead to kernel instability or a crash under TX timeout conditions. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel BPF subsystem arises from a use-after-free in the open-coded task_vma iterator, which read task->mm locklessly and took mmap_read_trylock() without ever calling mmget(). On kernels where a concurrent task exit frees the mm_struct (not protected by SLAB_TYPESAFE_BY_RCU), a BPF program iterating that task's VMAs can access freed memory, enabling information disclosure or kernel control-flow corruption. The fix has been merged upstream; there is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Local privilege escalation in the Linux kernel (6.11 through pre-patch 6.12.x/6.18.x/7.0.x) arises from a BPF verifier state-pruning flaw in regsafe() handling of BPF_ADD_CONST scalar registers, where base register IDs are not checked for mapping consistency. An attacker able to load BPF programs can construct two verifier states that falsely appear equivalent, causing state pruning to incorrectly succeed and letting an unsafe program bypass verification. With CVSS 7.8 (AV:L/PR:L) and full C/I/A impact, successful exploitation can corrupt kernel memory; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds read and kernel pointer leak in the Linux kernel's eBPF sock_ops subsystem lets a local low-privileged actor able to load BPF programs disclose kernel memory and corrupt kernel state. The SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register on the !fullsock/!locked_tcp_sock path when dst_reg == src_reg, leaving a stale ctx pointer that the verifier mistakes for a valid socket or a scalar. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Improper network-namespace isolation in the Linux kernel's net/rds InfiniBand transport (RDS/IB) lets a local user operating in a non-initial network namespace trigger faulty RDS/IB behavior, because the existing code was never written to function correctly outside the initial netns. The upstream fix restricts RDS/IB to the initial network namespace entirely. NVD rates it 7.8 (local, low-privilege); EPSS is low at 0.16% (6th percentile) and there is no public exploit identified at time of analysis.
Out-of-bounds kernel memory read in the Linux kernel's eBPF subsystem (pcpu_init_value) lets a local, low-privileged user with BPF access leak adjacent kernel memory and potentially crash the system. The flaw triggers when a per-CPU map is updated from a BPF_MAP_TYPE_CGROUP_STORAGE map whose value_size is not 8-byte aligned (e.g. 4 bytes), causing copy_map_value_long to read past the true source size. The issue is fixed in stable kernels; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.16%, 5th percentile).
Local privilege escalation in the Linux kernel's PPP driver allows an unprivileged user to issue network-administration ioctls against a network namespace they should not control. The /dev/ppp device authorizes opens against the file owner's user namespace (f_cred->user_ns) while unattached administrative ioctls act on current->nsproxy->net_ns, so a user who creates a new user namespace via CLONE_NEWUSER and gains CAP_NET_ADMIN only there can still invoke PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited (parent) network namespace. No public exploit identified at time of analysis, and EPSS is low (0.26%, 17th percentile), indicating no current evidence of mass exploitation.
Local privilege escalation potential in the Linux kernel netfilter nf_tables tunnel module (nft_tunnel) stems from a use-after-free triggered when a tunnel object is destroyed while packets still hold a reference to its metadata_dst. The flawed nft_tunnel_obj_destroy() path calls metadata_dst_free(), which kfree()s the structure while ignoring the dst_entry refcount, so packets queued in a qdisc (e.g. netem) later call dst_release() on freed memory. CVSS is 7.8 (high) with CVSS:3.1 vector AV:L/PR:L; EPSS is low at 0.18% (7th percentile), it is not in CISA KEV, and no public exploit identified at time of analysis.
Execute-permission bypass in the Linux kernel's KVM arm64 nested-virtualization (NV) code allows a nested guest to receive unintended execute permissions on stage-2 mappings when the host CPU lacks FEAT_XNX. The root cause is a misuse of FIELD_PREP() on the XN[0] mask after XN had already been shifted out of its bitfield position, which unconditionally grants execute rights instead of conditionally clearing them. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and the issue is not in CISA KEV, but the assigned CVSS of 8.8 reflects the hypervisor scope-change and potential for a guest to bypass non-executable memory enforcement.
Denial of service in the Linux kernel's Hyper-V netvsc network driver (hv_netvsc) allows a system crash when transmitting packets whose skb fragments reference high memory. On 32-bit x86 builds with CONFIG_HIGHMEM=y, netvsc_copy_to_send_buf() calls phys_to_virt() on fragment PFNs that may live above the LOWMEM boundary, producing an address outside the kernel direct map; the following memcpy() faults fatally on the transmit softirq path. No public exploit has been identified, the EPSS probability is low (0.18%), and the issue is not in CISA KEV.
Use-after-free in the Linux kernel's in-kernel SMB server (ksmbd) lets an authenticated SMB client corrupt kernel slab memory by sending a second SMB2_CANCEL for the same AsyncId of a blocking byte-range lock. The first cancel frees the struct file_lock but takes an early-exit that never unlinks the async work or clears its cancel callback, leaving a live cancel_fn pointing at freed memory in the file_lock_cache (size 192) slab; a racing second cancel re-runs smb2_remove_blocked_lock() on the dangling pointer. The flaw was reproduced on mainline with KASAN by an authenticated client, EPSS is low (0.18%), and there is no public exploit identified at time of analysis.
Local privilege escalation via use-after-free in the Linux kernel ALSA timer subsystem (sound/core/timer.c) allows an authenticated local user to corrupt kernel memory by triggering dangling references to a freed snd_timer object. When snd_timer_free() unlinked pending instances it left slave timer instances still pointing at the freed master timer; the flaw is readily reachable through the userspace-driven timer interface (CONFIG_SND_UTIMER), where opening/closing a file creates and destroys timer objects while other processes keep accessing them. EPSS is low (0.18%, 8th percentile) and there is no public exploit identified at time of analysis, but kernel UAF bugs of this class are historically a strong primitive for local privilege escalation.
Local privilege escalation or memory corruption in the Linux kernel's ALSA timer subsystem stems from a use-after-free in snd_timer_user_params() reachable via the SNDRV_TIMER_IOCTL_PARAMS ioctl. A low-privileged local user with access to a timer device (notably userspace timers under CONFIG_SND_UTIMER) can race a concurrent ioctl against timer object release to access freed memory. No public exploit identified at time of analysis, and EPSS is low (0.18%), reflecting the local-only, race-dependent nature of the bug.
Improper completion-flag handling in the Linux kernel's io_uring networking layer (io_uring/net) causes IORING_CQE_F_BUF_MORE to be dropped when a bundled recv operation retries while using incremental provided buffer rings (IOU_PBUF_RING_INC). Local applications using io_uring can be misled into advancing a buffer ring head past an entry the kernel is still using, leading to buffer reuse, data corruption, and potential information disclosure. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and a vendor patch is available across stable trees.
Use-after-free in the Linux kernel's transparent huge page code (mm/huge_memory) lets a local low-privileged process read freed folio state when __split_huge_pmd_locked() updates the file/shmem RSS counter only after dropping the PMD mapping's folio reference. On affected kernels (introduced around the 4.19 era through to fixes in 6.x/7.x stable trees), a final folio_put() can free the folio before mm_counter_file() inspects it via folio_test_swapbacked(), enabling reads of freed kernel memory. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), consistent with a hard-to-win race rather than turnkey exploitation.
Privilege/capability boundary bypass in the Linux kernel RDMA/core subsystem (ib_get_ucaps) lets a local low-privileged user masquerade as an authentic user-capability (ucap) character-device file descriptor. Because char and block devices share the dev_t namespace, the kernel previously validated only the device number, so a block device with a matching dev_t could be passed to ib_get_ucaps() to impersonate a legitimate ucap cdev and obtain RDMA capabilities the user should not hold. The fix validates the file's f_ops to accept only genuine cdevs. EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis; a stable-tree vendor patch is available.
Out-of-bounds read in the Linux kernel's RDMA/SRP initiator (ib_srp) driver lets a malicious or compromised SRP storage target that an initiator has logged into trigger a kernel memory over-read by returning an SRP_RSP with SRP_RSP_FLAG_SNSVALID and an attacker-controlled 32-bit resp_data_len that is never validated against the bytes actually received. With resp_data_len near 0xFFFFFFFF the sense-copy source lands gigabytes past the receive buffer, faulting the kernel for a denial of service and potentially disclosing adjacent kernel memory into the sense buffer. No public exploit is identified at time of analysis and EPSS is low (0.18%), but exploitation requires the privileged position of a trusted SRP target on the InfiniBand/RoCE fabric.
Use-after-free in the Linux kernel zram block-device driver allows local attackers to corrupt freed kernel page memory when a zram device is configured with a writeback (ZRAM_WB) backing device. The flaw is in zram_bvec_write_partial(), which passes its parent bio into zram_read_page(), causing the backing-device read to be dispatched asynchronously and return before completion; the buffer is then copied, rewritten, and freed while the in-flight read still writes into it. With a CVSS of 7.8 (high) but a low EPSS of 0.18% (7th percentile) and no public exploit identified at time of analysis, this is a memory-corruption primitive with potential for privilege escalation but no evidence of real-world abuse.
Remote denial of service in the Linux kernel's UDP receive path affects systems where a UDP socket is placed in a BPF sockmap with an attached SK_SKB verdict program. Because skb->dev is repurposed as dev_scratch on the UDP path and never cleared before the verdict program runs, a verdict program that calls a socket-lookup helper (bpf_sk_lookup_tcp/udp, bpf_skc_lookup_tcp) causes dev_net() to dereference a stale integer as a net_device pointer, triggering a general protection fault on a non-canonical address in softirq. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and the flaw is fixed; impact is availability only (kernel crash), not the 'Information Disclosure' the input tags suggest.
Resource exhaustion in the Linux kernel's MPTCP (Multipath TCP) subsystem lets a remote peer drive incoming traffic past the receiver's configured rcvbuf size by breaking receive-window accounting. The defect arises because the TCP-level receive window is prevented from shrinking while the MPTCP-level window is independently constrained, so when data is acked at the TCP level but is out-of-order in MPTCP sequence space (or backlogged), the advertised MPTCP window is artificially inflated. EPSS is low (0.18%, 8th percentile), there is no public exploit identified at time of analysis and no KEV listing; the issue is corrected upstream and carries availability impact (CVSS A:H) despite a source 'Information Disclosure' tag.
Heap buffer overflow in the Linux kernel's nl80211 WiFi configuration subsystem (cfg80211) allows a local user with network-configuration privileges to corrupt kernel memory by supplying an oversized EMA (Enhanced Multiple BSSID Advertisement) RNR element list. The parser nl80211_parse_rnr_elems() stores its element count in a u8 field and uses it to size a flexible-array allocation, so submitting 256 or more nested NL80211_ATTR_EMA_RNR_ELEMS attributes wraps the counter and produces an undersized allocation that is then overrun. There is no public exploit identified at time of analysis, EPSS risk is low (0.18%, 8th percentile), and the issue is not in CISA KEV.
Denial of service in the Linux kernel timer migration subsystem allows the global timer hierarchy to enter an indefinite livelock, hanging the affected CPU. The flaw is in tmigr_handle_remote_up(), where tmigr_handle_remote_cpu() skipped timer_expire_remote() for the local CPU on the assumption that the softirq path already serviced its timers; when jiffies advance between local timer processing and remote evaluation, a newly expired timer is never run and is re-queued with expires==now, spinning the goto-again loop forever. The CVSS 3.1 base score is 7.5 (availability only) but EPSS is just 0.18% (7th percentile), there is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Out-of-bounds kernel memory read in the Linux kernel's rtl8723bs staging Wi-Fi driver (Realtek RTL8723BS SDIO) lets a local low-privileged actor read past the intended information-element (IE) buffer. rtw_update_protection() receives a pointer already offset into the ies buffer while still being passed the full ie_length, so parsing walks beyond the valid data. There is no public exploit identified at time of analysis, EPSS risk is low (0.17%, 7th percentile), it is not in CISA KEV, and fixed kernel releases are available.
Memory-safety flaw in the Linux kernel's staging rtl8723bs Realtek SDIO Wi-Fi driver allows an adjacent (radio-range) attacker to trigger an unsigned-integer underflow in the rtw_mlme information-element parsing path, leading to out-of-bounds reads that can disclose kernel memory or crash the system. The bug occurs because ie_length was not validated before fixed IE offsets were subtracted from it. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis, but a vendor (upstream kernel) fix is available.
Slab use-after-free in the Linux kernel's IP fragment reassembly (inet frags) layer occurs during network namespace teardown: fqdir_pre_exit() flushes incomplete fragment queues via inet_frag_queue_flush() without clearing q->fragments_tail/last_run_head, so a fragment reassembly already in flight resumes after the flush and dereferences freed skbs. IPv4, IPv6, nf_conntrack_reasm6, and 6lowpan reassembly all share the affected flush path. There is no public exploit identified at time of analysis, and EPSS is low (0.18%, 7th percentile); NVD scores it CVSS 9.8 (AV:N), but the bug is fundamentally a teardown-vs-reassembly race, so the network-unauthenticated framing overstates practical reachability.
Improper error handling in the Linux kernel's overlayfs (ovl) directory-iteration code causes ovl_iterate_merged() to return a truncated cache pointer as a bogus non-zero error code after a successful ovl_cache_get(). The flaw is reachable by a local user performing a getdents64/readdir on a stacked overlay-on-overlay mount, as demonstrated by a syzbot reproducer; there is no public exploit and it is not actively exploited. EPSS is very low (0.16%, 6th percentile), consistent with a hard-to-leverage local logic bug rather than a broadly weaponizable flaw.
Heap out-of-bounds write in the Linux kernel's Arm Ethos-U NPU accelerator driver (accel/ethosu) lets a local user with access to the NPU device corrupt adjacent kernel heap memory. The command-stream parser masks the IFM region index with 0x7f (max 127) instead of 0x7 (max 7) like every other region assignment, so a crafted NPU_SET_IFM_REGION opcode with param > 7 indexes far past the 8-entry region_size[]/output_region[] arrays, writing up to ~1016 bytes beyond the allocation. No public exploit identified at time of analysis, and EPSS is low (0.16%), but the bug is a classic exploitable heap-overflow primitive in privileged kernel context.
Local privilege/availability weakness in the Linux kernel memory cgroup (memcg) subsystem stems from refill_stock() calling get_random_u32_below() for victim selection, a routine that is neither reentrant- nor NMI-safe. Because memcg charge draining can occur in NMI context, an NMI landing mid-update of the per-CPU batched_entropy_u32 ChaCha state could corrupt the random subsystem's per-CPU local_lock state. The fix replaces the random pick with a per-CPU round-robin counter serialized by the existing local_trylock; EPSS is very low (0.17%, 7th percentile), this is not in CISA KEV, and no public exploit identified at time of analysis.
Local privilege escalation and memory corruption in the Linux kernel's Qualcomm FastRPC misc driver (drivers/misc/fastrpc) arises from a use-after-free of the fastrpc_user structure during concurrent file-descriptor close and DSP response processing. A local user with access to the FastRPC device can race fastrpc_device_release() against the put_work workqueue so that fastrpc_context_free() dereferences an already-freed user object, enabling kernel memory corruption with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a hard-to-win kernel race on Qualcomm-only hardware.
Local privilege escalation and memory corruption in the Linux kernel's fastrpc misc driver allows an attacker with local low-privileged access to a FastRPC device to trigger a use-after-free in fastrpc_map_create by racing a concurrent MEM_UNMAP against map lookup. The flaw stems from fastrpc_map_lookup returning an unprotected raw pointer after dropping fl->lock, which a concurrent unmap can free before the reference is taken. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.17%, 7th percentile), consistent with a kernel race condition requiring local access and precise timing.
Slab use-after-free in the Linux kernel's Phonet subsystem (net/phonet) allows a local privileged actor to trigger memory corruption when a phonet_device is torn down. phonet_device_destroy() unlinks the object from the per-net device list with list_del_rcu() but frees it immediately, so concurrent RCU readers can still dereference the freed object; the fix converts the free to kfree_rcu(). No public exploit identified at time of analysis, EPSS is very low (0.17%, 7th percentile), and it is not on CISA KEV, but the CVSS 3.1 base score is 7.8 (High) reflecting full confidentiality, integrity and availability impact from local exploitation.
Local privilege escalation and memory corruption in the Linux kernel's nvmem core subsystem arises from use-after-free bugs in multiple error paths where __nvmem_device_put() releases the nvmem device (and its backing memory/resources) but the code continues to dereference the freed structure before returning. A local, low-privileged user able to trigger these error paths can corrupt kernel memory, potentially leading to code execution or information disclosure. Fix is upstream in stable kernel trees; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%).
Kernel memory corruption in the Linux memory-management list_lru subsystem (memory cgroup reparenting path) allows a local user to corrupt linked-list pointers and destabilize or potentially escalate privileges on the system. The flaw is a race condition in memcg_reparent_list_lrus(), affecting kernels from 6.13 onward; it carries CVSS 7.8 (High) with full confidentiality, integrity and availability impact but a low EPSS of 0.17% (7th percentile). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds buffer access in the Linux kernel's AF_RXRPC (rxrpc) networking subsystem allows a remote attacker who can send crafted RxRPC-over-UDP traffic to trigger improper reads of the SACK table when an incoming ACK packet is deliberately fragmented. AF_RXRPC wrongly assumes skb_condense() always linearizes the packet before parsing soft-ACKs in rxrpc_input_soft_acks(), but skb_condense() can silently no-op, leading to access of a non-flat buffer and in-place modification of the received skbuff. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and this is not in CISA KEV.
Out-of-bounds read in the Linux kernel Thunderbolt (thunderbolt) property parser lets a crafted property directory from a connected Thunderbolt/USB4 device cause the kernel to read past an allocated property block, potentially disclosing adjacent kernel memory or crashing the system. The flaw lives in __tb_property_parse_dir(), which fails to validate that content_offset + content_len stays within block_len for the root directory. It affects a broad range of stable kernel series and is fixed upstream; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.18% (7th percentile).
Out-of-bounds memory read in the Linux kernel's Thunderbolt (thunderbolt) XDomain driver allows an adjacent peer connected over a Thunderbolt link to leak kernel heap memory or crash the host. The flaw lives in tb_xdp_handle_request(), which casts a received XDomain packet to protocol-specific structs without confirming the kmemdup allocation is large enough, so a deliberately undersized packet that still passes the generic header-length check triggers reads past the buffer. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and it is not CISA KEV-listed.
Information disclosure in the Linux kernel's Thunderbolt XDomain driver allows a malicious peer device to read stale kernel DMA-pool memory from prior transactions. The tb_xdomain_copy() function copies the full expected response_size from a received packet buffer without bounding it to the actual frame size, so a deliberately short response causes the kernel to leak adjacent buffer contents. No public exploit identified at time of analysis; EPSS is low (0.18%, 7th percentile) and the issue is not in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel DRM/GEM subsystem stems from a race condition in the GEM change_handle ioctl when it runs concurrently with gem_close, where botched two-stage idr_replace handling against the wrong idr slot allows a concurrent close to steal the object's only inherited reference. The flaw affects systems using the DRM graphics stack (notably AMD GPU paths, per source tags) and an unprivileged local user with access to a DRM render/card device can trigger a use-after-free, with the upstream resolution disabling the change_handle ioctl entirely until the locking can be proven correct. No public exploit identified at time of analysis and EPSS is low (0.17%, 7th percentile), consistent with a local-only, hard-to-win race rather than mass exploitation.
Out-of-bounds read and unbounded-iteration denial of service in the Linux kernel's AMD Display (amdgpu DC) driver arises when the bios_parser/bios_parser2 code walks VBIOS record chains that lack a proper 0xFF terminator record. A local attacker able to supply a malformed VBIOS image can force hundreds of thousands of probe-time iterations (with record_size=1) and, near the image boundary, trigger struct casts that read past the 2-byte header validated by GET_IMAGE. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 6th percentile), consistent with a local, firmware-dependent memory-safety bug rather than a broadly exploited remote flaw.
Denial of service in the Linux kernel's virtio vsock transport allows a local actor to exhaust kernel memory by flooding the socket with zero-length packets flagged VIRTIO_VSOCK_SEQ_EOM, which bypass receive-buffer accounting and grow the skb receive queue without bound. The flaw affects the vsock/virtio guest-host communication path and carries CVSS 7.1 (A:H, scope-changed); EPSS is low (0.17%, 6th percentile) and there is no public exploit identified at time of analysis. Note a data conflict: the input tags it 'Information Disclosure', but the CVSS vector (C:N/I:N/A:H) and the description describe a memory-exhaustion availability issue, not disclosure.
Out-of-bounds memory access in the Linux kernel's netfilter subsystem allows attackers to leak adjacent kernel memory or crash the host by sending packets that traverse MAC-based matching paths (`xt_mac`, `ip6t_eui64`, the `bitmap:ip,mac`/`hash:ip,mac`/`hash:mac` ipset types, and `nf_log_syslog`) which call `eth_hdr(skb)` without first confirming the skb carries a full Ethernet header. Affected kernels span the 5.15 through 7.1 stable trees prior to the fixed releases, and the impact is information disclosure and denial of service rather than code execution. There is no public exploit identified at time of analysis, and the EPSS score is low at 0.17% (7th percentile).
Order shipping-destination tampering in the InPost PL WooCommerce plugin (versions before 1.9.1) lets unauthenticated remote attackers silently change the parcel-locker delivery point of any order still in 'pending' or 'processing' status, because the plugin never verifies the request comes from the legitimate buyer. Publicly available exploit code exists and a vendor patch has been released, though this is not listed in CISA KEV (no public exploit identified as actively exploited at time of analysis beyond the published POC). With CVSS 7.5 and an integrity-only impact, the practical risk is shipment redirection / parcel theft rather than data disclosure.
Information disclosure in GitLab Enterprise Edition 19.1 (before 19.1.1) lets a user retrieve sensitive data previously committed to a project because Duo Workflows fails to adequately filter its output under certain conditions. The flaw exposes confidential repository content through GitLab's AI workflow feature without altering or destroying data. No public exploit is identified at time of analysis and CISA SSVC rates exploitation as 'none', though EPSS sits at a modest 0.33% (25th percentile).
Information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers read sensitive data exposed through the named pipe MSI_SERVICE_2, which is configured with overly permissive access controls. The flaw scores CVSS 7.5 (high) for confidentiality-only impact with no authentication required; publicly available exploit code exists in a GitHub proof-of-concept, though there is no evidence of active exploitation and the EPSS probability is low (0.22%, 13th percentile).
Sensitive information disclosure in MSI NBFoundation Service v2.0.2506.1201 lets remote attackers recover confidential data protected by the service's weak 3DES-ECB encryption scheme. The ECB cipher mode leaks structural patterns and, combined with insecure permissions (CWE-200), exposes data an attacker can decrypt or infer without authentication. No public exploit is identified at time of analysis, though a GitHub research repository is referenced and EPSS remains low (0.15%).
Information disclosure in MSI's NBFoundation Service version 2.0.2506.1201 lets a remote attacker read sensitive data exposed by the bundled MSIAPService.exe component due to insecure permissions (CWE-200). Publicly available exploit code exists (GitHub, LittleSuRii/CVE-2026-MSIAPService), but there is no public evidence of active exploitation and the EPSS score is low at 0.22% (13th percentile). Rated CVSS 7.5 for a high-confidentiality, no-integrity, no-availability impact against MSI notebook systems running the affected service.
Unauthenticated information disclosure in ATEN Unizon allows remote attackers to read arbitrary files from affected installations by abusing a path-traversal weakness in the writeFileToHttpServletResponse method. Because the underlying service runs with SYSTEM privileges, an attacker can exfiltrate sensitive files including configuration, credentials, and OS-level data. Cataloged via ZDI (ZDI-26-380 / ZDI-CAN-28505) with no public exploit identified at time of analysis; not listed in CISA KEV and no EPSS score was provided.
Authenticated command execution in Appsmith versions prior to 2.1 lets any administrator run arbitrary OS commands inside the application's Docker container. The bundled supervisord exposes an XML-RPC management interface on port 9001, which Appsmith's Caddy reverse proxy publishes externally at /supervisor/* on the public ingress; combined with the supervisord password being readable through GET /api/v1/admin/env, an admin can authenticate to supervisord and abuse twiddler.addProgramToGroup to spawn programs that execute shell commands. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV. Fixed in 2.1.
Insecure object property modification (mass assignment) in Rocket.Chat's file-upload completion flow allows a low-privileged authenticated user to overwrite arbitrary fields on their own upload record, including the storage backend (store) and store-specific path fields. The flaw stems from sendFileMessage passing the entire attacker-controlled file object into Uploads.updateFileComplete, which Object.assigns it into a MongoDB $set with no writable-field allow-list, enabling an attacker to repoint their upload metadata at arbitrary storage locations and disclose sensitive data. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue affects all releases prior to the fixed 8.5.0/8.4.1/8.3.3/8.2.3/8.1.4/8.0.5/7.13.7/7.10.11 builds.
Local privilege boundary bypass in KubeVirt's safepath package lets an attacker who controls a virt-launcher pod trick the privileged virt-handler into applying file ownership or permission changes to unintended host paths. The OpenAtNoFollow safeguard is defeated because downstream helpers re-open the descriptor through /proc/self/fd/N with link-following syscalls, so a symlink at the path leaf is dereferenced. There is no public exploit identified at time of analysis, EPSS is very low (0.12%), and CISA SSVC marks exploitation as none.
Arbitrary JavaScript execution in AngularJS (all versions from 1.2.0-rc.3 onward) arises from a flaw in Strict Contextual Escaping (SCE) where resource-URL allowlist regular expressions are matched against URLs as partial rather than whole-string matches, letting attacker-controlled values slip past trusted-URL policies. A successful bypass runs script in the victim's browser session (script src, iframe documents, route templates), enabling client-side compromise; the framework is End-of-Life with no upstream fix, and a CodePen demonstration of the bypass is publicly available. No CISA KEV listing and no evidence of active exploitation were provided.
Denial of service in Mastodon affects all self-hosted instances prior to 4.5.11, 4.4.18, and 4.3.24, where the math content sanitizer fails to handle exceptions raised while processing malformed `<math>` nodes (MathML). A remote attacker can craft content containing broken math markup that propagates an uncaught exception, crashing whole-server services or disrupting service for targeted users depending on which component processes the malformed node. No public exploit has been identified at time of analysis, and the issue is not in CISA KEV; CVSS is 7.5 with availability-only impact.
Server-side request forgery in Mastodon (versions before 4.5.10, 4.4.17, and 4.3.23) lets an attacker who controls authoritative DNS for a hostname bypass Mastodon's private-network filter and force the server to connect to internal IPv4 endpoints. The flaw stems from PrivateAddressCheck.private_address? returning false for IPv4-mapped IPv6 addresses (::ffff:a.b.c.d) on Ruby releases older than 3.4, so a malicious AAAA record can redirect any outbound fetch to loopback (127.0.0.1), RFC1918 hosts, or cloud-metadata services like 169.254.169.254. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed, high confidentiality) rating reflects direct exposure of internal services and instance credentials.
Sandbox escape in Google Chrome's DevTools component (versions prior to 149.0.7827.197) lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page that triggers a race condition. Rated High by Chromium with a scope-changing CVSS 8.3, it requires a prior renderer compromise plus user interaction, and there is no public exploit identified at time of analysis. SSVC lists exploitation as none, indicating no observed in-the-wild use despite the total technical impact.
Remote code execution in Google Chrome's Blink rendering engine (InterestGroups component, part of the Privacy Sandbox/Protected Audience ad-auction API) affects all desktop versions prior to 149.0.7827.197. A crafted HTML page triggers an out-of-bounds read and write that a remote attacker can leverage to execute arbitrary code in the renderer; Chromium rates this Critical and assigns CVSS 8.8. There is no public exploit identified at time of analysis, but a vendor patch is already available, making prompt updating the priority.
Arbitrary file write and information disclosure in Jellyfin self-hosted media server (all versions prior to 10.11.10) arise from FFmpeg argument injection in the subtitle conversion path. Because SubtitleController.GetSubtitle carries no [Authorize] attribute, an attacker who can place a maliciously named file into a Jellyfin media library directory (e.g., via a shared NAS, Samba share, or guest upload) can break FFmpeg's argument quoting on Linux and inject arbitrary FFmpeg flags. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the unauthenticated endpoint and high CVSS (8.8) make it a meaningful concern for exposed instances.
Web cache poisoning in the Ghost Node.js CMS before 6.37.0 lets an unauthenticated attacker inject an x-ghost-preview header that alters the rendered frontend response, which a shared caching layer then stores and serves to other visitors of the same page. When Ghost's public frontend and admin panel share a single domain, this request-specific preview output can be weaponized to hijack staff accounts; separate-domain deployments are not exposed. No public exploit is identified at time of analysis, and the issue carries a vendor CVSS of 9.6.
Arbitrary code execution in the Warp agentic development environment (builds 0.2023.10.24.08.03.stable_00 through 0.2026.05.06.15.42.stable_01) arises because the Markdown link handler routes resolved local-file links to the operating system's default file opener. A malicious Markdown document or project repository can embed a benign-looking local-file link that, when clicked, hands an executable (such as an extensionless shell script) to the platform file opener (e.g. NSWorkspace.openURL on macOS) instead of a safe viewer/editor, executing it. There is no public exploit identified at time of analysis, but the fix is confirmed in 0.2026.05.06.15.42.stable_01 and the root cause is documented in the upstream commit and GHSA advisory.
Arbitrary local file write in Warp terminal (0.2025.03.05.08.02.stable_00 through builds before 0.2026.05.06.15.42.stable_01) lets malicious terminal output silently drop attacker-controlled files onto disk. Warp honored non-inline OSC 1337;File (and multipart MultipartFile) iTerm2 escape sequences by base64-decoding the payload and writing it to the active block's current working directory using the attacker-supplied filename, with no confirmation prompt. Because shell startup files such as .zshenv can be overwritten this way, the write converts into code execution on the victim's host; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Cross-origin credential leakage in libcurl (curl 7.10.6 through 8.20.0) causes the HTTP Digest 'Authorization:' header computed for one origin (hostA) to be wrongly reused on a subsequent transfer to a different origin (hostB) when an application reuses the same easy handle. This exposes Digest authentication credentials to an unintended, potentially attacker-controlled host, and is tracked as an Information Disclosure issue (EUVD-2026-41501). No public exploit identified at time of analysis; EPSS is low at 0.25% (16th percentile) and it is not in CISA KEV, so this is a latent credential-exposure bug rather than a demonstrated mass-exploitation threat.
Credential disclosure in curl 8.11.1 through 8.20.0 (and earlier) lets curl silently substitute the wrong password when .netrc lookup is combined with a URL that carries a username but no password, such as https://user@example.com/. When no matching entry exists for the specified user, curl falls back to a different user's password stored for that same host and transmits it during authentication, potentially leaking one user's secret to a server or to an unintended account. Publicly available exploit-flow details exist via the originating HackerOne report; EPSS is low (0.20%, 9th percentile) and it is not in CISA KEV.
Use-after-free in libcurl's HTTP/2 stream-dependency handling affects a wide range of curl releases (7.88.0 through 8.20.0) when an application sets CURLOPT_STREAM_DEPENDS or CURLOPT_STREAM_DEPENDS_E, then calls curl_easy_reset() before curl_easy_cleanup(); the reset frees an internal priority structure that cleanup later re-accesses. Despite the NVD 9.8 CVSS rating, the flaw is only reachable through a specific application-controlled API call sequence rather than remote attacker input, and is tagged Information Disclosure. No public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Information disclosure in libcurl (versions 8.18.0 through 8.20.0) causes the HTTP Referer header to persist on a reused easy handle even after an application explicitly clears it by passing NULL to CURLOPT_REFERER. Because the internal referrer state is not reset, a previously set referrer string is silently re-sent on later requests, potentially leaking sensitive URL data (paths, tokens, or query parameters) to unintended destination servers. There is no public exploit identified at time of analysis, EPSS risk is low (0.21%, 11th percentile), and it is not listed in CISA KEV.
Proxy-credential leakage in libcurl (curl 8.8.0 through 8.20.0) occurs because a request to clear previously set proxy authentication credentials is silently ignored, so the stale username/password remain attached to the reused easy handle and are sent on later transfers that were never meant to use them. This is an information-disclosure defect (tagged Information Disclosure, EUVD-2026-41510) affecting applications that reuse libcurl handles across multiple proxied requests. No public exploit identified at time of analysis and EPSS is low (0.25%, 16th percentile), consistent with a coding/logic flaw rather than a directly weaponizable remote bug.
Information disclosure and integrity exposure in curl/libcurl occurs when a new transfer that uses STARTTLS to upgrade a connection may reuse an already-established live connection whose TLS configuration does not match the requested one, so data intended for a strictly-configured secure channel can traverse a connection negotiated under different (potentially weaker or unverified) TLS settings. The flaw affects a very wide range of curl releases from 7.30.0 through 8.20.0 and is tagged as Information Disclosure with high confidentiality and integrity impact (CVSS 8.1). It is not listed in CISA KEV, EPSS is low (0.20%, 9th percentile), and no public exploit code is identified at time of analysis.
Use-after-free in libcurl 8.13.0 through 8.20.0 occurs when an application calls curl_easy_pause() from inside an event-based CURLMOPT_SOCKETFUNCTION callback, causing libcurl to write a flag through a struct pointer whose backing memory was just freed. Affected are applications built on the curl multi interface using event-based socket callbacks; the flaw can lead to memory corruption or limited information disclosure (tagged Information Disclosure) with low confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.21% (11th percentile), consistent with a niche triggering pattern rather than mass exploitation.
Incorrect mTLS connection reuse in libcurl (curl releases through 8.16.0) causes the library to reuse a pooled TLS connection even after client-certificate options - notably the private key - were changed in a way that should have forced a fresh handshake. Because those client-certificate settings were omitted from the connection-match logic, a later transfer can be sent over a connection authenticated with the wrong client identity, an integrity failure tagged as information disclosure. Rated CVSS 7.5 (C:N/I:H/A:N); EPSS is only 0.13% and there is no public exploit identified at time of analysis, though a HackerOne report (#3733910) drove the private disclosure.
Proxy credential leakage in libcurl (curl) occurs when a single reused easy handle drives sequential transfers through different environment-variable-configured proxies: after Digest-authenticating to proxyA, libcurl fails to reset the proxy authentication state, so the `Proxy-Authorization:` header meant for proxyA is resent to proxyB. Any application relying on handle reuse with env-var proxy settings and multiple upstream proxies can disclose proxyA's credentials to an unauthorized proxy operator. EPSS is low (0.25%, 16th percentile), it is not on CISA KEV, and no public exploit identified at time of analysis - this is a credential-confidentiality issue rather than a code-execution flaw.
TLS certificate-trust confusion in libcurl (curl 8.17.0 through 8.20.0) lets a reused pooled connection retain trust in the native platform CA store even after the application reconfigures the same easy handle to use custom CA material for a later transfer. An attacker positioned to intercept traffic could present a certificate valid under the native store - which the application intended to no longer trust - to silently intercept or spoof the connection. Rated CVSS 9.1, but EPSS is only 0.20% (9th percentile) and there is no public exploit identified at time of analysis, reflecting the narrow application-usage prerequisite rather than a broadly weaponizable flaw.
Information disclosure in libcurl (curl 8.11.0 through 8.20.0) allows a network man-in-the-middle to capture sensitive request data when TLS early data (0-RTT) is combined with SSL session ID caching. If an application enables the CURLSSLOPT_EARLYDATA bit and leaves the session cache active, libcurl can transmit a resumed request's bytes on a reconnection before it enforces a certificate verification failure, so an attacker who impersonates the original host without a valid certificate may receive the leaked data. No public exploit identified at time of analysis, and EPSS is low (0.13%), reflecting the non-default configuration and active-MITM prerequisite.
Memory-safety defect (double-free) in curl's SASL authentication path affects versions 8.15.0 through 8.20.0 when built with GSASL support: the GSASL context is cleaned up twice without the intervening pointer being cleared, causing the same allocation to be free()'d twice. A malicious or malfunctioning mail/auth server exercising the SASL handshake could trigger the condition, potentially corrupting heap memory and at minimum crashing the client. No public exploit identified at time of analysis, and the EPSS score is low (0.25%, 16th percentile) despite the headline CVSS of 9.8.
Host key verification bypass in libcurl affects applications using the CURLOPT_SSH_KEYFUNCTION callback for SCP:// or SFTP:// transfers, where a server presenting a host key of a different type than the one already recorded in known_hosts is silently accepted instead of rejected. This lets a network-positioned attacker impersonate a trusted SSH server and mount a man-in-the-middle attack, exposing and tampering with transferred data. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.19%, 9th percentile), reflecting the specific application configuration and attacker positioning required.
Out-of-bounds kernel memory write in the Linux kernel's OMFS filesystem driver (fs/omfs) allows a local attacker to corrupt kernel memory by mounting a crafted OMFS image. omfs_fill_super() validates that s_sys_blocksize is not larger than PAGE_SIZE but fails to enforce a lower bound, so a value below OMFS_DIR_START (0x1b8 = 440) triggers an unsigned integer underflow in omfs_make_empty(), driving a roughly 4 GiB memset() that overwrites kernel memory far beyond the block buffer. There is no public exploit identified at time of analysis, the EPSS score is low (0.18%), and it is not listed in CISA KEV; the fix has been backported across many stable kernel branches.
Local privilege-dependent use-after-free in the Linux kernel's fs/mbcache subsystem allows a privileged user (root or CAP_SYS_ADMIN) to trigger memory corruption when unmounting an ext2, ext4, or ocfs2 filesystem. mb_cache_destroy() frees the cache without cancelling the pending c_shrink_work item, so a still-running mb_cache_shrink_worker() accesses freed memory (CWE-416), potentially leading to kernel code execution or crash. No public exploit identified at time of analysis; EPSS is low (0.16%, 5th percentile) and it is not on CISA KEV.
Use-after-free in the Linux kernel PCI subsystem allows a local low-privileged attacker to corrupt memory by racing driver probe operations that access the driver_override field without holding the device lock. The flaw stems from __driver_attach() invoking the bus match() callback without the device lock, exposing an unlocked read of driver_override; exploitation could lead to memory corruption and privilege escalation. No public exploit identified at time of analysis, and EPSS risk is low (0.16%, 5th percentile), consistent with a hard-to-trigger local race rather than a widely-weaponized bug.
Local privilege escalation via memory corruption in the Linux kernel's platform/x86 WMI subsystem arises from an unlocked access to the driver_override field during driver probing, producing a use-after-free (CWE-416). Authenticated local users on affected kernels (introduced around 6.11 and backported into stable trees) can trigger the race through the WMI bus to corrupt kernel memory, with high confidentiality, integrity, and availability impact (CVSS 7.8). No public exploit identified at time of analysis, and EPSS is low at 0.16% (5th percentile), indicating no observed weaponization.
Local privilege escalation and memory corruption in the Linux kernel's vDPA (virtio Data Path Acceleration) subsystem stems from an unlocked access to the driver_override field during device-to-driver matching, producing a use-after-free (CWE-416). Affected kernels from 5.17 up to the fixed 6.18.33, 7.0.10, and 7.1 releases allow a local user with the ability to interact with vDPA devices to corrupt kernel memory, with full confidentiality, integrity, and availability impact. EPSS is low (0.15%, 5th percentile) and there is no public exploit identified at time of analysis, so this is a patch-on-schedule kernel hardening fix rather than an emergency.
Local privilege-relevant memory corruption in the Linux kernel's s390 channel-I/O (cio) subsystem allows a use-after-free when a device driver is probed via __driver_attach() and the bus match() callback reads the unprotected driver_override field. The flaw affects Linux on IBM Z (s390) mainframes and is resolved by switching to the driver-core's generic driver_override infrastructure, which handles locking internally. There is no public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Local privilege-adjacent memory corruption in the Linux kernel's s390 Adjunct Processor (AP) crypto bus driver allows a use-after-free when AP adapter/queue masks are updated concurrently with a driver_override write. When apmask_store()/aqmask_store() trigger ap_bus_revise_bindings(), __ap_revise_reserved() reads the driver_override string without a lock, racing a concurrent driver_override_store() that can free the old string, yielding a UAF (CWE-416) with high confidentiality, integrity, and availability impact on IBM Z (s390) systems. No public exploit identified at time of analysis, and EPSS is low (0.14%, 4th percentile); the fix migrates the driver to the driver-core's internally-locked driver_override infrastructure.
Local privilege escalation via a use-after-free in the Linux kernel's fsl-mc bus driver (drivers/bus/fsl-mc) allows a low-privileged local attacker to corrupt kernel memory when the bus match() callback accesses the unlocked driver_override field during __driver_attach() probing. The flaw affects NXP/Freescale Management Complex bus code and is fixed by switching to the driver-core's generic driver_override infrastructure that locks internally. No public exploit identified at time of analysis and EPSS is low (0.16%), but the CVSS 7.8 high severity reflects full confidentiality, integrity, and availability impact on a successful local attack.
Use-after-free in the Linux kernel's rtlwifi PCI driver (drivers/net/wireless/realtek/rtlwifi) lets a freed ieee80211_hw structure be accessed after teardown, because irq_prepare_bcn_tasklet is scheduled on the RTL_IMR_BCNINT beacon interrupt but never killed in rtl_pci_deinit(). When a Realtek PCIe Wi-Fi card fails to probe or is detached, the still-running or pending beacon tasklet dereferences the freed structure in _rtl_pci_prepare_bcn_tasklet(), enabling potential memory corruption and local privilege escalation. The flaw was found via static analysis; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 6th percentile).
Memory-safety and information-disclosure risk in the Linux kernel s390 (IBM Z) eBPF JIT compiler stems from incomplete ABI compliance: the JIT sign-extended values but never zero-extended unsigned BPF program return values and kfunc arguments as the s390x calling convention requires. On s390x hosts, a local user able to load BPF programs can cause the JIT to emit code that leaves stale upper register bits, producing incorrect computation that can leak kernel data or corrupt execution. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and the issue is not in CISA KEV; it is fixed in multiple stable releases.
Use-after-free / bad page state in the Linux kernel's PowerPC page-table fragment allocator (powerpc/pgtable-frag) allows a local user on affected POWER systems to trigger kernel memory corruption and instability during process teardown. The flaw manifests when a cached PTE fragment folio retains an unused reference at process exit, so pte_frag_destroy() frees the folio without clearing its active flag, producing a PAGE_FLAGS_CHECK_AT_FREE bad-page state. There is no public exploit identified at time of analysis and EPSS is very low (0.16%, 6th percentile); a vendor patch is available.
Local privilege/denial-of-service exposure in the Linux kernel BPF subsystem allows a low-privileged user who can load a device-bound XDP program to trigger a use-after-free during network namespace teardown. When constant blinding is enabled (bpf_jit_harden=2), JIT compilation of a BPF_F_XDP_DEV_BOUND_ONLY program clones the program and frees the original, but offload->prog is left pointing at the freed buffer; later netns cleanup dereferences it. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.17%), consistent with a config-dependent, non-default code path.
Privilege-relevant memory corruption in the Linux kernel eBPF verifier (introduced around v6.11) lets a local user with BPF-loading capability defeat the verifier's range tracking when a register adds to itself (rX += rX), because adjust_reg_min_max_vals() mutates dst_reg in place and then reads the already-modified src_reg, recording a wrong delta that sync_linked_regs() propagates to linked registers. The result is a verifier-vs-runtime mismatch - the verifier reasons about register bounds that differ from actual execution, the classic precursor to out-of-bounds kernel memory access and local privilege escalation. CVSS is 7.8 (High); EPSS is low (0.17%, 6th percentile), there is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds memory access in the Linux kernel networking stack (net/core qdisc segmentation path) lets a local user feed malformed GSO (Generic Segmentation Offload) packets whose headers are not present in skb->head, causing drivers and net/core/tso.c (tso_build_hdr) to memcpy beyond valid bounds. The flaw can leak adjacent kernel memory and/or crash the system; it is not in CISA KEV and no public exploit has been identified, with a low EPSS of 0.15% (5th percentile) indicating low near-term exploitation likelihood. The upstream fix adds proper header pulling via pskb_may_pull() and a new SKB_DROP_REASON_SKB_BAD_GSO drop reason so malicious packets are dropped early.
Improper simulation of BPF ld_{abs,ind} failure paths in the Linux kernel verifier allows a local attacker with BPF loading capability to bypass security checks and achieve full system compromise (C:H/I:H/A:H).
Local privilege-adjacent memory corruption in the Linux kernel's BPF offload subsystem allows a use-after-free triggered when querying info for an offloaded BPF map or program while the associated network namespace is being torn down. The bug lives in bpf_map_offload_info_fill_ns() and bpf_prog_offload_info_fill_ns(), where get_net() increments a netns refcount that may already have reached zero, corrupting freed memory. No public exploit is identified at time of analysis, and EPSS is very low (0.14%), consistent with a hard-to-win kernel race rather than a broadly exploited flaw.
Memory mishandling in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver stems from an off-by-one error in bcmgenet_put_txcb(), where the function returned the wrong transmit control block (tx_cb) because the write pointer was rewound after reading instead of before, causing incorrect cleanup of TX descriptors. The flaw affects systems using Broadcom GENET network controllers (notably Raspberry Pi 4/5 and various Broadcom SoCs) running affected kernels prior to the stable fixes. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.16% (6th percentile); despite the NVD CVSS 9.8 rating, the realistic impact is local denial-of-service or limited information disclosure rather than remote unauthenticated code execution.
Denial-of-service via resource leak in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver allows the transmit buffer-descriptor (BD) pool to be slowly exhausted. When the driver reclaims a TX queue and fast-forwards the write pointer to drop in-flight frames, those dropped frames' buffer descriptors are never returned to the free_bds pool and the netdev is not told the frames were dropped, gradually starving the TX ring until the interface can no longer transmit. There is no public exploit identified at time of analysis, EPSS is low (0.16%, 6th percentile), and a vendor (stable-tree) patch is available; the impact is availability-only (CVSS A:H, C:N/I:N).
Denial of service in the Linux kernel's Broadcom GENET (bcmgenet) Ethernet driver arises because the bcmgenet_timeout handler tears down all transmit queues when only a single queue times out, racing against queues still actively transmitting. The flaw affects systems using Broadcom GENET NICs (e.g. Raspberry Pi 4/CM4 and Broadcom set-top-box SoCs) and can lead to kernel instability or a crash under TX timeout conditions. There is no public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Local privilege escalation and memory corruption in the Linux kernel BPF subsystem arises from a use-after-free in the open-coded task_vma iterator, which read task->mm locklessly and took mmap_read_trylock() without ever calling mmget(). On kernels where a concurrent task exit frees the mm_struct (not protected by SLAB_TYPESAFE_BY_RCU), a BPF program iterating that task's VMAs can access freed memory, enabling information disclosure or kernel control-flow corruption. The fix has been merged upstream; there is no public exploit identified at time of analysis, EPSS is low (0.16%, 5th percentile), and it is not listed in CISA KEV.
Local privilege escalation in the Linux kernel (6.11 through pre-patch 6.12.x/6.18.x/7.0.x) arises from a BPF verifier state-pruning flaw in regsafe() handling of BPF_ADD_CONST scalar registers, where base register IDs are not checked for mapping consistency. An attacker able to load BPF programs can construct two verifier states that falsely appear equivalent, causing state pruning to incorrectly succeed and letting an unsafe program bypass verification. With CVSS 7.8 (AV:L/PR:L) and full C/I/A impact, successful exploitation can corrupt kernel memory; there is no public exploit identified at time of analysis and EPSS is low (0.16%).
Out-of-bounds read and kernel pointer leak in the Linux kernel's eBPF sock_ops subsystem lets a local low-privileged actor able to load BPF programs disclose kernel memory and corrupt kernel state. The SOCK_OPS_GET_SK() and SOCK_OPS_GET_FIELD() macros fail to zero the destination register on the !fullsock/!locked_tcp_sock path when dst_reg == src_reg, leaving a stale ctx pointer that the verifier mistakes for a valid socket or a scalar. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Improper network-namespace isolation in the Linux kernel's net/rds InfiniBand transport (RDS/IB) lets a local user operating in a non-initial network namespace trigger faulty RDS/IB behavior, because the existing code was never written to function correctly outside the initial netns. The upstream fix restricts RDS/IB to the initial network namespace entirely. NVD rates it 7.8 (local, low-privilege); EPSS is low at 0.16% (6th percentile) and there is no public exploit identified at time of analysis.
Out-of-bounds kernel memory read in the Linux kernel's eBPF subsystem (pcpu_init_value) lets a local, low-privileged user with BPF access leak adjacent kernel memory and potentially crash the system. The flaw triggers when a per-CPU map is updated from a BPF_MAP_TYPE_CGROUP_STORAGE map whose value_size is not 8-byte aligned (e.g. 4 bytes), causing copy_map_value_long to read past the true source size. The issue is fixed in stable kernels; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.16%, 5th percentile).
Local privilege escalation in the Linux kernel's PPP driver allows an unprivileged user to issue network-administration ioctls against a network namespace they should not control. The /dev/ppp device authorizes opens against the file owner's user namespace (f_cred->user_ns) while unattached administrative ioctls act on current->nsproxy->net_ns, so a user who creates a new user namespace via CLONE_NEWUSER and gains CAP_NET_ADMIN only there can still invoke PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against an inherited (parent) network namespace. No public exploit identified at time of analysis, and EPSS is low (0.26%, 17th percentile), indicating no current evidence of mass exploitation.