Information Disclosure

Linux Kernel quota subsystem livelocks the system when quotactl_block() and freeze_super() execute concurrently on non-preemptible kernels, causing 100% CPU consumption and an indefinite hang of the filesystem freeze process. The root cause is a missing scheduling point in quotactl_block()'s retry loop: on kernels with preemption disabled, the spinning loop never yields the CPU, starving synchronize_rcu() of the RCU quiescent state it needs to advance, which in turn blocks freeze_super() from completing. Affected are Linux kernel versions from commit 576215cffdefc1f0ceebffd87abb390926e6b037 onward, on systems using quota-enabled filesystems; no public exploit or active exploitation has been identified at time of analysis.

Race condition in Linux kernel Intel VT-d IOMMU driver (iommu/vt-d) allows torn reads of Scalable Mode PASID table entries during teardown, producing unpredictable behavior or spurious faults on systems with Intel VT-d enabled. The flaw stems from zeroing the entire 64-byte PASID entry while the Present bit is still set, violating the VT-d spec's invalidation guidance. No public exploit identified at time of analysis, and EPSS is very low (0.02%), but a vendor patch is available across multiple stable branches.

Out-of-bounds read in the Linux kernel's AppArmor subsystem allows a local, low-privileged attacker to leak adjacent kernel memory and potentially crash the system when AppArmor parses a policy table built from possibly unaligned, userspace-supplied source data. The flaw stems from unaligned memory accesses during table creation in the policy loader and carries high confidentiality and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.02%, 5th percentile), consistent with a hard-to-reach local-only kernel hardening fix rather than a mass-exploitation target.

Stale unwritten extent retention in the Linux kernel ext4 filesystem's in-memory extent status cache allows a local low-privileged user to trigger filesystem state inconsistency with high availability impact. The flaw manifests in ext4_split_extent() when a PARTIAL_VALID1 zeroout operation succeeds but the subsequent split at the first boundary fails due to temporary memory pressure, leaving the extent status tree out of sync with on-disk extent data. Patched stable releases are available; no public exploit or CISA KEV listing has been identified at time of analysis, and EPSS exploitation probability sits at 0.02% (5th percentile).

Local privilege-holder denial of service (and potential kernel memory corruption) in the Linux kernel's HiSilicon hns3 network driver allows a user with CAP_NET_ADMIN to trigger a double-free of the tx_spare backup buffer. The flaw lives in hns3_set_ringparam(), where a temporary ring copy is made for rollback but the original ring's tx_spare pointer is left dangling; if a subsequent allocation in hns3_init_all_ring() fails, the error path frees the stale pointer twice (CWE-415). EPSS is negligible (0.02%, 7th percentile) and there is no public exploit identified at time of analysis, but a vendor-released patch is available across multiple stable trees.

Guest-to-host denial of service in the Linux kernel's xen-netback driver allows a malicious or buggy Xen guest to crash the hypervisor host by writing "0" to the xenbus key multi-queue-num-queues. The connect() function validates only the upper bound of requested_num_queues, permitting a zero value to reach vzalloc(array_size(0, ...)), which triggers WARN_ON_ONCE in __vmalloc_node_range(); on hosts with panic_on_warn=1 this escalates to a full kernel panic. No public exploit exists and EPSS is 0.02% (7th percentile), consistent with a narrow Xen-specific attack surface, but the guest-controlled code path is trivial to trigger and vendor patches have been backported across seven stable kernel series, confirming the impact is real.

Divide-by-zero kernel panic (Oops) in the Linux kernel MPTCP subsystem's `mptcp_rcvbuf_grow()` function can be triggered by a local authenticated user under a rare but specific race condition involving concurrent out-of-order packet arrival and receive buffer initialization. The vulnerability also causes a secondary effect where the MPTCP receive buffer slowly drifts toward the `tcp_rmem[2]` maximum, degrading system performance on MPTCP-heavy workloads. No public exploit identified at time of analysis; EPSS is 0.02% (4th percentile), consistent with its local-only, race-dependent nature.

Memory leak in the Linux kernel's md/raid1 subsystem allows a local attacker with access to RAID configuration interfaces to gradually exhaust kernel memory by repeatedly triggering the faulty error path in raid1_run(). Affected kernel versions span multiple stable branches prior to 6.12.75, 6.18.14, 6.19.4, and 7.0. No public exploit identified at time of analysis; EPSS at 0.02% (5th percentile) and confirmed discovery via static analysis rather than active exploitation signals minimal real-world risk. Vendor-released patches are available across all affected stable branches.

Memory leak in the Linux kernel's af_unix subsystem allows a local low-privileged user to exhaust kernel memory by repeatedly triggering a failure path in unix_stream_connect(). When prepare_peercred() fails after unix_create1() has already allocated a new socket object (newsk), the error path omits the required unix_release_sock() call, leaving kernel memory permanently unreleased. No public exploit has been identified at time of analysis; EPSS at 0.02% (4th percentile) reflects negligible widespread exploitation likelihood, consistent with the local-only attack vector.

BPF verifier rejection in the Linux kernel's XDP subsystem forces valid BPF programs to fail load-time verification when they pass pointers from BPF_F_RDONLY_PROG maps to the bpf_xdp_store_bytes helper. The root cause is an incorrect argument type annotation - the helper's third argument (source buffer) is declared as ARG_PTR_TO_UNINIT_MEM, which carries the MEM_WRITE flag, causing the verifier to demand write permission on memory that the helper only reads. Separately, this same mistype permits the helper to read from uninitialized memory (CWE-908). No public exploit is identified at time of analysis, and EPSS sits at 0.02%, but kernel patches across all active stable branches have been issued.

Integer underflow in the Linux kernel's AppArmor subsystem (`aa_get_buffer()`) allows a local low-privileged user to cause per-CPU buffer starvation and system-wide denial of service. The `cache->hold` unsigned counter wraps to UINT_MAX when decremented below zero, permanently preventing `aa_put_buffer()` from recycling buffers back to the global pool and forcing repeated `kmalloc(aa_g_path_max)` heap allocations that starve other CPUs. No public exploit exists and EPSS is 0.02% (5th percentile); this is not in CISA KEV, but patches are available across multiple stable kernel branches.

Resource leak in the Linux kernel's sca3000 IIO accelerometer driver (sca3000_probe()) allows a local low-privileged user on affected hardware to cause IRQ resource exhaustion by repeatedly triggering the error path where iio_device_register() fails without releasing the IRQ registered via request_threaded_irq(). Affected are Linux kernel versions from approximately 4.10 through multiple stable branches, all of which now have upstream fix commits. No public exploit exists and EPSS stands at 0.02% (7th percentile), indicating this is a robustness/maintenance fix rather than an actively targeted vulnerability.

Memory exhaustion via the MediaTek SVS (Smart Voltage Scaling) debugfs interface in the Linux kernel allows a local attacker with low privileges to leak kernel memory on MediaTek SoC-based systems. The root cause is that `svs_enable_debug_write()` allocates a buffer via `memdup_user_nul()` to copy user-supplied input, but fails to free it when the subsequent `kstrtoint()` call rejects non-integer input - a classic CWE-401 missing-release flaw. No public exploit has been identified and EPSS is 0.02% (7th percentile), making this a low-urgency, patch-when-convenient issue for the narrow device population running affected MediaTek SoC kernels.

PCI/P2PDMA subsystem in the Linux kernel hangs indefinitely on PCI device removal due to a missing percpu_ref_put() call on the error exit path of p2pmem_alloc_mmap(). Low-privileged local users on systems with P2PDMA-capable PCI hardware can trigger a vm_insert_page() failure that leaks a per-CPU pgmap reference, causing memunmap_pages() to stall forever when the PCI device is later removed. No public exploit has been identified and EPSS is at the 5th percentile; this is not in CISA KEV.

Regulator resource leak in the Linux kernel MFD Arizona WM5102 audio codec driver causes availability degradation on affected hardware when the write sequencer error path is triggered. The `wm5102_clear_write_sequencer()` helper returns early on error without jumping to the `err_reset` cleanup label, leaving kernel voltage regulators enabled and leaking resources across repeated invocations. Exploitation requires local low-privilege access on systems with WM5102 hardware; EPSS is 0.02% (7th percentile) and no active exploitation has been identified, placing real-world priority firmly in the low tier.

Denial-of-service via kernel crash in the Linux kernel's netfilter nft_set_rbtree subsystem, exploitable by a local user with nftables manipulation capability. The flaw lies in the partial overlap detection logic for anonymous sets: an optimization that omits end elements for adjacent intervals also inadvertently suppresses overlap checks on start elements, allowing two intervals sharing the same start point (e.g., A-B and A-C where C < B) to be inserted simultaneously, corrupting the red-black tree and triggering a kernel panic. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (7th percentile) reflects low real-world exploitation probability, though the vulnerability is present across many long-term stable kernel branches.

Memory exhaustion denial-of-service in the Linux kernel smartpqi SCSI driver allows a local user to degrade system availability through kernel memory leak accumulation. The vulnerability exists in pqi_report_phys_luns(), which fails to release the rpl_list buffer on two distinct error paths - unsupported data format detection and rpl_16byte_wwid_list allocation failure - both of which bypass cleanup logic. No public exploit exists and EPSS sits at 0.02% (7th percentile), but systems running Microsemi/PMC-Sierra SmartPQI RAID controllers on unpatched kernels are at risk of gradual availability degradation.

Resource leak in the Linux kernel's st33zp24 TPM driver allows a low-privileged local user to exhaust TPM localities and deny TPM service on systems equipped with STMicroelectronics ST33ZP24 hardware. When get_burstcount() returns -EBUSY on timeout, st33zp24_send() exits without releasing the previously acquired TPM locality, creating a cumulative leak that can render all subsequent TPM operations unavailable. No public exploit code exists and EPSS probability is 0.02% (7th percentile), but systems relying on the ST33ZP24 for measured boot or disk-encryption attestation face meaningful operational risk if exploited.

Memory leaks in the Linux kernel's SUNRPC auth_gss subsystem allow a local low-privilege attacker to gradually exhaust kernel heap memory on systems using NFS with Kerberos (RPCSEC_GSS) authentication. The gssx_dec_ctx(), gssx_dec_status(), and gssx_dec_name() XDR decoding functions fail to release previously allocated kernel buffers when a partial decode sequence errors out mid-function, leaving unreferenced kmemdup() allocations on the heap. No public exploit exists and EPSS is 0.02%, but no public exploit identified at time of analysis; repeated triggering of the vulnerable paths could degrade availability on RPCSEC_GSS-enabled servers.

Reference count leak in the Linux kernel's pinctrl-single driver (`pcs_add_gpio_func()`) allows a local low-privileged user to cause kernel memory exhaustion and denial of service on affected embedded/SoC platforms. The `of_parse_phandle_with_args()` Device Tree API increments a refcount on the returned device_node pointer, but the iterating loop never calls `of_node_put()` to release it - accumulating leaked references on every GPIO phandle processed. No public exploit exists and EPSS is 0.02%, placing this firmly in the low-urgency patch category; exploitation requires specific hardware and driver configuration not present on typical x86 servers.

Local privilege-bounded use-after-free in the Linux kernel's CAIF serial line discipline (caif_serial / CONFIG_CAIF_TTY) lets a local attacker corrupt kernel memory by racing ldisc_close() against packet transmission. ldisc_close() drops the tty reference via tty_kref_put() while the CAIF network device is still live, so a concurrent caif_xmit()/handle_tx() can dereference the freed tty (ser->tty) and call tty->ops->write() on dangling memory, confirmed by a KASAN slab-use-after-free report. A reproducer is published, but no public weaponized exploit and no active exploitation are recorded; EPSS is 0.02% (7th percentile), consistent with a niche driver and a tight race window.

Uninitialized stack memory exposure in the Linux kernel's MCTP-over-I2C (mctp-i2c) driver affects systems using i2c-aspeed or i2c-npcm7xx bus drivers, particularly server/BMC hardware with Aspeed and Nuvoton chipsets. When a read is performed against an mctp-i2c device instance, the event handler fails to initialize the 'val' byte before returning it to the caller, exposing whatever residual value sits on the kernel stack at that moment. No public exploit has been identified at time of analysis, and with an EPSS of 0.03% (10th percentile), real-world exploitation pressure is currently negligible; however, kernel stack data leakage is a meaningful information disclosure primitive on affected hardware.

Memory leak in the Linux kernel's DesignWare i3c master driver (`drivers/i3c/master/dw-i3c-master.c`) allows a local low-privileged user on systems equipped with DesignWare i3c hardware to cause gradual kernel memory exhaustion by repeatedly triggering the failure path in `dw_i3c_master_i2c_xfers()`, where `dw_i3c_master_alloc_xfer()` allocates a transfer structure that is never freed when `pm_runtime_resume_and_get()` returns an error. No public exploit identified at time of analysis; EPSS of 0.02% (5th percentile) and the static-analysis discovery method both confirm this is a low-immediacy, low-exploitation-probability issue. Vendor-released patches are available across multiple stable kernel branches.

Race condition in the Linux kernel's Intel VT-d IOMMU driver allows non-coherent IOMMU hardware to read uninitialized memory from a freshly allocated PASID table because the PASID directory entry is published before the CPU cache flush completes. With CVSS 7.8 (AV:L/AC:H/PR:L) and EPSS at 0.02% (7th percentile), no public exploit identified at time of analysis, and the issue requires local privileges plus precise timing against non-coherent IOMMU hardware. The fix is included across multiple stable kernel branches.

Local privilege escalation potential in the Linux kernel's GFS2 (Global File System 2) filesystem stems from a slab-use-after-free in qd_put() that corrupts the quota data LRU list during filesystem shutdown. Local authenticated users with access to a GFS2 mount could trigger the shrinker path (gfs2_qd_shrink_scan) to dereference freed objects, with EPSS at 0.02% indicating no public exploit identified at time of analysis. The flaw was introduced by commit a475c5dd16e5 which began freeing quota data synchronously without removing entries from the LRU list first.

Denial of service in the Linux kernel netfilter nf_conncount subsystem allows remote attackers to trigger erroneous connection limit enforcement by establishing more than 8 new tracked connections per jiffy, causing the garbage collector to fall behind and the connection list to wrongly hit its cap. The flaw affects systems using nft_connlimit, xt_connlimit, or OVS connection limit features, with availability impact only (CVSS 7.5, AV:N/AC:L/PR:N/UI:N/A:H). EPSS is very low (0.02%) and no public exploit identified at time of analysis, but the issue is reproducible with common HTTP load tools such as slowhttptest.

Stale data exposure and filesystem data corruption in the Linux kernel's ext4 extent-splitting subsystem affects all major stable branches prior to 6.6.130, 6.12.75, 6.18.14, 6.19.4, and 7.0. When ext4_split_extent_at() encounters a transient ENOSPC condition while splitting a large unwritten extent at its first boundary, the error path incorrectly zeroes out and marks the entire extent as written - leaving stale disk content from adjacent regions readable in areas that should remain unwritten or zero-filled. No public exploit identified at time of analysis; EPSS at 0.02% (5th percentile) reflects the narrow, local-only, condition-dependent trigger path that makes automated or widespread exploitation highly unlikely.

Out-of-bounds kernel heap read in the Linux kernel's RDMA/uverbs subsystem allows local low-privileged users with access to InfiniBand/RDMA device nodes to leak kernel memory or trigger a denial-of-service WARNING by submitting a crafted ib_uverbs_post_send command with an undersized or oversized wqe_size value. EPSS is very low (0.02%, 7th percentile) and there is no public exploit identified at time of analysis, but the bug is fixed upstream across multiple stable trees, so patched versions should be deployed where RDMA is exposed to untrusted local users.

Non-NCQ command starvation in the Linux kernel's libata-scsi layer can cause complete denial of service for certain disk I/O operations on systems using multi-queue ATA host adapters. On affected hardware, when a target storage device is under sustained NCQ (Native Command Queuing) traffic, the SCSI layer's SCSI_MLQUEUE_XXX_BUSY requeue mechanism provides no forward-progress guarantees for non-NCQ commands - other CPU cores can continuously inject new NCQ commands from separate submission queues, indefinitely deferring the non-NCQ command. No public exploit has been identified at time of analysis and EPSS probability is very low (0.02%, 5th percentile), but the bug can manifest naturally under heavy I/O workloads without deliberate exploitation.

Kernel panic in the Linux inside-secure/eip93 hardware crypto driver occurs when the driver teardown routine unconditionally unregisters all cryptographic algorithms, including those never registered because the underlying EIP93 silicon does not implement them. Platforms with partial EIP93 silicon support - where only a subset of algorithms are burned into hardware - trigger the panic during module removal or system shutdown. No public exploit exists and EPSS sits at the 4th percentile (0.02%), indicating this is primarily a stability defect with negligible exploitation interest rather than a targeted attack surface.

Local privilege escalation and kernel memory corruption in the Linux kernel's RDMA Soft RoCE (rxe) driver stems from a double-free in rxe_srq_from_init() when copy_to_user() fails after the queue pointer has already been assigned to srq->rq.queue. A local user with permission to create Shared Receive Queues over RDMA can trigger the error path to cause the same memory to be freed twice via rxe_srq_cleanup(), enabling kernel heap corruption with potential for privilege escalation. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.02%, 7th percentile).

Denial of service in the Linux kernel's EFI unaccepted-memory handling allows a boot-time kernel panic on confidential-computing guests, affecting kernels from 6.6 through the 6.19/7.0 development line. The reserve_unaccepted() routine miscalculates the memblock reservation size when the unaccepted memory table is not page-aligned, leaving the table's tail unreserved so it can be overwritten or rendered inaccessible, triggering a panic in accept_memory(). It is observed on Intel TDX VMs with larger memory sizes (e.g. >64GB); there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).

Incorrect offset handling in the Linux kernel IPVS subsystem causes IPv6 protocol checksum validation to fail when extension headers precede the transport header, disrupting availability on systems acting as IPv6 load balancers. Affected across a broad kernel version range from 2.6.28 onward, with fixes confirmed in stable releases 6.19.4 and mainline 7.0. No public exploit code exists and no active exploitation has been identified; EPSS is 0.02% (5th percentile), indicating negligible real-world exploitation pressure.

Reachable assertion in the Linux kernel network subsystem allows a local low-privileged user to trigger a WARN_ON_ONCE by constructing a sufficiently long forward path through IPIP tunnels, resulting in a kernel warning and high availability impact. The root cause (CWE-617) is an assertion in the forward path array access code that became reachable after IPIP tunnel support was introduced, expanding the possible depth of forward paths beyond the implicit assumption encoded in the warning. No public exploit code exists and EPSS is extremely low (0.02%, 7th percentile), but the kernel-level denial-of-service impact on local multi-tenant or containerized systems warrants patching.

Unauthenticated configuration disclosure in the Netis AC1200 Router NC21 (firmware V4.0.1.4296) allows any LAN-connected attacker to retrieve the device's full configuration via a single HTTP GET to /cgi-bin/skk_get.cgi. The dump exposes administrator credentials, WiFi and PPPoE passwords, DDNS credentials, and a map of connected clients, enabling immediate device takeover and lateral movement. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile).

Predictable secure-key generation in Slican telephone exchanges (IPx, CCT-1668, MAC-6400, and CXS-0424 series) lets a remote unauthenticated attacker reconstruct the device's secure key from exchange properties that are readable without credentials, then derive administrator credentials. The flaw is network-reachable with low attack complexity and no authentication (CVSS 4.0 base 8.7), and while fixed firmware is available for supported lines, discontinued 4.xx and earlier units remain permanently exposed. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Sensitive information disclosure in IBM MQ Operator and IBM-supplied MQ Advanced container images exposes potentially sensitive data written to log files, readable by local users on the host or container system. Affected versions span three release tracks (LTS, CD, SC2) across both the MQ Operator (v2.0.0 through v3.9.1) and a broad range of container image releases from 9.3.x through 9.4.x. The CVSS score of 5.1 with a local attack vector and high complexity rating confines exploitation to users with existing local or container runtime access, and no public exploit has been identified at time of analysis.

WORM protection bypass in Samba's vfs_worm VFS module allows authenticated share users to defeat data retention controls by renaming a newly created file over an existing WORM-protected file. Affected users are those operating Samba deployments that have explicitly enabled the vfs_worm module for write-once, read-many data protection - such as compliance, archival, or audit log shares. An attacker with low-privilege write access can silently overwrite files that should be immutable post-grace-period, with high integrity impact (CVSS I:H). No public exploit or CISA KEV listing is identified at time of analysis.

NULL pointer dereference in libusb's USB descriptor parser allows any attacker who can supply a crafted configuration descriptor to crash any application that uses libusb for USB device enumeration. Affected versions are all libusb releases before 1.0.30; the flaw resides in parse_interface() within descriptor.c and is reachable through the public APIs libusb_get_active_config_descriptor and libusb_get_config_descriptor. No public exploit code is identified at time of analysis and this CVE does not appear in the CISA KEV catalog, but the availability impact is confirmed high (CVSS 4.0 VA:H) and regression corpus files in the fix commit demonstrate reliable crash reproduction.

Memory leak in the Linux kernel NTFS3 driver's ntfs_fill_super() function allows a local user with mount privileges to gradually exhaust kernel memory by repeatedly mounting NTFS filesystems. The ntfs_mount_options structure (32 bytes per mount) is permanently leaked because fc->fs_private is nulled before ntfs_fs_free() can release it, confirmed by kmemleak tooling. No active exploitation has been identified - EPSS is 0.02% (5th percentile) and this vulnerability is absent from CISA KEV - making it a maintenance-class fix rather than an urgent security priority, though the availability impact is rated High by CVSS.

Uninitialized memory use in the Linux kernel's NTFS3 filesystem driver (fs/ntfs3) causes a kernel crash when a local, low-privileged user triggers NTFS compression writes under specific folio allocation conditions. The flaw was surfaced by KMSAN (Kernel Memory Sanitizer) in longest_match_std(), called from ntfs_compress_write(), when newly allocated folios are neither marked uptodate nor initialized before use. No public exploit or active exploitation has been identified; EPSS stands at 0.02% (5th percentile), confirming negligible automated attack activity at time of analysis.

Deadlock in the Linux kernel's NTFS3 compressed-file read path (fs/ntfs3) causes indefinite task hang and local denial of service when concurrent readers contend over compressed NTFS frames. The inode mutex (ni_lock) and VFS page locks are acquired in inverted order across two concurrent tasks - a classic ABBA deadlock first surfaced by Syzbot. Versions prior to 6.19.4 (stable) and 7.0 (mainline) are affected; no public exploit or active exploitation has been identified, and the EPSS score of 0.02% (5th percentile) reflects the narrow, configuration-specific conditions required.

Out-of-bounds stack read in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem, in ima_appraise_measurement() reached via is_bprm_creds_for_exec(), affecting kernels from the 6.14 series up to the fixed stable commits. A misuse of container_of() on a *file pointer computes an invalid stack offset, letting a local execution path read one byte past a stack frame object (flagged by KASAN), which can disclose adjacent stack data or crash the task. EPSS is very low (0.02%, 5th percentile), the CVE is not on CISA KEV, and there is no public exploit identified at time of analysis; the issue is patched upstream.

Networking denial of service in the Linux kernel's Smack LSM disrupts IPv4 connectivity for all processes carrying non-ambient Smack labels when a previously-used CIPSO DOI value is cycled through /smack/doi. The kernel's smk_cipso_doi function retains decommissioned DOI definitions in netlabel's CIPSO configuration, causing re-add operations to fail with EEXIST (-17); this prevents the default IPv4 domain mapping from being re-established, silently severing label-based network traffic. No public exploit code is identified and EPSS sits at 0.02% (7th percentile), reflecting the very narrow deployment surface - only systems with Smack as the active LSM and CIPSO networking configured are affected.

Race condition in the Linux kernel's accel/amdxdna driver allows a local low-privileged user to cause device availability impact on systems equipped with AMD XDna AI accelerator hardware. The flaw in the rpm_on flag check permits command submissions to the accelerator during a narrow autosuspend transition window before the device has fully resumed, producing undefined hardware behavior or driver crashes. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible real-world exploitation probability; no active exploitation is confirmed.

IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain access to the underlying operating. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

IBM SDI 7.2.0.0 through 7.2.0.14 and IBM Security Directory Integrator 10.0.0.0 through 10.0.0.2 could allow a remote attacker to obtain sensitive information when a detailed technical error message. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Incorrect ARP payload parsing in the Linux kernel's netfilter arptables subsystem causes filtering rules to evaluate against garbage data on systems with IEEE1394 (FireWire) network interfaces. The arp_packet_match() function and arpt_mangle both assume a standard dual-hardware-address ARP layout, but IPv4-over-IEEE1394 per RFC 2734 omits the target hardware address field - the same discrepancy the rest of the kernel ARP stack already handles correctly. The result is that arptables rules on FireWire interfaces silently malfunction: legitimate traffic may be dropped and traffic that should be blocked may be passed, with arpt_mangle additionally writing to wrong offsets and corrupting packets. No public exploit has been identified and EPSS is 0.02% (6th percentile), consistent with the extremely niche attack surface.

Out-of-bounds read in the Linux kernel SLIP driver's VJ-compressed TCP header decoder (slhc_uncompress) allows a crafted short compressed frame to leak adjacent memory contents into the cached cstate and into subsequently reconstructed packets. The flaw affects systems using SLIP with Van Jacobson TCP/IP header compression; no public exploit has been identified at time of analysis and EPSS rates exploitation probability at 0.02%. The bug stems from missing bounds checks in decode() and pull16(), where the existing -1 error checks were dead code due to a 0xffff mask.

Local privilege-escalation-class memory corruption in the Linux kernel's BPF arena subsystem (introduced around 6.9) allows a process holding BPF capabilities to trigger a use-after-free. When a BPF arena VMA is inherited across fork(), arena_vm_open() bumps the mmap refcount but never registers the child VMA in arena->vma_list, leaving vml->vma pointing at the parent VMA; after the parent munmaps, a child call to bpf_arena_free_pages() dereferences the dangling pointer in zap_pages(). No public exploit or active exploitation is identified (EPSS 0.02%, 5th percentile), and vendor patches are available.

Sensitive data exposure in the ZAYTECH "Smart Online Order for Clover" WordPress plugin (all versions through 1.6.0) allows remote unauthenticated attackers to retrieve embedded sensitive information that the plugin inserts into data it sends. The CVSS 3.1 base score is 7.3 with a network/no-auth vector but only Low impact across confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and EPSS scores exploitation probability at just 0.04% (11th percentile), indicating low likelihood of opportunistic mass exploitation despite the easy attack path.

Unauthenticated manipulation of hidden input fields in Ads by WPQuads WordPress plugin (versions through 3.0.2) allows remote attackers to bypass input validation controls, producing low-severity integrity and availability impact. The root cause is CWE-1284 (Improper Validation of Specified Quantity in Input), enabling attackers to supply out-of-range or unexpected quantity values that the plugin fails to reject. EPSS is 0.06% (18th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA KEV, placing this firmly in lower-priority triage.

Input data manipulation in the Ads by WPQuads WordPress plugin (slug: quick-adsense-reloaded) versions up to and including 3.0.2 allows unauthenticated remote attackers to submit improperly validated input, resulting in low-impact integrity and availability degradation. Discovered and reported by Patchstack (audit@patchstack.com) and tracked under ENISA EUVD-2026-32183, this vulnerability carries a CVSS 6.5 base score. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at just 0.06% (18th percentile), indicating low real-world exploitation pressure currently.

Trust-store poisoning in Samba's certificate auto-enrollment lets an adjacent-network attacker install an attacker-controlled CA certificate when auto-enrollment is enabled. Because Samba retrieves the CA certificate over plaintext HTTP and adds it to the local trust store without verifying authenticity, a man-in-the-middle can have a rogue CA trusted system-wide, enabling interception or spoofing of otherwise trusted TLS communications. The issue carries CVSS 8.0 with high confidentiality and integrity impact and a changed scope; EPSS is 0.00% and no public exploit identified at time of analysis.

Arbitrary file read in the Xpro Elementor Addons - Pro WordPress plugin (versions ≤1.4.7) allows authenticated attackers with Contributor-level access to retrieve the contents of any file readable by the web server process, including credential-bearing files such as wp-config.php. The vulnerability originates in the Draw SVG widget, which passes user-controlled input to a server-side file read operation without adequate path restriction (CWE-73). No public exploit code has been identified at time of analysis, and CISA has not added this to the KEV catalog; however, successful exploitation fully compromises the confidentiality of server-side data.

Sensitive data exposure in the GenerateBlocks WordPress plugin (versions through 2.1.0) allows authenticated low-privilege users to retrieve embedded sensitive information via network requests. The vulnerability, classified under CWE-201, means the plugin inserts sensitive data into outbound responses where it can be intercepted or retrieved by parties with basic WordPress authentication. No public exploit code exists and CISA has not listed this in KEV, though the high confidentiality impact (CVSS C:H) indicates meaningful data leakage potential if exploited against unpatched installations.

Volume encryption in Synology Storage Manager before version 1.0.1-1100 transmits sensitive data via HTTP GET query strings, exposing encryption-related secrets to local attackers who can access web server logs, browser history, or other locally readable URL artifacts. The flaw (CWE-598) requires no privileges or user interaction beyond local system presence, and carries a High confidentiality impact rating because credentials or passphrases associated with volume encryption may be recoverable from logged GET requests. No public exploit exists and EPSS sits at the 1st percentile, indicating no widespread exploitation activity at time of analysis.

Synology Assistant before version 7.0.6-50085 exposes local users to arbitrary file write with restricted content via an origin validation error triggered during the installation process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) indicates that while integrity impact is limited, availability impact is rated High - meaning an attacker can corrupt or overwrite files in ways that destabilize the system, even though the written content is constrained. No public exploit code exists and CISA has not added this to KEV; EPSS stands at 0.00%, reflecting minimal observed exploitation interest.

Synology Active Backup for Business Agent before version 3.1.0-4967 contains an origin validation error (CWE-346) that permits local users to write arbitrary files with restricted content during the installation process, resulting in high availability impact and limited integrity compromise. The CVSS vector (AV:L/PR:N/UI:R) indicates exploitation requires local system access and user interaction - specifically, the installation must be in progress. No public exploit code has been identified and EPSS sits at 0.00%, aligning with SSVC's 'exploitation: none' assessment, indicating this is a low-urgency but legitimate local privilege abuse risk during deployment windows.

Credential disclosure in Synology C2 Identity Edge Server (DSM versions before 1.76.0-0307) allows remote unauthenticated attackers to retrieve user credentials directly from the edge server over the network. The flaw stems from an exposed dangerous method/function (CWE-749) reachable without authentication, yielding a high-confidentiality impact with no integrity or availability effect. No public exploit has been identified at time of analysis, and EPSS scores it at the bottom 7th percentile, indicating low near-term exploitation likelihood despite the network-reachable vector.

Arbitrary file write with restricted content in Synology ActiveProtect Agent before 1.1.0-0439 is exploitable by local users during the installation process due to an origin validation error (CWE-346). The CVSS vector (AV:L/AC:L/PR:N/UI:R) indicates a low-complexity local attack requiring user interaction - consistent with exploitation during an installation workflow - and scores high on availability impact (A:H) while integrity impact is limited (I:L), suggesting the file write can disrupt system stability despite content restrictions. No public exploit code exists and CISA SSVC rates exploitation as none with partial technical impact.

Insufficiently protected credentials vulnerability in IPSpeaker component in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with administrator. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

Improper preservation of permissions vulnerability in Archiving Push functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity.

Cleartext transmission of sensitive information vulnerability in Export Key functionality in Synology Surveillance Station before 9.2.2-11575 and 9.2.2-9575 allows remote authenticated users with. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity.

Files or directories accessible to external parties vulnerability in redis-server component in Synology BeeDrive for desktop before 1.3.2-13814 allows local users to conduct denial-of-service attacks. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity.

Local File Inclusion in the Query Shortcode plugin for WordPress (all versions through 0.2.1) lets authenticated users with contributor-level access or higher coerce the shortcode handler into including and executing arbitrary .php files already present on the server. Because included files are run by the PHP interpreter, this can leak sensitive data, bypass access controls, and escalate to full remote code execution where an attacker can also place a .php file (e.g. via an upload feature). EPSS rates near-term exploitation probability very low (0.07%, 21st percentile) and there is no public exploit identified at time of analysis.

Information disclosure in ZTE ZXUniPOS NDS-LTE (V24.40.40 and earlier, and V24.30.40CP02 and earlier) stems from an insecure cryptographic password scheme - such as hard-coded keys, weak encryption algorithms, or poor key management - that lets remote, unauthenticated attackers recover or tamper with protected data. The CVSS vector (AV:N/AC:H/PR:N) indicates network reachability without credentials but with high attack complexity, and the primary impact is confidentiality loss (C:H) with minor integrity and availability effects. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile).

Plaintext credential exposure in Hitachi Vantara Pentaho Data Integration & Analytics allows authenticated network users to retrieve Hadoop cluster credentials via the Cluster Test API response. Affected versions span the 8.3.x, 9.3.x, and 10.x lines up to 10.2.0.6, as well as all pre-11.0.0.0 builds in the 11.x line. The vendor acknowledges partial self-mitigation: because the Cluster Test API is only accessible to users who already hold sufficient privileges to submit Hadoop jobs via the backend API, the incremental credential exposure is constrained - though the plaintext disclosure still enables credential harvesting for lateral movement or offline use. No public exploit code exists and EPSS is negligible at time of analysis.

Missing ACL enforcement on Hitachi Vantara Pentaho Data Integration & Analytics API endpoints allows authenticated low-privileged users to interact with platform mail notification resources without authorization. Affected versions span the 8.3.x, 9.3.x, and pre-10.2.0.6/11.0.0.0 release lines. An attacker with a valid low-privilege account can read, modify, or disrupt mail notification configurations, resulting in limited confidentiality, integrity, and availability impact. No public exploit code exists and no active exploitation has been identified at time of analysis.

Denial of service in the Perl module IO::Uncompress::Unzip before version 2.220 allows remote attackers to cause CPU exhaustion by supplying a crafted ZIP archive that triggers a per-byte read loop in the fastForward() routine. No public exploit identified at time of analysis, and EPSS rates exploitation probability at 0.02%, but any application that accepts untrusted ZIP files and extracts a named entry through this module is exposed to availability impact.

Uncaught exception in IO::Uncompress::Unzip before version 2.215 for Perl causes application-level denial of service when parsing ZIP files containing malformed DOS date fields. The `_dosToUnixTime()` function calls `Time::Local::timelocal()` without an `eval` guard, so a ZIP header encoding an out-of-range month, day, or hour causes `timelocal()` to `die`, propagating the exception to the caller rather than returning `undef` with a populated `$UnzipError` as callers expect. Any Perl application that processes untrusted ZIP files locally is affected; no public exploit has been identified at time of analysis, and EPSS exploitation probability is negligible at 0.02%.

Weak password recovery in QianFox FoxCMS versions 1.2.0 through 1.2.6 exposes the admin panel's account recovery flow to abuse by authenticated administrators via a remotely accessible network vector. Publicly available exploit code exists (CVSS E:P), though the requirement for high privileges (PR:H) substantially constrains real-world impact, corroborated by an EPSS score of just 0.03% (11th percentile) and no CISA KEV listing. The vendor was notified via a GitHub issue report but has not responded, leaving all affected versions unpatched at time of analysis.

Proxy-Authorization header leakage in @hapi/wreck exposes forward-proxy credentials when redirect following is enabled and a 3xx response targets a different hostname. Prior to version 18.1.1, only Authorization and Cookie headers were stripped on cross-hostname redirects; the Proxy-Authorization header was forwarded intact to the redirect target, which may be an untrusted host outside the original trust boundary. No public exploit has been identified at time of analysis, but the impact is concrete credential exposure for any Node.js application using @hapi/wreck with redirect following explicitly enabled.

Path traversal in the tmp npm package (versions < 0.2.6) lets callers escape the intended temporary directory by passing traversal sequences or absolute paths in the prefix, postfix, or dir options to tmp.file(), tmp.dir(), or tmp.tmpName(). Applications that forward untrusted input into those options can be coerced into creating files at attacker-chosen filesystem locations with the process's privileges, enabling config poisoning, cache poisoning, or web-shell drops. Publicly available exploit code exists (the advisory ships a working PoC and a regression test), but no public exploit identified at time of analysis indicates active exploitation in the wild.

Prototype-chain property leakage in LiquidJS (npm/liquidjs <= 10.25.7) allows unauthenticated remote attackers to read prototype-chain properties of JavaScript objects passed to a {% render %} partial, even when the caller explicitly invoked parseAndRender() with { ownPropertyOnly: true } to lock down the render. The root cause is Context.spawn() failing to propagate the resolved per-render ownPropertyOnly value to child contexts, silently discarding a documented security override. A publicly available proof-of-concept exploit exists demonstrating that top-level {{ user.passwordHash }} is correctly blocked while the identical expression inside a {% render %} partial returns the sensitive value; no vendor-released patch is available at time of analysis.

Missing brute-force protection in Yamcs (Yet Another Mission Control System) before 5.12.7 lets unauthenticated remote attackers submit unlimited password-guessing requests to the POST /auth/token endpoint in yamcs-core, which enforces no rate limiting, account lockout, or throttling (CWE-307). Publicly available exploit code exists (Exploit-DB 52605), though EPSS estimates real-world exploitation probability at only 0.05% (17th percentile) and the flaw is not listed in CISA KEV. The upstream fix (5.12.7) introduces a per-IP request cap defaulting to 5 auth requests per second.

Privilege escalation and sensitive-data disclosure in Kirby CMS (versions before 4.9.1 and 5.4.1) let authenticated Panel users invoke arbitrary model methods through unvalidated collection-query parameters. By naming internal methods such as password(), root(), loginPasswordless() or delete() in filter/sort/findBy queries or the equivalent REST API search endpoints, a low-privilege Panel user can leak password hashes and server filesystem paths, take over other accounts, or mass-delete content. No public exploit identified at time of analysis and EPSS is low (0.07%), but the vendor rates real-world impact as high for any site exposing the Panel to untrusted users.

Remote code execution in FUXA SCADA/HMI server version 1.3.0 lets unauthenticated attackers run arbitrary OS commands when `secureEnabled` is true, by abusing the `POST /api/runscript` endpoint's test mode. The endpoint authorizes against a stored script's permission, but with `test:true` it compiles and runs attacker-supplied `code` instead, so a guest who knows any low-permission script's ID and name (leaked via the unauthenticated `GET /api/project` endpoint) achieves full RCE. A working PoC exists in the vendor advisory and the flaw is fixed in v1.3.1; EPSS is a moderate 0.59% (70th percentile), and there is no public exploit identified beyond the advisory PoC and no active exploitation confirmed.

Insecure PRNG fallback in Crypt::ScryptKDF for Perl (versions through 0.010) exposes applications to cryptographically weak random byte generation when none of five recognized CSPRNG modules are installed. The `random_bytes` function silently degrades to Perl's built-in `rand()`, which is not a cryptographically secure source, potentially weakening scrypt-derived salts or keys in password hashing and key derivation workflows. No public exploit is identified and EPSS is 0.02% (4th percentile), but the cryptographic impact in minimally-configured Perl environments could be severe, as predictable salts dramatically reduce the cost of offline attacks against derived key material.

Silent cryptographic key failure in Netty's OHTTP codec exposes HPKE response encryption to full key prediction. When HKDF_expand or EVP_HPKE_CTX_export fails internally, the library returns a zero-filled byte array rather than propagating the error, and that all-zero material is consumed directly by OHttpCrypto.createResponseAEAD() without any validation. Any OHTTP response encrypted under a failure-induced all-zero AEAD key is fully decryptable by any attacker who knows this behavior exists - the key is deterministic and universal. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Out-of-bounds read in Apple macOS (all versions prior to macOS Tahoe 26) allows a locally authenticated, low-privileged application to trigger unexpected system termination, constituting a local denial-of-service condition. The root cause is insufficient bounds checking in a macOS component, addressed by Apple in macOS Tahoe 26. No public exploit code exists and this vulnerability is not listed in CISA KEV, though a vendor-confirmed patch is available.

Incorrect permission assignment (CWE-732) in Apple macOS allows a locally-running app to modify protected parts of the file system without authorization. Affected are macOS Sonoma prior to 14.8, macOS Sequoia prior to 15.7, and macOS Tahoe prior to 26, covering three active macOS release trains simultaneously. The CVSS vector (AV:L/AC:L/PR:L/UI:N, I:H) confirms that a low-privileged local app can achieve high-integrity writes to restricted file system regions with no user interaction required; no public exploit has been identified at time of analysis.

Local privilege escalation in Apple macOS allows a malicious or compromised application to win a race condition (CWE-362) and elevate from a normal user context to root. The flaw affects macOS releases prior to Sequoia 15.7 and Tahoe 26, was reported by Apple itself, and is resolved by additional validation in the patched builds. No public exploit has been identified at time of analysis, and the CVSS 7.0 rating reflects high attack complexity tied to reliably hitting the timing window.

Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).

Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.

Denial of service in Vanetza (riebl) versions 26.02 and earlier lets remote unauthenticated attackers crash the V2X message-processing daemon by sending a crafted Secured Message whose signing certificate carries an out-of-range or invalid-CHOICE Psid value. The malformed certificate passes the permissive ASN.1 decode step but trips a semantic constraint check during OER re-encoding inside the signature-verification path, raising an exception that is never caught and forcing std::terminate. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but the network-reachable, no-authentication, low-complexity profile (CVSS 7.5) makes it a credible availability risk for any node that verifies untrusted V2X traffic.

Remote denial of service in Vanetza 26.02 and earlier lets unauthenticated attackers crash the C-ITS protocol stack by sending malformed network packets containing corrupted ASN.1/OER structures, such as invalid length fields or malformed certificate encodings. The ASN.1 wrapper (asn1c_wrapper.cpp) raises a std::runtime_error that is never caught at the parsing boundary, so it propagates to std::terminate and kills the process. No public exploit identified at time of analysis, and the CVE is not listed in CISA KEV; EPSS data was not provided.

Information exposure via verbose SQL error messages in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 enables authenticated remote attackers to harvest internal database details by manipulating the /index.php SQL Handler endpoint. The application returns raw SQL error output rather than sanitized application-level messages, leaking schema structure, table names, or query internals. A public proof-of-concept exploit is available on GitHub; this CVE is not listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the low-severity, confidentiality-only impact.

Improper access control in JeecgBoot versions up to 3.9.1 allows low-privileged authenticated remote users to interact with the /sys/comment/add endpoint beyond their assigned permission level, resulting in low-impact confidentiality, integrity, and availability effects. The CVSS 4.0 score of 2.1 reflects a narrow blast radius with no subsequent system compromise, but a publicly available proof-of-concept (E:P) elevates the likelihood of opportunistic exploitation on internet-facing deployments. No active exploitation has been confirmed by CISA KEV at time of analysis.