Information Disclosure
Monthly
Out-of-bounds read in ASR Kestrel's nr_fw power control module enables authenticated remote attackers to trigger buffer overflow conditions, potentially disclosing sensitive information and compromising system integrity with low-to-moderate impact across security boundaries. Exploitable over the network with low complexity by attackers holding low-privilege credentials. EPSS data unavailable; not currently listed in CISA KEV. Vendor advisory confirms patch released February 10, 2026.
Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.
SAML response redirection in Admidio 5.0.8 and earlier allows attackers to steal signed authentication assertions containing user credentials and profile data by exploiting missing validation of the AssertionConsumerServiceURL in SAML AuthnRequests. The Identity Provider (IdP) accepts attacker-controlled destination URLs from SAML requests without verifying them against registered Service Provider endpoints, enabling assertion theft and account impersonation across federated applications. No public exploit code identified at time of analysis, though proof-of-concept demonstration is included in the GitHub security advisory GHSA-p9w9-87c8-m235. EPSS data not available for this CVE.
Prototype pollution in n8n's XML node allows authenticated workflow editors to achieve remote code execution through global prototype manipulation. The vulnerability affects n8n workflow automation platform versions prior to 1.123.32, 2.17.4, and 2.18.1, enabling attackers with workflow creation privileges to inject malicious properties into JavaScript object prototypes that can be exploited by other nodes to execute arbitrary code. Vendor-released patches are available for all affected version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 10.0 score reflects the critical scope change and complete system compromise potential.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
Improper access control in SonicWall SonicOS lets an adjacent-network attacker reach certain management interface functions that should be restricted, exposing sensitive information (tagged Information Disclosure) with high confidentiality, integrity, and availability impact per CVSS 8.0. The flaw is vendor-reported by SonicWall PSIRT (SNWLID-2026-0004) and affects the firewall/appliance operating system across the 6.5.5.x, 7.0.x, 7.3.x, and 8.1.x branches. There is no public exploit identified at time of analysis, and EPSS is negligible (0.01%).
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verification routine that unconditionally returns success, so no signature or trust check is performed before staging and executing downloaded update payloads (CWE-494). Because Ollama on Windows applies updates silently and automatically, an attacker who can substitute the update executable can have arbitrary code installed and run without user awareness. No public exploit identified at time of analysis; EPSS is very low (0.01%) and CISA SSVC records exploitation as none, though technical impact is rated total.
Sensitive information disclosure in e-Sushrut (Hospital Management Information System / HMIS) lets an unauthenticated remote attacker read client-side JavaScript to harvest exposed sensitive data and hardcoded AES encryption keys, undermining the application's cryptographic protections. The flaw was reported by CERT-In and carries a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis. EPSS is very low (0.06%, 18th percentile) and CISA SSVC rates exploitation as 'none' with only partial technical impact, indicating no observed exploitation despite the high severity rating.
Sensitive information disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated attacker to access data belonging to other users by decoding and tampering with Base64-encoded parameters carried in request URLs. Because Base64 is a reversible encoding rather than a cryptographic control, a low-privileged logged-in user can enumerate or alter these object references (CWE-639) to reach records they are not authorized to view. This was reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Privilege escalation in Dell iDRAC10 (baseboard management controller firmware) versions 1.20.70.50 and 1.30.05.10 lets an already-authenticated low-privileged user exploit a race condition against insufficiently protected credentials to obtain elevated access to the server management controller. The flaw carries a CVSS 3.1 score of 7.1 with total confidentiality, integrity, and availability impact on the affected component. There is no public exploit identified at time of analysis and EPSS rates near-term exploitation at only 0.01%, but Dell has shipped a fix.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Sandbox escape in Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted HTML to the Feedback component, which insufficiently validates untrusted input. The flaw (CWE-20, Chromium severity High, CVSS 8.3 with a scope change) is a second-stage privilege boundary bypass rather than an initial-access bug. No public exploit is identified at time of analysis, and the EPSS score is very low (0.05%, 14th percentile), consistent with a vulnerability that requires a prior renderer compromise to reach.
Out-of-bounds read/write in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page corrupt GPU-process memory and potentially escape the browser sandbox, on all Chrome builds before 147.0.7727.138. Rated High by Chromium with CVSS 8.8; a vendor patch is available and no public exploit identified at time of analysis. EPSS is very low (0.01%) and SSVC records exploitation status 'none', so risk is currently theoretical despite the total technical impact.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.
Environment variable injection in OpenClaw's CLI backend runner enables local attackers to achieve arbitrary code execution or exfiltrate sensitive data by manipulating workspace configuration files. Attackers with the ability to supply malicious workspace configs can inject environment variables into backend processes during spawning, exploiting CWE-15 (external control of system or configuration setting). Vendor patch available via GitHub commit c2fb7f1. CVSS 8.5 reflects high impact across confidentiality, integrity, and availability, though exploitation requires local access and user interaction to load the malicious workspace config. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Execution approval bypass in OpenClaw before 2026.3.28 allows local authenticated users with standard privileges to establish overly broad executable allowlist entries through wrapper carrier exploitation. Attackers leverage positional routing in dispatch wrappers to trust carrier executables instead of their invoked targets, escalating from limited execution approval to arbitrary code execution with high confidentiality and integrity impact. Vendor-released patch version 2026.3.28 addresses the flaw (GHSA-p4x4-2r7f-wjxg). No evidence of active exploitation or public POC identified at time of analysis.
Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting malicious prompts that bypass sandbox access controls. The vulnerability affects the sandbox initialization component and enables information disclosure without requiring any authentication or user interaction (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Cross-scope impact (S:C) indicates the attack breaks out of the intended sandbox boundary to access host-level secrets. EPSS and KEV status not available; this appears to be a recently disclosed AI/LLM agent security issue.
Authentication bypass in NVIDIA NVFlare Dashboard allows remote unauthenticated attackers to escalate privileges through user-controlled key manipulation in the authentication system. The vulnerability affects the NVIDIA Flare SDK and enables complete system compromise including arbitrary code execution, data tampering, information disclosure, and denial of service. With a CVSS score of 9.8 (critical severity) and maximum exploitability metrics (AV:N/AC:L/PR:N/UI:N), this represents a severe security flaw requiring immediate remediation, though no active exploitation (KEV) or public exploit code has been identified at time of analysis.
HTTP request smuggling in Apache Pony Mail (Lua implementation) enables remote unauthenticated attackers to achieve complete admin account takeover with critical impact across confidentiality, integrity, and availability. This affects all versions of the retired Lua codebase - Apache has abandoned support with no patch planned, recommending migration to alternative solutions. CVSS 9.8 critical severity reflects trivial network-based exploitation requiring no authentication or user interaction.
Information disclosure in Mozilla Firefox, Firefox ESR 140, and Firefox ESR 115 allows remote unauthenticated attackers to extract sensitive data via incorrect boundary conditions in the Audio/Video component. The vulnerability permits network-based exploitation with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), enabling unauthorized access to high-confidentiality information. Mozilla released patches in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1 (confirmed by vendor advisories MFSA2026-35/36/37). SSVC indicates automatable exploitation with partial technical impact, though no public exploit or active exploitation is identified at time of analysis.
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Milesight AIOT cameras ship with hardcoded SSL private keys enabling remote man-in-the-middle attacks and credential interception. Remote unauthenticated attackers can decrypt TLS traffic, impersonate camera services, and potentially gain administrative access to affected devices. CISA ICS-CERT published advisory ICSA-26-113-03 for this industrial/IoT vulnerability affecting network-connected surveillance infrastructure.
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigger denial of service and disclose limited memory contents via malformed skip() operations during protocol deserialization. Affects all versions prior to 0.23.0, with publicly disclosed exploit details on oss-security mailing list. EPSS exploitation probability remains low (5th percentile) despite network-accessible attack vector, suggesting limited real-world targeting to date. Vendor patch released in version 0.23.0 addresses all six concurrently disclosed Thrift vulnerabilities (CVE-2026-41602 through CVE-2026-41607).
Environment variable injection in OpenClaw (pre-2026.3.31) allows authenticated remote attackers to compromise host execution integrity by injecting malicious variables that override package managers, Docker registries, compiler paths, and TLS configurations during host exec operations. The vulnerability exhibits high confidentiality impact (CVSS:4.0 VC:H) with network attack vector and low complexity (AV:N/AC:L), requiring only low-privilege authentication (PR:L). VulnCheck disclosure indicates this affects Docker-related operations, with fixes available via GitHub commit eb8de67 and tracked under GHSA-cg7q-fg22-4g98. EPSS and KEV data not available at time of analysis.
Environment variable disclosure in OpenClaw jq safe-bin policy allows authenticated remote attackers to extract sensitive credentials and configuration data. The vulnerability stems from incomplete filter blocking in jq program execution - specifically, the $ENV filter can bypass safe-bin restrictions to read process environment variables. Versions prior to 2026.3.28 are affected. No CISA KEV listing or public POC identified at time of analysis, but disclosure by VulnCheck indicates vendor-confirmed issue with available patch.
Remote authenticated attackers can overwrite arbitrary files on OpenClaw servers by uploading malicious tar archives containing symbolic links to the SSH sandbox feature. The vulnerability allows escaping sandbox restrictions to modify critical system files, enabling potential remote code execution or denial of service. Affects OpenClaw versions before 2026.3.31. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE.
Predictable secret generation in Spring Boot's random value property source allows remote, unauthenticated attackers to obtain potentially sensitive values. Affected versions include Spring Boot 4.0.0 to 4.0.5, 3.5.x, 3.4.x, 3.3.x, and 2.7.x before the respective patch releases. The vulnerability has a CVSS score of 7.5 (High) but no active exploitation has been confirmed, and EPSS suggests a very low likelihood of exploitation.
Spring Boot's Cassandra auto-configuration fails to verify hostnames during SSL/TLS connection establishment to Cassandra servers, enabling man-in-the-middle attackers on the local network to intercept credentials and data by presenting a valid certificate for any domain. Affects Spring Boot 2.7.0-4.0.5; vendor-released patches available for all supported versions (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33). No public exploit code identified at time of analysis.
Local privilege escalation and session hijacking in Spring Boot allows attackers with local access to hijack authenticated sessions or execute arbitrary code by taking control of the ApplicationTemp directory. The vulnerability affects Spring Boot versions 2.7.0 through 4.0.5 when server.servlet.session.persistent is enabled, requiring attack persistence across application restarts. VMware has released patches for all supported branches (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33), though unsupported versions remain vulnerable. No active exploitation confirmed at time of analysis.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' records - including password hashes and API keys - by directly calling the objectDetail.php endpoint, which fails to enforce ownership or role checks (CWE-862). Because the exposed administrator credentials enable privilege escalation, the flaw effectively promotes a low-privilege account to full control. Publicly available exploit code exists, though EPSS is low (0.06%, 18th percentile) and it is not on CISA KEV, indicating no public exploit identified as actively used in the wild.
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the username field, because the login variable is concatenated directly into a query without parameterization. Affecting versions 7.0 through 12.4.3, it can be leveraged to create privileged accounts, exfiltrate database contents, and - where the DB account has elevated OS privileges - achieve operating-system command execution. Publicly available exploit code exists (VulnCheck advisory and multiple PoCs), though EPSS remains low at 0.09% and it is not listed in CISA KEV.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.
Sensitive data exposure in Templately WordPress plugin ≤3.6.1 allows authenticated attackers to retrieve embedded sensitive information via network requests. The vulnerability exhibits scope change (S:C) indicating potential cross-boundary impact, with high confidentiality impact but no integrity or availability effects. CVSS 7.7 severity driven by network accessibility and low attack complexity. No CISA KEV listing indicates no confirmed widespread exploitation. Reported by Patchstack's audit team with reference to their vulnerability database entry.
Credential disclosure in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to intercept administrator passwords via broadcast UDP traffic containing symmetric encryption keys. When administrators issue privileged commands to GeoVision IP devices, the utility broadcasts credentials encrypted with a Blowfish-derived algorithm but includes the decryption key in the same packet, enabling passive network eavesdropping to extract full device credentials. CVSS 9.3 (Critical) with scope change reflects the pivot risk from utility compromise to full device control, including IP reconfiguration and factory resets.
DNS traffic amplification via cyclic nameserver delegation in Technitium DNS Server versions before 15.0 enables unauthenticated remote attackers to conduct distributed denial-of-service (DDoS) attacks. Attackers can exploit misconfigured or maliciously crafted DNS delegation chains to create resolution loops, forcing the server to generate significantly larger response traffic than the initial query size. This amplification can be weaponized against third-party victims, with the vulnerable server acting as an unwitting participant in reflection attacks. CVSS 7.2 (High) reflects network-accessible exploitation requiring no authentication, with cross-scope impact affecting availability and integrity of downstream systems.
WireGuard private keys leak through Cilium debugging tools in deployments using transparent encryption. Cilium's cilium-bugtool and cilium sysdump command expose the node-to-node WireGuard encryption private key (cilium_wg0.key) in output archives. Attackers with high-privilege local access to these diagnostic outputs can decrypt past and future inter-node traffic. Affects all Cilium versions prior to v1.17.15, v1.18.0-v1.18.8, and v1.19.0-v1.19.2. Patches released in v1.17.15, v1.18.9, and v1.19.3. No public exploit identified at time of analysis, but exploitation requires only access to previously shared bugtool/sysdump archives.
Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).
Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).
Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.
Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).
Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.
Out-of-bounds kernel memory access in the Linux kernel's network emulation scheduler (sch_netem) allows a local, privileged user to corrupt kernel memory and likely panic the system. When a netem qdisc has packet corruption enabled and an AF_PACKET TX_RING transmits fully non-linear packets over an IPIP tunnel, skb_headlen(skb) is 0, causing get_random_u32_below(0) to return an unconstrained 32-bit offset that indexes past the linear skb->data area. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not on CISA KEV; it is a locally-triggerable memory-safety bug rather than a remotely exploitable one.
Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).
Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Remote attackers can crash BACnet Stack-powered embedded devices (versions prior to 1.4.3) by sending malformed ReadPropertyMultiple (RPM) requests containing a 1-byte property payload with an extended tag marker (0xF9). The vulnerability triggers an out-of-bounds read in the RPM service decoder, causing denial-of-service on industrial building automation systems that use this open-source C library. Affects default configurations where ReadPropertyMultiple service is enabled. EPSS data and KEV status not available; no public exploit confirmed at time of analysis, though GitHub security advisory provides technical details that could facilitate reproduction.
Remote denial of service in BACnet Stack library versions before 1.4.3 allows unauthenticated attackers to crash embedded building automation devices by sending a malformed ReadPropertyMultiple request with a truncated object identifier. The off-by-one buffer read vulnerability triggers crashes on resource-constrained BACnet devices running the default-enabled RPM service handler. CVSS v4.0 scores this 8.7 (High) based on network attack vector and high availability impact, though no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in BACnet Stack library versions before 1.4.3 allows unauthenticated remote attackers to crash embedded BACnet devices or disclose memory contents by sending malformed WritePropertyMultiple (WPM) service requests over BACnet/IP. The flaw affects building automation and industrial control systems using the vulnerable C library. No public exploit identified at time of analysis, though the CVSS v4.0 score of 8.7 reflects high availability impact and network-accessible attack surface with low complexity.
Arbitrary file write in Kata Containers v3.4.0 to v3.28.0 allows untrusted hosts to overwrite binaries and exfiltrate data from guest workloads, including those in confidential VMs (CVMs). The vulnerability stems from inadequate validation in the CopyFile policy, permitting host-initiated writes to arbitrary paths inside guest images. This enables binary replacement for code execution or data theft across the trust boundary. Patched in v3.29.0. EPSS data not available; no active exploitation confirmed at time of analysis.
Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to corrupt memory and potentially disclose sensitive information through out-of-range writes when applications use v3, v5, or v6 UUID generation functions with caller-provided output buffers. The library fails to validate buffer boundaries, allowing partial writes beyond allocated memory regions. Vendor patch available in version 14.0.0 per GitHub security advisory GHSA-w5hq-g745-h8pq. No confirmed active exploitation (not in CISA KEV), and CVSS 4.0 Environmental Score suggests exploitation status is unproven (E:U).
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification of all JSON responses or complete HTTP transport hijacking when the JavaScript Object.prototype has been polluted by a co-dependency. This vulnerability requires a separate prototype pollution source within the same Node.js process but requires no authentication once that precondition exists. An attacker can then access credentials, headers, and request bodies across the application. EPSS data not available; no public exploit identified at time of analysis.
Unauthenticated attackers can steal admin tokens from Dgraph Alpha v25.3.2 and earlier via the exposed /debug/vars endpoint, enabling complete authentication bypass to administrative functions. The vulnerability exists because Dgraph incompletely fixed a previous cmdline exposure issue-blocking only /debug/pprof/cmdline while still serving Go's expvar handler at /debug/vars, which publishes the full command-line arguments including --security token= flags. Attackers can retrieve the token remotely without authentication (CVSS AV:N/PR:N) and replay it in X-Dgraph-AuthToken headers to access admin-only endpoints. Vendor patch released in v25.3.3 per GitHub advisory GHSA-vvf7-6rmr-m29q. No public exploit identified at time of analysis, but detailed proof-of-concept steps are published in the advisory.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Remote code execution in BridgeHead FileStore pre-24A via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. The vulnerability exploits exposed Axis2 admin console with unchanged default credentials, enabling full system compromise over the network with no authentication required. Publicly available exploit code exists (GitHub Gist), and CVSS 9.8 reflects critical risk with network vector, low complexity, and no privileges required. EPSS data not provided but exploitation prerequisites are minimal given default credential exposure.
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Improper lock ordering in the Linux kernel's uinput driver interacting with the force-feedback (ff-core) subsystem creates a circular locking dependency (ff->mutex → udev->mutex → input_mutex → dev->mutex → ff->mutex) that lockdep flags and that can deadlock kernel threads. It is reproducibly triggered by a local user exercising a force-feedback device through uinput - for example a Flydigi Vader 5 gamepad under Wine/Proton - and is fixed by replacing a mutex acquisition in uinput_request_send() with a leaf spinlock. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not on CISA KEV; despite the 7.8 CVSS this is a reliability/locking correctness fix rather than a memory-corruption bug.
Local privilege-level extent tree corruption in the Linux kernel's Btrfs filesystem (versions 6.10 through the 6.18/6.19/7.0 development lines) arises because lookup_extent_data_ref() returns 0 (success) instead of -ENOENT after crossing to a new leaf whose first key does not match, causing callers to operate on the wrong extent tree item. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%), indicating negligible likelihood of opportunistic exploitation; this is a reliability/data-integrity defect rather than a remotely reachable RCE. CVSS 7.8 (AV:L/PR:L) reflects local access requirements, not network exposure.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.
Denial of service in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a duplicate or stale GRP_ACK_MSG to underflow the u16 bc_ackers counter to 65535, permanently wedging group broadcast on the affected socket until the TIPC group is torn down and recreated. The flaw affects the tipc_group_proto_rcv() handler across a wide range of kernel branches (4.15 through the 7.0 series). It is a pure availability issue (CVSS A:H, C:N/I:N); there is no public exploit identified at time of analysis and EPSS probability is negligible (0.02%).
Heap out-of-bounds write in the Linux kernel's batman-adv mesh routing subsystem lets a remote mesh originator corrupt kernel memory by advertising an oversized global translation table (TT). In batadv_tt_prepare_tvlv_global_data(), the allocation length is computed in 16-bit temporaries, so a large TT payload plus the VLAN header offset wraps past 65535 before kmalloc(), producing an undersized buffer that the full-table response path then overruns using the original (unwrapped) length. It is fixed across multiple stable kernel branches; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Local privilege escalation in the Linux kernel's i915 graphics driver allows authenticated users to trigger a use-after-free condition via a race between the heartbeat worker and intel_engine_park_heartbeat() function when releasing engine heartbeat requests. The vulnerability stems from a non-atomic pointer read-and-clear operation that permits double-free of the same request object, causing refcount underflow and potential arbitrary code execution with elevated privileges. Patches are available across multiple stable kernel branches (5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Heap buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via crafted RxGK tokens. Exploitable through unprivileged add_key() system call when raw key/ticket lengths >= 0xfffffffd cause integer wraparound in round_up(), bypassing bounds checks while memcpy() copies up to 4 GiB into zero-sized heap allocation. Vendor patches available for stable branches 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite local privilege escalation potential with CVSS 7.8.
Linux kernel rxrpc subsystem allows remote denial of service via malformed RESP challenge packets due to incorrect serial number comparison logic. The rxrpc_post_response() function compares challenge serial numbers from the wrong packet structure, causing response queue corruption that can crash the kernel networking stack. This affects Linux kernel versions containing commit 5800b1cf3fd8 through the 6.16-6.19 and 7.0 series. Patches are available from kernel.org for affected stable branches. EPSS exploitation probability is very low (0.02%, 4th percentile) and no public exploits or active exploitation have been identified, suggesting limited real-world risk despite the network-accessible attack vector.
Unauthenticated remote attackers can exploit a cryptographic validation bypass in the Linux kernel's RxRPC rxkad authentication handler to potentially execute arbitrary code or cause denial of service. The rxkad_decrypt_ticket() function fails to verify that RXKAD response ticket decryption succeeded before parsing the buffer contents, allowing malformed RESPONSE packets with non-block-aligned ticket lengths to drive the ticket parser with attacker-controlled ciphertext bytes. Despite the critical 9.8 CVSS score indicating network-exploitable attack with high impact across confidentiality, integrity, and availability, EPSS exploitation probability is low (0.02%, 5th percentile) and no active exploitation or public POC has been identified. Patches are available across multiple stable kernel versions (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Out-of-bounds read in Linux kernel's rxrpc rxgk authentication handler allows remote unauthenticated attackers to trigger information disclosure and denial of service via malformed RESPONSE authenticator packets. The vulnerability stems from incorrect pointer arithmetic in rxgk_verify_authenticator() that inflates the parser boundary check by a factor of four, allowing reads beyond kmalloc() buffer boundaries. Vendor patches available for kernel versions 6.18.23, 6.19.13, and 7.0. EPSS score of 0.02% (4th percentile) suggests low observed exploitation probability despite network attack vector, though KASAN reports confirm reproducibility.
Remote denial of service in Linux kernel rxrpc subsystem allows unauthenticated network attackers to trigger kernel crash via malformed rxgk RESPONSE packets. An inverted length check in rxgk_verify_response() accepts oversized authenticators, causing skb_to_sgvec() to hit BUG_ON() and panic the kernel. EPSS exploitation probability is very low (0.02%, 4th percentile), no active exploitation confirmed, and patches are available across stable kernel branches 6.18.23, 6.19.13, and 7.0.
Buffer overflow in Linux kernel's AF_RXRPC procfs address formatting allows local authenticated users to corrupt memory and potentially escalate privileges. The vulnerability affects rxrpc proc handlers that write IPv6 socket addresses into 50-byte stack buffers, but ISATAP-format IPv6 addresses with ports can require 51 bytes, causing single-byte overflow. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.23, 6.19.13, and mainline 7.0. No active exploitation confirmed (not in CISA KEV), and CVSS 7.8 reflects local-only attack vector requiring authenticated access.
Use-after-free in Linux kernel NFC LLCP implementation allows adjacent-network attackers to execute arbitrary code with kernel privileges. The flaw occurs when socket state is LLCP_CLOSED in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), where missing return statements cause double release_sock() and refcount underflow, leading to memory corruption. Vendor-released patches available for stable kernels 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC confirmed at time of analysis.
Buffer overflow in Linux kernel's s3c24xx I2C driver allows local authenticated attackers to achieve arbitrary code execution with high privileges through malformed SMBUS block read messages. The driver fails to validate message length against I2C_SMBUS_BLOCK_MAX before processing, enabling out-of-bounds memory access. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low observed exploitation activity, with no CISA KEV listing indicating targeted rather than widespread attacks. Attack requires local access and low-level user privileges (CVSS AV:L/PR:L), limiting practical exploitability compared to the high CVSS 7.8 base score.
Uninitialized memory read in Linux kernel's rtl8723bs Wi-Fi driver allows adjacent network attackers to cause denial of service or potentially corrupt integrity through malformed BIP (Broadcast/Multicast Integrity Protocol) frames. The vulnerability affects the staging rtl8723bs driver where only 6 bytes are copied into an 8-byte variable during BIP verification, leaving 2 bytes uninitialized. Patches available across multiple stable kernel versions (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. Not listed in CISA KEV, and no public exploit identified at time of analysis.
Out-of-bounds kernel heap read in the Linux kernel's CIFS/SMB client (check_wsl_eas() extended-attribute parser) lets a malicious or compromised SMB server leak up to 8 bytes of adjacent kernel heap into the WSL xattr name comparison, influencing which WSL extended attribute the returned data is interpreted as. The root cause is an off-by-8 bounds check (CWE-125) that measures the EA end from the struct base instead of ea->ea_data, so the trailing name and value bytes of the last EA are read past the end of the response iov. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%), and it is not on CISA KEV; patched kernels are already available.
Out-of-bounds heap read in Linux kernel SMB client allows malicious SMB servers to leak kernel memory to userspace via crafted symlink error responses. When processing STATUS_STOPPED_ON_SYMLINK errors in SMB 3.1.1, inadequate bounds checking in smb2_check_message() and symlink_data() allows server-controlled ErrorDataLength values to trigger reads beyond buffer boundaries. The leaked heap bytes are UTF-16-decoded into the symlink target and exposed through readlink(2) syscalls (confidentiality impact), with potential for denial-of-service through memory corruption (availability impact). CVSS 8.1 (High) requires user interaction. EPSS score is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity. Patches available in kernel versions 6.18.24, 6.19.14, and 7.0.1.
Information disclosure in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to leak uninitialized heap memory via malformed SMB2 requests. The vulnerability exists in smb2_get_ea() which fails to validate EaNameLength from client requests before using it in strncmp(), enabling heap content extraction. With EPSS score of 0.02% and no KEV listing, exploitation likelihood remains low despite CVSS 7.5 rating. Patches available across kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Out-of-bounds read in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to manipulate file permissions by crafting malicious ACE SIDs with insufficient sub-authorities, triggering parse_dacl() to read 4 bytes past the ACL buffer boundary and apply those arbitrary bytes as POSIX file mode bits. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Double-free memory corruption in the Linux kernel SMB client (smbd) allows remote unauthenticated attackers to achieve arbitrary code execution, confidentiality breach, and denial of service. The vulnerability occurs when smbd_free_send_io() is erroneously called twice after smbd_send_batch_flush() operations, creating use-after-free conditions. Exploitation probability is low (EPSS 0.02%, 4th percentile) with no confirmed active exploitation or public POC, but the critical CVSS 9.8 score reflects the severe potential impact if network-accessible SMB client operations are triggered. Vendor patches available for kernel versions 6.18.24, 6.19.14, and 7.0.1.
A double-free vulnerability in the Linux kernel's SMB Direct (RDMA transport) server implementation allows remote unauthenticated attackers to trigger memory corruption with high CVSS 9.8 severity. The flaw occurs when smb_direct_free_sendmsg() is called twice on the same memory region after smb_direct_flush_send_list() moves messages to a batch list. Vendor patches available across kernel versions 6.18.24, 6.19.14, and 7.0.1, with upstream commits confirmed in stable branches. Despite critical CVSS scoring, EPSS probability remains very low at 0.02% (4th percentile) and no active exploitation or public POC identified, suggesting limited real-world targeting of this SMB Direct RDMA feature.
Memory access violation in Linux kernel ALSA ctxfi driver allows local authenticated users to trigger kernel page faults and potential privilege escalation. The flaw affects CT20K2 audio hardware drivers (snd_ctxfi module) where virtual memory mapping logic incorrectly accesses beyond allocated page table pages when aggregate memory allocations exceed 2MB on AMD64 systems. EPSS exploitation probability is very low (0.02%, 5th percentile) and no public exploit or active exploitation is confirmed. Vendor-released patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Kernel deadlock in Linux OCFS2 filesystem allows remote denial of service through lock ordering violation between unlink and direct I/O operations. OCFS2's orphan directory locking in ocfs2_unlink and ocfs2_dio_end_io_write acquire ip_alloc_sem and inode_lock in opposite orders (ABBA pattern), enabling concurrent operations to deadlock the system. Affects mainline Linux kernel through 6.19.14 with patches available in 6.12.83, 6.18.24, 7.0.1, and 6.19.14. EPSS score of 0.02% suggests minimal real-world exploitation likelihood despite CVSS 7.5 score, and no active exploitation or public POC identified.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.
Out-of-bounds read in ASR Kestrel's nr_fw power control module enables authenticated remote attackers to trigger buffer overflow conditions, potentially disclosing sensitive information and compromising system integrity with low-to-moderate impact across security boundaries. Exploitable over the network with low complexity by attackers holding low-privilege credentials. EPSS data unavailable; not currently listed in CISA KEV. Vendor advisory confirms patch released February 10, 2026.
Plack::Middleware::XSendfile through version 1.0053 allows remote unauthenticated attackers to read arbitrary files from nginx-proxied servers by injecting malicious X-Sendfile-Type and X-Accel-Mapping headers. When the middleware's sendfile type is not explicitly configured, clients can force nginx's X-Accel-Redirect mode and manipulate path mappings to access sensitive files outside intended directories. The middleware has been deprecated as of version 1.0053 and will be removed in future Plack releases. EPSS score of 0.01% suggests low current exploitation activity despite the high CVSS 9.1 rating. No public exploit code identified at time of analysis, though the attack technique mirrors the documented CVE-2025-61780 vulnerability in Rack::Sendfile.
SAML response redirection in Admidio 5.0.8 and earlier allows attackers to steal signed authentication assertions containing user credentials and profile data by exploiting missing validation of the AssertionConsumerServiceURL in SAML AuthnRequests. The Identity Provider (IdP) accepts attacker-controlled destination URLs from SAML requests without verifying them against registered Service Provider endpoints, enabling assertion theft and account impersonation across federated applications. No public exploit code identified at time of analysis, though proof-of-concept demonstration is included in the GitHub security advisory GHSA-p9w9-87c8-m235. EPSS data not available for this CVE.
Prototype pollution in n8n's XML node allows authenticated workflow editors to achieve remote code execution through global prototype manipulation. The vulnerability affects n8n workflow automation platform versions prior to 1.123.32, 2.17.4, and 2.18.1, enabling attackers with workflow creation privileges to inject malicious properties into JavaScript object prototypes that can be exploited by other nodes to execute arbitrary code. Vendor-released patches are available for all affected version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS 10.0 score reflects the critical scope change and complete system compromise potential.
Denial of service in MongoDB Server (v7.0 before 7.0.32, v8.0 before 8.0.21, and all v8.1/v8.2 releases up to 8.2.7) allows an authenticated client to crash the server by triggering MD5 checksum computation over a specially malformed BSON object, exhausting availability. The flaw stems from an integer-handling error (CWE-191) surfaced during checksum processing; a vendor patch is available. Currently no public exploit is identified, EPSS is very low (0.04%), and CISA SSVC rates exploitation as none.
Improper access control in SonicWall SonicOS lets an adjacent-network attacker reach certain management interface functions that should be restricted, exposing sensitive information (tagged Information Disclosure) with high confidentiality, integrity, and availability impact per CVSS 8.0. The flaw is vendor-reported by SonicWall PSIRT (SNWLID-2026-0004) and affects the firewall/appliance operating system across the 6.5.5.x, 7.0.x, 7.3.x, and 8.1.x branches. There is no public exploit identified at time of analysis, and EPSS is negligible (0.01%).
Local file tampering via symlink following in Pardus About (the 'About this system' utility of the TÜBİTAK BİLGEM Pardus Linux distribution) before v1.2.1 lets an attacker abuse improper link resolution (CWE-59) so that a privileged file operation is redirected to an attacker-chosen path. Reported by TR-CERT with SSVC technical impact rated 'total' and CVSS 8.8, though there is no public exploit identified at time of analysis and EPSS is very low (0.05%, 14th percentile). Note a signal conflict: the published vector is network (AV:N) yet a symlink attack in a local desktop utility strongly implies local access, which should be verified with the vendor.
Silent auto-update code execution in Ollama for Windows (versions 0.12.10 through 0.17.5) stems from an update-verification routine that unconditionally returns success, so no signature or trust check is performed before staging and executing downloaded update payloads (CWE-494). Because Ollama on Windows applies updates silently and automatically, an attacker who can substitute the update executable can have arbitrary code installed and run without user awareness. No public exploit identified at time of analysis; EPSS is very low (0.01%) and CISA SSVC records exploitation as none, though technical impact is rated total.
Sensitive information disclosure in e-Sushrut (Hospital Management Information System / HMIS) lets an unauthenticated remote attacker read client-side JavaScript to harvest exposed sensitive data and hardcoded AES encryption keys, undermining the application's cryptographic protections. The flaw was reported by CERT-In and carries a CVSS 4.0 score of 8.7 (High); no public exploit identified at time of analysis. EPSS is very low (0.06%, 18th percentile) and CISA SSVC rates exploitation as 'none' with only partial technical impact, indicating no observed exploitation despite the high severity rating.
Sensitive information disclosure in C-DAC's e-Sushrut Hospital Management Information System (HMIS) allows an authenticated attacker to access data belonging to other users by decoding and tampering with Base64-encoded parameters carried in request URLs. Because Base64 is a reversible encoding rather than a cryptographic control, a low-privileged logged-in user can enumerate or alter these object references (CWE-639) to reach records they are not authorized to view. This was reported by CERT-In (CIVN-2026-0207); there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Privilege escalation in Dell iDRAC10 (baseboard management controller firmware) versions 1.20.70.50 and 1.30.05.10 lets an already-authenticated low-privileged user exploit a race condition against insufficiently protected credentials to obtain elevated access to the server management controller. The flaw carries a CVSS 3.1 score of 7.1 with total confidentiality, integrity, and availability impact on the affected component. There is no public exploit identified at time of analysis and EPSS rates near-term exploitation at only 0.01%, but Dell has shipped a fix.
HTTP request smuggling in Starman, the preforking Perl PSGI/Plack web server, affects all releases before 0.4018 due to incorrect header precedence (CWE-444): when a request carries both Content-Length and Transfer-Encoding: chunked, Starman honors Content-Length instead of chunked encoding, violating RFC 7230 §3.3.3. When Starman sits behind a front-end reverse proxy that resolves the ambiguity differently, an attacker can desynchronize the two parsers to smuggle requests, poison the request queue, and capture or manipulate other users' traffic. There is no public exploit identified at time of analysis, EPSS is very low (0.02%), and CISA SSVC records exploitation status as none, but a vendor patch is available in version 0.4018.
Sandbox escape in Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted HTML to the Feedback component, which insufficiently validates untrusted input. The flaw (CWE-20, Chromium severity High, CVSS 8.3 with a scope change) is a second-stage privilege boundary bypass rather than an initial-access bug. No public exploit is identified at time of analysis, and the EPSS score is very low (0.05%, 14th percentile), consistent with a vulnerability that requires a prior renderer compromise to reach.
Out-of-bounds read/write in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page corrupt GPU-process memory and potentially escape the browser sandbox, on all Chrome builds before 147.0.7727.138. Rated High by Chromium with CVSS 8.8; a vendor patch is available and no public exploit identified at time of analysis. EPSS is very low (0.01%) and SSVC records exploitation status 'none', so risk is currently theoretical despite the total technical impact.
Missing integrity verification in OpenClaw before 2026.4.8 (npm package 'openclaw', tracked by the vendor as B-M3) lets attackers deliver tampered or malicious ClawHub plugin archives that install without any archive- or per-file integrity check, compromising the local assistant environment. The flaw was reported by VulnCheck and Tencent Zhuque Lab and is fixed in 2026.4.8; there is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 4th percentile). Because OpenClaw is a user-controlled local assistant, exploitation requires the victim to install a plugin whose download an attacker can substitute or tamper with.
OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.
Environment variable injection in OpenClaw's CLI backend runner enables local attackers to achieve arbitrary code execution or exfiltrate sensitive data by manipulating workspace configuration files. Attackers with the ability to supply malicious workspace configs can inject environment variables into backend processes during spawning, exploiting CWE-15 (external control of system or configuration setting). Vendor patch available via GitHub commit c2fb7f1. CVSS 8.5 reflects high impact across confidentiality, integrity, and availability, though exploitation requires local access and user interaction to load the malicious workspace config. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Execution approval bypass in OpenClaw before 2026.3.28 allows local authenticated users with standard privileges to establish overly broad executable allowlist entries through wrapper carrier exploitation. Attackers leverage positional routing in dispatch wrappers to trust carrier executables instead of their invoked targets, escalating from limited execution approval to arbitrary code execution with high confidentiality and integrity impact. Vendor-released patch version 2026.3.28 addresses the flaw (GHSA-p4x4-2r7f-wjxg). No evidence of active exploitation or public POC identified at time of analysis.
Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting malicious prompts that bypass sandbox access controls. The vulnerability affects the sandbox initialization component and enables information disclosure without requiring any authentication or user interaction (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Cross-scope impact (S:C) indicates the attack breaks out of the intended sandbox boundary to access host-level secrets. EPSS and KEV status not available; this appears to be a recently disclosed AI/LLM agent security issue.
Authentication bypass in NVIDIA NVFlare Dashboard allows remote unauthenticated attackers to escalate privileges through user-controlled key manipulation in the authentication system. The vulnerability affects the NVIDIA Flare SDK and enables complete system compromise including arbitrary code execution, data tampering, information disclosure, and denial of service. With a CVSS score of 9.8 (critical severity) and maximum exploitability metrics (AV:N/AC:L/PR:N/UI:N), this represents a severe security flaw requiring immediate remediation, though no active exploitation (KEV) or public exploit code has been identified at time of analysis.
HTTP request smuggling in Apache Pony Mail (Lua implementation) enables remote unauthenticated attackers to achieve complete admin account takeover with critical impact across confidentiality, integrity, and availability. This affects all versions of the retired Lua codebase - Apache has abandoned support with no patch planned, recommending migration to alternative solutions. CVSS 9.8 critical severity reflects trivial network-based exploitation requiring no authentication or user interaction.
Information disclosure in Mozilla Firefox, Firefox ESR 140, and Firefox ESR 115 allows remote unauthenticated attackers to extract sensitive data via incorrect boundary conditions in the Audio/Video component. The vulnerability permits network-based exploitation with low complexity and no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N), enabling unauthorized access to high-confidentiality information. Mozilla released patches in Firefox 150.0.1, Firefox ESR 140.10.1, and Firefox ESR 115.35.1 (confirmed by vendor advisories MFSA2026-35/36/37). SSVC indicates automatable exploitation with partial technical impact, though no public exploit or active exploitation is identified at time of analysis.
Command injection via ipmitool in OpenStack Ironic through 25.0.0 allows authenticated operators with high privileges to trigger ipmitool execution when a console interface is configured in a non-default deployment, leading to high impact on confidentiality, integrity, and availability of the bare-metal provisioning node. No public exploit identified at time of analysis, EPSS is very low (0.07%, 20th percentile), and SSVC indicates no observed exploitation, consistent with a niche operator-level flaw rather than mass-scanning risk.
Milesight AIOT cameras ship with hardcoded SSL private keys enabling remote man-in-the-middle attacks and credential interception. Remote unauthenticated attackers can decrypt TLS traffic, impersonate camera services, and potentially gain administrative access to affected devices. CISA ICS-CERT published advisory ICSA-26-113-03 for this industrial/IoT vulnerability affecting network-connected surveillance infrastructure.
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigger denial of service and disclose limited memory contents via malformed skip() operations during protocol deserialization. Affects all versions prior to 0.23.0, with publicly disclosed exploit details on oss-security mailing list. EPSS exploitation probability remains low (5th percentile) despite network-accessible attack vector, suggesting limited real-world targeting to date. Vendor patch released in version 0.23.0 addresses all six concurrently disclosed Thrift vulnerabilities (CVE-2026-41602 through CVE-2026-41607).
Environment variable injection in OpenClaw (pre-2026.3.31) allows authenticated remote attackers to compromise host execution integrity by injecting malicious variables that override package managers, Docker registries, compiler paths, and TLS configurations during host exec operations. The vulnerability exhibits high confidentiality impact (CVSS:4.0 VC:H) with network attack vector and low complexity (AV:N/AC:L), requiring only low-privilege authentication (PR:L). VulnCheck disclosure indicates this affects Docker-related operations, with fixes available via GitHub commit eb8de67 and tracked under GHSA-cg7q-fg22-4g98. EPSS and KEV data not available at time of analysis.
Environment variable disclosure in OpenClaw jq safe-bin policy allows authenticated remote attackers to extract sensitive credentials and configuration data. The vulnerability stems from incomplete filter blocking in jq program execution - specifically, the $ENV filter can bypass safe-bin restrictions to read process environment variables. Versions prior to 2026.3.28 are affected. No CISA KEV listing or public POC identified at time of analysis, but disclosure by VulnCheck indicates vendor-confirmed issue with available patch.
Remote authenticated attackers can overwrite arbitrary files on OpenClaw servers by uploading malicious tar archives containing symbolic links to the SSH sandbox feature. The vulnerability allows escaping sandbox restrictions to modify critical system files, enabling potential remote code execution or denial of service. Affects OpenClaw versions before 2026.3.31. No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE.
Predictable secret generation in Spring Boot's random value property source allows remote, unauthenticated attackers to obtain potentially sensitive values. Affected versions include Spring Boot 4.0.0 to 4.0.5, 3.5.x, 3.4.x, 3.3.x, and 2.7.x before the respective patch releases. The vulnerability has a CVSS score of 7.5 (High) but no active exploitation has been confirmed, and EPSS suggests a very low likelihood of exploitation.
Spring Boot's Cassandra auto-configuration fails to verify hostnames during SSL/TLS connection establishment to Cassandra servers, enabling man-in-the-middle attackers on the local network to intercept credentials and data by presenting a valid certificate for any domain. Affects Spring Boot 2.7.0-4.0.5; vendor-released patches available for all supported versions (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33). No public exploit code identified at time of analysis.
Local privilege escalation and session hijacking in Spring Boot allows attackers with local access to hijack authenticated sessions or execute arbitrary code by taking control of the ApplicationTemp directory. The vulnerability affects Spring Boot versions 2.7.0 through 4.0.5 when server.servlet.session.persistent is enabled, requiring attack persistence across application restarts. VMware has released patches for all supported branches (4.0.6, 3.5.14, 3.4.16, 3.3.19, 2.7.33), though unsupported versions remain vulnerable. No active exploitation confirmed at time of analysis.
Spring Boot's RabbitMQ auto-configuration omits TLS hostname verification when an SSL bundle is configured, enabling a man-in-the-middle attack on the message broker connection. Affected are Spring Boot 4.0.0-4.0.5 and 3.5.0-3.5.13; fixed in 4.0.6 and 3.5.14 respectively per the vendor advisory at spring.io. No active exploitation has been confirmed - CISA KEV status is absent, EPSS is 0.01% (3rd percentile), and SSVC classifies exploitation as none - making this a medium-priority patch for deployments that use SSL bundles with RabbitMQ.
Double-free memory corruption in the Linux kernel's KASAN shadow-teardown path (mm/kasan) affects kernels built with KASAN on architectures where page-table pages are not struct-page aligned - notably PowerPC with 64K page size, where the PUD table is allocated from the pgtable-2^9 slab cache. When device-managed memory is unmapped (e.g. unbinding a PMEM/nvdimm device via ndctl), kasan_remove_zero_shadow() frees the same slab object twice, corrupting the slab allocator. This is a local, KASAN-build-only defect with no public exploit identified at time of analysis; EPSS is negligible (0.02%) and it is not in CISA KEV.
Sensitive data disclosure in ProjeQtor 7.0 through 12.4.3 lets an authenticated guest-level user retrieve other users' records - including password hashes and API keys - by directly calling the objectDetail.php endpoint, which fails to enforce ownership or role checks (CWE-862). Because the exposed administrator credentials enable privilege escalation, the flaw effectively promotes a low-privilege account to full control. Publicly available exploit code exists, though EPSS is low (0.06%, 18th percentile) and it is not on CISA KEV, indicating no public exploit identified as actively used in the wild.
SQL injection in ProjeQtor's login endpoint lets unauthenticated remote attackers inject arbitrary SQL through the username field, because the login variable is concatenated directly into a query without parameterization. Affecting versions 7.0 through 12.4.3, it can be leveraged to create privileged accounts, exfiltrate database contents, and - where the DB account has elevated OS privileges - achieve operating-system command execution. Publicly available exploit code exists (VulnCheck advisory and multiple PoCs), though EPSS remains low at 0.09% and it is not listed in CISA KEV.
Sharing-token forgery in SmarterTools SmarterMail builds before 9610 lets remote unauthenticated attackers decrypt and access arbitrary emails, attachments, and file-storage contents. The file/email sharing endpoints protect tokens with DES-CBC keys and IVs derived from System.Random seeded with only ~19,000 possible values, and the attachment download endpoint leaks enough information to act as an oracle for recovering the seed. No public exploit is identified at time of analysis, and EPSS is low (0.03%), consistent with the high-complexity, non-automatable oracle attack it requires.
Authentication bypass in Apache Camel's camel-platform-http-main component (versions 4.14.1–4.14.5 and 4.18.0–4.18.1) allows remote unauthenticated attackers to reach protected business routes and management endpoints when a non-root context path is configured. Because the Vert.x sub-router registers the auth handler at the exact context path rather than its subpaths, requests to paths like /api/route or /admin/observe/info evade the credential challenge, exposing runtime metadata (user, working directory, PID, JVM and OS details) via /observe/info. No public exploit identified at time of analysis; EPSS is low (0.04%) and CISA SSVC records no known exploitation, though the flaw is assessed as automatable.
Sensitive data exposure in Templately WordPress plugin ≤3.6.1 allows authenticated attackers to retrieve embedded sensitive information via network requests. The vulnerability exhibits scope change (S:C) indicating potential cross-boundary impact, with high confidentiality impact but no integrity or availability effects. CVSS 7.7 severity driven by network accessibility and low attack complexity. No CISA KEV listing indicates no confirmed widespread exploitation. Reported by Patchstack's audit team with reference to their vulnerability database entry.
Credential disclosure in GeoVision GV-IP Device Utility 9.0.5 allows network attackers to intercept administrator passwords via broadcast UDP traffic containing symmetric encryption keys. When administrators issue privileged commands to GeoVision IP devices, the utility broadcasts credentials encrypted with a Blowfish-derived algorithm but includes the decryption key in the same packet, enabling passive network eavesdropping to extract full device credentials. CVSS 9.3 (Critical) with scope change reflects the pivot risk from utility compromise to full device control, including IP reconfiguration and factory resets.
DNS traffic amplification via cyclic nameserver delegation in Technitium DNS Server versions before 15.0 enables unauthenticated remote attackers to conduct distributed denial-of-service (DDoS) attacks. Attackers can exploit misconfigured or maliciously crafted DNS delegation chains to create resolution loops, forcing the server to generate significantly larger response traffic than the initial query size. This amplification can be weaponized against third-party victims, with the vulnerable server acting as an unwitting participant in reflection attacks. CVSS 7.2 (High) reflects network-accessible exploitation requiring no authentication, with cross-scope impact affecting availability and integrity of downstream systems.
WireGuard private keys leak through Cilium debugging tools in deployments using transparent encryption. Cilium's cilium-bugtool and cilium sysdump command expose the node-to-node WireGuard encryption private key (cilium_wg0.key) in output archives. Attackers with high-privilege local access to these diagnostic outputs can decrypt past and future inter-node traffic. Affects all Cilium versions prior to v1.17.15, v1.18.0-v1.18.8, and v1.19.0-v1.19.2. Patches released in v1.17.15, v1.18.9, and v1.19.3. No public exploit identified at time of analysis, but exploitation requires only access to previously shared bugtool/sysdump archives.
Out-of-bounds memory access in the Linux kernel's netfilter ip6t_eui64 IPv6 match module allows a malformed Ethernet/MAC header to reach eth_hdr(skb) before validation, leading to information disclosure or a kernel crash. The prior guard in eui64_mt6() only rejected an invalid MAC header when par->fragoff != 0, so non-fragmented packets (fragoff == 0) with an invalid MAC header could still be dereferenced. Exploitation requires an administrator to have configured an ip6tables rule using the eui64 match; no public exploit identified at time of analysis and EPSS is very low (0.02%).
Out-of-bounds read in the Linux kernel's bridge neighbour-discovery proxy (br_nd_send) allows remote attackers to leak adjacent kernel memory or crash the host by sending crafted IPv6 Neighbor Solicitation packets whose ND option area lies in the non-linear (paged/fragmented) part of the socket buffer. The function parses ns->opt[] assuming options reside in the skb's linear region, but callers only guarantee the ICMPv6 header and target address are linear, so parsing reads past the linear buffer. EPSS is very low (0.03%, 8th percentile) and there is no public exploit identified at time of analysis, but the fix is shipping across all maintained stable trees and downstream vendors (Ubuntu USN-8490-1, Siemens).
Kernel memory disclosure and denial of service in the Linux kernel's openvswitch (OVS) datapath arises because validate_set() accepted OVS_KEY_ATTR_MPLS as a variable-length payload for SET/SET_MASKED actions while the action handler expects the fixed-size struct ovs_key_mpls. A local low-privileged actor able to install OVS flow actions can supply an undersized or oversized MPLS key to trigger an out-of-bounds read (rated C:H, I:N, A:H), leaking adjacent kernel memory or crashing the datapath. There is no public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), consistent with a niche, privilege-gated networking bug rather than a mass-exploitation candidate.
Local privilege escalation via a use-after-free race in the Linux kernel's Open vSwitch (openvswitch) module allows a local user with network-configuration capability to corrupt kernel memory. The flaw lives in ovs_netdev_tunnel_destroy(), which drops the tunnel netdev reference during teardown; when this runs after NETDEV_UNREGISTER has already detached the device, it races concurrent RCU readers that still observe vport->dev, producing a premature reference drop and stale-pointer access. The fix defers the netdev_put to the RCU release callback (vport_netdev_free), matching the non-tunnel path. There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 7th percentile).
Denial of service in the Linux kernel's rxrpc (AF_RXRPC) subsystem allows remote attackers to disrupt service-side RxRPC connections by sending duplicate or late RESPONSE packets that re-run the connection setup path. The flaw stems from an unlocked, post-transition state test that permitted RESPONSE processing outside the RXRPC_CONN_SERVICE_CHALLENGING window; the fix gates processing on that state under state_lock. No public exploit has been identified and EPSS probability is very low (0.02%), but any kernel exposing an rxrpc service (e.g., kafs/AFS) is potentially reachable over the network without authentication.
Out-of-bounds kernel memory access in the Linux kernel's network emulation scheduler (sch_netem) allows a local, privileged user to corrupt kernel memory and likely panic the system. When a netem qdisc has packet corruption enabled and an AF_PACKET TX_RING transmits fully non-linear packets over an IPIP tunnel, skb_headlen(skb) is 0, causing get_random_u32_below(0) to return an unconstrained 32-bit offset that indexes past the linear skb->data area. There is no public exploit identified at time of analysis, EPSS risk is very low (0.02%), and it is not on CISA KEV; it is a locally-triggerable memory-safety bug rather than a remotely exploitable one.
Out-of-bounds kernel memory access in the Linux kernel's IPv6 netfilter ip6t_rt (Routing Header) match module allows a local user holding CAP_NET_ADMIN to install a crafted ip6tables rule whose addrnr field exceeds IP6T_RT_HOPS, causing rt_mt6() to read past the bounds of rtinfo->addrs[]. This can leak adjacent kernel memory (information disclosure) or crash the system (denial of service). No public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.02%, 7th percentile).
Kernel memory disclosure in the Linux kernel's AF_UNIX subsystem allows a local, low-privileged user to read stale or freed VFS data via the UNIX_DIAG_VFS netlink attribute. The sock_diag handler read a UNIX socket's u->path inode and device numbers without holding unix_state_lock, racing against unix_release_sock() which clears u->path under that lock before dropping the path reference. The fix reads the inode/device under unix_state_lock and emits the netlink attribute after unlocking; no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Local privilege escalation in Nullsoft Scriptable Install System (NSIS) 3.06.1 before 3.12 arises because an installer running as SYSTEM can fall back to the world-writable Low Integrity temp directory (c:\Windows\Temp\Low) when temp-file creation fails, letting a local low-privileged attacker plant content that the SYSTEM process trusts and thereby gain SYSTEM privileges. Exploitation requires an elevated NSIS installer to execute (UI:R) and hinges on forcing my_GetTempFileName to return 0, per the referenced bug #1326. There is no public exploit identified at time of analysis and EPSS is negligible (0.01%), consistent with SSVC exploitation status 'none'.
Remote attackers can crash BACnet Stack-powered embedded devices (versions prior to 1.4.3) by sending malformed ReadPropertyMultiple (RPM) requests containing a 1-byte property payload with an extended tag marker (0xF9). The vulnerability triggers an out-of-bounds read in the RPM service decoder, causing denial-of-service on industrial building automation systems that use this open-source C library. Affects default configurations where ReadPropertyMultiple service is enabled. EPSS data and KEV status not available; no public exploit confirmed at time of analysis, though GitHub security advisory provides technical details that could facilitate reproduction.
Remote denial of service in BACnet Stack library versions before 1.4.3 allows unauthenticated attackers to crash embedded building automation devices by sending a malformed ReadPropertyMultiple request with a truncated object identifier. The off-by-one buffer read vulnerability triggers crashes on resource-constrained BACnet devices running the default-enabled RPM service handler. CVSS v4.0 scores this 8.7 (High) based on network attack vector and high availability impact, though no public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds read in BACnet Stack library versions before 1.4.3 allows unauthenticated remote attackers to crash embedded BACnet devices or disclose memory contents by sending malformed WritePropertyMultiple (WPM) service requests over BACnet/IP. The flaw affects building automation and industrial control systems using the vulnerable C library. No public exploit identified at time of analysis, though the CVSS v4.0 score of 8.7 reflects high availability impact and network-accessible attack surface with low complexity.
Arbitrary file write in Kata Containers v3.4.0 to v3.28.0 allows untrusted hosts to overwrite binaries and exfiltrate data from guest workloads, including those in confidential VMs (CVMs). The vulnerability stems from inadequate validation in the CopyFile policy, permitting host-initiated writes to arbitrary paths inside guest images. This enables binary replacement for code execution or data theft across the trust boundary. Patched in v3.29.0. EPSS data not available; no active exploitation confirmed at time of analysis.
Buffer overwrite vulnerability in uuid JavaScript library versions prior to 14.0.0 enables remote attackers to corrupt memory and potentially disclose sensitive information through out-of-range writes when applications use v3, v5, or v6 UUID generation functions with caller-provided output buffers. The library fails to validate buffer boundaries, allowing partial writes beyond allocated memory regions. Vendor patch available in version 14.0.0 per GitHub security advisory GHSA-w5hq-g745-h8pq. No confirmed active exploitation (not in CISA KEV), and CVSS 4.0 Environmental Score suggests exploitation status is unproven (E:U).
Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification of all JSON responses or complete HTTP transport hijacking when the JavaScript Object.prototype has been polluted by a co-dependency. This vulnerability requires a separate prototype pollution source within the same Node.js process but requires no authentication once that precondition exists. An attacker can then access credentials, headers, and request bodies across the application. EPSS data not available; no public exploit identified at time of analysis.
Unauthenticated attackers can steal admin tokens from Dgraph Alpha v25.3.2 and earlier via the exposed /debug/vars endpoint, enabling complete authentication bypass to administrative functions. The vulnerability exists because Dgraph incompletely fixed a previous cmdline exposure issue-blocking only /debug/pprof/cmdline while still serving Go's expvar handler at /debug/vars, which publishes the full command-line arguments including --security token= flags. Attackers can retrieve the token remotely without authentication (CVSS AV:N/PR:N) and replay it in X-Dgraph-AuthToken headers to access admin-only endpoints. Vendor patch released in v25.3.3 per GitHub advisory GHSA-vvf7-6rmr-m29q. No public exploit identified at time of analysis, but detailed proof-of-concept steps are published in the advisory.
Missing JWT signature verification in AWS Ops Wheel enables remote unauthenticated attackers to forge administrative tokens and gain complete control over all application data and Cognito user accounts across all tenants. This critical authentication bypass (CVSS 9.8) has a vendor-released patch available via GitHub PR #164. EPSS data not available, but the combination of zero authentication requirements, network attack vector, and multi-tenant data exposure creates immediate exploitation risk for all deployments.
Remote code execution in BridgeHead FileStore pre-24A via Apache Axis2 default credentials allows unauthenticated attackers to deploy malicious web services and execute arbitrary OS commands. The vulnerability exploits exposed Axis2 admin console with unchanged default credentials, enabling full system compromise over the network with no authentication required. Publicly available exploit code exists (GitHub Gist), and CVSS 9.8 reflects critical risk with network vector, low complexity, and no privileges required. EPSS data not provided but exploitation prerequisites are minimal given default credential exposure.
Kernel memory corruption in Linux's MPTCP subsystem allows a use-after-free in __inet_lookup_established affecting IPv6 subflow sockets. Because mptcp_subflow_init() copied tcpv6_prot before inet6_init() had registered its slab cache, MPTCP IPv6 child sockets were allocated from kmalloc-4k without the SLAB_TYPESAFE_BY_RCU guarantee, so lockless RCU ehash lookups could dereference freed socket memory. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.03%), but the flaw is remotely reachable via network traffic on hosts using MPTCP over IPv6.
Improper lock ordering in the Linux kernel's uinput driver interacting with the force-feedback (ff-core) subsystem creates a circular locking dependency (ff->mutex → udev->mutex → input_mutex → dev->mutex → ff->mutex) that lockdep flags and that can deadlock kernel threads. It is reproducibly triggered by a local user exercising a force-feedback device through uinput - for example a Flydigi Vader 5 gamepad under Wine/Proton - and is fixed by replacing a mutex acquisition in uinput_request_send() with a leaf spinlock. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not on CISA KEV; despite the 7.8 CVSS this is a reliability/locking correctness fix rather than a memory-corruption bug.
Local privilege-level extent tree corruption in the Linux kernel's Btrfs filesystem (versions 6.10 through the 6.18/6.19/7.0 development lines) arises because lookup_extent_data_ref() returns 0 (success) instead of -ENOENT after crossing to a new leaf whose first key does not match, causing callers to operate on the wrong extent tree item. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.02%), indicating negligible likelihood of opportunistic exploitation; this is a reliability/data-integrity defect rather than a remotely reachable RCE. CVSS 7.8 (AV:L/PR:L) reflects local access requirements, not network exposure.
Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.
Use-after-free race condition in the Linux kernel's IPsec (xfrm) transport-mode input path allows a local attacker to corrupt kernel memory and potentially escalate privileges. In xfrm_input_resume(), the network device reference (skb->dev) is dropped via dev_put() immediately on async-crypto re-entry, yet the pointer is still dereferenced inside NF_HOOK and its okfn, creating a window that races with device teardown. No public exploit identified at time of analysis, and EPSS probability is negligible (0.02%), consistent with a difficult-to-trigger race rather than a mass-exploited flaw.
Denial of service in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a duplicate or stale GRP_ACK_MSG to underflow the u16 bc_ackers counter to 65535, permanently wedging group broadcast on the affected socket until the TIPC group is torn down and recreated. The flaw affects the tipc_group_proto_rcv() handler across a wide range of kernel branches (4.15 through the 7.0 series). It is a pure availability issue (CVSS A:H, C:N/I:N); there is no public exploit identified at time of analysis and EPSS probability is negligible (0.02%).
Heap out-of-bounds write in the Linux kernel's batman-adv mesh routing subsystem lets a remote mesh originator corrupt kernel memory by advertising an oversized global translation table (TT). In batadv_tt_prepare_tvlv_global_data(), the allocation length is computed in 16-bit temporaries, so a large TT payload plus the VLAN header offset wraps past 65535 before kmalloc(), producing an undersized buffer that the full-table response path then overruns using the original (unwrapped) length. It is fixed across multiple stable kernel branches; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%).
Local privilege escalation in the Linux kernel's i915 graphics driver allows authenticated users to trigger a use-after-free condition via a race between the heartbeat worker and intel_engine_park_heartbeat() function when releasing engine heartbeat requests. The vulnerability stems from a non-atomic pointer read-and-clear operation that permits double-free of the same request object, causing refcount underflow and potential arbitrary code execution with elevated privileges. Patches are available across multiple stable kernel branches (5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0). EPSS exploitation probability is low (0.02%, 7th percentile), and no public exploit or active exploitation has been identified at time of analysis.
Memory leak (with latent use-after-free risk) in the Linux kernel's DAMON monitoring subsystem (mm/damon/stat) allows a local, privileged user to leak damon_ctx objects and potentially trigger use-after-free by repeatedly toggling the DAMON_STAT 'enabled' control after a damon_call() failure. Affected are kernels on the 6.17-6.19 line prior to the stable fixes; the flaw is classified CWE-416 (Use After Free). There is no public exploit identified at time of analysis, and EPSS is negligible (0.02%, 4th percentile).
Local privilege-escalation potential via a use-after-free in the Linux kernel's vub300 MMC host-controller driver (drivers/mmc/host/vub300.c), affecting kernels built with CONFIG_MMC_VUB300 through 6.17 and stable branches prior to 6.18.23/6.19.13. Because the controller structure was allocated with device-managed (devm) memory while the driver keeps its own explicit reference count, the last reference can outlive driver unbind, letting the kernel dereference freed memory on disconnect or probe deferral. No public exploit identified at time of analysis, and EPSS is negligible (0.02%), consistent with the requirement that the uncommon vub300 USB-to-SDIO hardware be physically present.
Use-after-free in Linux kernel's lan966x network driver allows local authenticated attackers to achieve arbitrary code execution with high impact to confidentiality, integrity, and availability. The flaw occurs in lan966x_fdma_reload() when RX buffer allocation fails - freed pages remain referenced by active DMA descriptors, causing hardware to write into memory now controlled by other kernel subsystems. Vendor patches available for stable branches 6.12.82, 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (5th percentile) indicates low probability of widespread exploitation. No CISA KEV listing or public exploit identified at time of analysis, but successful exploitation grants kernel-level privileges to local attackers.
Heap buffer overflow in Linux kernel rxrpc subsystem allows local authenticated users to trigger memory corruption via crafted RxGK tokens. Exploitable through unprivileged add_key() system call when raw key/ticket lengths >= 0xfffffffd cause integer wraparound in round_up(), bypassing bounds checks while memcpy() copies up to 4 GiB into zero-sized heap allocation. Vendor patches available for stable branches 6.18.23, 6.19.13, and mainline 7.0. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite local privilege escalation potential with CVSS 7.8.
Linux kernel rxrpc subsystem allows remote denial of service via malformed RESP challenge packets due to incorrect serial number comparison logic. The rxrpc_post_response() function compares challenge serial numbers from the wrong packet structure, causing response queue corruption that can crash the kernel networking stack. This affects Linux kernel versions containing commit 5800b1cf3fd8 through the 6.16-6.19 and 7.0 series. Patches are available from kernel.org for affected stable branches. EPSS exploitation probability is very low (0.02%, 4th percentile) and no public exploits or active exploitation have been identified, suggesting limited real-world risk despite the network-accessible attack vector.
Unauthenticated remote attackers can exploit a cryptographic validation bypass in the Linux kernel's RxRPC rxkad authentication handler to potentially execute arbitrary code or cause denial of service. The rxkad_decrypt_ticket() function fails to verify that RXKAD response ticket decryption succeeded before parsing the buffer contents, allowing malformed RESPONSE packets with non-block-aligned ticket lengths to drive the ticket parser with attacker-controlled ciphertext bytes. Despite the critical 9.8 CVSS score indicating network-exploitable attack with high impact across confidentiality, integrity, and availability, EPSS exploitation probability is low (0.02%, 5th percentile) and no active exploitation or public POC has been identified. Patches are available across multiple stable kernel versions (6.6.135, 6.12.82, 6.18.23, 6.19.13, 7.0).
Out-of-bounds read in Linux kernel's rxrpc rxgk authentication handler allows remote unauthenticated attackers to trigger information disclosure and denial of service via malformed RESPONSE authenticator packets. The vulnerability stems from incorrect pointer arithmetic in rxgk_verify_authenticator() that inflates the parser boundary check by a factor of four, allowing reads beyond kmalloc() buffer boundaries. Vendor patches available for kernel versions 6.18.23, 6.19.13, and 7.0. EPSS score of 0.02% (4th percentile) suggests low observed exploitation probability despite network attack vector, though KASAN reports confirm reproducibility.
Remote denial of service in Linux kernel rxrpc subsystem allows unauthenticated network attackers to trigger kernel crash via malformed rxgk RESPONSE packets. An inverted length check in rxgk_verify_response() accepts oversized authenticators, causing skb_to_sgvec() to hit BUG_ON() and panic the kernel. EPSS exploitation probability is very low (0.02%, 4th percentile), no active exploitation confirmed, and patches are available across stable kernel branches 6.18.23, 6.19.13, and 7.0.
Buffer overflow in Linux kernel's AF_RXRPC procfs address formatting allows local authenticated users to corrupt memory and potentially escalate privileges. The vulnerability affects rxrpc proc handlers that write IPv6 socket addresses into 50-byte stack buffers, but ISATAP-format IPv6 addresses with ports can require 51 bytes, causing single-byte overflow. EPSS exploitation probability is low (0.02%, 4th percentile), and patches are available from kernel.org for versions 6.18.23, 6.19.13, and mainline 7.0. No active exploitation confirmed (not in CISA KEV), and CVSS 7.8 reflects local-only attack vector requiring authenticated access.
Use-after-free in Linux kernel NFC LLCP implementation allows adjacent-network attackers to execute arbitrary code with kernel privileges. The flaw occurs when socket state is LLCP_CLOSED in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), where missing return statements cause double release_sock() and refcount underflow, leading to memory corruption. Vendor-released patches available for stable kernels 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability, and no active exploitation or public POC confirmed at time of analysis.
Buffer overflow in Linux kernel's s3c24xx I2C driver allows local authenticated attackers to achieve arbitrary code execution with high privileges through malformed SMBUS block read messages. The driver fails to validate message length against I2C_SMBUS_BLOCK_MAX before processing, enabling out-of-bounds memory access. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS score of 0.02% suggests low observed exploitation activity, with no CISA KEV listing indicating targeted rather than widespread attacks. Attack requires local access and low-level user privileges (CVSS AV:L/PR:L), limiting practical exploitability compared to the high CVSS 7.8 base score.
Uninitialized memory read in Linux kernel's rtl8723bs Wi-Fi driver allows adjacent network attackers to cause denial of service or potentially corrupt integrity through malformed BIP (Broadcast/Multicast Integrity Protocol) frames. The vulnerability affects the staging rtl8723bs driver where only 6 bytes are copied into an 8-byte variable during BIP verification, leaving 2 bytes uninitialized. Patches available across multiple stable kernel versions (6.12.83, 6.18.24, 6.19.14, 7.0.1). EPSS score of 0.02% (5th percentile) indicates low observed exploitation probability. Not listed in CISA KEV, and no public exploit identified at time of analysis.
Out-of-bounds kernel heap read in the Linux kernel's CIFS/SMB client (check_wsl_eas() extended-attribute parser) lets a malicious or compromised SMB server leak up to 8 bytes of adjacent kernel heap into the WSL xattr name comparison, influencing which WSL extended attribute the returned data is interpreted as. The root cause is an off-by-8 bounds check (CWE-125) that measures the EA end from the struct base instead of ea->ea_data, so the trailing name and value bytes of the last EA are read past the end of the response iov. There is no public exploit identified at time of analysis, EPSS risk is negligible (0.02%), and it is not on CISA KEV; patched kernels are already available.
Out-of-bounds heap read in Linux kernel SMB client allows malicious SMB servers to leak kernel memory to userspace via crafted symlink error responses. When processing STATUS_STOPPED_ON_SYMLINK errors in SMB 3.1.1, inadequate bounds checking in smb2_check_message() and symlink_data() allows server-controlled ErrorDataLength values to trigger reads beyond buffer boundaries. The leaked heap bytes are UTF-16-decoded into the symlink target and exposed through readlink(2) syscalls (confidentiality impact), with potential for denial-of-service through memory corruption (availability impact). CVSS 8.1 (High) requires user interaction. EPSS score is very low at 0.02% (5th percentile), indicating minimal observed exploitation activity. Patches available in kernel versions 6.18.24, 6.19.14, and 7.0.1.
Information disclosure in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to leak uninitialized heap memory via malformed SMB2 requests. The vulnerability exists in smb2_get_ea() which fails to validate EaNameLength from client requests before using it in strncmp(), enabling heap content extraction. With EPSS score of 0.02% and no KEV listing, exploitation likelihood remains low despite CVSS 7.5 rating. Patches available across kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1.
Out-of-bounds read in Linux kernel's ksmbd SMB server allows remote unauthenticated attackers to manipulate file permissions by crafting malicious ACE SIDs with insufficient sub-authorities, triggering parse_dacl() to read 4 bytes past the ACL buffer boundary and apply those arbitrary bytes as POSIX file mode bits. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis. Vendor-released patches available across stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Double-free memory corruption in the Linux kernel SMB client (smbd) allows remote unauthenticated attackers to achieve arbitrary code execution, confidentiality breach, and denial of service. The vulnerability occurs when smbd_free_send_io() is erroneously called twice after smbd_send_batch_flush() operations, creating use-after-free conditions. Exploitation probability is low (EPSS 0.02%, 4th percentile) with no confirmed active exploitation or public POC, but the critical CVSS 9.8 score reflects the severe potential impact if network-accessible SMB client operations are triggered. Vendor patches available for kernel versions 6.18.24, 6.19.14, and 7.0.1.
A double-free vulnerability in the Linux kernel's SMB Direct (RDMA transport) server implementation allows remote unauthenticated attackers to trigger memory corruption with high CVSS 9.8 severity. The flaw occurs when smb_direct_free_sendmsg() is called twice on the same memory region after smb_direct_flush_send_list() moves messages to a batch list. Vendor patches available across kernel versions 6.18.24, 6.19.14, and 7.0.1, with upstream commits confirmed in stable branches. Despite critical CVSS scoring, EPSS probability remains very low at 0.02% (4th percentile) and no active exploitation or public POC identified, suggesting limited real-world targeting of this SMB Direct RDMA feature.
Memory access violation in Linux kernel ALSA ctxfi driver allows local authenticated users to trigger kernel page faults and potential privilege escalation. The flaw affects CT20K2 audio hardware drivers (snd_ctxfi module) where virtual memory mapping logic incorrectly accesses beyond allocated page table pages when aggregate memory allocations exceed 2MB on AMD64 systems. EPSS exploitation probability is very low (0.02%, 5th percentile) and no public exploit or active exploitation is confirmed. Vendor-released patches available across multiple stable kernel branches (6.12.83, 6.18.24, 6.19.14, 7.0.1).
Kernel deadlock in Linux OCFS2 filesystem allows remote denial of service through lock ordering violation between unlink and direct I/O operations. OCFS2's orphan directory locking in ocfs2_unlink and ocfs2_dio_end_io_write acquire ip_alloc_sem and inode_lock in opposite orders (ABBA pattern), enabling concurrent operations to deadlock the system. Affects mainline Linux kernel through 6.19.14 with patches available in 6.12.83, 6.18.24, 7.0.1, and 6.19.14. EPSS score of 0.02% suggests minimal real-world exploitation likelihood despite CVSS 7.5 score, and no active exploitation or public POC identified.
Use-after-free in Linux kernel OCFS2 filesystem enables local attackers with low privileges to achieve arbitrary code execution, privilege escalation, or denial of service. The vulnerability occurs when filemap_fault() drops mmap_lock before returning VM_FAULT_RETRY, allowing concurrent munmap() to free the vm_area_struct while ocfs2_fault() still holds a dangling pointer. Vendor patches available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. EPSS exploitation probability is very low (0.02%, 5th percentile) with no public exploit identified at time of analysis.
Use-after-free in Linux kernel memory management allows remote code execution when the folio_unmap_invalidate() function incorrectly accesses freed mapping structures. Kernel versions between 1da177e4c3f4 and patches 6.19.14/7.0.1 are affected. Exploitation probability is low (EPSS 2%, percentile 5%), with no confirmed active exploitation or public POC at time of analysis. Despite the critical CVSS 9.8 score indicating network-based unauthenticated attack, the description suggests this is a kernel memory corruption bug requiring local kernel code paths to trigger, not direct remote network exploitation - CVSS vector conflicts with technical nature and should be validated against vendor guidance.
Use-after-free in Linux kernel KVM x86 MMIO emulation allows local authenticated users with low privileges to potentially execute arbitrary code, escalate privileges, or cause denial of service. The flaw occurs when KVM's emulator initiates MMIO writes using on-stack variables that cross page boundaries between two MMIO pages, creating dangling pointers when fragments are processed across separate KVM_RUN calls, especially when different tasks handle subsequent runs. EPSS exploitation probability is very low (0.02%, 5th percentile), and vendor patches are available for kernel versions 6.12.83, 6.18.24, 6.19.14, and 7.0.1. No active exploitation or public POC identified at time of analysis.