Red Hat
Monthly
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim processes a crafted dataset. A publicly available exploit exists (CVE-2026-66007), though EPSS exploitation probability is low at 0.52% and user interaction is required. Patched in commit f989ef9.
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Limited code execution risk in Apache OpenNLP through crafted model archives or untrusted format names permits arbitrary class instantiation without prior validation. The flaw exists in three code paths (GeneratorFactory, StreamFactoryRegistry, and StringInterners) that use Class.forName() on attacker-supplied data. Exploitation is contingent on the presence of a class with hazardous static initializers or no-arg constructors on the classpath; no active exploitation has been reported.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.
Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are `react-router` (npm) 7.9.6-7.12.0 and `react-router-dom` (npm) 6.30.2-6.30.4; only `react-router` has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.
Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Symlink following in HuggingFace Datasets through version 5.00 allows local low-privileged attackers to redirect archive extraction to arbitrary filesystem locations by pre-planting symlinks at predictable output paths in the shared cache directory. When a higher-privileged user or automated service subsequently triggers Extractor.extract(), the library writes archive contents through the attacker-controlled symlink, enabling overwrite of sensitive system files and potential privilege escalation or code execution. A publicly available exploit exists and an upstream fix is available via commit ad2d853, though no confirmed tagged release version has been independently verified.
Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The `_get_checkpoint_shard_files` function in `hub_utils.py` blindly resolves `weight_map` shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.
Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inserted into the DOM via innerHTML using wrapper elements such as xmp, noscript, iframe, noembed, noframes, or script. Attacker-controlled payloads containing wrapper-closing sequences (e.g., </xmp>) survive DOMPurify sanitization intact but mutate during the browser's second parse, breaking out of the wrapper context and activating injected event handlers. A working public proof-of-concept is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.
Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event handler attributes it should block. Versions up to and including 3.3.1 of the npm package rebuild ALLOWED_ATTR as a plain JavaScript array when USE_PROFILES is active, making attribute allowlist lookups traverse the prototype chain - so a polluted Array.prototype (e.g., Array.prototype.onclick = true) causes DOMPurify to silently pass through event handlers like onclick into sanitized output. A proof-of-concept is included in the vendor advisory GHSA-cj63-jhhr-wcxv; no CISA KEV listing has been identified, indicating no confirmed active exploitation at time of analysis.
URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization and execute as DOM-based XSS when a crafted link is activated. The flaw exists in the `_isValidAttribute` function, which short-circuits before URI-safe validation runs when a caller-supplied predicate via `EXTRA_ELEMENT_HANDLING.attributeCheck` returns `true` for a given attribute/tag pair. Exploitation is conditioned on the consuming application using the non-default `ADD_ATTR` predicate API, but a working proof-of-concept is confirmed in the official GHSA advisory; no CISA KEV listing is present at time of analysis.
DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.
DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used in its function form alongside FORBID_TAGS, causing forbidden tags to survive sanitization. The flaw is a short-circuit evaluation error in purify.ts (lines 1117-1123): when the ADD_TAGS callback (tagCheck) returns true for a tag, the Boolean AND short-circuits, meaning FORBID_TAGS is never consulted - directly contradicting the attribute-side behavior where FORBID_ATTR always wins. An attacker who can supply HTML to an application using this specific configuration can inject tags the developer explicitly intended to block, leading to XSS or related injection in whatever context the sanitized output is rendered. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.
Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mode processes attacker-supplied live DOM nodes whose nodeName property has been clobbered to masquerade as an allowed element. The vulnerability bypasses DOMPurify's existing clobbering protections, which were scoped only to form elements, leaving all other live non-form nodes susceptible to nodeName manipulation. No vendor-released patch exists at time of analysis; no public exploit code has been identified, though the GHSA advisory provides a detailed technical breakdown sufficient for exploit construction.
SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE) are used alongside SAFE_FOR_TEMPLATES: true. The final normalization pass (_scrubTemplateExpressions) employs a NodeIterator that, per DOM specification, does not descend into <template>.content - a separate DocumentFragment outside the normal child-node tree - meaning split text nodes that merge into exploitable expressions inside template content are never caught. Downstream template engines receiving this output may evaluate attacker-supplied expressions, producing XSS or template injection outcomes; no public exploit is identified at time of analysis, and the string output path is explicitly confirmed unaffected.
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.
Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook that conditionally permits dangerous attributes for trusted elements. The 3.4.7 patch introduced a clone-guard to prevent hook-driven allowlist mutation, but that guard lives exclusively inside _parseConfig(); setConfig() sets an internal SET_CONFIG flag that causes sanitize() to skip _parseConfig() entirely, handing hooks the live shared ALLOWED_ATTR object. One trusted render permanently poisons the allowlist for the entire DOMPurify instance lifetime, so subsequent attacker-controlled content inherits the mutated policy and retains event-handler attributes like onerror or onclick unstripped. No public exploit or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects that exploitation requires prior privilege to trigger hook pollution and passive victim interaction to realize the XSS.
Missing authorization in the seunshare utility (policycoreutils through 3.10) permits a low-privileged local user running in an unconfined SELinux domain to send kill signals to root-owned processes also running in unconfined context - effectively enabling unprivileged denial-of-service against privileged system processes. The root cause (CWE-862) is the absence of ownership validation before allowing signal delivery, bypassing the expectation that non-root users cannot terminate root-owned processes. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.
Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Path traversal via indirect prompt injection in the Ansible Lightspeed Model Context Protocol (MCP) server allows an attacker to manipulate an AI agent into writing files to unauthorized filesystem locations on the user's system. Specifically affected is the Lightspeed MCP server component; the attack leverages poisoned content processed by the agent rather than a direct network request. Successful exploitation can expose sensitive host information and enable execution of malicious commands, potentially resulting in full system compromise. No public exploit identified at time of analysis.
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user, regardless of organizational access controls. Three event group types - inventory_update_events, project_update_events, and system_job_events - are absent from the consumer_access() authorization mapping, causing authorization checks to be silently skipped when users subscribe to these channels for arbitrary object IDs. This is confirmed as an incomplete remediation of CVE-2020-10698, affecting Red Hat Ansible Automation Platform 2. No public exploit or CISA KEV listing is identified at time of analysis.
NULL pointer dereference in the Linux kernel's mt76 driver for MediaTek mt7921/mt7925 WiFi chipsets causes a kernel panic (denial of service) via a race condition in Channel Switch Announcement (CSA) beacon processing. When a CSA beacon is received, cfg80211 queues a wiphy work item; if the station disconnects or the channel context is torn down before the work item executes, the driver's dev->new_ctx pointer is already NULL but dereferenced unconditionally in mt7921_channel_switch_rx_beacon() and mt7925_channel_switch_rx_beacon(). EPSS is 0.20% (10th percentile) and no public exploit or CISA KEV listing is identified at time of analysis.
Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.
Null pointer dereference in the Linux kernel's chacha20poly1305 crypto template allows a local unprivileged user to crash the system. The flaw exists in chachapoly_create(), which passes the unvalidated return value of crypto_attr_alg_name() directly to strcmp() when the poly1305 sub-argument is absent in a malformed template string; since that function returns an ERR_PTR on failure, the subsequent strcmp() call dereferences an invalid pointer, triggering a kernel panic. Patches are available across multiple stable branches; no public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Linux kernel's AMD CCP/SEV driver allows a local low-privileged process to crash a KVM hypervisor host by submitting SEV firmware ioctls to /dev/sev, which incorrectly triggers SNP initialization and zeroes the MSR_VM_HSAVE_PA register, causing a general protection fault on the next VMRUN and terminating all running virtual machines. Affected kernels span from the introducing commit (ceac7fb89e8da465aec3ac3c20477f912f5c3a6c) through the fixed stable releases 6.12.96, 6.18.39, and 7.1.4. No public exploit has been identified and EPSS is 0.22%, but the blast radius - crashing the host and all its tenant VMs - warrants prompt patching on AMD EPYC KVM deployments.
Crash of a Linux KVM host is achievable by a local low-privileged user via the /dev/sev ioctl interface on systems running AMD SEV-SNP firmware. When SNP_COMMIT is issued after a prior failed SEV initialization, the crypto/ccp driver incorrectly proceeds with SNP initialization, zeroing out MSR_VM_HSAVE_PA - the model-specific register holding the AMD SVM host save-area pointer. Any subsequent VMRUN instruction by KVM for an already-running VM will generate a General Protection Fault, crashing the host and terminating all guest workloads. No public exploit has been identified at time of analysis; patch commits are available across multiple stable branches.
Uncontrolled SNP initialization in the Linux kernel's CCP/SEV driver allows a local low-privileged user with /dev/sev access to crash the host kernel on AMD SEV/SNP-capable systems running KVM. Sending a SNP_VLEK_LOAD ioctl when SNP has not been initialized triggers an unnecessary initialization/shutdown wrapper that zeros MSR_VM_HSAVE_PA globally; the subsequent VMRUN instruction for any active KVM guest then triggers a General Protection Fault, bringing down the host and terminating all co-hosted VMs. No public exploit has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects the specialized attack environment required.
Host crash vulnerability in the Linux kernel's AMD SEV/SNP subsystem allows a local low-privileged user to take down a virtualization host by triggering SNP re-initialization via the `/dev/sev` `SNP_CONFIG` ioctl when SNP has previously failed to initialize. When re-initialization executes while KVM guests are running, it zeroes `MSR_VM_HSAVE_PA` globally across all CPUs; the next VMRUN instruction on any active guest then raises a General Protection Fault, crashing the host kernel and terminating all hosted VMs. No public exploit identified at time of analysis; EPSS is 0.22% at the 13th percentile, consistent with low opportunistic exploitation probability.
Silent error propagation in the Linux kernel's CTR_DRBG implementation (`drbg_ctr_generate()`) causes the function to return a success code while leaving its output buffer uninitialized when an internal operation fails. Code that relies on the generated random material receives garbage data, which can trigger kernel crashes or hangs depending on how the uninitialized buffer is consumed downstream. No public exploit has been identified; patched stable kernel releases are available across all active longterm-support branches.
PMD-sized vmemmap pages are silently leaked in the Linux kernel's x86 memory management subsystem following a regression introduced in commit bf9e4e30f353, which replaced __free_pages() with pagetable_free() for vmemmap page freeing. Because vmemmap pages are not compound pages (outside of HVO, which does not apply here), pagetable_free() resolves compound_order() to zero and frees only the first page of a PMD-sized block, leaking the remaining pages on every memory section removal. Systems running affected kernel versions (6.18.7-6.18.38, 6.19 series through 7.1.3) that perform x86 memory hotplug operations will experience progressive physical memory loss; no public exploit has been identified and this vulnerability is not in CISA KEV.
Reference count leak in the Linux kernel's SCMI regulator driver can exhaust kernel memory resources, leading to a denial-of-service condition on affected systems. The flaw resides in scmi_regulator_probe(), where of_find_node_by_name() acquires a reference on a device-tree node but the corresponding of_node_put() release call is omitted on the error path when process_scmi_regulator_of_node() fails, permanently leaking the reference. Exploitation requires local access; no public exploit code has been identified and EPSS probability stands at 0.21%, indicating very low likelihood of opportunistic exploitation.
libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).
Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.
Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.
Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.
Heap out-of-bounds read in Apache Thrift's C++ THeaderTransport::readHeaderFormat() allows remote attackers to read unintended memory contents, potentially leading to information disclosure or denial of service. All versions before 0.24.0 are affected. No public exploit code has been reported.
Resource exhaustion in Apache Thrift Java bindings 0.19.0 through 0.23.x allows remote denial of service via an unbounded read. No authentication or user interaction is required, and no public exploit code is known. Users should upgrade to version 0.24.0 to remediate the issue.
Local code injection in NLTK versions prior to 3.9.3 allows an attacker with low privileges who can invoke the collocations module via the command line to execute arbitrary Python code. A publicly available proof-of-concept exploit demonstrates passing a crafted argument to the BigramAssocMeasures.eval() call, enabling arbitrary code execution including OS commands. The vulnerability has been patched in NLTK 3.9.3.
Heap buffer over-write in Magick.NET versions before 14.15.0 on 32-bit platforms when processing extremely large JNX files can lead to a denial-of-service condition by crashing the application. The vulnerability resides in the bundled ImageMagick library's JNX decoder, where an integer overflow occurs during file handling. Exploitation requires the attacker to supply a malicious JNX file to a locally running .NET application using Magick.NET; no public exploit or active exploitation is known.
A heap buffer over-write in ImageMagick's fx operation can be triggered via a crafted argument when processing images with the Magick.NET library, leading to a denial of service. Affected versions of the Magick.NET NuGet package (before 14.15.0) are confirmed vulnerable; no active exploitation or public proof-of-concept has been identified. The vulnerability has a medium CVSS score (5.0) with local attack vector and user interaction required.
Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.
JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient
Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.
Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.
Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.
Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.
Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.
NULL pointer dereference in the Linux kernel's pch_uart serial driver allows a local low-privileged user to crash the kernel by triggering a failed DMA memory allocation in dma_handle_rx(). Systems running Intel PCH (Platform Controller Hub) hardware with the pch_uart driver active and DMA enabled are vulnerable to denial of service via kernel panic. No public exploit or CISA KEV listing exists; with an EPSS of 0.17% (6th percentile), real-world exploitation risk is low, but patches are confirmed across multiple stable kernel branches.
Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.
Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.
Kernel panic via NULL pointer dereference in the Linux tps65219 PMIC regulator driver crashes affected systems when a hardware IRQ fires on the device, producing a local denial-of-service condition. The regression was introduced by commit 64a6b577490c, which removed the helper function `tps65219_get_rdev_by_name()` and inadvertently eliminated the only code path that assigned `irq_data.rdev`, leaving the pointer uninitialized for every registered IRQ. Systems running Linux kernel versions from that commit through the stable-branch fix points (6.18.34 and 7.0.11) on hardware equipped with the TI tps65219 PMIC are affected; no public exploit has been identified and the EPSS score of 0.17% reflects low exploitation probability.
Broadcast TLB flush in the Linux kernel x86 memory management subsystem triggers a General Protection Fault (#GP) on AMD INVLPGB-capable systems booted with the 'nopcid' parameter, causing a kernel panic and local denial of service. When PCID is disabled via 'nopcid', CR4.PCIDE is not set, but the INVLPGB broadcast TLB invalidation path remains enabled; once a memory descriptor becomes active across more than three CPUs, the kernel assigns it a global ASID and issues INVLPGB with a non-zero PCID - an illegal state that crashes the kernel. No public exploit exists, EPSS is 0.17% (6th percentile), and this is not in CISA KEV; real-world impact is constrained to the uncommon 'nopcid' boot configuration on AMD hardware.
NULL pointer dereference in the Linux kernel ethtool PHY subsystem allows a local low-privileged user to trigger a kernel panic (denial of service) by unbinding a PHY driver via sysfs while the device remains registered in the ethtool link topology. Affected kernel versions span the 6.16, 6.18.x, 7.0.x, and 7.1 stable branches; upstream fixes are available in commits targeting 6.18.34 and 7.0.11. No public exploit code exists and no active exploitation has been identified at time of analysis, consistent with EPSS at 0.17% (6th percentile).
NULL pointer dereference in the Linux kernel ACPI platform driver subsystem crashes the kernel when 13 core ACPI drivers are force-matched to devices lacking an ACPI companion object. The root cause is the absence of ACPI_COMPANION() or ACPI_HANDLE() null-checks in affected drivers, combined with the kernel's device_match_driver_override() mechanism which can bypass normal device-ID matching. Impact is limited to local denial of service (kernel panic); no active exploitation is confirmed (not in CISA KEV) and EPSS sits at 0.17% (6th percentile), placing this firmly in the maintenance-fix rather than urgent-remediation category.
Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's Qualcomm Adreno GPU driver (drm/msm/a6xx) crashes the kernel when `a8xx_hfi_send_perf_table()` proceeds to dereference a kzalloc() return value without first validating it against NULL. Systems running affected kernel versions with Qualcomm Adreno 6xx or 8xx GPU hardware - primarily Snapdragon-based ARM devices, smartphones, and servers - can be crashed by a local low-privileged user who triggers the GPU HFI performance table code path under memory pressure. EPSS of 0.16% (5th percentile) and no CISA KEV listing confirm no known active exploitation; patches are available in stable kernel releases 7.0.11 and 7.1.
Kernel panic in the Linux kernel's PowerPC-specific arch_irq_work_raise() function crashes affected systems when machine check exception handlers invoke the function from real mode, a context where virtual memory translation is disabled and preempt_count access via a virtual address faults with a bad area data access error. PowerPC deployments running kernel versions prior to 6.1.175, 6.6.142, 6.12.92, 6.18.34, 7.0.11, and 7.1 are affected; x86, ARM, and other non-PowerPC architectures are completely unaffected. No public exploit code exists and EPSS is 0.17% (7th percentile), consistent with a hardware-architecture-specific reliability defect rather than an attacker-driven threat; the vulnerability does not appear in the CISA KEV catalog.
Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.
NULL pointer dereference in the Linux kernel's iwlwifi MLD (Multi-Link Device) Wi-Fi driver allows a local low-privileged user to crash the kernel, resulting in a denial-of-service condition. The flaw resides in `iwl_mld_remove_link`, where the `link->fw_id` field is read before the `link` pointer is validated for NULL, enabling a kernel panic on affected systems with Intel wireless hardware. No public exploit code exists and the vulnerability is not listed in CISA KEV; patches are available in stable kernel releases 6.18.34, 7.0.11, and 7.1.
Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.
Path traversal in Hugging Face Datasets up to 5.0.0 allows attackers to read arbitrary local files when a victim processes a crafted dataset. A publicly available exploit exists (CVE-2026-66007), though EPSS exploitation probability is low at 0.52% and user interaction is required. Patched in commit f989ef9.
Local information disclosure in accountsservice on Red Hat Enterprise Linux allows systemd-homed users to read arbitrary files via the SetIconFile handler. A proof-of-concept exists, but exploitation requires a local account managed by systemd-homed, limiting impact
Limited code execution risk in Apache OpenNLP through crafted model archives or untrusted format names permits arbitrary class instantiation without prior validation. The flaw exists in three code paths (GeneratorFactory, StreamFactoryRegistry, and StringInterners) that use Class.forName() on attacker-supplied data. Exploitation is contingent on the presence of a class with hazardous static initializers or no-arg constructors on the classpath; no active exploitation has been reported.
Server-Side Request Forgery (SSRF) in Red Hat Quay 3's notification webhook feature allows repository administrators to weaponize the Quay worker process as an internal network proxy. By supplying attacker-controlled URLs to the Slack or generic webhook notification handlers, a repository admin can cause the Quay backend to issue POST requests to RFC-1918 addresses, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other infrastructure that should be network-isolated from the application. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Open redirect in React Router (npm package, versions 6.0.0 through 7.17.x) allows bypass of the prior CVE-2025-68470 patch via attacker-supplied paths containing mixed backslash and forward-slash sequences (e.g., \\evil.com, /\evil.com, \/evil.com) passed to navigation APIs including useNavigate() and the Link component. Browsers interpret these malformed protocol-relative URL patterns as pointing to external hosts, enabling unexpected external navigation. No active exploitation (CISA KEV) or public proof-of-concept has been identified at time of analysis; vendor-released patch v7.18.0 is available.
Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are `react-router` (npm) 7.9.6-7.12.0 and `react-router-dom` (npm) 6.30.2-6.30.4; only `react-router` has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.
Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.
Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Symlink following in HuggingFace Datasets through version 5.00 allows local low-privileged attackers to redirect archive extraction to arbitrary filesystem locations by pre-planting symlinks at predictable output paths in the shared cache directory. When a higher-privileged user or automated service subsequently triggers Extractor.extract(), the library writes archive contents through the attacker-controlled symlink, enabling overwrite of sensitive system files and potential privilege escalation or code execution. A publicly available exploit exists and an upstream fix is available via commit ad2d853, though no confirmed tagged release version has been independently verified.
Path traversal in HuggingFace Diffusers through 0.39.0 enables arbitrary file reads when a user or pipeline loads a maliciously crafted model. The `_get_checkpoint_shard_files` function in `hub_utils.py` blindly resolves `weight_map` shard filenames from model index JSON without validating for path separators or absolute paths, allowing an attacker who controls a model repository to escape the model directory and read any file accessible to the Diffusers process. No active exploitation confirmed (not in CISA KEV), but a public POC issue exists on GitHub and the attack surface includes the widely-used HuggingFace Hub ecosystem.
Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.
Path traversal via prompt injection in Void editor through 1.3.4 allows network attackers who can deliver malicious content into the AI agent's processing context to silently read arbitrary host files outside the open workspace, including SSH private keys and cloud credentials. The AI agent's file-reading tools (read_file, ls_dir, get_dir_tree, search_*) accept absolute filesystem paths and file:// URIs without workspace confinement and bypass the built-in approval gate, enabling silent exfiltration. No CISA KEV listing exists, but a publicly available proof-of-concept exploit has been published, confirming exploitability; the AC:H rating reflects the prompt injection prerequisite rather than any technical barrier once malicious content is ingested.
Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inserted into the DOM via innerHTML using wrapper elements such as xmp, noscript, iframe, noembed, noframes, or script. Attacker-controlled payloads containing wrapper-closing sequences (e.g., </xmp>) survive DOMPurify sanitization intact but mutate during the browser's second parse, breaking out of the wrapper context and activating injected event handlers. A working public proof-of-concept is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.
Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event handler attributes it should block. Versions up to and including 3.3.1 of the npm package rebuild ALLOWED_ATTR as a plain JavaScript array when USE_PROFILES is active, making attribute allowlist lookups traverse the prototype chain - so a polluted Array.prototype (e.g., Array.prototype.onclick = true) causes DOMPurify to silently pass through event handlers like onclick into sanitized output. A proof-of-concept is included in the vendor advisory GHSA-cj63-jhhr-wcxv; no CISA KEV listing has been identified, indicating no confirmed active exploitation at time of analysis.
URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization and execute as DOM-based XSS when a crafted link is activated. The flaw exists in the `_isValidAttribute` function, which short-circuits before URI-safe validation runs when a caller-supplied predicate via `EXTRA_ELEMENT_HANDLING.attributeCheck` returns `true` for a given attribute/tag pair. Exploitation is conditioned on the consuming application using the non-default `ADD_ATTR` predicate API, but a working proof-of-concept is confirmed in the official GHSA advisory; no CISA KEV listing is present at time of analysis.
DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.
DOMPurify versions up to and including 3.3.3 incorrectly resolves a tag-allow conflict when ADD_TAGS is used in its function form alongside FORBID_TAGS, causing forbidden tags to survive sanitization. The flaw is a short-circuit evaluation error in purify.ts (lines 1117-1123): when the ADD_TAGS callback (tagCheck) returns true for a tag, the Boolean AND short-circuits, meaning FORBID_TAGS is never consulted - directly contradicting the attribute-side behavior where FORBID_ATTR always wins. An attacker who can supply HTML to an application using this specific configuration can inject tags the developer explicitly intended to block, leading to XSS or related injection in whatever context the sanitized output is rendered. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.
Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mode processes attacker-supplied live DOM nodes whose nodeName property has been clobbered to masquerade as an allowed element. The vulnerability bypasses DOMPurify's existing clobbering protections, which were scoped only to form elements, leaving all other live non-form nodes susceptible to nodeName manipulation. No vendor-released patch exists at time of analysis; no public exploit code has been identified, though the GHSA advisory provides a detailed technical breakdown sufficient for exploit construction.
SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE) are used alongside SAFE_FOR_TEMPLATES: true. The final normalization pass (_scrubTemplateExpressions) employs a NodeIterator that, per DOM specification, does not descend into <template>.content - a separate DocumentFragment outside the normal child-node tree - meaning split text nodes that merge into exploitable expressions inside template content are never caught. Downstream template engines receiving this output may evaluate attacker-supplied expressions, producing XSS or template injection outcomes; no public exploit is identified at time of analysis, and the string output path is explicitly confirmed unaffected.
Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.
Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook that conditionally permits dangerous attributes for trusted elements. The 3.4.7 patch introduced a clone-guard to prevent hook-driven allowlist mutation, but that guard lives exclusively inside _parseConfig(); setConfig() sets an internal SET_CONFIG flag that causes sanitize() to skip _parseConfig() entirely, handing hooks the live shared ALLOWED_ATTR object. One trusted render permanently poisons the allowlist for the entire DOMPurify instance lifetime, so subsequent attacker-controlled content inherits the mutated policy and retains event-handler attributes like onerror or onclick unstripped. No public exploit or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects that exploitation requires prior privilege to trigger hook pollution and passive victim interaction to realize the XSS.
Missing authorization in the seunshare utility (policycoreutils through 3.10) permits a low-privileged local user running in an unconfined SELinux domain to send kill signals to root-owned processes also running in unconfined context - effectively enabling unprivileged denial-of-service against privileged system processes. The root cause (CWE-862) is the absence of ownership validation before allowing signal delivery, bypassing the expectation that non-root users cannot terminate root-owned processes. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Grafana OSS exposes an unauthenticated or low-privilege denial-of-service path through its alertmanager templates test endpoint, which executes Go templates with no memory limits. Mass-execution of requests to `/api/alertmanager/grafana/config/api/v1/templates/test` in a short window exhausts heap memory, crashing the Grafana process entirely. No public exploit has been identified at time of analysis and this vulnerability is not listed in the CISA KEV catalog, but the anonymous-access exploitation path and low privilege bar make this a realistic availability risk for internet-exposed Grafana instances.
Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.
Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.
Unbounded Server Action payload processing in Next.js App Router exhausts server memory when the affected Server Action uses the Edge runtime, enabling remote denial of service without authentication. Any Next.js application on npm/next versions 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that exposes at least one Server Action on the Edge runtime is vulnerable. An attacker can send arbitrarily large HTTP request bodies to trigger runaway memory allocation, potentially crashing the process or degrading service for all users. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.
CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.
Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.
Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.
Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.
DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.
Heap buffer overflow in NLnet Labs Unbound up to and including 1.25.1 allows a network attacker who controls a DNSSEC-signed authoritative server to corrupt heap memory or crash the resolver by serving a PX, RP, MINFO, or SOA record with RDATA truncated to omit the expected second embedded domain name. The DNSSEC validator's canonical RDATA construction routine computes a pointer to the absent second domain name and passes it unchecked to query_dname_tolower(), which then walks label-by-label through stale bytes in the per-worker env->scratch_buffer - overflowing the heap allocation when msg-buffer-size is configured below its default. No public exploit has been identified at time of analysis; exploitation is constrained by the AC:H requirement for attacker control of a DNSSEC-signed zone.
Remote unauthenticated termination of Unbound 1.22.0 through 1.25.1 is possible via a crafted DNS-over-QUIC (DoQ) connection that exploits a signed-to-unsigned integer conversion error when Unbound mishandles the NGTCP2_ERR_STREAM_DATA_BLOCKED error condition. The flaw propagates an implicit conversion of the C literal `-1` to a 64-bit unsigned integer (0xFFFFFFFFFFFFFFFF), which exceeds the 62-bit QUIC varint ceiling and triggers a libngtcp2 assertion that aborts the entire resolver process. Exploitation is deterministic - a single QUIC connection with one crafted transport parameter and one DNS query is sufficient - though the attack surface is constrained to deployments compiled with assertions enabled and DoQ actively configured. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.
Denial of service in NLnet Labs Unbound 1.10.0 through 1.25.1 allows a remote attacker controlling any delegated DNS zone to crash the resolver daemon via a NULL pointer dereference. The vulnerable path is activated only when both the serve-expired feature and a response-ip or RPZ CNAME redirect rule are configured simultaneously; the serve-expired-client-timeout callback's two-pass CNAME alias loop resets alias_rrset on the second pass without resetting partial_rep, causing an eventual null dereference and process crash. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the network-accessible attack surface makes it a meaningful availability risk for any resolver running these co-configured features.
Memory corruption via use-after-free in NLnet Labs Unbound 1.25.0-1.25.1 can cause a DNS resolver crash under specific, non-default configurations when the server is under load. The flaw originates from a regression introduced in a fix enabling 'respip' and 'dns64' module interoperability: subqueries receive a shallow copy of the active view name, and if the parent query is evicted (jostled) before the subquery completes, the dangling reference causes memory corruption. No public exploit code exists and no confirmed active exploitation (CISA KEV) has been identified; the vendor explicitly describes crash likelihood as low due to dependence on memory layout and allocator behavior.
DNS cache poisoning risk in NLnet Labs Unbound 1.4.22 through 1.25.1 arises because the SO_REUSEPORT load balancing mechanism structurally leaks the secret entropy value - UDP source port randomization - that defends against Kaminsky-style attacks. Each worker thread is assigned a disjoint subset of source ports at startup, so an adjacent-network attacker who can observe Unbound's outgoing UDP queries to authoritative name servers can infer the thread-to-port-subset mapping and substantially reduce the port space to guess during a cache poisoning attempt. Proof-of-concept exploit code exists (CVSS 4.0 E:P); no confirmed active exploitation or CISA KEV listing has been identified.
Cache-clearing denial-of-service in NLnet Labs Unbound through 1.25.1 allows a remote attacker who controls a DNS delegation to indefinitely and repeatedly flush Unbound's message and rrset caches without sending a single spoofed packet. The attack exploits a logic flaw in how the iterator processes in-bailiwick glue records containing the unspecified address 0.0.0.0/::0: on Linux, such queries are routed via loopback and answered by 127.0.0.1, creating an IP mismatch that the unwanted-reply counter tallies until the configured threshold triggers a defensive cache clear - which resets the counter, enabling the loop to continue indefinitely. No public exploit identified at time of analysis; CVSS 3.1 scores this 5.3 (Medium) with Low availability impact and no confidentiality or integrity impact.
DNS response policy poisoning in NLnet Labs Unbound 1.7.0 through 1.25.1 allows an unauthenticated network attacker to become the authoritative XFR source for an auth/rpz zone by spoofing the configured primary hostname's A/AAAA record. The flaw stems from Unbound accepting a BOGUS-validated hostname resolution - one where DNSSEC validation has explicitly failed - as a valid zone transfer endpoint without requiring a valid RRSIG, violating the integrity guarantees DNSSEC is designed to enforce. Successful exploitation enables complete replacement of the resolver's response policy zone, making this a DNS firewall bypass with high real-world consequence for organizations relying on RPZ for threat blocking. No public exploit code has been identified at time of analysis.
DNS response policy rewriting in NLnet Labs Unbound 1.6.2 through 1.25.1 bypasses DNSSEC validation when the respip module is positioned ahead of the validator with response-ip or RPZ-IP redirect rules active. The rewriting handler fails to check upstream DNSSEC security status, allowing a spoofed BOGUS A/AAAA answer whose address falls within an operator-configured redirect subnet to be rewritten and returned to clients with a hardcoded INSECURE security level rather than being rejected as BOGUS. No public exploit code has been identified at time of analysis, but the integrity impact is concrete: clients receive silently misdirected responses that appear to pass through legitimate operator-controlled policy, undermining the core DNSSEC trust guarantee for affected deployments.
Use-after-free in NLnet Labs Unbound 1.15.0 through 1.25.1 crashes the DNS daemon via a dangling pointer to a freed TLS server name string in the DNS-over-TLS forwarding path. A remote attacker with knowledge of the target resolver's configuration can trigger the crash by sustaining query pressure against the configured DoT zone while inducing a transient upstream connection failure, causing denial of service. No public exploit code exists and this vulnerability has not been confirmed as actively exploited, but the network-accessible attack surface (PR:N) makes it relevant to operators running internet-facing recursive resolvers with DoT forwarding.
Quota bypass in NLnet Labs Unbound 1.22.0 through 1.25.1 allows a remote unauthenticated client to cause the resolver to send more upstream DNS packets per query than the operator-configured 'max-global-quota' limit. A single crafted query for a deeply nested hostname under a DNSSEC-signed parent zone triggers excessive recursive DNSSEC validation traffic, effectively neutralizing a security control designed to suppress upstream amplification. No public exploit code has been identified and the vulnerability is not listed in CISA KEV at time of analysis.
Fatal application termination in NLnet Labs Unbound's libunbound library (up to and including 1.25.1) can be triggered remotely when the 'unwanted-reply-threshold' feature is enabled. An attacker controlling or able to spoof responses from an authoritative nameserver can flood the resolver with wrong-transaction-ID UDP datagrams until the threshold is crossed, causing libunbound to invoke 'libworker_alloc_cleanup' - a function absent from the internal allow list - resulting in a fatal exit that crashes the embedding application. Notably, standalone Unbound is unaffected because its counterpart function 'worker_alloc_cleanup' is correctly registered; only applications embedding libunbound are at risk. No public exploit code or CISA KEV listing has been identified at time of analysis.
Denial of service in NLnet Labs Unbound 1.22.0 through 1.25.1 causes server termination when DNS-over-QUIC (DoQ) is enabled and the resolver operates under high concurrency. Unbound incorrectly passes realtime clock values to libngtcp2 where monotonic timestamps are required; under load, the resulting assertion failure in libngtcp2 abruptly kills the Unbound process. No public exploit code exists and no active exploitation has been reported, but the self-termination of a DNS resolver constitutes a severe availability impact for any infrastructure depending on it.
Heap buffer overflow in Red Hat Directory Server (389-ds-base) exposes LDAP services to remote unauthenticated denial of service or potential arbitrary memory write via malformed DN input. When a Distinguished Name containing a legacy-quoted value is processed, the server fails to close the associated heap allocation, permitting a subsequent operation to reference the same memory pointer - a classic heap confusion primitive. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV, though the network-accessible unauthenticated attack surface warrants prompt patching for any externally reachable Directory Server deployment.
Path traversal via indirect prompt injection in the Ansible Lightspeed Model Context Protocol (MCP) server allows an attacker to manipulate an AI agent into writing files to unauthorized filesystem locations on the user's system. Specifically affected is the Lightspeed MCP server component; the attack leverages poisoned content processed by the agent rather than a direct network request. Successful exploitation can expose sensitive host information and enable execution of malicious commands, potentially resulting in full system compromise. No public exploit identified at time of analysis.
Incomplete RBAC authorization in AWX's websocket event consumer exposes real-time job stdout to any authenticated user, regardless of organizational access controls. Three event group types - inventory_update_events, project_update_events, and system_job_events - are absent from the consumer_access() authorization mapping, causing authorization checks to be silently skipped when users subscribe to these channels for arbitrary object IDs. This is confirmed as an incomplete remediation of CVE-2020-10698, affecting Red Hat Ansible Automation Platform 2. No public exploit or CISA KEV listing is identified at time of analysis.