Red Hat
Monthly
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.
Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the scope-changed CVSS rating of 8.3 (S:C, C:H/I:H/A:H) underscores that a successful chain achieves full host-level compromise.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. No public exploit code has been identified and CISA's SSVC assessment confirms no known exploitation; however, the full CIA triad impact and sandbox escape potential make this a meaningful local privilege boundary violation.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making outbound requests to internal or cloud metadata endpoints via the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. Because URL validation and the actual delivery re-resolve the hostname independently and follow redirects, an attacker can bypass the public-IP check and receive the target's response_status and response_body, enabling exfiltration of cloud credentials (e.g. from 169.254.169.254). No public exploit identified at time of analysis; the CVSS 9.3 rating and scope-change flag reflect the credential-theft potential of reaching metadata services.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.
Path traversal in PostCSS's automatic source map loading allows arbitrary `.map` file disclosure when untrusted CSS is processed without explicitly opting out. Specifically, `lib/previous-map.js` constructs file paths from attacker-controlled `sourceMappingURL` comment values without sandboxing directory traversal sequences, enabling an attacker who can supply CSS to a PostCSS-processing service to exfiltrate `sourcesContent` from any `.map` file reachable by the process. The flaw affects all PostCSS versions from 8.0.0 through 8.5.17; no public exploit or CISA KEV listing has been confirmed at time of analysis, though the GHSA advisory provides a detailed attack scenario.
Excessive RBAC permissions on the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI enable privilege escalation to full cluster administrator. An attacker who compromises either ServiceAccount identity - by exploiting a separate RCE vulnerability within those pods or by creating a malicious pod in the same Kubernetes namespace - can create new ClusterRoleBindings to assume cluster-admin rights or read all secrets across the cluster. No public exploit has been identified at time of analysis, and the CVSS vector confirms high privileges are required as a prerequisite, limiting the realistic threat actor pool to those with existing cluster foothold.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.
Heap buffer overflow in FFmpeg's VC-2/Dirac RTP packetizer (libavformat/rtpenc_vc2hq.c) enables memory corruption via crafted Dirac data units across all versions prior to fix commit 1cdeb3c. The packetizer accepts an attacker-controlled data unit or fragment size and copies it into a fixed-size heap buffer without an upper-bound check, a classic CWE-122 condition with High confidentiality, integrity, and availability impact. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; an upstream fix commit is available from the FFmpeg repository.
Heap buffer overflow in FFmpeg's RIST protocol reader (libavformat/librist.c) lets a remote RIST sender corrupt heap memory in any FFmpeg instance ingesting an async:rist:// stream, enabling potential remote code execution or crash. The librist_read() function ignores the caller's buffer size and copies the entire received RIST payload into a destination buffer that the async wrapper sizes smaller than the packet, so an oversized payload writes past the buffer end. Reported by VulnCheck and fixed upstream in commit 1c10bcc; no public exploit is identified at time of analysis and it is not listed in CISA KEV.
Path traversal in GitPython before 3.1.58 allows remote attackers who control a Git repository to create fully initialized, attacker-controlled Git repositories at arbitrary filesystem paths outside the intended clone directory. GitPython's independent submodule implementation reads submodule names from .gitmodules without any validation - a check that core Git added years ago in response to CVE-2018-11235 - and passes the raw, traversal-containing name directly to os.makedirs() and git clone. A proof-of-concept with Docker-based reproduction is publicly documented in GHSA-hmq2-w58f-27jc; no CISA KEV listing is present at time of analysis, indicating exploitation is not yet confirmed as widespread.
Config-name injection in GitPython <= 3.1.57 enables arbitrary git-config directive forgery and remote code execution via `core.sshCommand` or `core.hooksPath`. The option-name validator in `git/config.py` only blocks CR/LF/NUL, allowing `=`, `#`, and whitespace to pass unchecked; `write_section` then writes the option name verbatim, causing git to parse attacker-supplied content as a valid directive. Exploitation requires a calling application to forward attacker-influenced input to `config_writer.set_value()` as the option-name argument, and a proof-of-concept is publicly confirmed in the vendor GHSA advisory. No CISA KEV listing is present at time of analysis.
Heap buffer overflows in FreeBSD's iconv(3) character-conversion library allow attackers who control input processed through the HZ, UTF-7, VIQR, or ZW encoding modules to corrupt heap memory, potentially leading to remote code execution. Applications on FreeBSD 14.3/14.4/15.0/15.1 that pass untrusted data through iconv using any of these encodings are exposed. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.21%, 12th percentile) despite the 9.8 CVSS.
Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the browser sandbox against users running Chrome prior to 151.0.7922.169. An unauthenticated remote attacker can trigger the vulnerability by luring a victim to a crafted HTML page, making this a drive-by exploitation scenario requiring only a single user interaction. Google has released a patch in stable channel version 151.0.7922.169; no public exploit or CISA KEV listing has been identified at time of analysis, though SSVC rates the technical impact as total.
Use-after-free in Google Chrome's WebGL subsystem allows remote code execution inside the browser sandbox for all Chrome versions prior to 151.0.7922.169. An attacker can achieve arbitrary code execution within the Chrome renderer by delivering a crafted HTML page to a victim, requiring only a single page visit. No public exploit code or CISA KEV listing has been identified at time of analysis; however, CVSS 8.8 with low attack complexity reflects meaningful real-world risk for any unpatched Chrome deployment.
Sandbox escape via race condition in Google Chrome's USB subsystem (all versions prior to 151.0.7922.169) enables arbitrary code execution on the host system when chained with a renderer process compromise. This is a second-stage exploit: an attacker must already have code execution within Chrome's sandboxed renderer before the USB TOCTOU race can be leveraged to cross the sandbox boundary, triggered through a crafted HTML page. No public exploit code or CISA KEV listing has been identified at time of analysis, though the scope-changed CVSS rating of 8.3 (S:C, C:H/I:H/A:H) underscores that a successful chain achieves full host-level compromise.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Use-after-free in the Browser component of Google Chrome on macOS prior to 151.0.7922.169 enables remote attackers to execute arbitrary code outside the sandbox. Exploitation requires social engineering to induce a user to visit a crafted HTML page, placing this in the user-interaction-required category. No public exploit code or CISA KEV listing has been identified at time of analysis, but the sandbox escape impact elevates real-world severity significantly.
Type confusion in V8, Chrome's JavaScript engine, enables arbitrary code execution inside the Chrome renderer sandbox on any platform (Windows, macOS, Linux) when a user visits an attacker-controlled HTML page. All Chrome releases prior to 151.0.7922.169 are affected; Google has released the patched stable-channel build. No public exploit code or active exploitation has been identified at time of analysis, though the SSVC framework rates technical impact as total within the sandbox boundary.
Sandbox escape via link following in Google Chrome's CredentialProvider component on Windows allows a local attacker to execute arbitrary code outside the browser's security sandbox, affecting all Chrome versions prior to 151.0.7922.169. The vulnerability stems from improper symbolic link or junction resolution (CWE-59) in the CredentialProvider, a Windows-specific subsystem handling credential operations, enabling a local attacker to redirect file access operations to attacker-controlled paths. No public exploit code has been identified and CISA's SSVC assessment confirms no known exploitation; however, the full CIA triad impact and sandbox escape potential make this a meaningful local privilege boundary violation.
Remote code execution in Google Chrome for Android before 151.0.7922.169 stems from a heap buffer overflow in Dawn, Chromium's WebGPU implementation, and is notable because Google explicitly states it allows code execution OUTSIDE the renderer sandbox. A remote attacker who lures a victim to a crafted HTML page can achieve full compromise of the browser process context on the device. Rated Critical by Chromium with CVSS 9.6; a vendor patch is available, and no public exploit has been identified at time of analysis.
Remote denial-of-service in Oracle Java SE's 2D component allows unauthenticated network attackers to hang or crash the JVM across versions 25.0.4 and 26.0.2 via multiple protocols. The attack surface spans both server-side Java deployments exposing 2D-related APIs through web services and client-side environments running sandboxed Java Web Start applications or applets processing untrusted code. Oracle characterizes this as easily exploitable with no public exploit identified at time of analysis; no KEV listing is present.
Full account takeover is possible in Keycloak's legacy client-initiated account-linking endpoint due to a predictable hash (CWE-341) used as a CSRF-like protection mechanism. An attacker who controls a registered OIDC client in the target realm can forge a valid linking URL that silently binds a victim's Keycloak account to the attacker's external identity, enabling subsequent login as the victim. No public exploit or CISA KEV listing is identified at time of analysis; Red Hat has released patches via RHSA-2026:56523 and RHSA-2026:56524.
Tar extraction path traversal in moby/go-archive allows an attacker who controls archive contents to create or overwrite files outside the intended destination directory, undermining container-to-host filesystem boundaries. The affected functions - Unpack, UnpackLayer, Untar, UntarUncompressed, and ApplyLayer - perform lexical path validation but rely on OS-level resolution at operation time, meaning symlinks introduced inside the archive redirect writes to arbitrary paths writable by the extracting process. This flaw propagates through the full Docker ecosystem including Docker Engine, Docker Desktop, Docker CLI, Docker Compose, and Docker Sandboxes; vendor-released patches are available and no public exploit code has been identified at time of analysis.
Account takeover in Red Hat Build of Keycloak allows an unauthenticated attacker to abuse the reset-credentials flow in the keycloak-services component to complete a password reset for any user without ever clicking the emailed verification link, letting them directly set new credentials. Because the mandatory email-ownership check can be bypassed, the flaw yields full control of arbitrary accounts (CVSS 9.1). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Excessive ClusterRole permissions on the managed-serviceaccount addon-manager pod in Red Hat Advanced Cluster Management for Kubernetes 2 allow a compromised addon-manager to read secrets across every namespace and approve arbitrary Certificate Signing Requests, resulting in cluster-wide information disclosure and privilege escalation. The CVSS scope-change (S:C) reflects that a single compromised pod can affect the entire Kubernetes cluster, not just the addon namespace. No public exploit code or active exploitation via CISA KEV has been confirmed at time of analysis.
Server-side request forgery in the Red Hat Ansible Automation Platform 2 Controller's HashiCorp Vault credential plugin lets an authenticated user with credential-creation rights force the controller pod to leak its own Kubernetes service account token. When a HashiCorp Vault Secret Lookup credential configured for kubernetes_role authentication is tested, the kubernetes_auth() routine in awx_plugins/credentials/hashivault.py transmits the pod token to an attacker-supplied URL. With that token the attacker gains Kubernetes API access to control-plane namespaces, enabling full pod CRUD and secret reads including database credentials and the Django SECRET_KEY. No public exploit identified at time of analysis, and the flaw is not on the CISA KEV list.
Code injection in Vim prior to 9.2.0845 enables arbitrary operating-system command execution by an attacker who can supply a malicious ctags-format tags file. The StructMembers() function in ccomplete.vim embeds typeref: and typename: field values from that tags file into a dynamically constructed vimgrep pattern using escaping that only covers '/' and '\', leaving regex metacharacters such as '[' active; an unclosed bracket breaks Vim's pattern parser, causing the remainder of the tag value to be interpreted as Ex commands where '|' acts as a command separator. Exploitation requires the victim to actively invoke C omni-completion (CTRL-X CTRL-O) while editing a C file referencing the malicious tags entry; no public exploit is identified at time of analysis, though the fix commit's test suite embeds a working proof-of-concept payload, substantially lowering the barrier to weaponization.
Privilege escalation and arbitrary code execution in Red Hat Advanced Cluster Management for Kubernetes (RHACM) allows an authenticated low-privilege user to hijack the governance-policy container image across managed clusters. By annotating the namespaced ManagedClusterAddOn resource - a permission that may be granted to non-administrative users - the attacker causes the governance-policy-addon-controller to deploy a malicious, attacker-controlled image running with cluster-admin privileges on every managed cluster under the hub's control. No public exploit or CISA KEV listing has been confirmed at time of analysis, but the low attack complexity and high impact across cluster boundaries make this a prioritized patching target for multi-cluster RHACM deployments.
Use-after-free in Valkey's RESTORE command allows a low-privileged remote attacker to potentially execute arbitrary code by supplying a crafted RDB stream payload that assigns a single Pending Entry List (PEL) NACK to multiple stream consumers. Valkey versions prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1 across all active release trains are affected. When one consumer referencing the shared NACK is deleted while another still holds a pointer to the same memory, a use-after-free condition occurs that can corrupt the allocator heap and enable remote code execution. No public exploit or CISA KEV listing exists at time of analysis, though the vendor's own fix PR includes a detailed reproducer test that substantially lowers the barrier to weaponization.
Use-after-free in Valkey's TLS connection handler allows an authenticated remote attacker to crash the server or potentially achieve remote code execution on TLS-enabled deployments. The flaw exists across all Valkey branches prior to 7.2.14, 8.0.10, 8.1.9, 9.0.5, and 9.1.1, confirmed via GitHub security advisory GHSA-53mc-f3m3-99vh and EUVD-2026-60822. No active exploitation has been confirmed (not in CISA KEV), but the full C:H/I:H/A:H CVSS impact and the RCE/Memory Corruption tags warrant prompt patching for any TLS-configured Valkey instance.
Access-control mitigation bypass in the Firefox Add-ons Manager component allows attackers to circumvent a security protection that Mozilla had previously put in place around add-on handling, affecting Firefox before 154 and Firefox ESR before 153.1. Mozilla assigned this a 9.8 CVSS score with a fully remote, unauthenticated, no-user-interaction vector, though the terse advisory text does not detail the exact protection defeated. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Information disclosure via a side-channel in Mozilla Firefox's Web Audio component allows remote, unauthenticated attackers to infer sensitive data that should be isolated between origins by measuring observable timing or behavioral discrepancies. The flaw affects Firefox before 154 and Firefox ESR before 153.1 and is fixed in those releases; no public exploit has been identified and EPSS is low (0.14%, 4th percentile), indicating no evidence of active exploitation.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Same-origin policy enforcement in Firefox's DOM Service Workers component can be bypassed, allowing a malicious web page to access resources, responses, or cached content belonging to another origin. The flaw affects Firefox before version 154 and Firefox ESR before 153.1, and carries a CVSS 3.1 base score of 9.1 (high confidentiality and integrity impact, no availability impact). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the network, no-authentication, no-interaction vector makes it attractive for drive-by attacks.
Privilege escalation in Firefox's Request Handling component exposes all versions prior to 154 (and ESR prior to 153.1) to high-impact compromise of confidentiality, integrity, and availability. The flaw carries a CVSS 8.8 score with a network attack vector and no privilege prerequisite, meaning a remote attacker can trigger it by inducing a user to interact with attacker-controlled content. SSVC assessment confirms no active exploitation at time of analysis and rates technical impact as total, while fix versions are confirmed via two Mozilla security advisories.
Side-channel information disclosure in Firefox's Storage: Cache API (CWE-203) allows remote unauthenticated attackers to infer sensitive cached data through observable timing discrepancies between cache hits and misses. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected per Mozilla advisories mfsa2026-74 through mfsa2026-80. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high confidentiality impact rating and broad Firefox deployment footprint make patching a near-term priority.
Privilege escalation in Mozilla Firefox's Downloads API component exposes users on any version prior to Firefox 154 or Firefox ESR 153.1 to high-impact compromise across confidentiality, integrity, and availability. Classified under CWE-269 (Improper Privilege Management), the flaw enables an unauthenticated remote attacker to escalate privileges when a user interacts with a crafted download trigger, requiring no prior foothold on the target system. No public exploit has been identified at time of analysis, but Firefox's ubiquitous deployment and the low attack complexity make this a high-priority patch for any organization.
Privilege escalation via invalid pointer dereference in Mozilla Firefox's Graphics component allows a remote attacker to gain elevated privileges within the browser context. Affected versions are all Firefox releases prior to 154 and all Firefox ESR releases prior to 153.1, with patches confirmed in Mozilla advisories mfsa2026-74 and mfsa2026-77. No public exploit identified at time of analysis, and CISA's SSVC framework rates exploitation status as none with the attack not automatable, though technical impact is assessed as total.
Protection-mechanism bypass in the Firefox JavaScript engine's garbage collector (JavaScript: GC) undermines a built-in exploit mitigation, weakening a defense that normally hinders memory-corruption exploitation. The flaw affects Mozilla Firefox and Firefox ESR and was addressed by the vendor in Firefox 154 and Firefox ESR 153.1. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was reported internally by Mozilla.
Use-after-free in Mozilla Firefox's JavaScript garbage collector (GC) component enables remote code execution when a victim visits a malicious webpage. All Firefox versions prior to 154 and Firefox ESR versions prior to 153.1 are affected across multiple product lines, as indicated by four separate Mozilla Security Advisories (MFSA2026-74, -77, -78, -80). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the high CVSS score of 8.8 with full C/I/A impact and low attack complexity demands prompt patching.
Protection mechanism failure in Firefox's Data Loss Prevention (DLP) component allows remote attackers, with user interaction, to bypass DLP controls, resulting in high confidentiality and integrity impact. Affected versions span the standard Firefox release channel (prior to 154) and both active ESR branches (ESR 140.x prior to 140.14, ESR 153.x prior to 153.1). No public exploit exists and EPSS sits at 0.17% (7th percentile), indicating low observed exploitation probability despite the high CVSS score - no active exploitation is confirmed via CISA KEV.
Use-after-free memory corruption in Firefox's Layout: Text and Fonts component allows a remote unauthenticated attacker to achieve high-confidence confidentiality, integrity, and availability impact by luring a user to visit a malicious web page. The vulnerability spans the main Firefox release channel and all three active ESR branches (115.x, 140.x, 153.x), indicating broad exposure across enterprise and consumer deployments. No public exploit or active exploitation has been identified at time of analysis, but the network-accessible, low-complexity nature of this flaw and the breadth of MFSA advisories (mfsa2026-74 through mfsa2026-80) signal a high-priority patching target.
Privilege escalation via the Shell Integration component in Mozilla Firefox allows a remote unauthenticated attacker - with user interaction - to achieve full compromise of confidentiality, integrity, and availability on affected systems. Affected are all Firefox releases prior to 154 and ESR branches prior to 140.14 and 153.1, as confirmed by Mozilla advisories mfsa2026-74, mfsa2026-76, and mfsa2026-77. No public exploit or CISA KEV listing has been identified at time of analysis, and SSVC rates exploitation status as none.
Memory corruption in Mozilla Firefox's Graphics component stems from an integer overflow (CWE-190) that can be triggered when the browser processes malicious web content, potentially leading to remote code execution within the content process. The flaw affects Firefox before 154 and the ESR 140.x and 153.x branches, and Mozilla has shipped fixes across advisories MFSA2026-74 through MFSA2026-80. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Site isolation bypass in Mozilla Firefox's Networking: Cookies component allows remote, unauthenticated attackers to read and manipulate cookies across origins when a victim visits a malicious page, scoring CVSS 8.1 (High) due to high confidentiality and integrity impact. The flaw, rooted in CWE-346 (Origin Validation Error), undermines a core browser security boundary that separates per-site cookie access. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing is identified at time of analysis.
Privilege escalation in Firefox's Networking: Cookies component allows a remote, unauthenticated attacker to gain elevated privileges within the browser when a user visits a malicious page, yielding full confidentiality, integrity, and availability impact. All Firefox releases prior to 154 and both ESR branches prior to 140.14 and 153.1 are affected across all platforms. SSVC rates technical impact as total, but exploitation status is confirmed as none and the attack is not automatable due to the required user interaction; no public exploit or CISA KEV listing exists at time of analysis.
Privilege escalation via incorrect boundary conditions in Firefox's Graphics: CanvasWebGL component allows remote attackers to achieve high-impact code execution by luring users to a crafted web page. The flaw affects all Firefox releases prior to version 154 and multiple ESR branches (115.x, 140.x, 153.x), making the exposure broad across both consumer and enterprise deployments. No active exploitation has been confirmed (SSVC: Exploitation: none), but the CVSS 8.8 score and total technical impact classification warrant prompt patching.
Memory corruption via a use-after-free in Firefox's DOM: Core & HTML component allows a remote attacker to trigger dangling-pointer reuse in the browser engine, potentially leading to arbitrary code execution within the content process. All Firefox and Firefox ESR users on versions prior to Firefox 154, ESR 140.14, and ESR 153.1 are affected. No public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), consistent with a freshly patched browser bug with no observed weaponization.
Memory corruption via a use-after-free in Firefox's Graphics: ImageLib component allows a remote attacker to potentially execute code or disclose memory contents when a victim renders attacker-controlled image data. All Firefox channels are affected up to the fixed builds (Firefox 154 and ESR 115.39, 140.14, 153.1). No public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile), indicating no observed weaponization despite the high CVSS score.
Privilege escalation via the Remote Settings Client component affects Mozilla Firefox across all supported mainline and ESR release tracks, with Mozilla assigning the issue CVSS 8.8 High severity. The flaw (CWE-269, Improper Privilege Management) permits a network-based attacker to escalate privileges within the browser context when a user interacts with attacker-controlled content, achieving total confidentiality, integrity, and availability impact. No public exploit code exists and CISA has not listed this in KEV, but the simultaneous patching of three ESR branches alongside mainline signals that Mozilla assessed significant breadth of exposure across its install base.
Privilege escalation in Firefox's CanvasWebGL graphics component affects all Firefox releases prior to version 154 and both active ESR branches, enabling a remote attacker to gain full control over confidentiality, integrity, and availability within the browser process. The flaw stems from improper privilege management (CWE-269) in the WebGL canvas rendering pipeline, exploitable by luring a victim to a crafted web page - no authentication or special software is required beyond a standard Firefox installation. No public exploit code or active exploitation has been identified at time of analysis; however, Mozilla issued three simultaneous security advisories (MFSA2026-74/76/77) addressing all supported release tracks, signaling broad internal severity.
Memory corruption in Mozilla Firefox's Graphics: Text component (CWE-416 use-after-free) can be triggered by malicious web content, potentially leading to remote code execution or information disclosure in the browser process. All Firefox users on pre-fix builds are affected until updated to Firefox 154 or the corresponding ESR releases (115.39, 140.14, 153.1). There is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.16%, 6th percentile).
Privilege escalation in Firefox's DOM Navigation component allows a remote unauthenticated attacker to achieve full confidentiality, integrity, and availability compromise within the browser process by inducing a user to visit a malicious webpage. All Firefox releases prior to version 154 and all active ESR branches (115.x, 140.x, 153.x) are affected, with Mozilla issuing four simultaneous MFSA advisories (mfsa2026-74 through mfsa2026-77) indicating broad impact across every supported release channel. No public exploit or KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this a high-priority patch for all Firefox deployments.
Memory-corruption via a use-after-free in Firefox's JavaScript WebAssembly engine allows a remote attacker to corrupt heap memory and potentially achieve arbitrary code execution or information disclosure when a victim loads attacker-controlled content. All Firefox versions prior to Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1 are affected. There is no public exploit identified at time of analysis, KEV does not list it as actively exploited, and EPSS is low (0.16%), so this is a high-severity but not yet demonstrably-exploited flaw.
Privilege escalation in Firefox's DOM Networking component allows remote attackers who can lure a user to a malicious webpage to achieve high-impact compromise of confidentiality, integrity, and availability. The flaw, rooted in improper privilege management (CWE-269), affects all Firefox releases prior to version 154 and multiple ESR branches, and has been patched across four simultaneous Mozilla advisories (mfsa2026-74 through mfsa2026-77). No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Server-side request forgery in MLflow before 3.15.0 lets remote unauthenticated attackers coerce the server into making outbound requests to internal or cloud metadata endpoints via the POST /api/2.0/mlflow/webhooks/{id}/test endpoint. Because URL validation and the actual delivery re-resolve the hostname independently and follow redirects, an attacker can bypass the public-IP check and receive the target's response_status and response_body, enabling exfiltration of cloud credentials (e.g. from 169.254.169.254). No public exploit identified at time of analysis; the CVSS 9.3 rating and scope-change flag reflect the credential-theft potential of reaching metadata services.
Quadratic CPU consumption in sqlparse versions prior to 0.6.0 allows unauthenticated remote denial-of-service via crafted deeply-nested SQL payloads submitted to any application calling sqlparse.parse(), sqlparse.format(), or sqlparse.split(). A ~2KB malicious input with 500-2000 nesting levels can consume approximately 10 seconds of CPU per request - a ~5000x amplification ratio - before depth or token limits raise a SQLParseError. No active exploitation is confirmed in CISA KEV, though the GHSA advisory includes a detailed proof-of-concept demonstrating the attack; CVSS 4.0 rates availability impact as High (8.7) with no authentication required.
CPU exhaustion via ReDoS in sqlparse affects all Python applications that pass caller-controlled SQL text to sqlparse.parse(), sqlparse.format(), or sqlparse.split() prior to version 0.6.0. The root cause is a backreference regex pattern in the dollar-quoted literal lexer that, combined with the per-position lexer loop, produces O(n²) CPU complexity when processing inputs containing many unique, unclosed dollar-quote openers or multiline comment delimiters — making it trivially exploitable from the network with no authentication. No public exploit code or CISA KEV listing has been identified at time of analysis, but the fix commit includes a purpose-built benchmark script that doubles as a functional reproduction guide.
Remote unauthenticated denial-of-service in INDI indiserver through 2.2.4.2 allows any attacker with TCP access to port 7624 to crash the daemon with a single malformed packet. The vulnerability stems from an unbounded sprintf() call writing XML error messages into a fixed 1024-byte stack buffer in MsgQueue.cpp - sending mismatched XML tags whose names exceed that boundary overflows the stack frame and terminates the process, immediately disconnecting all active astronomical instrument drivers and client sessions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the attack primitive is trivially constructible given the deterministic overflow path confirmed in the patch diff.
Path traversal in PostCSS's automatic source map loading allows arbitrary `.map` file disclosure when untrusted CSS is processed without explicitly opting out. Specifically, `lib/previous-map.js` constructs file paths from attacker-controlled `sourceMappingURL` comment values without sandboxing directory traversal sequences, enabling an attacker who can supply CSS to a PostCSS-processing service to exfiltrate `sourcesContent` from any `.map` file reachable by the process. The flaw affects all PostCSS versions from 8.0.0 through 8.5.17; no public exploit or CISA KEV listing has been confirmed at time of analysis, though the GHSA advisory provides a detailed attack scenario.
Excessive RBAC permissions on the maas-api and maas-controller ServiceAccounts in Red Hat OpenShift AI enable privilege escalation to full cluster administrator. An attacker who compromises either ServiceAccount identity - by exploiting a separate RCE vulnerability within those pods or by creating a malicious pod in the same Kubernetes namespace - can create new ClusterRoleBindings to assume cluster-admin rights or read all secrets across the cluster. No public exploit has been identified at time of analysis, and the CVSS vector confirms high privileges are required as a prerequisite, limiting the realistic threat actor pool to those with existing cluster foothold.
Netfilter's nft_payload offload mask builder in the Linux kernel performs an undefined-behavior shift (1 << 120 on a 32-bit int) when constructing hardware-offload match masks for partial IPv6 address fields, and separately over-masks trailing bytes when priv_len is a multiple of four. Systems running affected kernel versions that use nftables hardware offload rules with partial IPv6 address matches may experience firewall rule bypass (I:H) or kernel instability triggered by UBSAN (A:H). No public exploit is identified at time of analysis, and EPSS sits at 0.16% (5th percentile), consistent with a kernel correctness/stability bug rather than an actively targeted security issue. Patches are available across all active stable branches.
IV race condition in the Linux kernel's AF_ALG skcipher interface allows local unprivileged users to inject attacker-controlled initialization vectors into in-flight AIO cryptographic operations. For CTR and CBC modes, IV reuse enables keystream derivation and plaintext recovery of concurrent cipher operations sharing the same AF_ALG socket. No public exploit has been identified at time of analysis; patches are confirmed available across all major stable kernel branches (5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 7.1.5, 7.2-rc1).
Unbounded recursion in the Linux kernel's slab allocator free path can crash the kernel when memory allocation profiling or cgroup memory accounting is active. Specific size relationships between KMALLOC_NORMAL caches cause circular obj_exts array dependencies - for example, kmalloc-512 and kmalloc-1k each hold the other's obj_exts array - so freeing one slab triggers a chain of recursive kfree/discard_slab calls that exhausts the kernel task stack. This was confirmed to cause production kernel stack overflows at Meta's infrastructure (approximately 125 recursive frames observed) and is fixed in Linux 6.12.103, 6.18.44, and 7.1.8; no public exploit code exists and exploitation probability is very low (EPSS 0.18%).
Deadlock and use-after-free conditions in the Linux kernel's IDXD character device driver expose local low-privileged users on Intel DSA-equipped systems to potential kernel memory corruption or denial of service. The vulnerability resides in `idxd_cdev_open()`, where error cleanup paths call `put_device(fdev)` while still holding `wq->wq_lock`, causing `idxd_file_dev_release()` to deadlock on synchronous reentry; a secondary fallthrough defect then allows `idxd_xa_pasid_remove(ctx)` and `kfree(ctx)` to operate on memory already freed by that release callback. No public exploit has been identified at time of analysis, and an EPSS score of 0.16% (6th percentile) reflects the low observed exploitation probability consistent with the specialized hardware prerequisite.
Out-of-bounds kernel memory read and incomplete invalidation affect the Linux kernel's ARM SMMUv3 iommufd nested-virtualization path (arm_vsmmu_vsid_to_sid), where a guest virtual Stream ID is mapped to a single physical Stream ID from master->streams[0]. On ARM64 hosts using nested SMMUv3 with iommufd vDEVICE, assigning a device that has zero streams turns master->streams into a ZERO_SIZE_PTR that is read out of bounds, while a device with multiple streams leaves the other streams' ATC/IOTLB entries unreachable by guest invalidations. There is no public exploit identified at time of analysis, and EPSS is very low (0.15%, 5th percentile), consistent with a niche subsystem rather than broad exploitability despite the 9.3 CVSS.
Deadlock in the Linux kernel btrfs zoned filesystem causes an unrecoverable filesystem hang on hosts using zoned block devices (SMR HDDs or ZNS SSDs). The writeback path in btree_writepages() holds zoned_meta_io_lock while the tree-log block group fallback path waits for a transaction commit, while the concurrent transaction commit path blocks on that same lock - a classic ABBA deadlock resulting in complete filesystem unavailability. No public exploit exists and EPSS is 0.16% (5th percentile), reflecting a niche-deployment reliability issue rather than a broad security threat; the condition can be triggered by normal I/O stress and was confirmed reproducible via fstests generic/475.
Memory corruption in the Linux kernel's NTFS filesystem driver stems from unchecked integer arithmetic when converting runlist element counts into byte sizes inside ntfs_rl_realloc() and ntfs_rl_realloc_nofail(). An attacker who can get a crafted NTFS volume mounted and parsed can overflow the size calculation and corrupt kernel heap memory, potentially escalating to code execution. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.14%, 4th percentile).
Out-of-bounds kernel memory read in the Linux netfilter SIP connection-tracking helper (nf_conntrack_sip) lets remote attackers crash or leak memory from any host doing SIP NAT rewriting. When sip_help_tcp() NAT-rewrites a SIP message, the per-message size delta is stored in a signed 16-bit variable; a single message with a long Contact list can grow by more than S16_MAX (while still under the 65535 enlarge_skb limit), wrapping the counter so datalen underflows to a huge unsigned value and ct_sip_get_header() reads past the linearized skb tail (KASAN use-after-free). Tagged Information Disclosure; no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile).
Local privilege escalation and host memory corruption in the Linux kernel's KVM arm64 virtual GIC (vgic) LPI handling allows a malicious guest to trigger a use-after-free by racing LPI release against re-registration. Affecting arm64 KVM hosts (introduced by the LPI refcounting rework, present through Linux 6.17), a guest that issues an ITS DISCARD while an LPI is still referenced and then re-maps the same INTID via MAPTI can cause the kernel to erase a newly registered LPI from the xarray or leak an orphaned structure. There is no public exploit identified at time of analysis and EPSS is low (0.14%), but the scope-changing guest-to-host impact makes this a meaningful host-integrity issue.
Out-of-bounds slab read in the Linux kernel keyring subsystem's `keyring_get_key_chunk()` exposes kernel heap memory and enables potential kernel crashes from any unprivileged local user account. Affected kernels fail to bounds-check the full computed byte offset when walking description-level key chunks, allowing reads past a `kmemdup`-allocated buffer. This is reachable via the standard `add_key(2)` syscall with no elevated privileges and is confirmed by KASAN as a slab-out-of-bounds read; no public exploit exists and EPSS is 0.16% (5th percentile), but multi-tenant and container environments with untrusted local users face meaningful exposure.
Use-after-free in the Linux kernel's RDS/TCP subsystem allows a local authenticated attacker to read freed kernel memory via a race condition in `rds_tcp_laddr_check()`, potentially enabling privilege escalation. The flaw is triggered through the `bind()` syscall when the RCU read lock is incorrectly released between a `dev_get_by_index_rcu()` lookup and a subsequent `ipv6_chk_addr()` call, creating a window for concurrent interface deletion to free the `net_device` struct. No public exploit is identified at time of analysis, and EPSS of 0.16% (5th percentile) indicates low near-term exploitation probability despite the CVSS 7.8 High rating.
Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. No public exploit is confirmed in CISA KEV and EPSS is a low 0.14%, but KASAN stack traces embedded in the advisory (tasks 'exploit/142' and 'exploit/143') confirm the race was reproducibly triggered, and the vendor has released fix commits to the stable kernel trees.
Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. This CVE carries a CVSS 3.1 score of 8.8 (S:C, C:H/I:H/A:H) but EPSS of 0.14% (4th percentile) and no CISA KEV listing indicate no confirmed active exploitation at time of analysis.
Stale kernel memory leaks to userspace through an off-by-two bounds error in the Linux kernel's libiscsi subsystem, specifically in `iscsi_scsi_cmd_rsp()`. Systems running an iSCSI initiator (libiscsi loaded) that connect to a malicious or compromised iSCSI target are exposed: the target crafts a SCSI Response PDU where the data segment length equals the declared sense length, causing a `memcpy()` to read two bytes past the received buffer boundary into stale `conn->data` contents, which are then returned to userspace in the SCSI sense buffer. No public exploit exists and EPSS stands at 0.16% (5th percentile); exploitation requires adversary control of an iSCSI target the victim connects to, making this a concern primarily for enterprise iSCSI storage environments rather than general internet-facing systems.
Heap buffer overflow in the Linux kernel iSCSI TCP initiator (drivers/scsi/libiscsi_tcp.c) lets a malicious or compromised iSCSI target overflow the fixed 8192-byte conn->data buffer by returning a SCSI Command Response (ISCSI_OP_SCSI_CMD_RSP) whose DataSegmentLength exceeds ISCSI_DEF_MAX_RECV_SEG_LEN. Unlike LOGIN_RSP, TEXT_RSP, REJECT and ASYNC_EVENT, the SCSI response path copied sense/response data into conn->data without bounding it against the buffer size, only against the negotiated MaxRecvDataSegmentLength (open-iscsi default 262144). Any Linux host acting as an iSCSI initiator against an untrusted target is affected; there is no public exploit identified at time of analysis and EPSS is low (0.16%, 5th percentile), and it is not on CISA KEV.
Out-of-bounds memory corruption in the Linux kernel's ath12k WiFi 7 driver corrupts kernel memory adjacent to the ML peer ID bitmap during MLO peer cleanup. The `ath12k_mac_dp_peer_cleanup()` function incorrectly indexes a 256-bit bitmap with `dp_peer->peer_id`, which always carries the ATH12K_PEER_ML_ID_VALID flag (BIT(13), value 8192+), causing `clear_bit()` to write far outside the valid bitmap range. No public exploit has been identified at time of analysis, and EPSS probability stands at 0.14%, though the CVSS 8.8 rating reflects the adjacent-network, unauthenticated vector and full kernel-level C/I/A impact of the memory corruption primitive.
Memory corruption in the Linux kernel's nzxt-smart2 hwmon driver exposes systems on non-coherent DMA architectures (ARM, MIPS) to deterministic kernel memory corruption whenever the NZXT Smart Device 2 USB hardware triggers a DMA-mapped output report. The driver's send_output_report() passes a misaligned buffer to hid_hw_output_report(), which hands it to usb_interrupt_msg() for DMA mapping; on non-coherent caches, cache line flush or invalidate operations corrupt adjacent kernel variables (mutex, update_interval) sharing the same cache line. No public exploit has been identified at time of analysis; EPSS of 0.17% (6th percentile) reflects low exploitation probability, and the bug is not listed in CISA KEV.
Un-rate-limited ICMP and NDISC Redirect packet storms are possible in the Linux kernel when peer entry allocation fails inside `inet_getpeer_v4()` or `inet_getpeer_v6()`, affecting all kernels from 2.6.39 through the fixed stable releases. A remote unauthenticated attacker who can trigger peer table exhaustion against a Linux system acting as a network forwarder can cause the kernel to emit unbounded ICMP/NDISC Redirect messages, producing severe network availability degradation. No public exploit or proof-of-concept is identified at time of analysis, and EPSS sits at 0.17%, but the no-authentication CVSS profile warrants prompt patching on any Linux routing infrastructure.
Out-of-bounds array access in the Linux kernel nct6775-core hardware monitoring driver allows a local low-privileged user on systems equipped with the nct6116 Super I/O chip to trigger reads beyond 3-element weight register arrays (up to index 4), with the resulting garbage values subsequently used as hardware I/O register addresses. This can cause invalid hardware register writes, hardware misconfiguration, or system crashes. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), making this a patch-priority rather than emergency-response item; exploitation is bounded by the hardware specificity of the nct6116 chip.
Use-after-free in the Linux kernel's forcedeth Ethernet driver allows a local user to trigger kernel memory corruption during device removal. The driver's nv_remove() function frees per-CPU txrx_stats before unregister_netdev() completes, leaving the ndo_get_stats64 statistics path, NAPI polling, xmit data path, and nv_close()/drain all capable of accessing the already-freed structure. With CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and no public exploit identified at time of analysis, the immediate risk is narrow but the potential for local privilege escalation on systems with NVIDIA nForce-era hardware warrants prompt patching.
Shift-out-of-bounds undefined behavior in the Linux kernel's TC u32 classifier allows local privilege escalation on systems where unprivileged namespace creation is permitted. The root cause is that u32_change() copies a user-supplied offshift value (0-255) into the kernel without validating it is less than 16, so when packet classification later evaluates the variable offset expression with TC_U32_VAROFFSET set, an offshift >= 32 violates C11 §6.5.7p3 and produces undefined behavior exploitable for kernel-level impact. No public exploit has been identified at time of analysis, and patched stable releases 7.1.8 and 7.2-rc6 are available.
Use-after-free in the Linux kernel Bluetooth ISO subsystem allows a physically adjacent, unauthenticated attacker to corrupt kernel heap memory, potentially enabling privilege escalation or a denial-of-service crash. The defect exists in `iso_sock_disconn()`, where clearing `conn->hcon = NULL` omits the required `conn->hcon->iso_data = NULL` reset, leaving a dangling pointer that `iso_conn_free()` later dereferences. Patches are available across multiple stable branches (6.6.151, 6.12.103, 6.18.44, 7.1.8); no confirmed active exploitation is on record despite the high CVSS score, consistent with the very low EPSS of 0.17% and the specialized Bluetooth ISO attack surface.
Use-After-Free in the Linux kernel's Bluetooth L2CAP LE connection response handler exposes systems with Bluetooth enabled to potential kernel-level memory corruption by an adjacent, unauthenticated attacker. The flaw in `l2cap_le_connect_rsp()` stems from missing reference-count protection on a channel object, allowing a concurrent remote-disconnect-triggered `l2cap_chan_del()` to free the object between lookup and lock - a pattern already fixed in the BR/EDR counterpart but overlooked here. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.17%, and no public exploit code has been identified, though the kernel-level UAF impact class is inherently severe if triggered.
Missing socket lock in the Linux kernel Bluetooth ISO subsystem exposes a race condition in iso_sock_getname that allows a low-privileged adjacent attacker to trigger a use-after-free or null-pointer dereference via concurrent connection teardown. Systems running affected kernel versions with Bluetooth ISO (Isochronous) sockets enabled are vulnerable to kernel crashes or memory disclosure. No public exploit code exists and EPSS probability is 0.17%, but the CVSS 8.0 score reflects the potential for high-impact memory corruption if the race is won.
Race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger a NULL pointer dereference or memory corruption by sending crafted Bluetooth LE ISO connection events targeting a socket concurrently transitioning out of LISTEN or CONNECT state. Affected kernels span the 6.8.9 through pre-6.9 range, with backported fixes confirmed for stable releases 6.18.44 and 7.1.8. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), though the kernel-level impact and Bluetooth-adjacent unauthenticated access vector justify the vendor's 8.8 CVSS rating.
Use-after-free race condition in the Linux kernel's Bluetooth ISO subsystem allows an unauthenticated attacker within Bluetooth adjacency range to corrupt kernel memory by exploiting concurrent socket teardown in iso_conn_ready(), potentially leading to privilege escalation or system crash on affected hosts. The flaw - present since the introduction of Bluetooth 5.2 ISO channel support in Linux 5.15 - arises because conn->sk is dereferenced without holding a lock or refcount, enabling a concurrent iso_sock_release() call to free the socket before iso_conn_ready() completes its dereference. No public exploit or CISA KEV entry exists at time of analysis, and the EPSS score of 0.17% (6th percentile) reflects very low near-term exploitation probability despite the High CVSS score.
Concurrent deadlock and use-after-free (UAF) vulnerabilities in the Linux kernel's Bluetooth ISO socket layer allow adjacent-network attackers to corrupt kernel memory via race conditions in `iso_sock_timeout()`. Affected systems must be within Bluetooth radio range; no authentication is required. No public exploit code and no CISA KEV listing have been identified - EPSS of 0.17% (6th percentile) reflects low current exploitation probability despite the high CVSS score of 8.8.
Use-after-free via reference counting race in the Linux kernel's Bluetooth ISO (LE Audio) subsystem allows an adjacent, unauthenticated attacker to potentially achieve kernel-level code execution or information disclosure. The race arises between concurrent execution of iso_conn_del() and iso_chan_del() in separate kernel tasks, resulting in a double-put of the iso_conn object and subsequent memory corruption. Affected stable branches span Linux 6.11.11 through pre-6.13 series; upstream patches are available in Linux 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code exists and no active exploitation has been confirmed, consistent with a very low EPSS score of 0.17%.
Use-after-free race condition in the Linux kernel Bluetooth ISO subsystem allows an adjacent, unauthenticated attacker to trigger kernel memory corruption with full confidentiality, integrity, and availability impact. The flaw resides in the hci_conn::iso_data field, which is read and modified across concurrent kernel tasks without lock or RCU protection - allowing a kfree() in one task to race against a kref_get_unless_zero() in another, yielding a dangling pointer dereference. No public exploit code has been identified and EPSS exploitation probability is 0.15% (5th percentile), but kernel UAF primitives are well-understood by skilled attackers and the Bluetooth adjacency requirement is the primary limiting factor for mass exploitation.
Use-after-free in the Linux kernel Bluetooth HCI synchronization subsystem (hci_sync) creates a theoretical kernel memory corruption risk via a race condition in the hci_connect_big_sync() callback. The conn (connection) struct can be freed while the hci_sync asynchronous task is still executing, potentially allowing an adjacent, unauthenticated attacker within Bluetooth range to trigger a dangling pointer dereference in kernel context. No public exploit identified at time of analysis and EPSS stands at 0.15% (5th percentile), but patches are available across multiple Linux stable branches and should be applied as routine maintenance.
Use-after-free in the Linux kernel Bluetooth hci_sync subsystem exposes local users with low privileges to potential kernel heap corruption via a race condition in `hci_connect_pa_sync()`. The `conn` connection object can be freed by one code path while the asynchronous hci_sync callback is still executing, allowing a local attacker on affected 6.12.x, 6.14.x, and 6.15.x kernel branches to corrupt kernel memory and potentially achieve full privilege escalation. No public exploit code has been identified, and EPSS of 0.15% (5th percentile) confirms very low exploitation probability at this time - no confirmed active exploitation (not in CISA KEV).
Use-after-free in the Linux kernel's Bluetooth HCI synchronization subsystem allows an adjacent-network attacker with low privileges to pass freed hci_conn pointers to hci_conn_valid(), where kmalloc may have reallocated that memory to unrelated objects. Affected Linux kernel versions across multiple stable branches expose systems with active Bluetooth to potential kernel memory corruption, yielding full confidentiality, integrity, and availability impact at the kernel level. No public exploit code has been identified and CISA KEV does not list this CVE; however, the HIGH CVSS score and kernel-level CIA:H/H/H impact justify prompt patching on any Bluetooth-enabled Linux host.
Local privilege escalation in the Linux kernel's octeontx2-af driver (Marvell OcteonTX2 hardware) allows a low-privileged Virtual Function (VF) tenant to overwrite the Physical Function's (PF) shared CGX hardware PKIND configuration, corrupting HiGig2 or EDSA packet parsing state and achieving high confidentiality, integrity, and availability impact across the PF boundary. The vulnerability arises because VF NIX LF allocation did not check whether the LMAC was already configured with a privileged PKIND before resetting it. No public exploit code has been identified and EPSS is 0.15% (5th percentile), indicating very low exploitation probability, though the changed-scope CVSS vector reflects genuine cross-tenant hardware corruption potential in SR-IOV deployments.
Deadlock in the Linux kernel qede NIC driver's recovery path permanently wedges the rtnetlink control plane of any affected host when a TX timeout fires on a QLogic/Cavium FastLinQ interface with VXLAN or GENEVE tunnel ports configured. Systems in this state remain pingable but every subsequent caller of rtnl_lock - including ip, sshd, ovs-vswitchd, IPv6 addrconf, and lldpad - blocks indefinitely, denying all network management access until reboot. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the impact on unpatched datacenter hosts in tunnel-overlay environments is severe and patch adoption should be prioritized.
Use-after-free memory corruption in the Linux kernel's ksmbd SMB server subsystem exposes systems running the in-kernel file-sharing daemon to potential kernel-level compromise by an authenticated remote attacker. Affected are Linux kernel versions beginning at commit 8510a043d334ecdf83d4604782f288db6bf21d60 (ksmbd introduction) through multiple stable branches, with vendor-released patches confirmed in 6.6.151, 6.12.103, 6.18.44, 7.1.8, and 7.2-rc6. No public exploit code has been identified and EPSS stands at 0.17% (6th percentile), indicating no observed mass exploitation at time of analysis despite the CVSS 8.8 severity rating.
Session-binding authentication weakness in the Linux kernel's ksmbd in-kernel SMB3 server allows different SMB clients to be treated as identical because ClientGUID values were compared with strncmp(), which halts at the first embedded NUL byte. An attacker able to reach an exposed ksmbd share could exploit this to bind to another client's authenticated SMB3 multichannel session or bypass FSCTL_VALIDATE_NEGOTIATE_INFO integrity checks, exposing high confidentiality and integrity impact per the CVSS 9.1 rating. There is no public exploit identified at time of analysis, and EPSS is low (0.15%, 5th percentile), indicating no observed exploitation activity.