Red Hat
Monthly
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
DuckDB is a SQL database management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out-of-bounds heap write in the Linux kernel's Btrfs filesystem allows local corruption of adjacent memory when btrfs_encode_fh() encodes a connectable file handle whose parent inode resides in a different subvolume/root. The function reserves only BTRFS_FID_SIZE_CONNECTABLE (32 bytes) but then writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (40 bytes), producing an 8-byte overflow at fid->parent_root_objectid when the caller's buffer (*max_len) is undersized. No public exploit has been identified at time of analysis, EPSS is low (0.07%), and the upstream commit notes the condition is not easily triggerable, making this a defensive hardening fix rather than an urgent externally-exploited flaw.
Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local privilege-relevant memory corruption in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem stems from flawed user-message limit accounting, including improper reference counting and a use-after-free when messages are allocated in the receive path. A local user with access to the IPMI device can trigger the flaw to crash the system or potentially corrupt kernel memory, and while tagged as Denial of Service, the CVSS:3.1 vector rates full confidentiality, integrity, and availability impact (7.8). There is no public exploit identified at time of analysis, and the very low EPSS score (0.03%, 10th percentile) reflects limited near-term mass-exploitation expectation.
Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.
Denial of service in the Linux kernel networking stack (page_pool subsystem) can crash affected systems at boot, originally observed on 32-bit PA-RISC hardware. The PP_MAGIC_MASK introduced for page_pool page tagging was defined too wide, causing page_pool_page_is_pp() to mistake ordinary kernel pointers for page_pool-tagged pages (false positives) and panic the machine. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.03%); this is a reliability/robustness regression rather than an attacker-driven flaw.
Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
The Datadog Agent collects events and metrics from hosts and sends them to Datadog. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
Ceph is a distributed object, block, and file storage platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
Local privilege-adjacent memory corruption in the Linux kernel's AF_XDP (XSK) transmit path allows a local user with access to an XDP socket to bypass descriptor validation via integer overflow, queuing malformed frames and triggering undefined behavior. The flaw stems from unchecked arithmetic in xp_aligned_validate_desc()/xp_unaligned_validate_desc() when a non-zero tx_metadata_len is combined with a crafted xdp_desc, and carries a CVSS of 7.8. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis; it is not listed in CISA KEV.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
Denial of service in the Linux kernel's SUNRPC/GSS-Kerberos (krb5) implementation allows remote attackers to crash the system via a zero-length RPCSEC_GSS checksum. When xdr_stream_decode_opaque_auth() decodes an auth token whose checksum length is zero, checksum.data is set to NULL, and gss_krb5_verify_mic_v2() then dereferences that NULL pointer, triggering a kernel panic. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N with A:H only) reflects availability-only impact; EPSS is very low (0.03%, 10th percentile) and there is no public exploit identified at time of analysis, though a vendor patch is available.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
A flaw was found in Red Hat Single Sign-On. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in DevTools in Google Chrome prior to 126.0.6478.182 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
Inappropriate implementation in Fullscreen in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required. No vendor patch available.
js-yaml is a JavaScript YAML parser and dumper. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) vulnerability could allow attackers to modify object prototypes to inject properties affecting application logic.
Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. Rated medium severity (CVSS 4.0), this vulnerability is no authentication required, low attack complexity. Public exploit code available.
DuckDB is a SQL database management system. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Out-of-bounds heap write in the Linux kernel's Btrfs filesystem allows local corruption of adjacent memory when btrfs_encode_fh() encodes a connectable file handle whose parent inode resides in a different subvolume/root. The function reserves only BTRFS_FID_SIZE_CONNECTABLE (32 bytes) but then writes BTRFS_FID_SIZE_CONNECTABLE_ROOT (40 bytes), producing an 8-byte overflow at fid->parent_root_objectid when the caller's buffer (*max_len) is undersized. No public exploit has been identified at time of analysis, EPSS is low (0.07%), and the upstream commit notes the condition is not easily triggerable, making this a defensive hardening fix rather than an urgent externally-exploited flaw.
Timing side-channel in the Linux kernel's SCTP subsystem allows remote attackers to defeat message-authentication (MAC) integrity by measuring non-constant-time byte-by-byte MAC comparisons, enabling forgery of authenticated SCTP data. The flaw affects the in-kernel SCTP implementation across multiple stable kernel series and was resolved by switching to a constant-time comparison helper. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with the high attack complexity of a practical network timing attack.
Local privilege-adjacent memory corruption in the Linux kernel's listmount() mount-enumeration syscall arises because the code invoked path_put() while still holding the namespace semaphore; if that call drops the final reference to a path, cleanup runs under the held lock and can trigger a use-after-free or deadlock. Any local user able to call listmount() is affected on vulnerable stable kernels, and while EPSS is very low (0.03%) with no public exploit identified at time of analysis, the NVD-assigned CVSS of 7.8 reflects full CIA impact from local exploitation. The fix relocates the reference drop to outside the lock across three stable-branch commits.
Local privilege-relevant memory corruption in the Linux kernel's IPMI (Intelligent Platform Management Interface) subsystem stems from flawed user-message limit accounting, including improper reference counting and a use-after-free when messages are allocated in the receive path. A local user with access to the IPMI device can trigger the flaw to crash the system or potentially corrupt kernel memory, and while tagged as Denial of Service, the CVSS:3.1 vector rates full confidentiality, integrity, and availability impact (7.8). There is no public exploit identified at time of analysis, and the very low EPSS score (0.03%, 10th percentile) reflects limited near-term mass-exploitation expectation.
Local memory corruption in the Linux kernel's resource-limit syscall (prlimit64) stems from unsafe locking in the sys_prlimit64()->do_prlimit() path, where task_lock(tsk->group_leader) can operate on an already-freed or concurrently-changed task_struct. When a low-privileged local user targets another process that exits, execs, or performs a multithreaded exec, the kernel may take the wrong lock or dereference freed memory, enabling a use-after-free race. No public exploit is identified at time of analysis and EPSS exploitation probability is very low (0.03%), but the CVSS 3.1 score of 7.8 reflects high confidentiality, integrity, and availability impact via local access.
Denial of service in the Linux kernel networking stack (page_pool subsystem) can crash affected systems at boot, originally observed on 32-bit PA-RISC hardware. The PP_MAGIC_MASK introduced for page_pool page tagging was defined too wide, causing page_pool_page_is_pp() to mistake ordinary kernel pointers for page_pool-tagged pages (false positives) and panic the machine. There is no public exploit identified at time of analysis, and EPSS exploitation probability is negligible (0.03%); this is a reliability/robustness regression rather than an attacker-driven flaw.
Out-of-bounds buffer over-read in the Linux kernel ext4 filesystem driver allows disclosure of adjacent kernel memory or a system crash when a maliciously crafted ext4 superblock is mounted. The flaw lives in parse_apply_sb_mount_options(), which trusted the s_mount_opts field to be NUL-terminated (a guarantee normally provided only by tune2fs); a non-terminated string causes the parser to read past the buffer. There is no public exploit identified at time of analysis, and EPSS rates practical exploitation as very low (0.07%), consistent with a local-only, mount-triggered issue rather than a remote mass-exploitation candidate.
Filesystem corruption and denial of service in the Linux kernel's ext4 extended-attribute (EA) inode handling allows a local attacker who can mount a crafted or corrupted ext4 image to trigger a reference-count underflow in ext4_xattr_inode_update_ref(). Because the code previously read an EA inode refcount that was already <= 0 and still applied the change (typically -1), it proceeded on a bogus negative value, spawning EXT4-fs errors and orphan/cleanup churn. No public exploit identified at time of analysis, and the EPSS score is very low (0.07%), consistent with a corruption-triggered fault rather than a readily weaponized remote flaw.
Denial of service in the Linux kernel's SCTP stack (net/sctp) allows a NULL-pointer dereference in the sctp_sf_do_5_1D_ce() COOKIE ECHO state-machine handler, crashing the kernel. When processing an incoming SCTP association setup, if the peer adaptation indication is zero and the authkey ulpevent allocation returns NULL, the uninitialized ai_ev pointer is passed to sctp_ulpevent_free() and dereferenced, panicking the system. The issue affects hosts actively using SCTP; there is no public exploit identified at time of analysis and EPSS risk is low (0.07%).
Memory corruption in the Linux kernel TCP stack allows a race between closing a listening socket and processing an in-flight TCP Fast Open (TFO) connection request to trigger a refcount underflow and double-free of the request socket, originally caught by syzbot. The flaw sits in tcp_conn_request(), which redundantly calls reqsk_fastopen_remove() after inet_child_forget()/tcp_disconnect() has already released the request socket, corrupting the listener's refcount. There is no public exploit identified at time of analysis and EPSS is very low (0.07%), but as a remotely reachable kernel use-after-free it warrants patching on IPv4/IPv6 servers that accept TFO connections.
Resource exhaustion in the Linux kernel's BPF subsystem allows gradual, unbounded kernel memory consumption (kmalloc-256 slab) leading to denial of service on hosts using the bpf_redirect_neigh() helper on the collect-metadata vxlan datapath. The __bpf_redirect_neigh_v4/v6 code called skb_dst_set() to attach a new dst entry without first releasing the metadata_dst that vxlan had already attached, leaking one dst object per redirected packet. The condition was observed in production on Cilium egress-gateway deployments, where decapsulated Pod traffic is forwarded via bpf_redirect_neigh(); EPSS is low (0.07%) and there is no public exploit identified at time of analysis.
Local privilege-escalation and memory-corruption in the Linux kernel's crypto skcipher (symmetric block cipher) framework allows a low-privileged local user to corrupt kernel memory by exercising an skcipher algorithm that declares its request size via the new cra_reqsize field. The regression stems from commit afddce13ce81d, which added cra_reqsize for ahash/acomp but left skcipher's framework paths unaware of it, so per-request scratch buffers are undersized. EPSS is negligible (0.03%), the issue is not on the CISA KEV list, and no public exploit is identified - the tags characterize the practical outcome as denial of service (kernel crash), though memory corruption leaves privilege escalation theoretically possible.
The Datadog Agent collects events and metrics from hosts and sends them to Datadog. Rated high severity (CVSS 7.0), this vulnerability is low attack complexity. No vendor patch available.
Ceph is a distributed object, block, and file storage platform. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in dvsekhvalnov jose2go 1.5.0 thru 1.7.0 allowing an attacker to cause a Denial-of-Service (DoS) via crafted JSON Web Encryption (JWE) token with an exceptionally high. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.166 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Memory-safety fault in the Linux kernel's kTLS (kernel TLS) receive path allows use-after-free on socket buffers and stray writes into userspace memory after recv() has returned when async record decryption is used and an atomic skb clone allocation fails. Affected systems are those whose applications enable in-kernel TLS with asynchronous decryption; an attacker able to induce memory pressure while TLS records are inflight can corrupt kernel/user memory or leak data. Tagged as Information Disclosure, EPSS is negligible (0.03%), no public exploit is identified, and the issue is fixed upstream and shipped by distributions (Ubuntu USN-8125-1/USN-8126-1).
Missing memory-barrier ordering in the x86 memory-management code of the Linux kernel allows stale TLB entries to persist after an address-space switch, because switch_mm_irqs_off() can fail to observe a recent tlb_gen update from flush_tlb_mm_range(). On affected x86 SMP systems a local, low-privileged process could read or corrupt memory mappings it should no longer have access to, mapping to the CVSS 7.8 high/high/high impact. No public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 10th percentile), indicating this is a subtle correctness/race fix rather than an actively-targeted flaw.
Unbounded network device headroom growth in the Linux kernel's IPv6 tunnel driver (net/ip6_tunnel) lets the dev->needed_headroom value increase perpetually because, unlike its IPv4 counterpart, it lacked a ceiling. The fix ports the IPv4 headroom-growth limit (commit 5ae1e9922bbd) to the IPv6 path, capping repeated headroom adjustments. There is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.07%), so this is a stability/robustness hardening fix rather than an actively weaponized flaw.
Memory corruption in the Linux kernel's accel/qaic driver (Qualcomm Cloud AI 100 accelerator) allows a local user to trigger a general protection fault by submitting a DMA transfer request with a zero length, or when the device requests continuation (QAIC_TRANS_DMA_XFER_CONT) after all bytes have already been transferred. In these cases find_and_map_user_pages() returns 0 without allocating the scatter-gather table, and encode_addr_size_pairs() then dereferences the unallocated sgt, faulting the kernel. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis, but distro patches (Ubuntu USN-8125-1/8126-1) are already shipping.
Resource exhaustion in the Linux kernel's NVMe-oF Fibre Channel target driver (nvmet-fc) stems from a reference-counting error in Link Service request handling: when multiple asynchronous LS commands are in flight from __nvmet_fc_send_ls_req, each takes a tgtport reference but only a single put-work item is queued, leaking the surplus references. Systems acting as NVMe-over-Fabrics FC targets are affected, and the leaked references prevent proper teardown of the target port, degrading availability over time. This is a defensive kernel hardening fix with no public exploit identified at time of analysis and a very low EPSS (0.05%).
Local information disclosure and potential use-after-free in the Linux kernel networking stack stems from unprotected reads of the destination cache device pointer (dst->dev) in sk_setup_caps() and related IPv4/IPv6 forwarding paths. Affected builds accessed dst->dev without RCU protection, allowing a concurrent update to free the device while another CPU dereferenced it. There is no public exploit identified at time of analysis, EPSS probability is negligible (0.03%), and the issue is not in CISA KEV; the upstream fix switches these call sites to the RCU-safe dst_dev_rcu()/dst_dev_net_rcu() helpers.
Local privilege-relevant memory corruption in the Linux kernel eBPF verifier arises because check_alu_op() validated the signed 16-bit instruction offset with 'insn->off > 1', which silently accepts negative values such as -1 instead of only 0 and 1. A local user able to load BPF programs can submit malformed ALU instructions (BPF_DIV/BPF_MOD) that bypass verifier bounds, undermining the safety guarantees the verifier is meant to enforce. No public exploit identified at time of analysis; EPSS is negligible (0.03%), and Ubuntu has shipped fixes.
Denial-of-service in the Linux kernel ext4 filesystem driver allows a local attacker to trigger a kernel BUG_ON (panic) by inducing a victim to mount and access a specially crafted, corrupted ext4 image. The flaw stems from an inode that illegally carries both the INLINE_DATA and EXTENTS flags, which causes extent-tree validation to be skipped and an integer underflow during hole-size calculation in ext4_es_cache_extent(). Discovered via the syzbot fuzzer, it carries a low EPSS score (0.07%, 21st percentile), is not on the CISA KEV list, and has no public exploit identified at time of analysis, though a syzbot reproducer effectively exists.
Improper resource cleanup in the Linux kernel's Intel Xe DRM driver (drm/xe/guc) lets a local user trigger a memory-management fault when destroying a GPU exec queue after the GuC firmware has already been stopped - for example during a forced driver unbind. Because the driver waits for a GuC response that can never arrive, exec queue resources are never freed, leaving the GuC ID manager and VRAM manager in an unclean state and producing kernel WARNING/ERROR traces. The upstream fix (cherry-picked from commit 9b42321a02c5) releases the resources directly when the GuC is not running; EPSS is very low (0.03%) and there is no public exploit identified at time of analysis.
Local resource-leak and kernel-warning condition in the Linux kernel's NXP i.MX8-ISI mem2mem (m2m) media driver (imx8-isi) lets a local user with access to the V4L2 video device leave an ISI channel permanently allocated by terminating a streaming application uncleanly (e.g. Ctrl+C), because imbalanced streamon/streamoff calls prevent the m2m usage_count from reaching zero. On i.MX95-class hardware, streaming with an input line width greater than 2K additionally trips a WARN_ON() in mxc_isi_channel_chain(). This carries a low EPSS (0.03%, 10th percentile), is not on CISA KEV, and has no public exploit identified at time of analysis; a vendor fix is available.
Local privilege-adjacent memory corruption in the Linux kernel's AF_XDP (XSK) transmit path allows a local user with access to an XDP socket to bypass descriptor validation via integer overflow, queuing malformed frames and triggering undefined behavior. The flaw stems from unchecked arithmetic in xp_aligned_validate_desc()/xp_unaligned_validate_desc() when a non-zero tx_metadata_len is combined with a crafted xdp_desc, and carries a CVSS of 7.8. EPSS is very low (0.03%) and there is no public exploit identified at time of analysis; it is not listed in CISA KEV.
Denial-of-service and potential kernel information disclosure in the Linux kernel IPv6 stack arises from a use-after-free in ip6_output(), where the network device destination (dst) could be freed while still referenced during packet transmission. The fix wraps ip6_output() in an RCU read-side critical section and uses dst_dev_rcu() so the device pointer stays valid, removing now-redundant rcu_read_lock/unlock pairs from ip6_finish_output2(). No public exploit identified at time of analysis; EPSS is very low (0.03%) and the flaw is not in CISA KEV, but the CVSS 8.1 rating reflects the memory-safety impact of a UAF in the packet output path.
Denial of service (and potential information disclosure) in the Linux kernel's Intel VT-d IOMMU debugfs interface allows a privileged local user to crash the host by reading the domain translation dump. When a device's context entry uses a legacy-mode translation type other than 00b/01b, the SSPTPTR field is uninitialized or zero, and the debugfs code walks it as a valid page-table pointer, producing a general-protection fault on a non-canonical address. No public exploit identified at time of analysis; EPSS is negligible (0.03%) and this is not in CISA KEV.
Local denial of service in the Linux kernel's LoongArch BPF JIT allows a low-privileged local user with BPF tracing capability to crash the system by attaching a trampoline (fentry/fexit) program to a function whose arguments include a struct passed by value. On LoongArch the trampoline code never implemented struct-by-value handling, so the generated code dereferences an invalid address and triggers a kernel oops with subsequent RCU stalls. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is 0.03% (10th percentile), consistent with a niche, architecture-specific crash rather than a widely weaponized flaw.
Memory corruption in the Linux kernel Bluetooth Isochronous (ISO) channel subsystem allows a use-after-free when iso_conn_free() runs without conn->sk being cleared to NULL, mirroring a previously fixed SCO flaw. An attacker within Bluetooth range able to establish or tear down ISO connections can trigger the dangling-pointer condition to corrupt kernel memory, potentially escalating privileges or crashing the host. It carries a CVSS 8.0 (high) score; no public exploit has been identified and EPSS is very low (0.03%), indicating no observed exploitation activity.
Denial-of-service race condition in the Linux kernel's rtl8150 USB-to-Ethernet driver allows a kernel WARNING and double URB submission when the ndo_set_rx_mode path (rtl8150_set_multicast) improperly wakes the TX queue before an in-flight transmit URB completes, colliding with rtl8150_start_xmit. It affects systems using an RTL8150-based USB Ethernet adapter and was surfaced by syzbot fuzzing; no public exploit identified at time of analysis and EPSS is low (0.07%). The supplied 8.8 CVSS (AV:A/C:H/I:H/A:H) appears substantially inflated for what is fundamentally a local driver race with availability impact.
Use-after-free in the Linux kernel IPv6 stack's ip6_xmit() transmit path allows attackers to corrupt or read freed kernel memory when a destination cache (dst) entry and its associated network device are released concurrently during packet transmission. The fix converts the device dereference to an RCU-protected access via dst_dev_rcu(), closing a race window that could yield information disclosure or memory corruption. No public exploit has been identified at the time of analysis; EPSS exploitation probability is negligible (0.03%, 10th percentile).
Use-after-free in the Linux kernel's MPTCP (Multipath TCP) subsystem allows potential kernel memory corruption during active connection establishment. The flaw lives in mptcp_active_enable(), reached via subflow_finish_connect()/sk_rx_dst_set(), where the destination cache is dereferenced (sk_dst_get(sk)->dev) outside RCU protection, permitting a freed dst/device pointer to be accessed. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%), indicating negligible observed exploitation despite the 8.1 CVSS.
Denial of service in the Linux kernel's SUNRPC/GSS-Kerberos (krb5) implementation allows remote attackers to crash the system via a zero-length RPCSEC_GSS checksum. When xdr_stream_decode_opaque_auth() decodes an auth token whose checksum length is zero, checksum.data is set to NULL, and gss_krb5_verify_mic_v2() then dereferences that NULL pointer, triggering a kernel panic. The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N with A:H only) reflects availability-only impact; EPSS is very low (0.03%, 10th percentile) and there is no public exploit identified at time of analysis, though a vendor patch is available.
Local memory-safety mishandling in the Linux kernel's SPARC (UltraSPARC III) copy_from_user/copy_to_user routines causes these functions to return impossibly large "bytes not copied" values when a user-space access faults, because the %o2 register masking was performed after the bulk copy loop instead of before the exception handlers ran. Downstream consumers such as __copy_from_iter propagate the bogus count, which was observed triggering a BUG_ON in ext4 with large folios enabled, and can lead to kernel state corruption, information disclosure of uninitialized memory, or denial of service. No public exploit is identified at time of analysis (EPSS 0.09%, not in CISA KEV); the flaw is limited to legacy SPARC hardware.
Memory corruption in the Linux kernel pm80xx SCSI driver (drivers/scsi/pm8001/pm8001_sas.c) lets a privileged local operation trigger an out-of-bounds array write when a module unload (rmmod) occurs on a system with a SAS expander attached. Introduced by commit f7b705c238d1, the flaw causes the driver to index the fixed 16-entry pm8001_ha->phy array with a remote expander phy id (observed index 28), corrupting kernel memory during teardown. No public exploit identified at time of analysis; EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, consistent with a stability/robustness bug rather than a weaponized escalation path.
Local privilege escalation and memory corruption in the Linux kernel's pci_endpoint_test misc driver stems from an array underflow reachable through the driver's ioctl handler. A regression from commit eefb83790a0d (which added the doorbell test case and introduced NO_BAR = -1 into the pci_barno enum, silently converting it to a signed type) lets a user passing a negative BAR number in pci_endpoint_test_ioctl() drive pci_endpoint_test_bar() to index before the start of the BAR array. There is no public exploit identified at time of analysis and EPSS rates near-term mass exploitation at 0.03%, but the flaw affects the ubiquitous Linux kernel wherever the pci-endpoint-test device node is exposed.
Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Local privilege-escalation-capable use-after-free in the Linux kernel's vmwgfx DRM driver (drm/vmwgfx) lets a low-privileged local user trigger a stale-pointer dereference during GPU command-buffer validation. During vmw_execbuf_process, a validation node held in the duplicates hashtable is backed by an arena allocator that is bulk-cleared at the end of processing; because the node's resource is destroyed prematurely, it escapes vmw_validation_drop_ht, leaving a dangling reference into freed memory that can be reused. There is no public exploit identified at time of analysis and it is not on the CISA KEV list, but the CVSS 7.8 rating with full confidentiality/integrity/availability impact makes it a meaningful local escalation primitive on VMware Linux guests.
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incus is a system container and virtual machine manager. Rated high severity (CVSS 8.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OAuth2-Proxy is an open-source tool that can act as either a standalone reverse proxy or a middleware component integrated into existing reverse proxy or load balancer setups. Rated high severity (CVSS 8.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect security UI in SplitView in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 4.2), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Out of bounds read in WebXR in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds read in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in PageInfo in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Race in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference vulnerability exists in GNU libmicrohttpd v1.0.2 and earlier. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.0). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.
KubeVirt is a virtual machine management add-on for Kubernetes. Rated medium severity (CVSS 4.7). Public exploit code available.
containerd is an open-source container runtime. Rated medium severity (CVSS 6.9), this vulnerability is no authentication required, low attack complexity. This Memory Leak vulnerability could allow attackers to exhaust available memory leading to denial of service.
A flaw was found in Red Hat Single Sign-On. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.