Suse
Monthly
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Unbounded resource allocation and decompression amplification in Apache Thrift's C++ bindings (all versions before 0.25.0) let remote, unauthenticated clients force excessive memory and CPU consumption by sending highly compressed or amplified Thrift payloads to a service that deserializes attacker-controlled input, degrading or denying service availability. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity loss, and no public exploit code was identified at time of analysis, so real-world risk is driven mainly by whether a Thrift endpoint is exposed to untrusted clients. No EPSS score or CISA KEV listing was supplied in the source intelligence, so no exploitation-probability or active-exploitation claim can be made.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
Uninitialized-resource handling in the Apache Thrift C++ WebSocket server causes the server to return incorrect status codes and potentially leak stale memory contents in responses. All Apache Thrift releases before 0.25.0 are affected, but only deployments that actually run the C++ WebSocket server transport are exposed - the default binary and framed socket transports are not in scope. Exploitation is remote and requires no authentication or user interaction, but an attack-requirement precondition (AT:P in the vendor CVSS 4.0 vector, a specific server state or timing condition) makes it unreliably repeatable, and impact is limited to low integrity effects with no confirmed confidentiality or availability loss; no public exploit identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one, and the vendor-released fix is Apache Thrift 0.25.0.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
TLS hostname verification in the Apache Thrift C++ and D libraries can be bypassed, letting a man-in-the-middle present a certificate that chains to an already-trusted CA and still be accepted for the wrong hostname. The default access managers shipped with the C++ TSSLSocketFactory (versions 0.7.0 through 0.24.0) and the D accessManager property (versions 0.9.0 through 0.24.0) treat a non-matching subjectAltName dNSName as a 'skip' instead of a rejection and then fall back to the certificate Common Name, which violates RFC 6125 section 6.4.4 and RFC 9525 section 2. Because public CAs have not issued on Common Name alone for years, the practical exposure is confined to private or enterprise PKI deployments where such certificates still exist, and exploitation additionally requires an on-path attacker plus a CN-matching certificate from a trusted CA; unauthenticated per the CVSS 4.0 vector (PR:N) and no public exploit identified at time of analysis.
Improper TLS certificate validation in the Apache Thrift Python bindings (all versions before 0.25.0) allows a man-in-the-middle attacker to present a forged or otherwise invalid certificate and have it accepted, breaking the confidentiality and integrity guarantees of Thrift RPC traffic. Because the flaw also returns an incorrect status code on the failed validation path, code that inspects the returned status may mistakenly treat a rejected or malicious connection as legitimate. Exploitation is conditional rather than opportunistic: the attacker must already occupy a man-in-the-middle position on the network path (AT:P, AC:H) and the victim deployment must actually rely on Thrift's Python TLS transport for trust; authentication is not required (PR:N) and no user interaction is needed (UI:N). No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Uninitialized-resource handling in Apache Thrift's c_glib (C/GLib) bindings before 0.25.0 allows unauthenticated, network-reachable attackers to read stale memory contents or receive incorrect status codes from a service built with those bindings, producing limited information disclosure and low availability impact with no integrity impact. There is no public exploit identified at time of analysis, and independent assessment rates this moderate rather than urgent because exposure is narrow (only processes compiled against the c_glib binding are implicated, not Java, Python, C++, Go, or other bindings) and the CVSS attack-requirement metric (AT:P in the CVSS 4.0 vector, AC:H in the assessed CVSS 3.1 vector) signals that a specific request/protocol condition must be met before the vulnerable path triggers.
GNU GRUB 2.x does not validate the MMIO base address passed to its serial command, allowing a local attacker with high privileges (PR:H) who controls GRUB's configuration to write limited non-arbitrary data to an arbitrary memory address and reset the grub_file_verifiers list, thereby loading unsigned GRUB modules while GRUB still reports lockdown as enabled. The issue only matters when Secure Boot and GRUB lockdown mode are active; it is not remotely reachable (AV:L) and requires high attack complexity (AC:H) to select a base address that yields the needed writes. A vendor fix is available as an upstream commit, but no released patched version is independently confirmed, and no public exploit identified at time of analysis.
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.
Local attackers with low privileges can inject crafted text into the kernel log on Linux systems running the NVIDIA GPU Display Driver because the kernel mode layer fails to sanitize a supplied version string, leading to denial of service and data tampering. The vulnerability requires local access (AV:L) and low privileges (PR:L) with no user interaction, and has low impact on integrity and availability (I:L/A:L) with no confidentiality loss. No public exploit identified at time of analysis, and the overall risk is low despite the wide deployment of NVIDIA GPUs.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux occurs when a NULL pointer dereference is triggered in the kernel-mode layer, crashing or hanging the graphics subsystem on the affected host. Only systems with a physical NVIDIA GPU (GeForce, RTX/Quadro/NVS, or Tesla branches) running a driver older than the branch-specific fixed release are exposed, and exploitation requires an attacker who already holds HIGH privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so an unprivileged local user cannot reach the vulnerable interface. There is no confidentiality or integrity impact, no public exploit code and no confirmed active exploitation (not in CISA KEV), and the EPSS score was not reported; the high-privilege prerequisite caps real-world priority at LOW despite the nominal MEDIUM CVSS.
Denial of service in NVIDIA GPU Display Driver on Windows and Linux is possible when a highly privileged local attacker reaches a firmware code path that dereferences a null pointer. Affected products include GeForce, RTX/Quadro/NVS, and Tesla driver branches prior to the fixes documented in NVIDIA bulletin 5861, with some older branches limited to Maxwell, Volta, and Pascal GPUs. The assessed vector is local and requires high privileges, with availability impact only; no public exploit identified at time of analysis, and the low CVSS score of 4.4 reflects those constraints.
Information disclosure in the NVIDIA GPU Display Driver kernel-mode component (Windows and Linux) lets an authenticated local user read another process's GPU channel state, because the driver performs missing authorization checks (CWE-862) when a process requests channel state it does not own. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires a pre-existing local, low-privileged foothold and yields confidentiality impact only - no integrity or availability effect - and there is no public exploit identified at time of analysis. Practical risk concentrates on hosts where multiple security contexts share the same GPU, such as multi-user workstations, VDI, and cloud/virtual-GPU deployments; single-user desktops with one active GPU context gain little from this primitive, so the overall priority is low-to-moderate and locally scoped.
Local information disclosure in NVIDIA Display Driver for Windows and Linux allows an authenticated local user with low privileges to access another process's GPU channel state because the kernel-mode driver omits authorization checks. Affected platforms include NVIDIA GeForce, RTX/Quadro/NVS, and Tesla GPUs; the issue is rated CVSS 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit was identified at time of analysis, and the practical risk is greatest in multi-user or multi-tenant GPU environments such as VDI and cloud-GPU deployments.
Local, authenticated, low-privilege users on Linux hosts can cause a denial-of-service condition against the NVIDIA GPU Display Driver kernel-mode layer by repeatedly invoking an interface that emits unrate-limited error messages, leading to uncontrolled kernel log generation and resource exhaustion. Affected products include GeForce, RTX/Quadro/NVS, and Tesla GPU families running the Linux driver, as reflected in the NVIDIA CPE entries. Despite the moderate 5.5 CVSS score, this is a low-priority issue because exploitation requires local code execution with no remote or unauthenticated path, only availability is impacted, and no public exploit has been identified at time of analysis.
Denial of service in NVIDIA GPU Display Driver for Linux arises when a local authenticated low-privileged user exhausts the DRM VMA offset address space, causing uncontrolled resource consumption in the kernel mode layer. The issue is limited to Linux and to availability impact; exploitation requires an existing local foothold and cannot provide code execution, privilege escalation, or data disclosure. No public exploit was identified at time of analysis, and the assessed risk is low, though shared or multi-tenant GPU systems such as VDI, cloud GPU, and Tesla/vGPU deployments face the greatest practical disruption.
Kernel memory exhaustion in the NVIDIA GPU Display Driver for Linux allows a local, unprivileged user to repeatedly drive error-handling paths in the driver's kernel-mode layer so that leaked allocations accumulate until kernel memory is depleted, resulting in a denial of service on the affected host. The flaw (CWE-401) affects the Linux display driver across the GeForce, RTX/Quadro/NVS and Tesla product lines, including vGPU guest-driver and Virtual GPU Manager deployments, and is local-only, requiring an existing low-privileged account (AV:L/PR:L) with no user interaction and causing availability-only impact (C:N/I:N/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation requires an attacker who already holds a shell on the box and can sustain repeated triggering; the practical risk concentrates on shared, multi-tenant GPU hosts (vGPU, VDI, cloud GPU) where one tenant's resource exhaustion degrades every other workload on the same kernel.
Local denial of service in the NVIDIA GPU Display Driver for Linux lets any unprivileged user on the host trigger a NULL pointer dereference (CWE-476) inside the driver's kernel-mode layer, crashing or destabilising the graphics kernel component (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 5.5). The flaw spans NVIDIA's GeForce, RTX/Quadro/NVS and Tesla product lines and is bounded strictly to availability impact - there is no confidentiality or integrity loss and no path to privilege escalation - so the practical blast radius is limited to disrupting the machine, and is materially more serious only on multi-tenant or shared-GPU hosts (VDI, cloud GPU) where one low-privilege user's crash affects other tenants. Exploitation requires local access with a normal, non-privileged account and direct interaction with the driver's kernel interface; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local attackers with low-privileged access can read uninitialized kernel memory from NVIDIA GPU Display Drivers on Windows and Linux, leading to information disclosure. The flaw resides in the kernel-mode driver and requires an existing account on the target system (CVSS 3.1: AV:L/PR:L, 5.5 Medium). No public exploit code or active exploitation has been identified at time of analysis.
NULL pointer dereference in the NVIDIA GPU Display Driver kernel module for Linux allows an authenticated local attacker to crash the driver, resulting in denial of service. Affected products include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver (vGPU) product lines. Exploitation requires an unprivileged local account (CVSS vector AV:L/PR:L) and yields only denial of service with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in NVIDIA Display Driver on Windows and Linux allows a local low-privileged attacker to crash the kernel-mode driver by triggering a divide-by-zero condition. Affected product branches include GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager builds prior to the fixed versions in NVIDIA bulletin 5861, with impact limited to availability and no public exploit identified at time of analysis.
Local denial of service in NVIDIA GPU Display Driver for Linux lets a logged-in user or a low-privileged process with GPU device access (PR:L, confirmed via CVSS vector) crash the kernel mode driver by submitting a crafted ioctl that triggers a NULL pointer dereference (CWE-476), rated CVSS 5.5 Medium. Impact is availability-only - the assessed vector shows C:N/I:N/A:H, so no privilege escalation, code execution, or data exposure is achievable, and the attack is strictly local, not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied for this CVE.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux arises from improper access control (CWE-862) in the kernel-mode layer, where a local user with a low-privileged account can invoke a driver interface they should not be authorized to reach and thereby crash or hang the affected system. Impact is limited to availability: with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 5.5, Medium), exploitation requires pre-existing local authenticated access on a host running an affected driver branch - GeForce, RTX/Quadro/NVS, Tesla, or the vGPU Guest Driver/Virtual GPU Manager - and no remote path exists. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and no code execution, privilege escalation, or data disclosure is achievable, making this a low-to-moderate operational priority that is chiefly relevant to multi-user, VDI, and shared-workstation environments.
Privilege escalation and potential code execution in the NVIDIA GPU Display Driver for Windows and Linux arise from an incorrect permission assignment (CWE-732) within a secure microcontroller component, allowing an attacker who already holds privileged local access to write to protected memory that should be restricted. Exploitation is gated by two strong prerequisites - the CVSS vector (AV:L/AC:H/PR:H/UI:N) requires local access with administrator/root-equivalent privileges and high attack complexity - so this is a genuine but lower-tier risk that primarily matters as a post-compromise escalation or persistence primitive rather than a standalone entry vector. Affected branches include GeForce (only Maxwell, Volta, and Pascal architecture GPUs), RTX/Quadro/NVS, and Tesla data-center drivers below the branch-specific fixed versions in NVIDIA bulletin 5861; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Use-after-free in the NVIDIA GPU Display Driver kernel module (CVE-2026-47586) allows an attacker with local access to the GPU device on Windows or Linux to corrupt kernel memory, with potential outcomes including code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vendor CVSS vector (AV:P/AC:H/PR:N) is anomalous - designating physical access and no privileges - while the independent assessment uses AV:L/AC:H/PR:L, indicating that exploitation is not remotely triggerable and instead depends on winning a timing/command-sequence race after obtaining local low-privileged access to the driver. No public exploit code or confirmed active exploitation is identified at time of analysis, and exploitation signals point to a low-to-moderate real-world priority despite the memory-corruption impact.
Improper input validation in NVIDIA GPU Display Driver firmware for Windows and Linux (GeForce, RTX/Quadro/NVS, and Tesla product lines) allows a locally positioned attacker who already holds high privileges to trigger code execution, denial of service, privilege escalation, information disclosure, and data tampering within the GPU firmware handling path. Scoring 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the flaw is not remotely reachable and cannot be exercised by an unprivileged local user, so it is best characterized as a post-compromise privilege/kernel-boundary escalation rather than an initial-access vector. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation; EPSS scoring was not provided in the available intelligence.
Local high-privileged attackers can exploit improper input validation in NVIDIA GPU Display Driver firmware on Windows and Linux to potentially achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. The assessed CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms local access and high privileges (PR:H), so this is realistically a post-compromise escalation/persistence primitive rather than an initial-access vulnerability. No public exploit identified at time of analysis.
Improper input validation in the NVIDIA GPU Display Driver kernel-mode layer allows a local high-privileged attacker to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. Affected products include GeForce, RTX/Quadro/NVS, and Tesla drivers on Windows and Linux. Exploitation requires administrator or root-equivalent access (PR:H), so risk is limited to scenarios where a high-privilege account is already compromised; no public exploit code is identified at time of analysis.
Improper input validation in the kernel-mode layer of the NVIDIA GPU Display Driver on Windows and Linux allows a local attacker who already holds high privileges to execute code, escalate privileges, disclose information, or crash the system. The flaw is not remotely reachable (AV:L) and requires existing HIGH privileges (PR:H) to reach the vulnerable kernel code path, with no user interaction needed; the resulting CVSS 3.1 base score is 6.7. There is no public exploit identified at time of analysis and no EPSS score or KEV listing was provided in the available intelligence, making this a moderate-priority local privilege-escalation/kernel-compromise primitive rather than an internet-facing emergency.
An out-of-bounds write in the firmware component of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds administrator or root privileges corrupt memory, with potential outcomes spanning code execution, escalation of privileges, denial of service, information disclosure and data tampering. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-787), the flaw affects GeForce, RTX/Quadro/NVS and Tesla products; exploitation requires local access to the host plus high existing privileges, and no public exploit code was identified at time of analysis, so real-world risk is moderate rather than urgent. No user interaction is required and there is no network attack path, which rules out remote exploitation entirely.
Out-of-bounds write in the NVIDIA GPU Display Driver for Linux kernel mode layer allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, potentially achieving code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected driver branches cover GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions listed in NVIDIA's advisory, and the attack surface is local-only, so real-world risk is assessed as MODERATE-LOW. No public exploit identified at time of analysis.
Improper validation of an array index in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux gives a local, already highly privileged attacker a path to full loss of confidentiality, integrity, and availability on the host. The flaw affects driver branches for GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions published in NVIDIA bulletin 5861, including 580.178.04, 582.78, 595.91.07, 596.86, 610.60, 610.88, 615.71.09 and 616.92 depending on the product line. Exploitation requires local access (AV:L) and pre-existing high privileges (PR:H) to reach the kernel-mode driver interface, with no user interaction and no network vector, so this is a local privilege/kernel-escalation primitive rather than an initial-access vector; no public exploit has been identified at time of analysis. Real-world risk is MODERATE-LOW despite the full-CIA impact assessment, because the attacker must already be highly privileged before the flaw can be touched.
An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, with the potential for code execution, privilege escalation, information disclosure, denial of service, and data tampering. Affected installations are those running GeForce, RTX/Quadro/NVS, or Tesla display drivers at versions below the fixed release for their branch (for example prior to 610.88, 582.78, 616.92, or 580.178.04), on either Windows or Linux. The CVSS 3.1 base score of 6.7 reflects the non-network, high-privilege access prerequisite rather than broad exposure; no public exploit code has been identified at time of analysis.
A kernel-mode out-of-bounds write in the NVIDIA GPU Display Driver for Linux lets a local attacker who already holds high privileges corrupt kernel memory in the driver's kernel mode layer, which the vendor states may lead to code execution, denial of service, privilege escalation, information disclosure and data tampering. The flaw carries a CVSS 3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is strictly local and requires pre-existing elevated/administrative access on the host; there is no network attack vector and no user interaction is needed. Affected systems are Linux hosts running GeForce, RTX/Quadro/NVS or Tesla driver branches below the fixed releases published in NVIDIA security bulletin 5861, and there is no public exploit identified at time of analysis.
Out-of-bounds read in the firmware component of NVIDIA GPU Display Drivers for Windows and Linux allows a local attacker who already holds high privileges (PR:H, per CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) to read memory beyond intended firmware buffer bounds, most plausibly resulting in memory disclosure or a driver/GPU crash, with the vendor also flagging the potential for code execution, escalation of privileges and data tampering. The CVSS 3.1 base score is 6.7; the attack path is local-only, requires no user interaction, and is gated behind pre-existing high privilege, which materially limits real-world exposure. No public exploit code has been identified for this issue and it is not in CISA KEV, so no public exploit identified at time of analysis.
Code execution, privilege escalation, denial of service, information disclosure, and data tampering are all possible on Windows and Linux hosts running unpatched NVIDIA GPU Display Driver branches, because the kernel-mode layer fails to validate an array index (CWE-129) when processing a crafted GPU command. The flaw is strictly local: per the CVSS vector (AV:L, PR:H, UI:N) and our independent assessment, an attacker must already hold high privileges on the machine and be able to submit work to the GPU kernel driver, and there is no network or unauthenticated path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but moderate-priority hardening target for GeForce, RTX/Quadro/NVS, and Tesla deployments; fixed driver builds exist for each affected branch.
An out-of-bounds read in the kernel-mode layer of NVIDIA's GPU Display Driver for Windows and Linux can be triggered by a locally present attacker who already holds high privileges, potentially leading to kernel-context code execution, privilege escalation, denial of service, information disclosure, or data tampering. Exploitation requires local code execution at an elevated privilege level (CVSS vector PR:H) against a vulnerable driver build that is installed and loaded, so there is no remote or unauthenticated path and the practical risk is a defense-in-depth and privilege-boundary concern rather than an initial-access vector; no public exploit has been identified at time of analysis. NVIDIA has published fixed driver builds per product line and branch, and the affected install base spans GeForce, RTX/Quadro/NVS, and Tesla GPUs.
An out-of-bounds read in the NVIDIA GPU Display Driver kernel-mode layer on Windows and Linux lets a locally authenticated attacker who already holds high privileges trigger an unbounded string operation that reads beyond the end of an allocated buffer, with vendor-acknowledged consequences including code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw (CWE-125, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) affects GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest driver builds below the fixed versions published in NVIDIA's 2026 advisory, and exploitation is strictly local - there is no network vector, no user interaction, and no non-default configuration requirement, only a privileged process on an affected host. Real-world risk is moderate and localized: no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so value to an attacker is mainly as a local privilege-escalation or kernel-tampering primitive after an initial foothold.
Kernel-mode out-of-bounds write in NVIDIA GPU Display Driver for Windows and Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) allows a local attacker with high privileges to corrupt kernel memory, potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No public exploit has been identified at time of analysis. Affected driver branches include GeForce prior to 595.91.07, RTX/Quadro/NVS prior to 596.86, Tesla prior to 616.92, and vGPU guest drivers prior to vGPU 19.5/20.1, among others.
An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
Out-of-bounds write in the U-Boot bootloader's RLE8-compressed BMP decoder (video_display_rle8_bitmap in drivers/video/video_bmp.c) lets an attacker who can place or modify a crafted splash/logo image write past the framebuffer, corrupting adjacent memory and crashing the bootloader. All U-Boot versions through 2026.10-rc5 are affected per the wildcard CPE, but exploitation is genuinely constrained: the platform must actually route an attacker-controlled BMP through the BMP display path, which in typical deployments means write access to boot media, the splash partition, or the environment-configured image source, and the outcome is primarily availability loss with only limited integrity impact and no confidentiality exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is moderate rather than critical despite the headline score.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Memory exhaustion in the sshd-sftp component of Apache MINA SSHD (1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets an authenticated remote SFTP client crash the server by driving the SFTP v6 check-file-name/check-file-handle extension to build an oversized reply entirely in server memory. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the session must be authenticated and must negotiate SFTP protocol version 6, and the attacker must point the request at a very large (possibly sparse) file using a tiny block size such as the 256-byte minimum, so that file-size divided by block size yields an enormous number of hashes; availability impact is high while confidentiality and integrity are unaffected. This is a genuine but bounded availability risk with no public exploit identified at time of analysis, and deployments that already cap SFTP message size (typically 256kB, as OpenSSH does) are not exposed.
Memory exhaustion denial of service in Apache MINA SSHD's SCP subsystem (module sshd-scp) affects all releases before 2.20.0 and the 3.0.0-M1 through 3.0.0-M5 milestones, requiring a connected SSH peer that has reached the SCP protocol handler - on a server deployment this typically means successful low-privilege authentication, which is the main gating factor (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium). The peer only needs to stream a single malformed SCP command line that never terminates with an LF, causing the handler to buffer the endless input until the JVM throws OutOfMemoryError and the application crashes; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is a bounded availability issue for deployments that expose or use the SCP subsystem.
Improper input validation in the sshd-git component of Apache MINA SSHD lets authenticated SSH clients write arbitrary files onto the server by invoking 'git archive' with the single-argument '-o=file.zip' form. Only deployments that use GitPgmCommandFactory to expose remote JGit command execution to SSH clients are affected, and the attacker must hold valid SSH credentials (PR:L), so impact is a conditional integrity violation (C:N/I:H/A:N, CVSS 6.5) rather than a confidentiality or availability compromise. The flaw is an incomplete fix for CVE-2026-58624, which restricted git subcommands but missed the '-o=file.zip' variant; no public exploit code and no confirmed active exploitation were identified at time of analysis, and fixed releases are available (2.20.0 and 3.0.0-M6).
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Local users able to run KVM guests on x86 hosts can crash the host kernel by driving KVM's MMU into an inconsistent write-tracking state, because kvm_gfn_is_write_tracked() inspects only the memslot it is handed even though page tracking is per-address-space and shadow pages are shared across address spaces; under SMM emulation a GFN write-tracked in one address space appears untracked through the other, letting mmu_try_to_unsync_pages() mark an upper-level shadow page unsync and trip the BUG in pte_list_remove(). The flaw is scored CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so access is local with low privileges required and impact is limited to host availability with no confidentiality or integrity effect; exploitation requires /dev/kvm access plus a guest configuration that reaches the SMM dual-address-space path. Vendor patches exist for the stable branches (6.1.187, 6.6.156, 6.12.108, 6.18.49, 7.1.13 and 7.2), EPSS is 0.19% (8th percentile), and no public exploit code or CISA KEV entry is identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.
An infinite loop in the TTL trace-file parser of Wireshark 4.6.0 through 4.6.8 lets a crafted capture file hang the application when an analyst opens it, producing a denial of service limited to the local Wireshark process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attacker cannot trigger the flaw remotely or without the victim manually opening the malicious TTL capture, and there is no confidentiality or integrity impact. No public exploit code or confirmed active exploitation was reported at the time of analysis, and no EPSS score was supplied, so the practical risk is low-priority availability loss rather than a broad compromise vector.
A NULL pointer dereference in Wireshark 4.6.0 through 4.6.8 allows a local user to crash the application by opening a crafted PEAK CAN TRC trace file, resulting in denial of service. The flaw requires user interaction to open a malicious file and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 5.5 with availability-only impact.
Memory leakage in Wireshark's IEEE C37.118 Synchrophasor protocol dissector allows a crafted packet capture to progressively exhaust process memory and crash the application on versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation requires a local user to open an attacker-supplied capture that actually contains malformed synchrophasor/PMU traffic, so the C37.118 dissector code path must run; the CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a local, unauthenticated but user-interaction-dependent trigger with availability-only impact. This is a low-priority, moderate-CVSS (5.5) availability bug with no confidentiality or integrity impact and no code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows an attacker to crash the application by supplying a crafted packet capture or frame that reaches the MBIM (Mobile Broadband Interface Model) protocol dissector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) shows the attack is local with no privileges required but requires user interaction - typically opening a malicious capture file - and the only impact is availability loss from a recoverable crash with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; consistent with the independent assessment, this is a low-priority, availability-only defect despite its medium 5.5 rating, and consumers of untrusted captures should still patch or restrict the MBIM dissector.
Heap-based buffer overflow in Wireshark's sharkd JSON-RPC backend (CVE-2026-95388) allows attacker-controlled packet-capture data to crash the local analysis process in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The issue is local and requires user interaction, because an analyst must load a malicious capture into sharkd, and it yields only denial of service (CVSS 5.5, AV:L/PR:N/UI:R, A:H). No public exploit identified at time of analysis, and the practical risk is limited to deployments that actually invoke the sharkd utility.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by a reachable-assertion failure in the Frame protocol metadissector, a local, user-assisted denial of service tracked as CVE-2026-96422 (CVSS 5.5, CWE-617). The attack vector is local and requires user interaction: an analyst must open or process a crafted capture file, or capture crafted live traffic that reaches the metadissector, after which the parser aborts the process; the impact is limited to availability (A:H) with no confidentiality or integrity effect and no code execution. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; authentication requirements are not confirmed from the available data, though the assessed vector (AV:L/PR:N/UI:R) indicates no privileges are needed beyond the victim loading the malicious input. Risk is genuine but low-urgency, confined to disruption of the analysis workflow.
Denial of service in Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 allows attackers to hang or exhaust memory in the Wireshark process by getting a user to open a crafted capture file containing malformed USB HID data. The flaw is an infinite loop and memory leak in the USB HID protocol dissector (CWE-1325); exploitation requires user interaction to load the file and cannot cause code execution or data disclosure. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 score is 5.5 (Medium) with high availability impact under a local vector.
Crashing denial-of-service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when the RF4CE protocol dissector processes a malformed packet, triggering a heap-based buffer overflow (CWE-122) that terminates the application. The attack is not remotely triggerable: a local user must be induced to open a crafted capture file (or start a live capture containing RF4CE-classified traffic), and no authentication is required (PR:N) while user interaction is mandatory (UI:R), so impact is confined to process availability with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published an advisory (wnpa-sec-2026-104) that should be consulted for the fixed release.
Malformed TIFF data processed by Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 causes the TIFF protocol dissector to loop indefinitely, hanging the application until it is killed manually. Exploitation is local and client-side (AV:L, UI:R): an attacker must convince an analyst to open a crafted capture file or dissect attacker-controlled traffic containing the malicious TIFF payload, and no privileges are required (PR:N). Impact is availability-only (C:N/I:N/A:H, CVSS 5.5) with no data disclosure, modification, or code execution, and no public exploit has been identified at time of analysis - this is a genuine but low-priority issue whose realistic risk is targeted social engineering of analysts rather than mass exploitation.
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can crash when a user opens a crafted capture file in the Toshiba ('compact router snoop') format, producing a denial-of-service condition limited to the affected process. The underlying issue is a buffer over-read (CWE-126) in the Toshiba wiretap parser; the supplied CVSS vector rates it as local, high-complexity, user-interaction-required, and availability-only, and the independent assessment calls it a genuine but low-priority issue. No public exploit was identified at time of analysis.
A heap-based buffer overflow in the IEEE 802.11 dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows local, unauthenticated attackers to cause a denial of service (application crash) by convincing a user to open a crafted packet capture file or by processing malicious live 802.11 traffic. The vulnerability requires user interaction and has only availability impact, with no confidentiality or integrity loss, and is considered low priority despite its Medium CVSS score of 5.5. No public exploit code or active exploitation has been identified at time of analysis; the IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious data.
Opening a crafted Catapult DCT2000 capture file in Wireshark 4.6.0 through 4.6.8 or 4.4.0 through 4.4.18 triggers a stack-based buffer overflow in the DCT2000 protocol dissector, terminating the application. The issue is local and client-side (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5): the analyst must actively load the malicious file or a capture whose packets are routed through the DCT2000 dissector, and no authentication is required per the vector, but user interaction is. Impact is limited to an availability loss - a crash of the Wireshark process - with no code execution, data disclosure, or integrity impact indicated. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor has published advisory wnpa-sec-2026-110 and an associated GitLab work item.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
DKIM signature verification in OpenDKIM through 2.11.0 can be desynchronized by a crafted DKIM-Signature header, causing the tag tokenizer (dkim_process_set in dkim.c) to consume attribute values from a less trusted source than the signed data and return an attacker-influenced authentication verdict. Exploitation is remote and unauthenticated over SMTP against a standard Postfix/Sendmail milter deployment, but the impact is deliberately limited: the desync affects only the DKIM result of the single crafted message, so real damage depends on whether downstream DMARC enforcement or anti-phishing filtering blindly trusts OpenDKIM's verdict. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the researcher published a technical write-up), there is no confirmed active exploitation in CISA KEV, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
Risk cannot be meaningfully assessed from the available data for CVE-2026-96543, which is currently known only through the vendor:ubuntu security feed with no description, no CWE, no CVSS score or vector, and no identified affected package. Because the affected product or feature, the protocol involved, and the configuration prerequisites are all absent, it is not possible to determine who is affected or what an attacker could achieve. No public exploit identified at time of analysis, and no patch version data was supplied, so the corresponding Ubuntu Security Notice (USN) must be reviewed manually to establish exploitation prerequisites and impact.
Ubuntu is the only vendor identified for CVE-2026-96544, but the intelligence feed supplies no description, CWE, CVSS score, or CVSS vector, so the affected component, the vulnerable version range, and the resulting impact are all unconfirmed. The identifier comes from a vendor advisory channel (vendor:ubuntu), which indicates the flaw is most likely tracked against one or more Ubuntu source packages rather than a third-party upstream product, but the specific package and release cannot be determined from the data at hand. No public exploit code and no confirmed active exploitation are indicated by the supplied intelligence, and because no CVE record, Ubuntu Security Notice, or patch reference was included, no meaningful severity or risk rating can be assigned until the authoritative record is retrieved.
Ubuntu Linux is the only product context available for CVE-2026-88841, and the record is effectively a placeholder: the supplied intelligence contains no description, no affected package or component name, no CVSS score or vector, no CWE mapping, no CPE identifiers, and no references beyond the originating vendor tracker (vendor:ubuntu). Because of this, the concrete impact, attack vector, authentication requirements, and platform prerequisites cannot be stated, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data; the only defensible action at this point is to obtain the Ubuntu CVE tracker entry and the referenced upstream advisory before making any defensive or prioritization decision.
No impact assessment is possible for CVE-2026-95622 from the intelligence available at this time: the record supplies no description, no CVSS score or vector, no CWE classification, and no CPE identifiers, and the only attribution is a 'vendor:ubuntu' reporter tag. Consequently the vulnerable component, the affected Ubuntu package and release, and the privileges an attacker would require remain unknown, and no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal are present to suggest real-world activity. The identifier should be treated as unverified and non-actionable until NVD/MITRE publishes the CVE record and the Ubuntu security team issues a corresponding USN or tracker entry.
Sandboxed Flatpak applications can deliver signals to a process group that also contains a parent process outside the app's sandbox, letting a malicious or compromised app terminate the desktop environment or user session (denial of service) on Flatpak versions before 1.18.4. Exploitation is local and gated on the victim installing and executing attacker-controlled sandboxed code; the assessed CVSS v3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) records a scope change with high availability impact and no confidentiality or integrity impact. No CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis, and the issue is fixed in Flatpak 1.18.4, released alongside sibling fixes CVE-2026-97023 through CVE-2026-97027.
SUSE Rancher Fleet versions 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, and 0.13 before 0.13.16 allow an attacker with low-privilege bundle deployment rights to modify labels and annotations on Kubernetes namespaces that the bundle's pinned identity is not authorized to change. The flaw arises from inconsistent authorization checks when a bundle requests namespace metadata updates via the namespaceLabels and namespaceAnnotations options. No public exploit code has been identified at time of analysis, and the CVSS 3.1 score of 6.5 reflects integrity-only impact (C:N/I:H/A:N) requiring existing low privileges on the network.
Rancher Fleet 0.16.0 and 0.16.1 accept requests to the gitjob webhook receiver without verification whenever no webhook secret is configured, allowing any party with network reach to that endpoint to alter the spec.pollingInterval field of matching GitRepo resources in any namespace - including namespaces where the caller holds no Kubernetes credentials or RBAC. The assessed vector is unauthenticated remote (AV:N/PR:N), and impact is deliberately narrow: only a single configuration field can be changed, with no arbitrary spec edits, secret exposure, or workload execution and no confidentiality loss. Only Fleet 0.16.0/0.16.1 are affected, Fleet 0.16.2 and all pre-0.16 releases are not, and no public exploit code has been identified at time of analysis.
Relative path traversal (CWE-23) in SUSE Rancher Fleet allows an authenticated attacker with either Git push access to a repository referenced by a GitRepo resource or Kubernetes RBAC permission to create or modify a GitRepo (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read files from the filesystem of the bundle-processing environment and have their contents emitted into the generated Bundle resource. The most valuable target is Helm registry credential material that Fleet makes available to the bundle-processing job when per-path Helm credentials are configured, letting the attacker exfiltrate secrets they have no Kubernetes RBAC permission to read. All Fleet branches below 0.16.2, 0.15.7, 0.14.11, 0.13.16 and 0.12.20 are affected; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, so this is a moderate privilege-boundary-crossing disclosure rather than an emergency.
An unsigned integer underflow in libXpm's XPM write/save path (libXpm before 3.5.19) causes unbounded CPU consumption and memory exhaustion, resulting in denial of service. The flaw is reachable only when an application linked against the library is made to write or convert attacker-influenced data to the XPM format, so exploitation is local (AV:L) and requires the victim to actively process the crafted input (UI:R); no privileges are required (PR:N) and there is no path to data disclosure or code execution. No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; the upstream fix is present in a libXpm merge-request commit, with libXpm 3.5.19 indicated as the corrected version. Given the local, interaction-dependent trigger and DoS-only impact (CVSS 5.5), this is a genuine but low-priority issue.
Malicious or compromised X servers can crash X clients linked against libX11 before 1.8.14 by supplying crafted byte-oriented codeset/locale data that triggers an out-of-bounds read in the client's codeset parser. The flaw is a client-side denial of service with only incidental memory disclosure, not code execution, and it works in the reverse of the usual trust direction: the server attacks the client, so exposure requires a victim application to open an X11 connection to an X server the attacker controls or has compromised (such as a hostile remote or forwarded display). The local attack vector and the requirement for an untrusted display keep realistic risk low; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (upstream fix merged for the 1.8.14 release).
Crashing of X11 client applications can be triggered by a malicious X server exploiting an out-of-bounds read in libX11's X Input Method (XIM) trigger-key registration parser in versions before 1.8.14. This is a medium-severity denial-of-service issue (CVSS 5.5) that requires the victim to connect to an attacker-controlled X server, with user interaction (UI:R) and no authentication required (PR:N), but impact is limited to availability (client crash). No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Remote, unauthenticated attackers who control an X server can crash X clients linked against libX11 before 1.8.14 by returning crafted XIM (X Input Method) attribute data, because the parser performs an out-of-bounds read (CWE-125). This is an availability-only denial-of-service (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) limited by an inverted trust relationship: the victim's client must attach to the attacker's display, so exploitation requires the user to connect to a malicious, compromised, or spoofed X server. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An off-by-one error in OpenDKIM's quoted-printable decoder (dkim_qp_decode in util.c) affects all releases up to and including 2.11.0 and is reachable by remote, unauthenticated attackers who can deliver mail to a host running OpenDKIM as a verifying milter. The flaw is triggered while decoding attacker-controlled message bodies, producing low-magnitude confidentiality, integrity and availability impact rather than reliable code execution, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Publicly available exploit code exists, and the vendor was contacted before disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
RabbitMQ Management versions 3.13.0 through 3.13.18, 4.0.23, 4.1.14, 4.2.9 and 4.3.4 render an attacker-controlled AMQP queue name as unescaped HTML in an authorization-error reason when the OAuth management UI is enabled, allowing an injected <base> element to retarget the UI's automatic relative refresh. An authenticated attacker holding queue 'configure' permission can therefore cause a management administrator who clicks 'Get Message(s)' on the crafted queue to send their Authorization header to an attacker-controlled endpoint whose CORS policy accepts the management origin. Exploitation requires a stacked set of preconditions - non-default OAuth UI, attacker queue-configure rights, an administrator who can see but cannot read the queue, a victim click, a Content Security Policy lacking base-uri and connect-src, and an attacker endpoint that permits the management origin via CORS - which substantially limits real-world risk; no public exploit identified at time of analysis, and the issue is rated MEDIUM (CVSS 4.0 base 4.5).
Secret disclosure in kitty 0.25.0 through versions before 0.49.0 lets a second local user on the same host capture text that the victim types into prompts rendered by kitty itself, including masked password prompts, without holding any privilege on the victim's account. The askpass escape-code handler in kitty/window.py (handle_remote_askpass) opens a POSIX shared-memory object named in an attacker-supplied device control string and later writes the typed answer back into an object of that same name, never verifying that the object is owned by the user running kitty or that its permissions exclude other users, unlike the equivalent ssh kitten path which performs exactly that check. Exploitation is tightly bounded: it requires a POSIX shared-memory namespace shared between attacker and victim, attacker-influenced bytes being displayed in the victim's terminal, and the victim actually answering the rendered prompt; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV, and hosts with isolated shared memory, single-user workstations, and kitty 0.49.0 or later are not affected.
Atom-table exhaustion in RabbitMQ 4.x lets an authenticated user who holds the 'policymaker' tag crash a broker node by sending a sustained stream of requests (roughly one million) to the Management plugin's /api/global-parameters/:name endpoint, each with a unique name value. The handler passes the URL segment through rabbit_data_coercion:to_atom/1, which uses the unsafe binary_to_atom/2; because Erlang atoms are never garbage collected, every novel name permanently consumes an atom-table slot until the VM aborts. Exposure requires the Management plugin to be enabled and an account above the management tag (but below administrator); it is not reachable unauthenticated, and the assessed impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in RabbitMQ 4.0.22, 4.1.14, 4.2.7 and 4.3.1.
Denial of service in RabbitMQ's management HTTP API lets an authenticated administrator crash the broker by submitting a user (or importing definitions) whose tags list contains roughly one million unique strings; each string is converted to a permanent Erlang atom until the bounded atom table is exhausted and the BEAM node dies. Affected versions are RabbitMQ 4.0.0 through 4.0.21, 4.1.x before 4.1.14, and 4.2.x before 4.2.7, and the attack requires the management plugin to be enabled and reachable plus full administrator privileges, so there is no unauthenticated or low-privilege path. No public exploit code identified at time of analysis, and vendor-released patches are available in 4.0.22, 4.1.14 and 4.2.7; this is a genuine but low-priority availability issue rather than a confidentiality or integrity risk.
Use-after-free in the drag-and-drop source path of the kitty terminal emulator (versions 0.47.0 up to but not including 0.49.0) allows any program that controls the terminal's output byte stream to make the terminal read from and write to freed heap memory while the user is actively dragging content out of the window. The flaw lives in drag_remote_file_data() in kitty/dnd.c, which keeps a DragRemoteItem pointer into an array that the error path's cancel_drag()/drag_free_offer() teardown frees, then continues to dereference and write through it; per the assessed vector this is a local, user-interaction-required issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with integrity and availability impact only and no confidentiality impact, matching the vendor's low 4.6 CVSS 4.0 base score. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); a vendor patch is available in kitty 0.49.0.
Information disclosure in the kitty terminal emulator versions 0.47.0 through 0.48.x lets a program that can write escape sequences to the terminal read the contents of files a user merely drags over a kitty window, without ever completing the drop. The drag-and-drop handler in kitty/dnd.c serves a client's drag-data request without first verifying that a drop has actually occurred, and drop_left_child() keeps the offered URI list, directory handles, an open file descriptor and its main-loop transfer timer alive after the drag leaves the window, so a client can keep reading through a retained directory handle or let an in-flight file transfer continue streaming with no drag in progress. The CVSS 4.0 base score is 6.0 (moderate), the request path is unauthenticated (PR:N) and the decisive precondition is user interaction: the victim must drag a file or directory over the window; no public exploit code was identified at time of analysis, and vendor-released patch kitty 0.49.0 is available.
Denial of service in Bouncy Castle for Java (bc-java before 1.86 and bc-lts-java before 2.73.13) arises because the legacy PBES1 (PKCS#5 scheme 1) and PKCS#12 PBE families derive keys using an iteration count read from untrusted input without upper or lower bounds, so a tiny amount of attacker-controlled data can force an unbounded amount of CPU work before any validation occurs. Unauthenticated remote attackers can trigger the condition by supplying crafted PKCS12PBEParams/PBEParameter encodings or a PKCS#12 PBE-protected private key that the application processes through the raw JCA provider, including the common javax.crypto.EncryptedPrivateKeyInfo.getKeySpec() path; impact is availability-only (CPU/time exhaustion) with no confidentiality or integrity effect, and the assessed severity is moderate (CVSS 3.1 5.3, A:L). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) information for this issue.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Unbounded resource allocation and decompression amplification in Apache Thrift's C++ bindings (all versions before 0.25.0) let remote, unauthenticated clients force excessive memory and CPU consumption by sending highly compressed or amplified Thrift payloads to a service that deserializes attacker-controlled input, degrading or denying service availability. The assessed impact is availability-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) with no confidentiality or integrity loss, and no public exploit code was identified at time of analysis, so real-world risk is driven mainly by whether a Thrift endpoint is exposed to untrusted clients. No EPSS score or CISA KEV listing was supplied in the source intelligence, so no exploitation-probability or active-exploitation claim can be made.
Denial of service in Apache Thrift before 0.25.0 allows unauthenticated remote attackers to exhaust resources through the Delphi bindings' buffered transport (TBufferedTransport), causing service unavailability. The flaw is an unbounded resource allocation issue (CWE-770) scored 6.9 (CVSS 4.0) with availability-only impact; exploitation requires a reachable service built with the Delphi bindings and buffered transport. No public exploit code has been identified at time of analysis, and the vendor has released version 0.25.0 as the fix.
Uninitialized-resource handling in the Apache Thrift C++ WebSocket server causes the server to return incorrect status codes and potentially leak stale memory contents in responses. All Apache Thrift releases before 0.25.0 are affected, but only deployments that actually run the C++ WebSocket server transport are exposed - the default binary and framed socket transports are not in scope. Exploitation is remote and requires no authentication or user interaction, but an attack-requirement precondition (AT:P in the vendor CVSS 4.0 vector, a specific server state or timing condition) makes it unreliably repeatable, and impact is limited to low integrity effects with no confirmed confidentiality or availability loss; no public exploit identified at time of analysis. This is a moderate-severity, low-priority issue rather than an urgent one, and the vendor-released fix is Apache Thrift 0.25.0.
Prototype pollution in the JavaScript bindings of Apache Thrift (all versions before 0.25.0) allows unauthenticated remote attackers to corrupt object prototype attributes when an application deserializes attacker-influenced Thrift messages through generated JS code. Impact is integrity-only and limited - the vendor-assigned CVSS 4.0 base score is 6.3, while our independent CVSS 3.1 assessment rates it AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N, reflecting that exploitation requires the JS binding to be in the data path and specific object properties to be reachable. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Apache has released a fix in version 0.25.0, which also requires regenerating JS code to be effective.
TLS hostname verification in the Apache Thrift C++ and D libraries can be bypassed, letting a man-in-the-middle present a certificate that chains to an already-trusted CA and still be accepted for the wrong hostname. The default access managers shipped with the C++ TSSLSocketFactory (versions 0.7.0 through 0.24.0) and the D accessManager property (versions 0.9.0 through 0.24.0) treat a non-matching subjectAltName dNSName as a 'skip' instead of a rejection and then fall back to the certificate Common Name, which violates RFC 6125 section 6.4.4 and RFC 9525 section 2. Because public CAs have not issued on Common Name alone for years, the practical exposure is confined to private or enterprise PKI deployments where such certificates still exist, and exploitation additionally requires an on-path attacker plus a CN-matching certificate from a trusted CA; unauthenticated per the CVSS 4.0 vector (PR:N) and no public exploit identified at time of analysis.
Improper TLS certificate validation in the Apache Thrift Python bindings (all versions before 0.25.0) allows a man-in-the-middle attacker to present a forged or otherwise invalid certificate and have it accepted, breaking the confidentiality and integrity guarantees of Thrift RPC traffic. Because the flaw also returns an incorrect status code on the failed validation path, code that inspects the returned status may mistakenly treat a rejected or malicious connection as legitimate. Exploitation is conditional rather than opportunistic: the attacker must already occupy a man-in-the-middle position on the network path (AT:P, AC:H) and the victim deployment must actually rely on Thrift's Python TLS transport for trust; authentication is not required (PR:N) and no user interaction is needed (UI:N). No public exploit code and no confirmed active exploitation were identified at the time of analysis, and the independent assessment rates this as a moderate, conditional risk rather than an urgent priority.
Improper certificate validation in the Perl bindings of Apache Thrift before 0.25.0 leaves TLS peer verification effectively disabled by default, allowing an active man-in-the-middle to impersonate the RPC server, read and alter traffic, and return forged responses. The flaw is unauthenticated (PR:N) and needs no user interaction, but exploitation is conditional on the deployment actually using the Perl bindings for TLS-protected RPC and on the attacker holding a network interception vantage point (vendor CVSS 4.0 AT:P; independent CVSS 3.1 AC:H), which limits real-world exposure to a moderate, conditional TLS trust issue rather than a broadly exploitable one. Upgrading to 0.25.0 remediates the flaw; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Uninitialized-resource handling in Apache Thrift's c_glib (C/GLib) bindings before 0.25.0 allows unauthenticated, network-reachable attackers to read stale memory contents or receive incorrect status codes from a service built with those bindings, producing limited information disclosure and low availability impact with no integrity impact. There is no public exploit identified at time of analysis, and independent assessment rates this moderate rather than urgent because exposure is narrow (only processes compiled against the c_glib binding are implicated, not Java, Python, C++, Go, or other bindings) and the CVSS attack-requirement metric (AT:P in the CVSS 4.0 vector, AC:H in the assessed CVSS 3.1 vector) signals that a specific request/protocol condition must be met before the vulnerable path triggers.
GNU GRUB 2.x does not validate the MMIO base address passed to its serial command, allowing a local attacker with high privileges (PR:H) who controls GRUB's configuration to write limited non-arbitrary data to an arbitrary memory address and reset the grub_file_verifiers list, thereby loading unsigned GRUB modules while GRUB still reports lockdown as enabled. The issue only matters when Secure Boot and GRUB lockdown mode are active; it is not remotely reachable (AV:L) and requires high attack complexity (AC:H) to select a base address that yields the needed writes. A vendor fix is available as an upstream commit, but no released patched version is independently confirmed, and no public exploit identified at time of analysis.
Denial of service in geopy versions prior to 2.5.0 allows an unauthenticated remote attacker to consume excessive CPU by supplying a long, malformed coordinate string to geopy.Point, Point.from_string(), or a geocoder reverse() method invoked with a string argument. The root cause is catastrophic backtracking (CWE-1333) in the POINT_PATTERN regular expression; the fix in 2.5.0 adds a 256-character input cap that rejects oversized input immediately, while the numeric Point constructor is unaffected. Impact is availability-only (C:N/I:N/A:L) with no code execution or data exposure; no public exploit code was identified at time of analysis, and reachability depends on the host application exposing one of the string-parsing entry points to untrusted input.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 arises from a path-equivalence flaw (CWE-55, '/./' single-dot directory) in the mod_userdir module, which mishandles the single-dot directory segment when the UserDir directive is configured with an absolute, non-wildcard path. Only deployments that load mod_userdir and use that specific second syntax form (for example 'UserDir /some/absolute/path') are exposed; servers on the default wildcard/username form, or without mod_userdir loaded, are unaffected regardless of version, so the practical exposure surface is a non-default configuration. The issue is network-reachable over HTTP and is assessed as low-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code or confirmed active exploitation has been identified at time of analysis, and no patch version is specified in the available advisory data.
Information disclosure in Apache HTTP Server 2.4.0 through 2.4.68 allows an unauthenticated remote client to read WebDAV dead properties of resources it cannot author by sending an HTTP GET request to the module's internal .DAV state directory. The flaw is in mod_dav_fs (CWE-552, files or directories accessible to external parties) and is reachable only when mod_dav and mod_dav_fs are loaded with WebDAV enabled and the .DAV state directory is web-accessible, so no default configuration is affected. No public exploit identified at time of analysis, and there is no CISA KEV listing; the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a read-only, low-confidentiality leak of client-set metadata with no integrity, availability, or code-execution impact.
Local attackers with low privileges can inject crafted text into the kernel log on Linux systems running the NVIDIA GPU Display Driver because the kernel mode layer fails to sanitize a supplied version string, leading to denial of service and data tampering. The vulnerability requires local access (AV:L) and low privileges (PR:L) with no user interaction, and has low impact on integrity and availability (I:L/A:L) with no confidentiality loss. No public exploit identified at time of analysis, and the overall risk is low despite the wide deployment of NVIDIA GPUs.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux occurs when a NULL pointer dereference is triggered in the kernel-mode layer, crashing or hanging the graphics subsystem on the affected host. Only systems with a physical NVIDIA GPU (GeForce, RTX/Quadro/NVS, or Tesla branches) running a driver older than the branch-specific fixed release are exposed, and exploitation requires an attacker who already holds HIGH privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H), so an unprivileged local user cannot reach the vulnerable interface. There is no confidentiality or integrity impact, no public exploit code and no confirmed active exploitation (not in CISA KEV), and the EPSS score was not reported; the high-privilege prerequisite caps real-world priority at LOW despite the nominal MEDIUM CVSS.
Denial of service in NVIDIA GPU Display Driver on Windows and Linux is possible when a highly privileged local attacker reaches a firmware code path that dereferences a null pointer. Affected products include GeForce, RTX/Quadro/NVS, and Tesla driver branches prior to the fixes documented in NVIDIA bulletin 5861, with some older branches limited to Maxwell, Volta, and Pascal GPUs. The assessed vector is local and requires high privileges, with availability impact only; no public exploit identified at time of analysis, and the low CVSS score of 4.4 reflects those constraints.
Information disclosure in the NVIDIA GPU Display Driver kernel-mode component (Windows and Linux) lets an authenticated local user read another process's GPU channel state, because the driver performs missing authorization checks (CWE-862) when a process requests channel state it does not own. The flaw is rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), so it requires a pre-existing local, low-privileged foothold and yields confidentiality impact only - no integrity or availability effect - and there is no public exploit identified at time of analysis. Practical risk concentrates on hosts where multiple security contexts share the same GPU, such as multi-user workstations, VDI, and cloud/virtual-GPU deployments; single-user desktops with one active GPU context gain little from this primitive, so the overall priority is low-to-moderate and locally scoped.
Local information disclosure in NVIDIA Display Driver for Windows and Linux allows an authenticated local user with low privileges to access another process's GPU channel state because the kernel-mode driver omits authorization checks. Affected platforms include NVIDIA GeForce, RTX/Quadro/NVS, and Tesla GPUs; the issue is rated CVSS 5.5 with high confidentiality impact but no integrity or availability impact. No public exploit was identified at time of analysis, and the practical risk is greatest in multi-user or multi-tenant GPU environments such as VDI and cloud-GPU deployments.
Local, authenticated, low-privilege users on Linux hosts can cause a denial-of-service condition against the NVIDIA GPU Display Driver kernel-mode layer by repeatedly invoking an interface that emits unrate-limited error messages, leading to uncontrolled kernel log generation and resource exhaustion. Affected products include GeForce, RTX/Quadro/NVS, and Tesla GPU families running the Linux driver, as reflected in the NVIDIA CPE entries. Despite the moderate 5.5 CVSS score, this is a low-priority issue because exploitation requires local code execution with no remote or unauthenticated path, only availability is impacted, and no public exploit has been identified at time of analysis.
Denial of service in NVIDIA GPU Display Driver for Linux arises when a local authenticated low-privileged user exhausts the DRM VMA offset address space, causing uncontrolled resource consumption in the kernel mode layer. The issue is limited to Linux and to availability impact; exploitation requires an existing local foothold and cannot provide code execution, privilege escalation, or data disclosure. No public exploit was identified at time of analysis, and the assessed risk is low, though shared or multi-tenant GPU systems such as VDI, cloud GPU, and Tesla/vGPU deployments face the greatest practical disruption.
Kernel memory exhaustion in the NVIDIA GPU Display Driver for Linux allows a local, unprivileged user to repeatedly drive error-handling paths in the driver's kernel-mode layer so that leaked allocations accumulate until kernel memory is depleted, resulting in a denial of service on the affected host. The flaw (CWE-401) affects the Linux display driver across the GeForce, RTX/Quadro/NVS and Tesla product lines, including vGPU guest-driver and Virtual GPU Manager deployments, and is local-only, requiring an existing low-privileged account (AV:L/PR:L) with no user interaction and causing availability-only impact (C:N/I:N/A:H). No public exploit code and no CISA KEV entry were identified at time of analysis, so exploitation requires an attacker who already holds a shell on the box and can sustain repeated triggering; the practical risk concentrates on shared, multi-tenant GPU hosts (vGPU, VDI, cloud GPU) where one tenant's resource exhaustion degrades every other workload on the same kernel.
Local denial of service in the NVIDIA GPU Display Driver for Linux lets any unprivileged user on the host trigger a NULL pointer dereference (CWE-476) inside the driver's kernel-mode layer, crashing or destabilising the graphics kernel component (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base score 5.5). The flaw spans NVIDIA's GeForce, RTX/Quadro/NVS and Tesla product lines and is bounded strictly to availability impact - there is no confidentiality or integrity loss and no path to privilege escalation - so the practical blast radius is limited to disrupting the machine, and is materially more serious only on multi-tenant or shared-GPU hosts (VDI, cloud GPU) where one low-privilege user's crash affects other tenants. Exploitation requires local access with a normal, non-privileged account and direct interaction with the driver's kernel interface; no public exploit identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV).
Local attackers with low-privileged access can read uninitialized kernel memory from NVIDIA GPU Display Drivers on Windows and Linux, leading to information disclosure. The flaw resides in the kernel-mode driver and requires an existing account on the target system (CVSS 3.1: AV:L/PR:L, 5.5 Medium). No public exploit code or active exploitation has been identified at time of analysis.
NULL pointer dereference in the NVIDIA GPU Display Driver kernel module for Linux allows an authenticated local attacker to crash the driver, resulting in denial of service. Affected products include GeForce, RTX/Quadro/NVS, Tesla, and Guest Driver (vGPU) product lines. Exploitation requires an unprivileged local account (CVSS vector AV:L/PR:L) and yields only denial of service with no confidentiality or integrity impact; no public exploit has been identified at time of analysis.
Denial of service in NVIDIA Display Driver on Windows and Linux allows a local low-privileged attacker to crash the kernel-mode driver by triggering a divide-by-zero condition. Affected product branches include GeForce, RTX/Quadro/NVS, Tesla, and Virtual GPU Manager builds prior to the fixed versions in NVIDIA bulletin 5861, with impact limited to availability and no public exploit identified at time of analysis.
Local denial of service in NVIDIA GPU Display Driver for Linux lets a logged-in user or a low-privileged process with GPU device access (PR:L, confirmed via CVSS vector) crash the kernel mode driver by submitting a crafted ioctl that triggers a NULL pointer dereference (CWE-476), rated CVSS 5.5 Medium. Impact is availability-only - the assessed vector shows C:N/I:N/A:H, so no privilege escalation, code execution, or data exposure is achievable, and the attack is strictly local, not remotely reachable. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score was supplied for this CVE.
Denial of service in the NVIDIA GPU Display Driver for Windows and Linux arises from improper access control (CWE-862) in the kernel-mode layer, where a local user with a low-privileged account can invoke a driver interface they should not be authorized to reach and thereby crash or hang the affected system. Impact is limited to availability: with the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H (base 5.5, Medium), exploitation requires pre-existing local authenticated access on a host running an affected driver branch - GeForce, RTX/Quadro/NVS, Tesla, or the vGPU Guest Driver/Virtual GPU Manager - and no remote path exists. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and no code execution, privilege escalation, or data disclosure is achievable, making this a low-to-moderate operational priority that is chiefly relevant to multi-user, VDI, and shared-workstation environments.
Privilege escalation and potential code execution in the NVIDIA GPU Display Driver for Windows and Linux arise from an incorrect permission assignment (CWE-732) within a secure microcontroller component, allowing an attacker who already holds privileged local access to write to protected memory that should be restricted. Exploitation is gated by two strong prerequisites - the CVSS vector (AV:L/AC:H/PR:H/UI:N) requires local access with administrator/root-equivalent privileges and high attack complexity - so this is a genuine but lower-tier risk that primarily matters as a post-compromise escalation or persistence primitive rather than a standalone entry vector. Affected branches include GeForce (only Maxwell, Volta, and Pascal architecture GPUs), RTX/Quadro/NVS, and Tesla data-center drivers below the branch-specific fixed versions in NVIDIA bulletin 5861; there is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
Use-after-free in the NVIDIA GPU Display Driver kernel module (CVE-2026-47586) allows an attacker with local access to the GPU device on Windows or Linux to corrupt kernel memory, with potential outcomes including code execution, privilege escalation, denial of service, information disclosure, and data tampering. The vendor CVSS vector (AV:P/AC:H/PR:N) is anomalous - designating physical access and no privileges - while the independent assessment uses AV:L/AC:H/PR:L, indicating that exploitation is not remotely triggerable and instead depends on winning a timing/command-sequence race after obtaining local low-privileged access to the driver. No public exploit code or confirmed active exploitation is identified at time of analysis, and exploitation signals point to a low-to-moderate real-world priority despite the memory-corruption impact.
Improper input validation in NVIDIA GPU Display Driver firmware for Windows and Linux (GeForce, RTX/Quadro/NVS, and Tesla product lines) allows a locally positioned attacker who already holds high privileges to trigger code execution, denial of service, privilege escalation, information disclosure, and data tampering within the GPU firmware handling path. Scoring 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the flaw is not remotely reachable and cannot be exercised by an unprivileged local user, so it is best characterized as a post-compromise privilege/kernel-boundary escalation rather than an initial-access vector. No public exploit code was identified at time of analysis and there is no indication of confirmed active exploitation; EPSS scoring was not provided in the available intelligence.
Local high-privileged attackers can exploit improper input validation in NVIDIA GPU Display Driver firmware on Windows and Linux to potentially achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. The assessed CVSS vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) confirms local access and high privileges (PR:H), so this is realistically a post-compromise escalation/persistence primitive rather than an initial-access vulnerability. No public exploit identified at time of analysis.
Improper input validation in the NVIDIA GPU Display Driver kernel-mode layer allows a local high-privileged attacker to achieve code execution, denial of service, privilege escalation, information disclosure, or data tampering. Affected products include GeForce, RTX/Quadro/NVS, and Tesla drivers on Windows and Linux. Exploitation requires administrator or root-equivalent access (PR:H), so risk is limited to scenarios where a high-privilege account is already compromised; no public exploit code is identified at time of analysis.
Improper input validation in the kernel-mode layer of the NVIDIA GPU Display Driver on Windows and Linux allows a local attacker who already holds high privileges to execute code, escalate privileges, disclose information, or crash the system. The flaw is not remotely reachable (AV:L) and requires existing HIGH privileges (PR:H) to reach the vulnerable kernel code path, with no user interaction needed; the resulting CVSS 3.1 base score is 6.7. There is no public exploit identified at time of analysis and no EPSS score or KEV listing was provided in the available intelligence, making this a moderate-priority local privilege-escalation/kernel-compromise primitive rather than an internet-facing emergency.
An out-of-bounds write in the firmware component of the NVIDIA GPU Display Driver for Windows and Linux lets a local attacker who already holds administrator or root privileges corrupt memory, with potential outcomes spanning code execution, escalation of privileges, denial of service, information disclosure and data tampering. Rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-787), the flaw affects GeForce, RTX/Quadro/NVS and Tesla products; exploitation requires local access to the host plus high existing privileges, and no public exploit code was identified at time of analysis, so real-world risk is moderate rather than urgent. No user interaction is required and there is no network attack path, which rules out remote exploitation entirely.
Out-of-bounds write in the NVIDIA GPU Display Driver for Linux kernel mode layer allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, potentially achieving code execution, privilege escalation, denial of service, information disclosure, or data tampering. Affected driver branches cover GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions listed in NVIDIA's advisory, and the attack surface is local-only, so real-world risk is assessed as MODERATE-LOW. No public exploit identified at time of analysis.
Improper validation of an array index in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux gives a local, already highly privileged attacker a path to full loss of confidentiality, integrity, and availability on the host. The flaw affects driver branches for GeForce, RTX/Quadro/NVS, and Tesla products below the fixed versions published in NVIDIA bulletin 5861, including 580.178.04, 582.78, 595.91.07, 596.86, 610.60, 610.88, 615.71.09 and 616.92 depending on the product line. Exploitation requires local access (AV:L) and pre-existing high privileges (PR:H) to reach the kernel-mode driver interface, with no user interaction and no network vector, so this is a local privilege/kernel-escalation primitive rather than an initial-access vector; no public exploit has been identified at time of analysis. Real-world risk is MODERATE-LOW despite the full-CIA impact assessment, because the attacker must already be highly privileged before the flaw can be touched.
An out-of-bounds write in the kernel-mode layer of the NVIDIA GPU Display Driver for Windows and Linux allows a local attacker who already holds high privileges (PR:H) to corrupt kernel memory, with the potential for code execution, privilege escalation, information disclosure, denial of service, and data tampering. Affected installations are those running GeForce, RTX/Quadro/NVS, or Tesla display drivers at versions below the fixed release for their branch (for example prior to 610.88, 582.78, 616.92, or 580.178.04), on either Windows or Linux. The CVSS 3.1 base score of 6.7 reflects the non-network, high-privilege access prerequisite rather than broad exposure; no public exploit code has been identified at time of analysis.
A kernel-mode out-of-bounds write in the NVIDIA GPU Display Driver for Linux lets a local attacker who already holds high privileges corrupt kernel memory in the driver's kernel mode layer, which the vendor states may lead to code execution, denial of service, privilege escalation, information disclosure and data tampering. The flaw carries a CVSS 3.1 base score of 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), meaning exploitation is strictly local and requires pre-existing elevated/administrative access on the host; there is no network attack vector and no user interaction is needed. Affected systems are Linux hosts running GeForce, RTX/Quadro/NVS or Tesla driver branches below the fixed releases published in NVIDIA security bulletin 5861, and there is no public exploit identified at time of analysis.
Out-of-bounds read in the firmware component of NVIDIA GPU Display Drivers for Windows and Linux allows a local attacker who already holds high privileges (PR:H, per CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) to read memory beyond intended firmware buffer bounds, most plausibly resulting in memory disclosure or a driver/GPU crash, with the vendor also flagging the potential for code execution, escalation of privileges and data tampering. The CVSS 3.1 base score is 6.7; the attack path is local-only, requires no user interaction, and is gated behind pre-existing high privilege, which materially limits real-world exposure. No public exploit code has been identified for this issue and it is not in CISA KEV, so no public exploit identified at time of analysis.
Code execution, privilege escalation, denial of service, information disclosure, and data tampering are all possible on Windows and Linux hosts running unpatched NVIDIA GPU Display Driver branches, because the kernel-mode layer fails to validate an array index (CWE-129) when processing a crafted GPU command. The flaw is strictly local: per the CVSS vector (AV:L, PR:H, UI:N) and our independent assessment, an attacker must already hold high privileges on the machine and be able to submit work to the GPU kernel driver, and there is no network or unauthenticated path. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so this is a genuine but moderate-priority hardening target for GeForce, RTX/Quadro/NVS, and Tesla deployments; fixed driver builds exist for each affected branch.
An out-of-bounds read in the kernel-mode layer of NVIDIA's GPU Display Driver for Windows and Linux can be triggered by a locally present attacker who already holds high privileges, potentially leading to kernel-context code execution, privilege escalation, denial of service, information disclosure, or data tampering. Exploitation requires local code execution at an elevated privilege level (CVSS vector PR:H) against a vulnerable driver build that is installed and loaded, so there is no remote or unauthenticated path and the practical risk is a defense-in-depth and privilege-boundary concern rather than an initial-access vector; no public exploit has been identified at time of analysis. NVIDIA has published fixed driver builds per product line and branch, and the affected install base spans GeForce, RTX/Quadro/NVS, and Tesla GPUs.
An out-of-bounds read in the NVIDIA GPU Display Driver kernel-mode layer on Windows and Linux lets a locally authenticated attacker who already holds high privileges trigger an unbounded string operation that reads beyond the end of an allocated buffer, with vendor-acknowledged consequences including code execution, denial of service, privilege escalation, information disclosure, and data tampering. The flaw (CWE-125, CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7) affects GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest driver builds below the fixed versions published in NVIDIA's 2026 advisory, and exploitation is strictly local - there is no network vector, no user interaction, and no non-default configuration requirement, only a privileged process on an affected host. Real-world risk is moderate and localized: no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so value to an attacker is mainly as a local privilege-escalation or kernel-tampering primitive after an initial foothold.
Kernel-mode out-of-bounds write in NVIDIA GPU Display Driver for Windows and Linux (GeForce, RTX/Quadro/NVS, Tesla, and vGPU guest drivers) allows a local attacker with high privileges to corrupt kernel memory, potentially leading to code execution, denial of service, privilege escalation, information disclosure, and data tampering. No public exploit has been identified at time of analysis. Affected driver branches include GeForce prior to 595.91.07, RTX/Quadro/NVS prior to 596.86, Tesla prior to 616.92, and vGPU guest drivers prior to vGPU 19.5/20.1, among others.
An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.
Heap under-allocation in U-Boot's SquashFS directory-table parser (fs/squashfs/sqfs.c) allows an attacker who supplies a crafted SquashFS filesystem image to trigger out-of-bounds heap writes and crash the bootloader, producing a denial of service during or after boot. All U-Boot releases before 2026.10-rc4 that are compiled with SquashFS support are affected, and exploitation requires the device to read and parse an attacker-controlled image from boot media, which is why the vendor treats this as a physical/local-vector issue (CVSS 4.0 base 5.2; the independent assessment rates it CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). No public exploit code has been identified at time of analysis, and the flaw was reported by VulnCheck alongside a vendor fix commit.
Out-of-bounds write in the U-Boot bootloader's RLE8-compressed BMP decoder (video_display_rle8_bitmap in drivers/video/video_bmp.c) lets an attacker who can place or modify a crafted splash/logo image write past the framebuffer, corrupting adjacent memory and crashing the bootloader. All U-Boot versions through 2026.10-rc5 are affected per the wildcard CPE, but exploitation is genuinely constrained: the platform must actually route an attacker-controlled BMP through the BMP display path, which in typical deployments means write access to boot media, the splash partition, or the environment-configured image source, and the outcome is primarily availability loss with only limited integrity impact and no confidentiality exposure. No public exploit code or confirmed active exploitation was identified at time of analysis, and the risk is moderate rather than critical despite the headline score.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
Pausing a shared (public) Grafana dashboard fails to revoke the public access token, so anyone still holding the share link can continue to reach the frontend bootstrap endpoints unauthenticated and retrieve the dashboard's data-source configuration - including stored credentials for data sources configured in browser (direct) access mode. The flaw is a missing authorization check (CWE-862) affecting both Grafana OSS and Grafana Enterprise, rated CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), meaning remote, unauthenticated access with no user interaction but a confidentiality-only impact. Exploitation is materially narrowed by prerequisites: the dashboard must be paused rather than deleted (deleting correctly revokes the token), the attacker must still possess the share link, and credential disclosure specifically requires browser-access data sources; no public exploit code has been identified at time of analysis.
Memory exhaustion in the sshd-sftp component of Apache MINA SSHD (1.0.0 through 2.19.0 and 3.0.0-M1 through 3.0.0-M5) lets an authenticated remote SFTP client crash the server by driving the SFTP v6 check-file-name/check-file-handle extension to build an oversized reply entirely in server memory. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), the session must be authenticated and must negotiate SFTP protocol version 6, and the attacker must point the request at a very large (possibly sparse) file using a tiny block size such as the 256-byte minimum, so that file-size divided by block size yields an enormous number of hashes; availability impact is high while confidentiality and integrity are unaffected. This is a genuine but bounded availability risk with no public exploit identified at time of analysis, and deployments that already cap SFTP message size (typically 256kB, as OpenSSH does) are not exposed.
Memory exhaustion denial of service in Apache MINA SSHD's SCP subsystem (module sshd-scp) affects all releases before 2.20.0 and the 3.0.0-M1 through 3.0.0-M5 milestones, requiring a connected SSH peer that has reached the SCP protocol handler - on a server deployment this typically means successful low-privilege authentication, which is the main gating factor (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5 Medium). The peer only needs to stream a single malformed SCP command line that never terminates with an LF, causing the handler to buffer the endless input until the JVM throws OutOfMemoryError and the application crashes; there is no confidentiality or integrity impact. No public exploit code and no confirmed active exploitation were identified at time of analysis, so the practical risk is a bounded availability issue for deployments that expose or use the SCP subsystem.
Improper input validation in the sshd-git component of Apache MINA SSHD lets authenticated SSH clients write arbitrary files onto the server by invoking 'git archive' with the single-argument '-o=file.zip' form. Only deployments that use GitPgmCommandFactory to expose remote JGit command execution to SSH clients are affected, and the attacker must hold valid SSH credentials (PR:L), so impact is a conditional integrity violation (C:N/I:H/A:N, CVSS 6.5) rather than a confidentiality or availability compromise. The flaw is an incomplete fix for CVE-2026-58624, which restricted git subcommands but missed the '-o=file.zip' variant; no public exploit code and no confirmed active exploitation were identified at time of analysis, and fixed releases are available (2.20.0 and 3.0.0-M6).
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Local users able to run KVM guests on x86 hosts can crash the host kernel by driving KVM's MMU into an inconsistent write-tracking state, because kvm_gfn_is_write_tracked() inspects only the memslot it is handed even though page tracking is per-address-space and shadow pages are shared across address spaces; under SMM emulation a GFN write-tracked in one address space appears untracked through the other, letting mmu_try_to_unsync_pages() mark an upper-level shadow page unsync and trip the BUG in pte_list_remove(). The flaw is scored CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), so access is local with low privileges required and impact is limited to host availability with no confidentiality or integrity effect; exploitation requires /dev/kvm access plus a guest configuration that reaches the SMM dual-address-space path. Vendor patches exist for the stable branches (6.1.187, 6.6.156, 6.12.108, 6.18.49, 7.1.13 and 7.2), EPSS is 0.19% (8th percentile), and no public exploit code or CISA KEV entry is identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8: a use-after-free in the ZigBee ZCL (ZigBee Cluster Library) protocol dissector causes the application to crash when a malformed ZCL packet is dissected. The attack vector is local and requires user interaction - an analyst must open a crafted capture file or live-dissect malicious ZigBee traffic (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5), and impact is limited to availability, with no code execution, data disclosure, or tampering reported. No public exploit code and no confirmed active exploitation were identified at time of analysis; exploitation is constrained by the need for the malformed packet to actually reach the ZigBee/ZCL dissector on a machine running an affected build.
An infinite loop in the TTL trace-file parser of Wireshark 4.6.0 through 4.6.8 lets a crafted capture file hang the application when an analyst opens it, producing a denial of service limited to the local Wireshark process. The CVSS vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) confirms the attacker cannot trigger the flaw remotely or without the victim manually opening the malicious TTL capture, and there is no confidentiality or integrity impact. No public exploit code or confirmed active exploitation was reported at the time of analysis, and no EPSS score was supplied, so the practical risk is low-priority availability loss rather than a broad compromise vector.
A NULL pointer dereference in Wireshark 4.6.0 through 4.6.8 allows a local user to crash the application by opening a crafted PEAK CAN TRC trace file, resulting in denial of service. The flaw requires user interaction to open a malicious file and cannot be triggered remotely; no public exploit code or active exploitation has been identified at time of analysis. The CVSS score is 5.5 with availability-only impact.
Memory leakage in Wireshark's IEEE C37.118 Synchrophasor protocol dissector allows a crafted packet capture to progressively exhaust process memory and crash the application on versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. Exploitation requires a local user to open an attacker-supplied capture that actually contains malformed synchrophasor/PMU traffic, so the C37.118 dissector code path must run; the CVSS vector (AV:L/AC:L/PR:N/UI:R) confirms a local, unauthenticated but user-interaction-dependent trigger with availability-only impact. This is a low-priority, moderate-CVSS (5.5) availability bug with no confidentiality or integrity impact and no code execution; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows an attacker to crash the application by supplying a crafted packet capture or frame that reaches the MBIM (Mobile Broadband Interface Model) protocol dissector. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 5.5) shows the attack is local with no privileges required but requires user interaction - typically opening a malicious capture file - and the only impact is availability loss from a recoverable crash with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; consistent with the independent assessment, this is a low-priority, availability-only defect despite its medium 5.5 rating, and consumers of untrusted captures should still patch or restrict the MBIM dissector.
Heap-based buffer overflow in Wireshark's sharkd JSON-RPC backend (CVE-2026-95388) allows attacker-controlled packet-capture data to crash the local analysis process in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18. The issue is local and requires user interaction, because an analyst must load a malicious capture into sharkd, and it yields only denial of service (CVSS 5.5, AV:L/PR:N/UI:R, A:H). No public exploit identified at time of analysis, and the practical risk is limited to deployments that actually invoke the sharkd utility.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by a reachable-assertion failure in the Frame protocol metadissector, a local, user-assisted denial of service tracked as CVE-2026-96422 (CVSS 5.5, CWE-617). The attack vector is local and requires user interaction: an analyst must open or process a crafted capture file, or capture crafted live traffic that reaches the metadissector, after which the parser aborts the process; the impact is limited to availability (A:H) with no confidentiality or integrity effect and no code execution. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; authentication requirements are not confirmed from the available data, though the assessed vector (AV:L/PR:N/UI:R) indicates no privileges are needed beyond the victim loading the malicious input. Risk is genuine but low-urgency, confined to disruption of the analysis workflow.
Denial of service in Wireshark 4.6.0-4.6.8 and 4.4.0-4.4.18 allows attackers to hang or exhaust memory in the Wireshark process by getting a user to open a crafted capture file containing malformed USB HID data. The flaw is an infinite loop and memory leak in the USB HID protocol dissector (CWE-1325); exploitation requires user interaction to load the file and cannot cause code execution or data disclosure. No public exploit was identified at time of analysis, and the assessed CVSS 3.1 score is 5.5 (Medium) with high availability impact under a local vector.
Crashing denial-of-service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when the RF4CE protocol dissector processes a malformed packet, triggering a heap-based buffer overflow (CWE-122) that terminates the application. The attack is not remotely triggerable: a local user must be induced to open a crafted capture file (or start a live capture containing RF4CE-classified traffic), and no authentication is required (PR:N) while user interaction is mandatory (UI:R), so impact is confined to process availability with no confidentiality or integrity loss. There is no public exploit identified at time of analysis and no CISA KEV listing; the vendor has published an advisory (wnpa-sec-2026-104) that should be consulted for the fixed release.
Malformed TIFF data processed by Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 causes the TIFF protocol dissector to loop indefinitely, hanging the application until it is killed manually. Exploitation is local and client-side (AV:L, UI:R): an attacker must convince an analyst to open a crafted capture file or dissect attacker-controlled traffic containing the malicious TIFF payload, and no privileges are required (PR:N). Impact is availability-only (C:N/I:N/A:H, CVSS 5.5) with no data disclosure, modification, or code execution, and no public exploit has been identified at time of analysis - this is a genuine but low-priority issue whose realistic risk is targeted social engineering of analysts rather than mass exploitation.
Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can crash when a user opens a crafted capture file in the Toshiba ('compact router snoop') format, producing a denial-of-service condition limited to the affected process. The underlying issue is a buffer over-read (CWE-126) in the Toshiba wiretap parser; the supplied CVSS vector rates it as local, high-complexity, user-interaction-required, and availability-only, and the independent assessment calls it a genuine but low-priority issue. No public exploit was identified at time of analysis.
A heap-based buffer overflow in the IEEE 802.11 dissector of Wireshark versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 allows local, unauthenticated attackers to cause a denial of service (application crash) by convincing a user to open a crafted packet capture file or by processing malicious live 802.11 traffic. The vulnerability requires user interaction and has only availability impact, with no confidentiality or integrity loss, and is considered low priority despite its Medium CVSS score of 5.5. No public exploit code or active exploitation has been identified at time of analysis; the IEEE 802.11 dissector is enabled by default, so no special configuration is needed beyond processing the malicious data.
Opening a crafted Catapult DCT2000 capture file in Wireshark 4.6.0 through 4.6.8 or 4.4.0 through 4.4.18 triggers a stack-based buffer overflow in the DCT2000 protocol dissector, terminating the application. The issue is local and client-side (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, base 5.5): the analyst must actively load the malicious file or a capture whose packets are routed through the DCT2000 dissector, and no authentication is required per the vector, but user interaction is. Impact is limited to an availability loss - a crash of the Wireshark process - with no code execution, data disclosure, or integrity impact indicated. No public exploit code was identified at time of analysis, and the flaw is not confirmed actively exploited (not in CISA KEV); the vendor has published advisory wnpa-sec-2026-110 and an associated GitLab work item.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
DKIM signature verification in OpenDKIM through 2.11.0 can be desynchronized by a crafted DKIM-Signature header, causing the tag tokenizer (dkim_process_set in dkim.c) to consume attribute values from a less trusted source than the signed data and return an attacker-influenced authentication verdict. Exploitation is remote and unauthenticated over SMTP against a standard Postfix/Sendmail milter deployment, but the impact is deliberately limited: the desync affects only the DKIM result of the single crafted message, so real damage depends on whether downstream DMARC enforcement or anti-phishing filtering blindly trusts OpenDKIM's verdict. Publicly available exploit code exists (the CVSS 4.0 vector carries E:P and the researcher published a technical write-up), there is no confirmed active exploitation in CISA KEV, and the vendor did not respond to the disclosure, so no vendor-released patch has been identified.
Risk cannot be meaningfully assessed from the available data for CVE-2026-96543, which is currently known only through the vendor:ubuntu security feed with no description, no CWE, no CVSS score or vector, and no identified affected package. Because the affected product or feature, the protocol involved, and the configuration prerequisites are all absent, it is not possible to determine who is affected or what an attacker could achieve. No public exploit identified at time of analysis, and no patch version data was supplied, so the corresponding Ubuntu Security Notice (USN) must be reviewed manually to establish exploitation prerequisites and impact.
Ubuntu is the only vendor identified for CVE-2026-96544, but the intelligence feed supplies no description, CWE, CVSS score, or CVSS vector, so the affected component, the vulnerable version range, and the resulting impact are all unconfirmed. The identifier comes from a vendor advisory channel (vendor:ubuntu), which indicates the flaw is most likely tracked against one or more Ubuntu source packages rather than a third-party upstream product, but the specific package and release cannot be determined from the data at hand. No public exploit code and no confirmed active exploitation are indicated by the supplied intelligence, and because no CVE record, Ubuntu Security Notice, or patch reference was included, no meaningful severity or risk rating can be assigned until the authoritative record is retrieved.
Ubuntu Linux is the only product context available for CVE-2026-88841, and the record is effectively a placeholder: the supplied intelligence contains no description, no affected package or component name, no CVSS score or vector, no CWE mapping, no CPE identifiers, and no references beyond the originating vendor tracker (vendor:ubuntu). Because of this, the concrete impact, attack vector, authentication requirements, and platform prerequisites cannot be stated, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data; the only defensible action at this point is to obtain the Ubuntu CVE tracker entry and the referenced upstream advisory before making any defensive or prioritization decision.
No impact assessment is possible for CVE-2026-95622 from the intelligence available at this time: the record supplies no description, no CVSS score or vector, no CWE classification, and no CPE identifiers, and the only attribution is a 'vendor:ubuntu' reporter tag. Consequently the vulnerable component, the affected Ubuntu package and release, and the privileges an attacker would require remain unknown, and no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal are present to suggest real-world activity. The identifier should be treated as unverified and non-actionable until NVD/MITRE publishes the CVE record and the Ubuntu security team issues a corresponding USN or tracker entry.
Sandboxed Flatpak applications can deliver signals to a process group that also contains a parent process outside the app's sandbox, letting a malicious or compromised app terminate the desktop environment or user session (denial of service) on Flatpak versions before 1.18.4. Exploitation is local and gated on the victim installing and executing attacker-controlled sandboxed code; the assessed CVSS v3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) records a scope change with high availability impact and no confidentiality or integrity impact. No CISA KEV listing, EPSS score, or public exploit code was identified at time of analysis, and the issue is fixed in Flatpak 1.18.4, released alongside sibling fixes CVE-2026-97023 through CVE-2026-97027.
SUSE Rancher Fleet versions 0.16 before 0.16.2, 0.15 before 0.15.7, 0.14 before 0.14.11, and 0.13 before 0.13.16 allow an attacker with low-privilege bundle deployment rights to modify labels and annotations on Kubernetes namespaces that the bundle's pinned identity is not authorized to change. The flaw arises from inconsistent authorization checks when a bundle requests namespace metadata updates via the namespaceLabels and namespaceAnnotations options. No public exploit code has been identified at time of analysis, and the CVSS 3.1 score of 6.5 reflects integrity-only impact (C:N/I:H/A:N) requiring existing low privileges on the network.
Rancher Fleet 0.16.0 and 0.16.1 accept requests to the gitjob webhook receiver without verification whenever no webhook secret is configured, allowing any party with network reach to that endpoint to alter the spec.pollingInterval field of matching GitRepo resources in any namespace - including namespaces where the caller holds no Kubernetes credentials or RBAC. The assessed vector is unauthenticated remote (AV:N/PR:N), and impact is deliberately narrow: only a single configuration field can be changed, with no arbitrary spec edits, secret exposure, or workload execution and no confidentiality loss. Only Fleet 0.16.0/0.16.1 are affected, Fleet 0.16.2 and all pre-0.16 releases are not, and no public exploit code has been identified at time of analysis.
Relative path traversal (CWE-23) in SUSE Rancher Fleet allows an authenticated attacker with either Git push access to a repository referenced by a GitRepo resource or Kubernetes RBAC permission to create or modify a GitRepo (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) to read files from the filesystem of the bundle-processing environment and have their contents emitted into the generated Bundle resource. The most valuable target is Helm registry credential material that Fleet makes available to the bundle-processing job when per-path Helm credentials are configured, letting the attacker exfiltrate secrets they have no Kubernetes RBAC permission to read. All Fleet branches below 0.16.2, 0.15.7, 0.14.11, 0.13.16 and 0.12.20 are affected; there is no public exploit identified at time of analysis and no evidence of confirmed active exploitation, so this is a moderate privilege-boundary-crossing disclosure rather than an emergency.
An unsigned integer underflow in libXpm's XPM write/save path (libXpm before 3.5.19) causes unbounded CPU consumption and memory exhaustion, resulting in denial of service. The flaw is reachable only when an application linked against the library is made to write or convert attacker-influenced data to the XPM format, so exploitation is local (AV:L) and requires the victim to actively process the crafted input (UI:R); no privileges are required (PR:N) and there is no path to data disclosure or code execution. No public exploit has been identified at time of analysis, and no confirmed active exploitation (CISA KEV) has been reported; the upstream fix is present in a libXpm merge-request commit, with libXpm 3.5.19 indicated as the corrected version. Given the local, interaction-dependent trigger and DoS-only impact (CVSS 5.5), this is a genuine but low-priority issue.
Malicious or compromised X servers can crash X clients linked against libX11 before 1.8.14 by supplying crafted byte-oriented codeset/locale data that triggers an out-of-bounds read in the client's codeset parser. The flaw is a client-side denial of service with only incidental memory disclosure, not code execution, and it works in the reverse of the usual trust direction: the server attacks the client, so exposure requires a victim application to open an X11 connection to an X server the attacker controls or has compromised (such as a hostile remote or forwarded display). The local attack vector and the requirement for an untrusted display keep realistic risk low; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available (upstream fix merged for the 1.8.14 release).
Crashing of X11 client applications can be triggered by a malicious X server exploiting an out-of-bounds read in libX11's X Input Method (XIM) trigger-key registration parser in versions before 1.8.14. This is a medium-severity denial-of-service issue (CVSS 5.5) that requires the victim to connect to an attacker-controlled X server, with user interaction (UI:R) and no authentication required (PR:N), but impact is limited to availability (client crash). No public exploit identified at time of analysis, and it is not confirmed actively exploited (CISA KEV).
Remote, unauthenticated attackers who control an X server can crash X clients linked against libX11 before 1.8.14 by returning crafted XIM (X Input Method) attribute data, because the parser performs an out-of-bounds read (CWE-125). This is an availability-only denial-of-service (CVSS 6.5, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) limited by an inverted trust relationship: the victim's client must attach to the attacker's display, so exploitation requires the user to connect to a malicious, compromised, or spoofed X server. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.
An off-by-one error in OpenDKIM's quoted-printable decoder (dkim_qp_decode in util.c) affects all releases up to and including 2.11.0 and is reachable by remote, unauthenticated attackers who can deliver mail to a host running OpenDKIM as a verifying milter. The flaw is triggered while decoding attacker-controlled message bodies, producing low-magnitude confidentiality, integrity and availability impact rather than reliable code execution, consistent with the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Publicly available exploit code exists, and the vendor was contacted before disclosure but did not respond, so no vendor-released patch has been identified at time of analysis.
RabbitMQ Management versions 3.13.0 through 3.13.18, 4.0.23, 4.1.14, 4.2.9 and 4.3.4 render an attacker-controlled AMQP queue name as unescaped HTML in an authorization-error reason when the OAuth management UI is enabled, allowing an injected <base> element to retarget the UI's automatic relative refresh. An authenticated attacker holding queue 'configure' permission can therefore cause a management administrator who clicks 'Get Message(s)' on the crafted queue to send their Authorization header to an attacker-controlled endpoint whose CORS policy accepts the management origin. Exploitation requires a stacked set of preconditions - non-default OAuth UI, attacker queue-configure rights, an administrator who can see but cannot read the queue, a victim click, a Content Security Policy lacking base-uri and connect-src, and an attacker endpoint that permits the management origin via CORS - which substantially limits real-world risk; no public exploit identified at time of analysis, and the issue is rated MEDIUM (CVSS 4.0 base 4.5).
Secret disclosure in kitty 0.25.0 through versions before 0.49.0 lets a second local user on the same host capture text that the victim types into prompts rendered by kitty itself, including masked password prompts, without holding any privilege on the victim's account. The askpass escape-code handler in kitty/window.py (handle_remote_askpass) opens a POSIX shared-memory object named in an attacker-supplied device control string and later writes the typed answer back into an object of that same name, never verifying that the object is owned by the user running kitty or that its permissions exclude other users, unlike the equivalent ssh kitten path which performs exactly that check. Exploitation is tightly bounded: it requires a POSIX shared-memory namespace shared between attacker and victim, attacker-influenced bytes being displayed in the victim's terminal, and the victim actually answering the rendered prompt; no public exploit code has been identified at time of analysis and this CVE is not in CISA KEV, and hosts with isolated shared memory, single-user workstations, and kitty 0.49.0 or later are not affected.
Atom-table exhaustion in RabbitMQ 4.x lets an authenticated user who holds the 'policymaker' tag crash a broker node by sending a sustained stream of requests (roughly one million) to the Management plugin's /api/global-parameters/:name endpoint, each with a unique name value. The handler passes the URL segment through rabbit_data_coercion:to_atom/1, which uses the unsafe binary_to_atom/2; because Erlang atoms are never garbage collected, every novel name permanently consumes an atom-table slot until the VM aborts. Exposure requires the Management plugin to be enabled and an account above the management tag (but below administrator); it is not reachable unauthenticated, and the assessed impact is availability-only (no confidentiality or integrity loss). No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in RabbitMQ 4.0.22, 4.1.14, 4.2.7 and 4.3.1.
Denial of service in RabbitMQ's management HTTP API lets an authenticated administrator crash the broker by submitting a user (or importing definitions) whose tags list contains roughly one million unique strings; each string is converted to a permanent Erlang atom until the bounded atom table is exhausted and the BEAM node dies. Affected versions are RabbitMQ 4.0.0 through 4.0.21, 4.1.x before 4.1.14, and 4.2.x before 4.2.7, and the attack requires the management plugin to be enabled and reachable plus full administrator privileges, so there is no unauthenticated or low-privilege path. No public exploit code identified at time of analysis, and vendor-released patches are available in 4.0.22, 4.1.14 and 4.2.7; this is a genuine but low-priority availability issue rather than a confidentiality or integrity risk.
Use-after-free in the drag-and-drop source path of the kitty terminal emulator (versions 0.47.0 up to but not including 0.49.0) allows any program that controls the terminal's output byte stream to make the terminal read from and write to freed heap memory while the user is actively dragging content out of the window. The flaw lives in drag_remote_file_data() in kitty/dnd.c, which keeps a DragRemoteItem pointer into an array that the error path's cancel_drag()/drag_free_offer() teardown frees, then continues to dereference and write through it; per the assessed vector this is a local, user-interaction-required issue (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) with integrity and availability impact only and no confidentiality impact, matching the vendor's low 4.6 CVSS 4.0 base score. No public exploit code was identified at time of analysis, and the issue is not confirmed actively exploited (not in CISA KEV); a vendor patch is available in kitty 0.49.0.
Information disclosure in the kitty terminal emulator versions 0.47.0 through 0.48.x lets a program that can write escape sequences to the terminal read the contents of files a user merely drags over a kitty window, without ever completing the drop. The drag-and-drop handler in kitty/dnd.c serves a client's drag-data request without first verifying that a drop has actually occurred, and drop_left_child() keeps the offered URI list, directory handles, an open file descriptor and its main-loop transfer timer alive after the drag leaves the window, so a client can keep reading through a retained directory handle or let an in-flight file transfer continue streaming with no drag in progress. The CVSS 4.0 base score is 6.0 (moderate), the request path is unauthenticated (PR:N) and the decisive precondition is user interaction: the victim must drag a file or directory over the window; no public exploit code was identified at time of analysis, and vendor-released patch kitty 0.49.0 is available.