Suse
Monthly
Miniflux's media proxy endpoint is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.16, allowing authenticated users to craft malicious proxy URLs that force the application to fetch and expose responses from internal network resources including localhost and private IP ranges. An attacker with valid credentials can abuse this to access sensitive internal services and metadata endpoints by embedding specially crafted URLs in feed content. Public exploit code exists for this vulnerability, and no patch is currently available for affected installations.
Bokeh versions 3.8.1 and below allow attackers to bypass Origin validation in WebSocket connections by registering domains that suffix-match allowlisted domains (e.g., dashboard.corp.attacker.com for allowlist entry dashboard.corp), enabling unauthorized server interaction. Public exploit code exists for this vulnerability, which could allow attackers to access sensitive data or modify visualizations on behalf of victims. The issue is resolved in Bokeh 3.8.2.
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that permits unauthenticated attackers to probe and access internal network resources and services. The endpoint insufficiently validates destination addresses, allowing requests to internal IP ranges despite scheme validation. Public exploit code exists for this vulnerability, which is resolved in version 1.28.1.
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. [CVSS 7.5 HIGH]
Stored XSS in Listmonk before version 6.0.0 allows authenticated users with campaign management permissions to inject malicious JavaScript that executes when administrators preview campaigns or templates, enabling privilege escalation attacks such as creating backdoor admin accounts. Public exploit code exists for this vulnerability, and the attack surface expands through the public archive feature where victims need only visit a link to trigger the payload. Version 6.0.0 addresses this flaw, though patches are currently unavailable for earlier versions.
Improper IV handling in libtpms 0.10.0 and 0.10.1 causes the library to return initial instead of final initialization vectors during symmetric cipher operations with OpenSSL 3.x, potentially weakening cryptographic security for local users who can interact with the TPM emulation. Public exploit code exists for this vulnerability affecting confidentiality of encrypted data. Update to libtpms 0.10.2 to remediate.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Arbitrary file read in KEDA (Kubernetes Event Driven Autoscaling) affects operator versions prior to 2.17.3 and 2.18.0 through 2.18.2 (fixed in 2.17.3, 2.18.3 and 2.19.0+), allowing an authenticated attacker who holds Kubernetes RBAC permission to create or modify a TriggerAuthentication resource to direct the content of any file on the KEDA pod's node - such as service account tokens, secrets, or /etc/passwd - to an attacker-controlled HashiCorp Vault endpoint during the Vault authentication handshake. This is an access-gated confidentiality issue rather than a broadly exploitable flaw: the PR:H prerequisite (write access to TriggerAuthentication) is the main limiting factor, and the advisory's only effective workaround is strict RBAC restriction on that resource. No public exploit code has been identified at time of analysis, and EPSS is low at 0.55% (44th percentile), with no CISA KEV listing.
Denial of service in Dire Wolf through 1.8 and before commit 3658a87 allows a remote, unauthenticated attacker to terminate the decoding process by delivering a malformed AX.25/APRS MIC-E frame whose comment field is empty or truncated, such as one containing an embedded NUL byte near the end of the packet. The flaw is a reachable assertion in aprs_mic_e() in src/decode_aprs.c (CWE-617) that aborts when the decoded comment string is not non-empty. No public exploit identified at time of analysis, and impact is availability-only: no code execution or data exposure results. The NVD CVSS 4.0 vector scores 8.7 with VA:H, while the independent assessment rates availability-only impact with no authentication or user interaction required.
Argument injection in libnbd's SSH transport allows an attacker who persuades a libnbd-using application or user to open a crafted NBD URI to run arbitrary commands with the privileges of the user running libnbd. The flaw affects libnbd builds that support nbd+ssh:// style connections and triggers when the hostname component of the URI begins with '-o', so the spawned ssh process interprets it as a command-line option instead of a host. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation remains gated by user interaction (a victim process must be induced to open the crafted URI), EPSS is low at 0.14% (3rd percentile), and Red Hat scores it 4.8 while our independent assessment applies a higher-impact vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) given the full confidentiality, integrity and availability impact of command execution.
A compromised or malicious Android device connected over USB/ADB can crash the scrcpy host client (versions up to and including 3.3.3, prior to commit 3e40b24) by sending crafted device messages that trigger out-of-bounds reads in sc_device_msg_deserialize(). Publicly available exploit code exists, but with an EPSS score of only 0.42% (34th percentile) and no CISA KEV listing, multiple signals point to a modest, situationally-bounded risk rather than a top-tier priority; per the assessed CVSS 3.1 vector the impact is availability only (client crash or denial of service) with no confirmed confidentiality or integrity loss, though the advisory notes this may enable further exploitation on the host system.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Forged plaintext can be substituted for legitimate decryption output in the Amazon S3 Encryption Client for Go (versions up to and including v3.1) when an application stores the encrypted data key (EDK) in an external "Instruction File" instead of the S3 object's metadata record. An attacker who holds write/upload permission to the target bucket can replace that instruction file with a rogue EDK that decrypts the same underlying ciphertext into attacker-chosen content, exploiting the "Invisible Salamanders" property of a non-committing AEAD, so later reads by the victim client return valid-looking but forged data; the impact is integrity-only (no confidentiality or availability loss) and the default metadata-record storage path is not vulnerable. Amazon shipped key commitment in v4.0.0 on 2025-12-16, EPSS is only 0.11% (1st percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Heap corruption in Google Chrome's V8 JavaScript engine affects all builds prior to 143.0.7499.147, allowing a remote attacker to trigger out-of-bounds reads and writes by luring a victim to a crafted HTML page. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms unauthenticated remote reachability gated only by user interaction - simply rendering the malicious page - with high confidentiality and integrity impact, and no public exploit identified at time of analysis. Exploitation is confined to the renderer process by Chrome's sandbox, so full host compromise would typically require chaining a separate sandbox-escape, but the issue remains high priority for patching given the reliability of V8 memory-corruption primitives and the trivial delivery vector.
Heap corruption via use-after-free in Google Chrome's WebGPU implementation (CWE-416) affects all builds prior to 143.0.7499.147, allowing a remote, unauthenticated attacker to corrupt memory in the renderer process when a victim simply visits a crafted HTML page that exercises the WebGPU API. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) - the priority here is driven by Chrome's enormous deployment footprint and by the fact that exploitation needs only user interaction (UI:R) with no credentials (PR:N). Google rates the issue as High severity and has shipped a fixed build in the stable channel, and because the flaw lands in the sandboxed renderer, full host compromise would still require chaining an additional sandbox escape.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Namespace administrators on OpenShift clusters running the Red Hat OpenShift GitOps (Argo CD) operator prior to v1.16.2 can craft ArgoCD Custom Resources that coerce the operator into assigning permissions in other namespaces, including privileged ones. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1), an authenticated attacker with namespace-admin rights can escalate from a single tenant namespace to cluster-wide root by creating privileged workloads scheduled onto master nodes; the scope change reflects the cross-namespace breakout. Exploitation requires prior namespace-admin privilege (PR:H), so multi-tenant shared clusters with semi-trusted tenants carry the real risk, while single-tenant environments where namespace admins are already trusted see limited added exposure; no public exploit identified at time of analysis and the EPSS score is only 0.69% (51st percentile), indicating low observed exploitation activity despite the high paper severity.
Memory corruption in OFFIS DCMTK 3.6.9 and earlier lets a remote, authenticated user corrupt a heap buffer when an affected application parses a maliciously crafted DICOM byte-string value element through DcmByteString::makeDicomByteString in dcmdata/libsrc/dcbytstr.cc. Impact is bounded - Low confidentiality, integrity, and availability - consistent with a single-byte out-of-bounds write rather than reliable remote code execution, and the practical exposure depends on whether the target deployment exposes a DICOM listener (PACS/SCP), file viewer, or conversion pipeline that ingests untrusted DICOM data. No public exploit code has been identified at time of analysis and EPSS is low (0.27%, 18th percentile); vendor-released patch: 3.7.0 (commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a), making this a routine medium-to-low priority library upgrade rather than an emergency.
Domain spoofing in the toolbar of Google Chrome for Android before 143.0.7499.110 lets a remote, unauthenticated attacker deceive users about the true origin of a page by having them open a crafted HTML page. Exploitation requires the victim to actively navigate to the attacker's page (UI:R) and depends entirely on the user believing the spoofed address bar, so impact is limited to phishing facilitation rather than code execution, data theft, or session compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.27% (18th percentile); per Google's own rating this is a Medium-severity Chromium issue, and the vendor fix is available in version 143.0.7499.110.
Use-after-free in the Password Manager component of Google Chrome prior to 143.0.7499.110 allows a remote, unauthenticated attacker to corrupt memory and potentially pivot out of the browser sandbox when a victim opens a crafted HTML page. The attack is not autonomous: it requires the victim to load the malicious page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the resulting primitive is only a sandbox-escape building block, so realistic impact depends on chaining a separate renderer compromise. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is low at 0.24% (14th percentile), which combined with Chrome's automatic update mechanism makes this a moderate-risk rather than high-priority issue. Google rates the underlying Chromium bug as Medium severity and has shipped a fix in Chrome 143.0.7499.110.
Authenticated remote code execution in pgAdmin 4 versions up to and including 9.10 lets a user who holds restore privileges inject and execute arbitrary operating-system commands on the pgAdmin host by submitting a crafted PLAIN-format dump file to the restore workflow while the product runs in server (web) mode. The attacker needs only a valid low-privilege account (CVSS vector PR:L, unauthenticated network reachability of the web interface per AV:N) and no user interaction, giving full compromise of confidentiality, integrity, and availability of the pgAdmin instance and the database credentials and data it manages. Exploitation is gated on a specific deployment posture - server mode rather than desktop mode - and on the ability to trigger a restore of attacker-controlled PLAIN-format input, which confines realistic risk to authenticated or internal users rather than anonymous internet attackers. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is modest at 0.94% (60th percentile), making this a genuine high-priority issue rather than a drop-everything emergency.
Local privilege escalation in the sd command-line find-and-replace utility (versions 1.0.0 and earlier, by chmln) allows a local attacker to gain root privileges through a crafted command. The flaw stems from incorrect privilege assignment (CWE-266) and is exploitable locally with no authentication indicated by the CVSS vector (PR:N), yielding full confidentiality, integrity, and availability compromise. Publicly available exploit code exists (proof-of-concept gist), though the EPSS score is low at 0.18% (8th percentile), and the CVE is not listed in CISA KEV.
Improper input validation in TianoCore EDK2-based BIOS/UEFI firmware allows a local attacker with high privileges to alter control flow and potentially execute arbitrary commands, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high privileges (PR:H) and local access, with no user interaction; the CVSS 4.0 vector's network access metric (AV:N) conflicts with the assessed local-access requirement and must be verified with the vendor. No public exploit code or confirmed active exploitation was identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.
In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix with num_config_bases rows and num_config_regs columns. This is currently handled by allocating a buffer to hold a pointer for each row (i.e. num_config_bases). After that, the logic attempts to allocate the memory required to hold the register configuration for each row. However, instead of doing this allocation for each row (i.e. num_config_bases allocations), the logic erroneously does this allocation num_config_regs number of times. This scenario can lead to out-of-bounds accesses when num_config_regs is greater than num_config_bases. Fix this by updating the terminating condition of the loop that allocates the memory for holding the register configuration to allocate memory only for each row in the matrix. Amit Pundir reported a crash that was occurring on his db845c device due to memory corruption (see "Closes" tag for Amit's report). The KASAN report below helped narrow it down to this issue: [ 14.033877][ T1] ================================================================== [ 14.042507][ T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364 [ 14.050796][ T1] Write of size 8 at addr 06ffff8081021850 by task init/1 [ 14.242004][ T1] The buggy address belongs to the object at ffffff8081021850 [ 14.242004][ T1] which belongs to the cache kmalloc-8 of size 8 [ 14.255669][ T1] The buggy address is located 0 bytes inside of [ 14.255669][ T1] 8-byte region [ffffff8081021850, ffffff8081021858)
In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 inline_data_addr fs/f2fs/f2fs.h:3275 [inline] __recover_inline_status fs/f2fs/inode.c:113 [inline] do_read_inode fs/f2fs/inode.c:480 [inline] f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 mount_bdev+0x276/0x3b0 fs/super.c:1391 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_sys_mount fs/namespace.c:3884 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue was bisected to: commit d48a7b3a72f121655d95b5157c32c7d555e44c05 Author: Chao Yu <chao@kernel.org> Date: Mon Jan 9 03:49:20 2023 +0000 f2fs: fix to do sanity check on extent cache correctly The root cause is we applied both v1 and v2 of the patch, v2 is the right fix, so it needs to revert v1 in order to fix reported issue. v1: commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ v2: commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/
In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release().
In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allowed various crash as reported by syzbot [1] and Kyle Zeng. Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32. kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0. kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations. Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE). This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng. [1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554 CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4 mm/kasan/report.c:398 kasan_report+0x150/0x1ac mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 __build_skb_around net/core/skbuff.c:294 [inline] __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 alloc_skb include/linux/skbuff.h:1316 [inline] igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359 add_grec+0x81c/0x1124 net/ipv4/igmp.c:534 igmpv3_send_cr net/ipv4/igmp.c:667 [inline] igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810 call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x54c/0x710 kernel/time/timer.c:1790 run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803 _stext+0x380/0xfbc ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq kernel/softirq.c:437 [inline] __irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683 irq_exit_rcu+0x14/0x78 kernel/softirq.c:695 el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.
In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.
Local privilege escalation via kernel memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with network-admin capability to trigger a use-after-free in tipc_mon_reinit_self(). The flaw stems from tipc_net_finalize_work() iterating the RTNL-protected monitors[] array from a workqueue without holding the RTNL lock, letting freed monitor structures be accessed. Reported by syzbot with no public exploit and a very low EPSS (0.05%); it is not in CISA KEV, and a vendor fix is available across all supported stable branches.
Local memory corruption in the Linux kernel's KVM guest_memfd subsystem (introduced in 6.8) lets a local user with KVM VM-management access trigger a slab use-after-free by racing memslot deletion against release of a dying guest_memfd file. When a memslot is freed before its guest_memfd file is fully released, kvm_gmem_release() writes to already-freed memory, as confirmed by a syzbot/KASAN report. There is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 6th percentile), reflecting a narrow race rather than a broadly weaponizable flaw.
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public PoC available. Vendor patch is available.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
A security vulnerability in KDE Connect (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
Use-after-free in the Linux kernel's MPTCP subsystem stems from a race in mptcp_schedule_work() (net/mptcp/protocol.c), where the socket refcount was taken only after the work item was queued, allowing mptcp_worker() to run and free the socket before sock_hold() executes. Reachable via the MPTCP timeout timer (mptcp_tout_timer), it was found by syzbot and produces a refcount 'addition on 0' warning that signals kernel memory corruption. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-time race rather than a readily weaponized flaw despite the auto-generated 9.8 score.
Denial-of-service via a use-after-free in the Linux kernel's MPTCP path-manager allows the add-address timer (mptcp_pm_del_add_timer()) to call sk_stop_timer_sync() on an announcement-list entry that another context has already freed, corrupting kernel memory. The flaw affects the mptcp subsystem across multiple long-lived stable branches and was found by syzbot via a KASAN slab-use-after-free report; the upstream fix adds RCU protection. No public exploit is identified at time of analysis, EPSS is 0.05%, and it is not listed in CISA KEV.
Local privilege-context memory corruption in the Linux kernel's GPIO character device (gpio cdev) subsystem allows a use-after-free on the file structure backing an open GPIO chardev descriptor. When a GPIO line-change event fires after the final fput() has dropped the fd's reference count to zero but before the deferred .release() callback unregisters the notifier, the kernel calls get_file() on a file with a zero refcount, triggering a use-after-free (warned as 'f_count incremented from zero; use-after-free condition present'). No public exploit has been identified at time of analysis and the EPSS score is negligible (0.03%), consistent with a hard-to-win local race rather than a widely exploited flaw.
Local privilege-escalation-grade memory corruption in the Linux kernel's AF_VSOCK (virtio/vhost vsock) stack allows a local user to trigger a use-after-free or NULL-pointer dereference by racing a signal or timeout against an in-progress connect() on an already-established socket. Aborting the connect could tear down a connected socket while a concurrent sendmsg() or sockmap operation runs, corrupting credit accounting (bytes_unsent), breaking sockmap invariants, and enabling a transport change/drop after TCP_ESTABLISHED. No public exploit is identified at time of analysis and EPSS is 0.05%, but the flaw is patched across many stable branches and tracked by Ubuntu, Debian, and Siemens.
Memory-map miscalculation in the Linux kernel's nios2 architecture code allows local low-privileged users to trigger kernel paging failures and denial of service on affected nios2 (soft-core) systems built with CONFIG_FLATMEM. Because memblock.current_limit is left at its default MEMBLOCK_ALLOC_ANYWHERE when pfn limits are computed, max_low_pfn can exceed max_pfn and push mem_map beyond valid DRAM, producing 'Unable to handle kernel paging request' oopses and kernel panics. No public exploit identified at time of analysis; EPSS is 0.04% (11th percentile) and the flaw is not in CISA KEV.
Uninitialized-memory read in the Linux kernel's HFS+ filesystem driver (__hfsplus_ext_cache_extent) allows a local actor who can write to a mounted HFS+ volume to trigger use of uninitialized heap data, leading to information disclosure or a kernel crash. The flaw, found by syzbot via KMSAN on kernel 6.12-rc5, is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 11th percentile). Distributions including Ubuntu (USN-8029/8030/8033/8034) and Debian (DLA-4404-1) have shipped patches.
Uninitialized-memory (KMSAN uninit-value) defect in the Linux kernel HFS filesystem driver allows a local attacker who can mount or operate on a crafted HFS volume to corrupt on-disk allocation state and destabilize the filesystem. The bitmap buffer in hfs_mdb_get() was allocated with kmalloc() (leaving residual heap garbage) and later consumed by hfs_find_set_zero_bits() during block allocation, so non-zero uninitialized bits can drive incorrect bitmap decisions leading to volume corruption and driver misbehavior. Discovered by syzbot fuzzing; there is no public exploit identified at time of analysis and EPSS risk is very low (0.04%).
Denial of service in the Linux kernel EROFS filesystem driver (versions 6.15 through the 6.17.x series before 6.17.6) lets a local user crash the system by mounting or reading a specially crafted read-only filesystem image. The flaw lives in the 'encoded extents' feature added in Linux 6.15, where malformed physical-length (plen) values and out-of-48-bit physical block addresses trigger an out-of-bounds access in z_erofs_submit_queue(). No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), but vendor patches are available and the issue is tracked by Ubuntu (medium priority) and Debian.
Denial of service in the Linux kernel SCTP subsystem allows remote attackers to crash affected systems via a NULL pointer dereference triggered when an SCTP chunk arrives without a data buffer. The flaw stems from dereferencing chunk->skb inside a code path that assumes it is NULL, and is fixed across multiple stable trees (5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, 6.18). No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), indicating minimal real-world exploitation likelihood despite the network-reachable vector.
Stale extent-map cache handling in the Linux kernel's OCFS2 clustered filesystem lets a local, low-privileged user with access to an OCFS2 mount crash the kernel and read or corrupt on-disk extent data. After a reflinked (OCFS2_EXT_REFCOUNTED) extent is moved or defragmented, the in-memory extent cache retains stale flags while the disk holds updated ones; a subsequent write hits a BUG_ON in ocfs2_refcount_cal_cow_clusters(), producing a panic (denial of service) and potential data/integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a niche, non-KEV local kernel bug rather than a mass-exploited flaw.
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)
A security vulnerability in DevTools in Google Chrome (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.
A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.
A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS file.
A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MKV file.
A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.
A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted X.509 certificate that causes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Denial of service in the Linux kernel's NFSD server (NFSv4 subsystem) allows a remote attacker to exhaust memory by specifying an arbitrarily large operation count in an NFSv4 COMPOUND request header, forcing NFSD to attempt a multi-terabyte vmalloc allocation that fails and disrupts service. The flaw was introduced by commit 48aab1606fa8, which removed the historical cap on operations per COMPOUND; the fix restores a limit (raised to 200). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is very low at 0.03%.
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Miniflux's media proxy endpoint is vulnerable to Server-Side Request Forgery (SSRF) in versions prior to 2.2.16, allowing authenticated users to craft malicious proxy URLs that force the application to fetch and expose responses from internal network resources including localhost and private IP ranges. An attacker with valid credentials can abuse this to access sensitive internal services and metadata endpoints by embedding specially crafted URLs in feed content. Public exploit code exists for this vulnerability, and no patch is currently available for affected installations.
Bokeh versions 3.8.1 and below allow attackers to bypass Origin validation in WebSocket connections by registering domains that suffix-match allowlisted domains (e.g., dashboard.corp.attacker.com for allowlist entry dashboard.corp), enabling unauthorized server interaction. Public exploit code exists for this vulnerability, which could allow attackers to access sensitive data or modify visualizations on behalf of victims. The issue is resolved in Bokeh 3.8.2.
Mailpit versions 1.28.0 and earlier contain a server-side request forgery vulnerability in the /proxy endpoint that permits unauthenticated attackers to probe and access internal network resources and services. The endpoint insufficiently validates destination addresses, allowing requests to internal IP ranges despite scheme validation. Public exploit code exists for this vulnerability, which is resolved in version 1.28.1.
Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string. [CVSS 7.5 HIGH]
Stored XSS in Listmonk before version 6.0.0 allows authenticated users with campaign management permissions to inject malicious JavaScript that executes when administrators preview campaigns or templates, enabling privilege escalation attacks such as creating backdoor admin accounts. Public exploit code exists for this vulnerability, and the attack surface expands through the public archive feature where victims need only visit a link to trigger the payload. Version 6.0.0 addresses this flaw, though patches are currently unavailable for earlier versions.
Improper IV handling in libtpms 0.10.0 and 0.10.1 causes the library to return initial instead of final initialization vectors during symmetric cipher operations with OpenSSL 3.x, potentially weakening cryptographic security for local users who can interact with the TPM emulation. Public exploit code exists for this vulnerability affecting confidentiality of encrypted data. Update to libtpms 0.10.2 to remediate.
Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.
Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.
Out-of-bounds memory access in the Linux kernel's ch341 SPI driver (drivers/spi/spi-ch341) allows a local low-privileged actor to trigger heap buffer overreads and overwrites during SPI transfers on systems using a WCH CH341 USB-to-SPI bridge. The flaw stems from ch341_transfer_one copying 'len' bytes (which includes a 1-byte command header) instead of 'len - 1' from the user-supplied transfer buffer, causing both an out-of-bounds read from trans->tx_buf and, when len equals the 32-byte packet length, a 1-byte overflow of ch341->tx_buf. EPSS is low at 0.18% and there is no public exploit identified at time of analysis, consistent with a niche hardware-dependent kernel driver rather than a widely exploited target.
Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.
Arbitrary file read in KEDA (Kubernetes Event Driven Autoscaling) affects operator versions prior to 2.17.3 and 2.18.0 through 2.18.2 (fixed in 2.17.3, 2.18.3 and 2.19.0+), allowing an authenticated attacker who holds Kubernetes RBAC permission to create or modify a TriggerAuthentication resource to direct the content of any file on the KEDA pod's node - such as service account tokens, secrets, or /etc/passwd - to an attacker-controlled HashiCorp Vault endpoint during the Vault authentication handshake. This is an access-gated confidentiality issue rather than a broadly exploitable flaw: the PR:H prerequisite (write access to TriggerAuthentication) is the main limiting factor, and the advisory's only effective workaround is strict RBAC restriction on that resource. No public exploit code has been identified at time of analysis, and EPSS is low at 0.55% (44th percentile), with no CISA KEV listing.
Denial of service in Dire Wolf through 1.8 and before commit 3658a87 allows a remote, unauthenticated attacker to terminate the decoding process by delivering a malformed AX.25/APRS MIC-E frame whose comment field is empty or truncated, such as one containing an embedded NUL byte near the end of the packet. The flaw is a reachable assertion in aprs_mic_e() in src/decode_aprs.c (CWE-617) that aborts when the decoded comment string is not non-empty. No public exploit identified at time of analysis, and impact is availability-only: no code execution or data exposure results. The NVD CVSS 4.0 vector scores 8.7 with VA:H, while the independent assessment rates availability-only impact with no authentication or user interaction required.
Argument injection in libnbd's SSH transport allows an attacker who persuades a libnbd-using application or user to open a crafted NBD URI to run arbitrary commands with the privileges of the user running libnbd. The flaw affects libnbd builds that support nbd+ssh:// style connections and triggers when the hostname component of the URI begins with '-o', so the spawned ssh process interprets it as a command-line option instead of a host. There is no public exploit identified at time of analysis and no CISA KEV listing; exploitation remains gated by user interaction (a victim process must be induced to open the crafted URI), EPSS is low at 0.14% (3rd percentile), and Red Hat scores it 4.8 while our independent assessment applies a higher-impact vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) given the full confidentiality, integrity and availability impact of command execution.
A compromised or malicious Android device connected over USB/ADB can crash the scrcpy host client (versions up to and including 3.3.3, prior to commit 3e40b24) by sending crafted device messages that trigger out-of-bounds reads in sc_device_msg_deserialize(). Publicly available exploit code exists, but with an EPSS score of only 0.42% (34th percentile) and no CISA KEV listing, multiple signals point to a modest, situationally-bounded risk rather than a top-tier priority; per the assessed CVSS 3.1 vector the impact is availability only (client crash or denial of service) with no confirmed confidentiality or integrity loss, though the advisory notes this may enable further exploitation on the host system.
Use-after-free memory corruption in Apple's WebKit rendering engine allows remote attackers to crash Safari and iOS/iPadOS applications by processing maliciously crafted web content, requiring only user interaction (page visit) and no authentication. The vulnerability affects Safari 26.2, iOS 18.7.3 and iOS 26.2, iPadOS 18.7.3 and iPadOS 26.2, and macOS Tahoe 26.2 and earlier versions. With an EPSS score of 0.06% and no public exploit confirmed, this represents a low real-world exploitation priority despite the moderate CVSS 4.3 severity rating, with impact limited to denial of service through process termination.
Forged plaintext can be substituted for legitimate decryption output in the Amazon S3 Encryption Client for Go (versions up to and including v3.1) when an application stores the encrypted data key (EDK) in an external "Instruction File" instead of the S3 object's metadata record. An attacker who holds write/upload permission to the target bucket can replace that instruction file with a rogue EDK that decrypts the same underlying ciphertext into attacker-chosen content, exploiting the "Invisible Salamanders" property of a non-committing AEAD, so later reads by the victim client return valid-looking but forged data; the impact is integrity-only (no confidentiality or availability loss) and the default metadata-record storage path is not vulnerable. Amazon shipped key commitment in v4.0.0 on 2025-12-16, EPSS is only 0.11% (1st percentile), and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Heap corruption in Google Chrome's V8 JavaScript engine affects all builds prior to 143.0.7499.147, allowing a remote attacker to trigger out-of-bounds reads and writes by luring a victim to a crafted HTML page. The CVSS 3.1 vector (8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms unauthenticated remote reachability gated only by user interaction - simply rendering the malicious page - with high confidentiality and integrity impact, and no public exploit identified at time of analysis. Exploitation is confined to the renderer process by Chrome's sandbox, so full host compromise would typically require chaining a separate sandbox-escape, but the issue remains high priority for patching given the reliability of V8 memory-corruption primitives and the trivial delivery vector.
Heap corruption via use-after-free in Google Chrome's WebGPU implementation (CWE-416) affects all builds prior to 143.0.7499.147, allowing a remote, unauthenticated attacker to corrupt memory in the renderer process when a victim simply visits a crafted HTML page that exercises the WebGPU API. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) - the priority here is driven by Chrome's enormous deployment footprint and by the fact that exploitation needs only user interaction (UI:R) with no credentials (PR:N). Google rates the issue as High severity and has shipped a fixed build in the stable channel, and because the flaw lands in the sandboxed renderer, full host compromise would still require chaining an additional sandbox escape.
Local denial-of-service (and potential memory corruption) in the AMD amdkfd (Kernel Fusion Driver) component of the Linux kernel arises from a race between GPU compute-partition switching and asynchronous KFD process teardown. Because the driver's partition-switch path only checks whether the kfd_processes_table is empty - while the actual kfd_process teardown runs later in the kfd_process_wq workqueue - a partition switch can free kfd_node structures still being accessed by an in-flight release, producing a divide-by-zero kernel oops (observed in kfd_get_num_sdma_engines). No public exploit identified at time of analysis, EPSS is low (0.16%), and it is not listed in CISA KEV.
Namespace administrators on OpenShift clusters running the Red Hat OpenShift GitOps (Argo CD) operator prior to v1.16.2 can craft ArgoCD Custom Resources that coerce the operator into assigning permissions in other namespaces, including privileged ones. According to the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1), an authenticated attacker with namespace-admin rights can escalate from a single tenant namespace to cluster-wide root by creating privileged workloads scheduled onto master nodes; the scope change reflects the cross-namespace breakout. Exploitation requires prior namespace-admin privilege (PR:H), so multi-tenant shared clusters with semi-trusted tenants carry the real risk, while single-tenant environments where namespace admins are already trusted see limited added exposure; no public exploit identified at time of analysis and the EPSS score is only 0.69% (51st percentile), indicating low observed exploitation activity despite the high paper severity.
Memory corruption in OFFIS DCMTK 3.6.9 and earlier lets a remote, authenticated user corrupt a heap buffer when an affected application parses a maliciously crafted DICOM byte-string value element through DcmByteString::makeDicomByteString in dcmdata/libsrc/dcbytstr.cc. Impact is bounded - Low confidentiality, integrity, and availability - consistent with a single-byte out-of-bounds write rather than reliable remote code execution, and the practical exposure depends on whether the target deployment exposes a DICOM listener (PACS/SCP), file viewer, or conversion pipeline that ingests untrusted DICOM data. No public exploit code has been identified at time of analysis and EPSS is low (0.27%, 18th percentile); vendor-released patch: 3.7.0 (commit 4c0e5c10079392c594d6a7abd95dd78ac0aa556a), making this a routine medium-to-low priority library upgrade rather than an emergency.
Domain spoofing in the toolbar of Google Chrome for Android before 143.0.7499.110 lets a remote, unauthenticated attacker deceive users about the true origin of a page by having them open a crafted HTML page. Exploitation requires the victim to actively navigate to the attacker's page (UI:R) and depends entirely on the user believing the spoofed address bar, so impact is limited to phishing facilitation rather than code execution, data theft, or session compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.27% (18th percentile); per Google's own rating this is a Medium-severity Chromium issue, and the vendor fix is available in version 143.0.7499.110.
Use-after-free in the Password Manager component of Google Chrome prior to 143.0.7499.110 allows a remote, unauthenticated attacker to corrupt memory and potentially pivot out of the browser sandbox when a victim opens a crafted HTML page. The attack is not autonomous: it requires the victim to load the malicious page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), and the resulting primitive is only a sandbox-escape building block, so realistic impact depends on chaining a separate renderer compromise. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV; EPSS is low at 0.24% (14th percentile), which combined with Chrome's automatic update mechanism makes this a moderate-risk rather than high-priority issue. Google rates the underlying Chromium bug as Medium severity and has shipped a fix in Chrome 143.0.7499.110.
Authenticated remote code execution in pgAdmin 4 versions up to and including 9.10 lets a user who holds restore privileges inject and execute arbitrary operating-system commands on the pgAdmin host by submitting a crafted PLAIN-format dump file to the restore workflow while the product runs in server (web) mode. The attacker needs only a valid low-privilege account (CVSS vector PR:L, unauthenticated network reachability of the web interface per AV:N) and no user interaction, giving full compromise of confidentiality, integrity, and availability of the pgAdmin instance and the database credentials and data it manages. Exploitation is gated on a specific deployment posture - server mode rather than desktop mode - and on the ability to trigger a restore of attacker-controlled PLAIN-format input, which confines realistic risk to authenticated or internal users rather than anonymous internet attackers. No public exploit code or CISA KEV entry is associated with this CVE, and EPSS is modest at 0.94% (60th percentile), making this a genuine high-priority issue rather than a drop-everything emergency.
Local privilege escalation in the sd command-line find-and-replace utility (versions 1.0.0 and earlier, by chmln) allows a local attacker to gain root privileges through a crafted command. The flaw stems from incorrect privilege assignment (CWE-266) and is exploitable locally with no authentication indicated by the CVSS vector (PR:N), yielding full confidentiality, integrity, and availability compromise. Publicly available exploit code exists (proof-of-concept gist), though the EPSS score is low at 0.18% (8th percentile), and the CVE is not listed in CISA KEV.
Improper input validation in TianoCore EDK2-based BIOS/UEFI firmware allows a local attacker with high privileges to alter control flow and potentially execute arbitrary commands, with high impact to confidentiality, integrity, and availability. Exploitation requires existing high privileges (PR:H) and local access, with no user interaction; the CVSS 4.0 vector's network access metric (AV:N) conflicts with the assessed local-access requirement and must be verified with the vendor. No public exploit code or confirmed active exploitation was identified at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.
In the Linux kernel, the following vulnerability has been resolved: regmap-irq: Fix out-of-bounds access when allocating config buffers When allocating the 2D array for handling IRQ type registers in regmap_add_irq_chip_fwnode(), the intent is to allocate a matrix with num_config_bases rows and num_config_regs columns. This is currently handled by allocating a buffer to hold a pointer for each row (i.e. num_config_bases). After that, the logic attempts to allocate the memory required to hold the register configuration for each row. However, instead of doing this allocation for each row (i.e. num_config_bases allocations), the logic erroneously does this allocation num_config_regs number of times. This scenario can lead to out-of-bounds accesses when num_config_regs is greater than num_config_bases. Fix this by updating the terminating condition of the loop that allocates the memory for holding the register configuration to allocate memory only for each row in the matrix. Amit Pundir reported a crash that was occurring on his db845c device due to memory corruption (see "Closes" tag for Amit's report). The KASAN report below helped narrow it down to this issue: [ 14.033877][ T1] ================================================================== [ 14.042507][ T1] BUG: KASAN: invalid-access in regmap_add_irq_chip_fwnode+0x594/0x1364 [ 14.050796][ T1] Write of size 8 at addr 06ffff8081021850 by task init/1 [ 14.242004][ T1] The buggy address belongs to the object at ffffff8081021850 [ 14.242004][ T1] which belongs to the cache kmalloc-8 of size 8 [ 14.255669][ T1] The buggy address is located 0 bytes inside of [ 14.255669][ T1] 8-byte region [ffffff8081021850, ffffff8081021858)
In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: fix to do sanity check on extent cache correctly" syzbot reports a f2fs bug as below: UBSAN: array-index-out-of-bounds in fs/f2fs/f2fs.h:3275:19 index 1409 is out of range for type '__le32[923]' (aka 'unsigned int[923]') Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106 ubsan_epilogue lib/ubsan.c:217 [inline] __ubsan_handle_out_of_bounds+0x11c/0x150 lib/ubsan.c:348 inline_data_addr fs/f2fs/f2fs.h:3275 [inline] __recover_inline_status fs/f2fs/inode.c:113 [inline] do_read_inode fs/f2fs/inode.c:480 [inline] f2fs_iget+0x4730/0x48b0 fs/f2fs/inode.c:604 f2fs_fill_super+0x640e/0x80c0 fs/f2fs/super.c:4601 mount_bdev+0x276/0x3b0 fs/super.c:1391 legacy_get_tree+0xef/0x190 fs/fs_context.c:611 vfs_get_tree+0x8c/0x270 fs/super.c:1519 do_new_mount+0x28f/0xae0 fs/namespace.c:3335 do_mount fs/namespace.c:3675 [inline] __do_sys_mount fs/namespace.c:3884 [inline] __se_sys_mount+0x2d9/0x3c0 fs/namespace.c:3861 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd The issue was bisected to: commit d48a7b3a72f121655d95b5157c32c7d555e44c05 Author: Chao Yu <chao@kernel.org> Date: Mon Jan 9 03:49:20 2023 +0000 f2fs: fix to do sanity check on extent cache correctly The root cause is we applied both v1 and v2 of the patch, v2 is the right fix, so it needs to revert v1 in order to fix reported issue. v1: commit d48a7b3a72f1 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230109034920.492914-1-chao@kernel.org/ v2: commit 269d11948100 ("f2fs: fix to do sanity check on extent cache correctly") https://lore.kernel.org/lkml/20230207134808.1827869-1-chao@kernel.org/
In the Linux kernel, the following vulnerability has been resolved: HID: hidraw: fix data race on device refcount The hidraw_open() function increments the hidraw device reference counter. The counter has no dedicated synchronization mechanism, resulting in a potential data race when concurrently opening a device. The race is a regression introduced by commit 8590222e4b02 ("HID: hidraw: Replace hidraw device table mutex with a rwsem"). While minors_rwsem is intended to protect the hidraw_table itself, by instead acquiring the lock for writing, the reference counter is also protected. This is symmetrical to hidraw_release().
In the Linux kernel, the following vulnerability has been resolved: net: deal with integer overflows in kmalloc_reserve() Blamed commit changed: ptr = kmalloc(size); if (ptr) size = ksize(ptr); size = kmalloc_size_roundup(size); ptr = kmalloc(size); This allowed various crash as reported by syzbot [1] and Kyle Zeng. Problem is that if @size is bigger than 0x80000001, kmalloc_size_roundup(size) returns 2^32. kmalloc_reserve() uses a 32bit variable (obj_size), so 2^32 is truncated to 0. kmalloc(0) returns ZERO_SIZE_PTR which is not handled by skb allocations. Following trace can be triggered if a netdev->mtu is set close to 0x7fffffff We might in the future limit netdev->mtu to more sensible limit (like KMALLOC_MAX_SIZE). This patch is based on a syzbot report, and also a report and tentative fix from Kyle Zeng. [1] BUG: KASAN: user-memory-access in __build_skb_around net/core/skbuff.c:294 [inline] BUG: KASAN: user-memory-access in __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 Write of size 32 at addr 00000000fffffd10 by task syz-executor.4/22554 CPU: 1 PID: 22554 Comm: syz-executor.4 Not tainted 6.1.39-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:279 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:286 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x120/0x1a0 lib/dump_stack.c:106 print_report+0xe4/0x4b4 mm/kasan/report.c:398 kasan_report+0x150/0x1ac mm/kasan/report.c:495 kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:189 memset+0x40/0x70 mm/kasan/shadow.c:44 __build_skb_around net/core/skbuff.c:294 [inline] __alloc_skb+0x3c4/0x6e8 net/core/skbuff.c:527 alloc_skb include/linux/skbuff.h:1316 [inline] igmpv3_newpack+0x104/0x1088 net/ipv4/igmp.c:359 add_grec+0x81c/0x1124 net/ipv4/igmp.c:534 igmpv3_send_cr net/ipv4/igmp.c:667 [inline] igmp_ifc_timer_expire+0x1b0/0x1008 net/ipv4/igmp.c:810 call_timer_fn+0x1c0/0x9f0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x54c/0x710 kernel/time/timer.c:1790 run_timer_softirq+0x28/0x4c kernel/time/timer.c:1803 _stext+0x380/0xfbc ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:79 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:891 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:84 invoke_softirq kernel/softirq.c:437 [inline] __irq_exit_rcu+0x1c0/0x4cc kernel/softirq.c:683 irq_exit_rcu+0x14/0x78 kernel/softirq.c:695 el0_interrupt+0x7c/0x2e0 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
In the Linux kernel, the following vulnerability has been resolved: cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname TCP_Server_Info::hostname may be updated once or many times during reconnect, so protect its access outside reconnect path as well and then prevent any potential use-after-free bugs.
In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Fix potential array out-of-bounds in decoder queue_setup variable *nplanes is provided by user via system call argument. The possible value of q_data->fmt->num_planes is 1-3, while the value of *nplanes can be 1-8. The array access by index i can cause array out-of-bounds. Fix this bug by checking *nplanes against the array size.
In the Linux kernel, the following vulnerability has been resolved: fpga: prevent integer overflow in dfl_feature_ioctl_set_irq() The "hdr.count * sizeof(s32)" multiplication can overflow on 32 bit systems leading to memory corruption. Use array_size() to fix that.
Local privilege escalation via kernel memory corruption in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem allows a local attacker with network-admin capability to trigger a use-after-free in tipc_mon_reinit_self(). The flaw stems from tipc_net_finalize_work() iterating the RTNL-protected monitors[] array from a workqueue without holding the RTNL lock, letting freed monitor structures be accessed. Reported by syzbot with no public exploit and a very low EPSS (0.05%); it is not in CISA KEV, and a vendor fix is available across all supported stable branches.
Local memory corruption in the Linux kernel's KVM guest_memfd subsystem (introduced in 6.8) lets a local user with KVM VM-management access trigger a slab use-after-free by racing memslot deletion against release of a dying guest_memfd file. When a memslot is freed before its guest_memfd file is fully released, kvm_gmem_release() writes to already-freed memory, as confirmed by a syzbot/KASAN report. There is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 6th percentile), reflecting a narrow race rather than a broadly weaponizable flaw.
A security vulnerability in cpp-httplib (CVSS 5.3) that allows attacker-controlled http headers. Risk factors: public PoC available. Vendor patch is available.
cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.27.0, a vulnerability allows attacker-controlled HTTP headers to influence server-visible metadata, logging, and authorization decisions. An attacker can inject headers named REMOTE_ADDR, REMOTE_PORT, LOCAL_ADDR, LOCAL_PORT that are parsed into the request header multimap via read_headers() in httplib.h (headers.emplace), then the server later appends its own internal metadata using the same header names in Server::process_request without erasing duplicates. Because Request::get_header_value returns the first entry for a header key (id == 0) and the client-supplied headers are parsed before server-inserted headers, downstream code that uses these header names may inadvertently use attacker-controlled values. Affected files/locations: cpp-httplib/httplib.h (read_headers, Server::process_request, Request::get_header_value, get_header_value_u64) and cpp-httplib/docker/main.cc (get_client_ip, nginx_access_logger, nginx_error_logger). Attack surface: attacker-controlled HTTP headers in incoming requests flow into the Request.headers multimap and into logging code that reads forwarded headers, enabling IP spoofing, log poisoning, and authorization bypass via header shadowing. This vulnerability is fixed in 0.27.0.
In KDE Connect before 1.33.0 on Android, malicious device IDs (sent via broadcast UDP) could cause an application crash.
A security vulnerability in KDE Connect (CVSS 4.3). Remediation should follow standard vulnerability management procedures.
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.
A stored cross-site scripting (XSS) vulnerability was discovered in Seafile Community Edition prior to version 13.0.12. When Seafile is configured with the Golang file server, an attacker can upload a crafted SVG file containing malicious JavaScript and share it using a public link. Opening the link triggers script execution in the victim's browser. This issue has been fixed in Seafile Community Edition 13.0.12.
Use-after-free in the Linux kernel's MPTCP subsystem stems from a race in mptcp_schedule_work() (net/mptcp/protocol.c), where the socket refcount was taken only after the work item was queued, allowing mptcp_worker() to run and free the socket before sock_hold() executes. Reachable via the MPTCP timeout timer (mptcp_tout_timer), it was found by syzbot and produces a refcount 'addition on 0' warning that signals kernel memory corruption. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-time race rather than a readily weaponized flaw despite the auto-generated 9.8 score.
Denial-of-service via a use-after-free in the Linux kernel's MPTCP path-manager allows the add-address timer (mptcp_pm_del_add_timer()) to call sk_stop_timer_sync() on an announcement-list entry that another context has already freed, corrupting kernel memory. The flaw affects the mptcp subsystem across multiple long-lived stable branches and was found by syzbot via a KASAN slab-use-after-free report; the upstream fix adds RCU protection. No public exploit is identified at time of analysis, EPSS is 0.05%, and it is not listed in CISA KEV.
Local privilege-context memory corruption in the Linux kernel's GPIO character device (gpio cdev) subsystem allows a use-after-free on the file structure backing an open GPIO chardev descriptor. When a GPIO line-change event fires after the final fput() has dropped the fd's reference count to zero but before the deferred .release() callback unregisters the notifier, the kernel calls get_file() on a file with a zero refcount, triggering a use-after-free (warned as 'f_count incremented from zero; use-after-free condition present'). No public exploit has been identified at time of analysis and the EPSS score is negligible (0.03%), consistent with a hard-to-win local race rather than a widely exploited flaw.
Local privilege-escalation-grade memory corruption in the Linux kernel's AF_VSOCK (virtio/vhost vsock) stack allows a local user to trigger a use-after-free or NULL-pointer dereference by racing a signal or timeout against an in-progress connect() on an already-established socket. Aborting the connect could tear down a connected socket while a concurrent sendmsg() or sockmap operation runs, corrupting credit accounting (bytes_unsent), breaking sockmap invariants, and enabling a transport change/drop after TCP_ESTABLISHED. No public exploit is identified at time of analysis and EPSS is 0.05%, but the flaw is patched across many stable branches and tracked by Ubuntu, Debian, and Siemens.
Memory-map miscalculation in the Linux kernel's nios2 architecture code allows local low-privileged users to trigger kernel paging failures and denial of service on affected nios2 (soft-core) systems built with CONFIG_FLATMEM. Because memblock.current_limit is left at its default MEMBLOCK_ALLOC_ANYWHERE when pfn limits are computed, max_low_pfn can exceed max_pfn and push mem_map beyond valid DRAM, producing 'Unable to handle kernel paging request' oopses and kernel panics. No public exploit identified at time of analysis; EPSS is 0.04% (11th percentile) and the flaw is not in CISA KEV.
Uninitialized-memory read in the Linux kernel's HFS+ filesystem driver (__hfsplus_ext_cache_extent) allows a local actor who can write to a mounted HFS+ volume to trigger use of uninitialized heap data, leading to information disclosure or a kernel crash. The flaw, found by syzbot via KMSAN on kernel 6.12-rc5, is fixed across multiple stable trees; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 11th percentile). Distributions including Ubuntu (USN-8029/8030/8033/8034) and Debian (DLA-4404-1) have shipped patches.
Uninitialized-memory (KMSAN uninit-value) defect in the Linux kernel HFS filesystem driver allows a local attacker who can mount or operate on a crafted HFS volume to corrupt on-disk allocation state and destabilize the filesystem. The bitmap buffer in hfs_mdb_get() was allocated with kmalloc() (leaving residual heap garbage) and later consumed by hfs_find_set_zero_bits() during block allocation, so non-zero uninitialized bits can drive incorrect bitmap decisions leading to volume corruption and driver misbehavior. Discovered by syzbot fuzzing; there is no public exploit identified at time of analysis and EPSS risk is very low (0.04%).
Denial of service in the Linux kernel EROFS filesystem driver (versions 6.15 through the 6.17.x series before 6.17.6) lets a local user crash the system by mounting or reading a specially crafted read-only filesystem image. The flaw lives in the 'encoded extents' feature added in Linux 6.15, where malformed physical-length (plen) values and out-of-48-bit physical block addresses trigger an out-of-bounds access in z_erofs_submit_queue(). No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), but vendor patches are available and the issue is tracked by Ubuntu (medium priority) and Debian.
Denial of service in the Linux kernel SCTP subsystem allows remote attackers to crash affected systems via a NULL pointer dereference triggered when an SCTP chunk arrives without a data buffer. The flaw stems from dereferencing chunk->skb inside a code path that assumes it is NULL, and is fixed across multiple stable trees (5.4.301, 5.10.246, 5.15.196, 6.1.158, 6.6.115, 6.12.56, 6.17.6, 6.18). No public exploit identified at time of analysis, and EPSS probability is very low (0.04%, 11th percentile), indicating minimal real-world exploitation likelihood despite the network-reachable vector.
Stale extent-map cache handling in the Linux kernel's OCFS2 clustered filesystem lets a local, low-privileged user with access to an OCFS2 mount crash the kernel and read or corrupt on-disk extent data. After a reflinked (OCFS2_EXT_REFCOUNTED) extent is moved or defragmented, the in-memory extent cache retains stale flags while the disk holds updated ones; a subsequent write hits a BUG_ON in ocfs2_refcount_cal_cow_clusters(), producing a panic (denial of service) and potential data/integrity impact. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), consistent with a niche, non-KEV local kernel bug rather than a mass-exploited flaw.
Improper cleanup of IPComp fallback tunnel xfrm states in the Linux kernel's IPsec (xfrm) subsystem allows a local low-privileged attacker to trigger memory corruption (use-after-free) leading to full compromise of confidentiality, integrity, and availability. The flaw arises because fallback tunnel states were only deleted when the last user state was destroyed rather than deleted, so lingering skb references (via IP reassembly queues or deferred skb freeing) leave stale states on xfrm hashtables/lists, tripping the WARN in xfrm_state_fini and leaving dangling structures. This is not in CISA KEV and no public exploit was identified at time of analysis; EPSS is very low at 0.05%, but the 7.8 CVSS and CIA-high impact make it a meaningful local privilege-escalation candidate.
Local privilege escalation / kernel memory corruption in the Linux kernel's AF_UNIX garbage collector arises because unix_add_edge() fails to initialise the new vertex's scc_index field. On kernels where GC has already run and grouped sockets into strongly-connected components, a freshly allocated in-flight socket inherits a stale SCC index (via heap spraying), causing unix_vertex_dead() to misjudge an alive in-flight socket as dead and garbage-collect its receive queue - a use-after-free. A detailed public reproducer exists (publicly available exploit code exists); it is not in CISA KEV and EPSS is very low (0.04%).
Coder allows organizations to provision remote development environments via Terraform. Prior to 2.26.5, 2.27.7, and 2.28.4, Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace (VM, K8s Pod etc.) or a third-party system (SIEM, logging stack) could access those logs. This vulnerability is fixed in 2.26.5, 2.27.7, and 2.28.4.
CVE-2025-12084 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
MEGACO dissector infinite loop in Wireshark 4.6.0 to 4.6.1 and 4.4.0 to 4.4.11 allows denial of service
HTTP3 dissector crash in Wireshark 4.6.0 and 4.6.1 allows denial of service
Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)
A security vulnerability in DevTools in Google Chrome (CVSS 5.4). Remediation should follow standard vulnerability management procedures.
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
In gokey versions <0.2.0, a flaw in the seed decryption logic resulted in passwords incorrectly being derived solely from the initial vector and the AES-GCM authentication tag of the key seed. This issue has been fixed in gokey version 0.2.0. This is a breaking change. The fix has invalidated any passwords/secrets that were derived from the seed file (using the -s option). Even if the input seed file stays the same, version 0.2.0 gokey will generate different secrets. Impact This vulnerability impacts generated keys/secrets using a seed file as an entropy input (using the -s option). Keys/secrets generated just from the master password (without the -s option) are not impacted. The confidentiality of the seed itself is also not impacted (it is not required to regenerate the seed itself). Specific impact includes: * keys/secrets generated from a seed file may have lower entropy: it was expected that the whole seed would be used to generate keys (240 bytes of entropy input), where in vulnerable versions only 28 bytes was used * a malicious entity could have recovered all passwords, generated from a particular seed, having only the seed file in possession without the knowledge of the seed master password Patches The code logic bug has been fixed in gokey version 0.2.0 and above. Due to the deterministic nature of gokey, fixed versions will produce different passwords/secrets using seed files, as all seed entropy will be used now. System secret rotation guidance It is advised for users to regenerate passwords/secrets using the patched version of gokey (0.2.0 and above), and provision/rotate these secrets into respective systems in place of the old secret. A specific rotation procedure is system-dependent, but most common patterns are described below. Systems that do not require the old password/secret for rotation Such systems usually have a "Forgot password" facility or a similar facility allowing users to rotate their password/secrets by sending a unique "magic" link to the user's email or phone. In such cases users are advised to use this facility and input the newly generated password secret, when prompted by the system. Systems that require the old password/secret for rotation Such systems usually have a modal password rotation window usually in the user settings section requiring the user to input the old and the new password sometimes with a confirmation. To generate/recover the old password in such cases users are advised to: * temporarily download gokey version 0.1.3 https://github.com/cloudflare/gokey/releases/tag/v0.1.3 for their respective operating system to recover the old password * use gokey version 0.2.0 or above to generate the new password * populate the system provided password rotation form Systems that allow multiple credentials for the same account to be provisioned Such systems usually require a secret or a cryptographic key as a credential for access, but allow several credentials at the same time. One example is SSH: a particular user may have several authorized public keys configured on the SSH server for access. For such systems users are advised to: * generate a new secret/key/credential using gokey version 0.2.0 or above * provision the new secret/key/credential in addition to the existing credential on the system * verify that the access or required system operation is still possible with the new secret/key/credential * revoke authorization for the existing/old credential from the system Credit This vulnerability was found by Théo Cusnir ( @mister_mime https://hackerone.com/mister_mime ) and responsibly disclosed through Cloudflare's bug bounty program.
A use-after-free in the MPEG1or2Demux::newElementaryStream() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MPEG Program stream.
A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS file.
A heap overflow in the MatroskaFile::createRTPSinkForTrackNumber() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted MKV file.
A use-after-free in the ADTSAudioFileSource::samplingFrequency() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via supplying a crafted ADTS/AAC file.
A buffer overflow in the getSideInfo2() function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service (DoS) via a crafted MP3 stream.
Out-of-bounds memory operations in org.lz4:lz4-java 1.8.0 and earlier allow remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The mistral-dashboard plugin for openstack has a local file inclusion vulnerability through the 'Create Workbook' feature that may result in disclosure of arbitrary local files content. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.
Tinyproxy through 1.11.2 contains an integer overflow vulnerability in the strip_return_port() function within src/reqs.c. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Insecure permissions in fail2ban-client v0.11.2 allows attackers with limited sudo privileges to perform arbitrary operations as root. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Nnssf_NSSAIAvailability API. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the Nudm_SubscriberDataManagement API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Null pointer dereference in coap_dtls_info_callback() in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a DTLS handshake where SSL_get_app_data() returns NULL. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Array index error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in coap_dtls_generate_cookie() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Integer signedness error in tls_verify_call_back() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted TLS certificate that causes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in get_san_or_cn_from_cert() in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted X.509 certificate that causes. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
NULL pointer dereference in src/coap_openssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS/TLS connection that triggers BIO_get_data() to return NULL. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Denial of service in the Linux kernel's NFSD server (NFSv4 subsystem) allows a remote attacker to exhaust memory by specifying an arbitrarily large operation count in an NFSv4 COMPOUND request header, forcing NFSD to attempt a multi-terabyte vmalloc allocation that fails and disrupts service. The flaw was introduced by commit 48aab1606fa8, which removed the historical cap on operations per COMPOUND; the fix restores a limit (raised to 200). No public exploit identified at time of analysis, and it is not listed in CISA KEV; EPSS is very low at 0.03%.
phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.