Information Disclosure

The keyspan_pda USB-serial driver in the Linux kernel transmits kernel memory beyond the tty write buffer to an attached USB device due to an incorrect write() return value introduced with write FIFO support. After commit 034e38e8f687, the driver returns the byte count submitted to the USB device rather than the count accepted from the caller; the TTY line discipline interprets this inflated count as authorization to advance its read pointer past the buffer boundary, exposing adjacent kernel memory. Affected stable trees span Linux 5.15 through 7.1 and the 7.2-rc3 development branch, with patches released across all maintained stable series; no public exploit or active exploitation is confirmed, and EPSS is 0.21% (12th percentile).

Sensitive cryptographic key material handled by the Linux kernel's CAAM (Cryptographic Acceleration and Assurance Module) driver was unconditionally emitted to the kernel ring buffer via unguarded hex-dump calls in *_setkey() and gen_split_key(), exposing raw key bytes to any local user with dmesg access on kernels built with CONFIG_DYNAMIC_DEBUG. The exposure affects NXP CAAM-equipped platforms (i.MX, QorIQ SoC families) running kernel versions from approximately 5.3 through the fix commits across all active stable branches. No public exploit code exists and EPSS probability is 0.22%, but key material disclosure on a crypto-accelerator driver carries genuine confidentiality risk that the vendor-assigned CVSS (C:N/I:N/A:H) incorrectly characterizes - the real primary impact is confidentiality loss, not availability.

Incorrect idmap handling in the Linux kernel memory management subsystem causes `owner_or_capable()` checks inside `mincore()` and `madvise(MADV_PAGEOUT)` to use the identity no-op mount idmap (`nop_mnt_idmap`) rather than the actual mount's idmap, producing incorrect ownership evaluations on idmapped mounts. Local users with low privileges on Linux 5.12+ systems configured with idmapped mounts may trigger incorrect authorization decisions that deny legitimate memory management operations, with the most impactful edge case occurring on 0444 files where neither the idmap check nor the fallback `file_permission(MAY_WRITE)` path succeeds. No public exploit is known and EPSS is 0.21% (11th percentile), reflecting minimal real-world exploitation risk despite the Linux kernel's ubiquitous deployment footprint.

Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.

Unbounded cache invalidation parameters in the Linux kernel iommufd subsystem allow a local low-privileged user to pin a CPU indefinitely or trigger a soft-lockup watchdog fault, resulting in a kernel denial of service. The iommufd_hwpt_invalidate() ioctl accepts user-supplied entry_len and entry_num values bounded only by U32_MAX, enabling an uninterruptible gigabyte-scale memory scan or a no-reschedule VT-d flush loop. No public exploit has been identified and EPSS stands at 0.21% (11th percentile); the vulnerability is not listed in CISA KEV, indicating low active exploitation pressure.

KVM's SEV-SNP guest initialization path in the Linux kernel can trigger a host kernel panic when processing CPUID data backed by a read-only memory mapping. The flaw affects hypervisors running Linux 7.0.x before 7.1.4 where a local, low-privileged VMM process can cause KVM to write corrected CPUID values into a read-only source page after AMD's trusted firmware rejects the userspace-supplied data. No public exploit has been identified and EPSS sits at 0.20% (10th percentile), consistent with a niche, difficult-to-trigger local denial-of-service condition with no confirmed active exploitation.

KVM arm64 in the Linux kernel leaks a Page Frame Number reference when kvm_translate_vncr() races an MMU notifier, allowing a local low-privileged attacker to gradually exhaust kernel memory and cause a denial of service on affected arm64 hypervisor hosts. The vulnerability is specific to arm64 systems running KVM with VNCR (Virtualization Non-Cached Region) active, and requires precise race-condition timing (AC:H). No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) confirms this remains a low-probability exploitation target.

System hang vulnerability in the Linux kernel's NXP i.MX LPI2C driver arises from a race condition during suspend/resume power transitions. Specifically, periodic workqueues in I2C client drivers can fire I2C transfers between the suspend_noirq and resume_noirq phases, when clock and pinctrl resources have already been disabled or are not yet restored. Accessing I2C controller registers in this state causes the system to hang. The fix marks the adapter as suspended during noirq suspend, blocking transfers until hardware resources are fully restored. No public exploit or confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Division-by-zero and arithmetic underflow flaws in the Linux kernel's elan_i2c touchpad driver cause kernel panic during device probe on systems equipped with Elan I2C touchpad hardware. When device firmware or device tree supplies zero values for x_traces or y_traces, the driver performs an unguarded integer division by zero, crashing the kernel. A secondary arithmetic underflow causes the input subsystem to report a massively incorrect touch width value to userspace when physical device dimensions fall below a hardcoded threshold. No public exploit exists and EPSS is 0.22% (13th percentile), reflecting the hardware-specific, limited-scope nature of this flaw.

Integer wrap in the FUSE subsystem's prune notification handler crashes 32-bit Linux kernels when a malicious or compromised FUSE daemon sends a crafted FUSE_NOTIFY_PRUNE message. On 32-bit platforms where size_t is 32 bits, multiplying a daemon-controlled count value of 0x20000000 by sizeof(u64) wraps to zero, causing the payload length check to pass with no actual nodeid data present; the subsequent copy loop then triggers a BUG_ON assertion, inducing a kernel panic. No public exploit has been identified at time of analysis and EPSS stands at 0.21% (11th percentile), consistent with the narrow exploitation window of 32-bit-only kernels and requiring FUSE daemon control.

Error-code mishandling in the Linux kernel fuse-uring subsystem causes a failed copy_from_user() in fuse_uring_commit to be silently treated as success, leaving callers processing uninitialized or partial output arguments. Local users with low-privilege access on kernels from 6.14 through pre-patch versions can trigger a kernel panic or crash, yielding a local denial of service. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) indicates no meaningful active exploitation activity at time of analysis.

Resource exhaustion and denial of service in the Linux kernel's fuse-uring subsystem allows a local authenticated user to permanently hang FUSE requests and stall all background filesystem operations for the affected connection. The flaw was introduced with the fuse-uring interface in Linux 6.14 and affects stable series through 6.18.38 and 7.1.3; patched releases 6.18.39, 7.1.4, and mainline 7.2-rc1 are available. No public exploit has been identified at time of analysis (EPSS 0.21%, 11th percentile) and the vulnerability is absent from CISA KEV, indicating no confirmed active exploitation.

XFS filesystem quota iteration in the Linux kernel wraps a 32-bit quota ID back to zero when a disk quota entry (dquot) exists at XFS_DQ_ID_MAX, producing an infinite loop and local denial of service. Systems running Linux 6.8 and later with XFS quotas enabled are vulnerable if a dquot is present at the maximum 32-bit ID boundary (0xFFFFFFFF). No active exploitation has been identified; patched releases 6.12.96, 6.18.39, 7.1.4, and 7.2-rc4 are available from the kernel stable tree.

libsoup leaks proxy credentials to destination servers via Proxy-Authorization header attachment after CONNECT tunnel establishment. Affects libsoup when used with HTTP proxies for HTTPS tunneling. No public exploit is known, and exploitation probability is low (EPSS 0.23%).

Heap buffer over-read in libsoup's multipart response parser allows remote, unauthenticated attackers to crash client applications or leak heap memory. The flaw occurs when processing crafted HTTP multipart responses from a malicious server. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability.

Hostname verification missing in Apache Thrift Python TSSLSocket before 0.24.0 enables man-in-the-middle impersonation, allowing interception and manipulation of RPC traffic. This flaw violates TLS certificate hostname matching, effectively letting an attacker with a valid certificate for any domain present as a legitimate server. No active exploitation or public exploit code is known.

Out-of-bounds read vulnerability in the c_glib language bindings of Apache Thrift before 0.24.0 may allow remote attackers to read heap memory contents through crafted Thrift messages. Affected users should upgrade to version 0.24.0. No public exploit or active exploitation has been identified at this time.

Cleartext credential storage in Tycon Systems TPDIN-Monitor-WEB2 web management interface allows authenticated attackers to view system credentials, potentially leading to compromise of other network systems. Affected version is 2.3.9. No active exploitation or public exploit is known, and EPSS indicates a very low probability of exploitation.

Information disclosure in Cloudreve allows any logged-in user to enumerate and harvest email addresses of inactive and banned accounts via the user search API. The `SearchActive` method in v4 and v3 omits the required status filter, exposing basic profile metadata to authenticated attackers. No account credentials are compromised, but the leaked PII enables user enumeration across the platform.

Heap buffer overwrite in ImageMagick's morphology operation when an invalid user-supplied kernel is provided, leading to a denial-of-service condition. This integer overflow flaw (CWE-190) affects ImageMagick versions prior to 7.1.2-27 and the Magick.NET wrapper below 14.15.0. No active exploitation or public proof-of-concept has been identified, and EPSS data is unavailable.

JVM crash and potential in-process memory exposure in lz4-java 1.11.0 and earlier due to insufficient

Heap-buffer-overflow READ in ONNX's Gemm version converter adapter (gemm_7_6.h:41) allows an attacker who can supply a crafted model file to trigger a 16-byte out-of-bounds read when convert_version() downgrades an opset-7 Gemm node whose input tensor B has fewer than 2 dimensions. The vulnerability affects onnx pip package versions 1.3.0 through 1.21.0 and any pipeline that calls onnx.version_converter.convert_version() on untrusted model files. On Release builds the OOB read is silent and the leaked heap bytes propagate into the converted model's output shape metadata, enabling information disclosure; on instrumented builds ASan confirms the 16-byte overread 0 bytes past a 48-byte allocation. No public exploitation confirmed at time of analysis (EPSS 0.17%), though a functional 186-byte PoC is publicly available in the advisory.

Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.

Shutdown and reboot operations hang indefinitely on LoongArch-based Linux systems due to a missing RCU notification in stop_this_cpu(), exposing multi-CPU LoongArch hosts running affected kernel stable branches to an unrecoverable hang during system halt or reboot. The vulnerable path is triggered when smp_send_stop() parks secondary CPUs without calling rcutree_report_cpu_dead(), after which any irq_work_sync() call in the shutdown sequence invokes synchronize_rcu() - which then blocks forever waiting for quiescent states from CPUs that are permanently parked with interrupts disabled. No public exploit identified at time of analysis; EPSS is 0.16% at the 6th percentile and the CVE is absent from CISA KEV, consistent with this being a reliability defect rather than a security exploitation path.

MIPS SMP systems running affected Linux kernel versions hang indefinitely during reboot or shutdown due to a missing RCU subsystem notification in the stop_this_cpu() shutdown path. When smp_send_stop() parks secondary CPUs, it correctly removes them from the scheduler's view via set_cpu_online(false) but never calls rcutree_report_cpu_dead(), leaving RCU waiting for quiescent states that can never arrive. The defect became reliably triggered after commit 91840be8f710 was backported to stable branches starting with 6.18.34, causing irq_work_sync() to invoke synchronize_rcu() on MIPS systems that lack an irq_work self-IPI, with no public exploit identified at time of analysis.

Improper ordering of resource assignment in the Linux kernel's memory hotplug subsystem causes a spurious WARN_ON during error recovery in __add_memory_block(). When xa_store() fails under memory pressure, device_unregister() is invoked while mem->altmap is already set, triggering memory_block_release() with a non-NULL altmap pointer and producing a kernel warning that can lead to system instability or crash. Affected systems are those running Linux kernel versions from the introduction commit 1a8c64e110435e44e71bcd50a75663174b575f22 through the respective fix commits across the 6.6, 6.12, 6.18, 7.0, and 7.1 stable series; patches are confirmed available. No public exploit has been identified and EPSS stands at 0.16% (6th percentile), consistent with a stability regression rather than an actively targeted security flaw.

Resource leaks and teardown race conditions in the Linux kernel's gpio-rockchip driver expose Rockchip-based systems to kernel panic and memory exhaustion. Three distinct defects exist in the driver's remove path: an unreleased debounce clock reference, a stale chained IRQ handler left registered after driver removal, and an unfreed IRQ domain with its generic chips. The IRQ handler defect is the most severe - if a stray GPIO interrupt arrives after the driver is unbound, the kernel dereferences a stale function pointer and panics. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects the niche, hardware-specific exploitation surface.

Incorrect pointer passing in the Linux kernel's igorplugusb infrared USB receiver driver causes the USB core to misinterpret raw pointer bytes as a USB control setup packet, triggering a BOGUS control direction warning and a kernel-level denial of service. The regression was introduced by commit eac69475b01f, which allocated ir->request as a pointer for DMA coherency but left the usb_fill_control_urb() call referencing &ir->request (the pointer variable's address) rather than ir->request (the allocated struct usb_ctrlrequest). No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.17% (6th percentile), reflecting minimal real-world exploitation probability.

Deadlock vulnerability in the Linux kernel's GPIO shared proxy subsystem allows a local, low-privileged user to cause a system hang by triggering removal of a shared GPIO proxy's parent device. The root cause is an overly-wide mutex critical section introduced in commit 710abda58055, where the gpio_shared_entry mutex was held for too long, creating a locking inversion scenario during parent device teardown. No public exploit code exists and no active exploitation has been identified; the fix narrows the critical section to protect only offset reads.

Division-by-zero kernel panic in the Linux kernel's i2c-davinci driver causes a deterministic system crash on TI DaVinci SoC-based hardware when the 'clock-frequency' device tree property is absent. The root cause is a unit mismatch: DAVINCI_I2C_DEFAULT_BUS_FREQ was defined in kHz (100) but the probe path divided it by 1000, producing dev->bus_freq = 0, which then triggers an unconditional divide-by-zero during clock divider calculation. Availability impact is complete (kernel panic), but exploitation requires specific embedded hardware context; no public exploit exists and EPSS is 0.15%, consistent with a reliability defect rather than an adversarially exploitable flaw.

Use-after-free in the Linux kernel USB UVC gadget driver allows a privileged local user to crash the kernel by racing configfs extension-unit teardown against the bind-time list walks in uvc_function_bind(). The bind path walks opts->extension_units without holding opts->lock, while the configfs write path (uvcg_extension_drop) correctly holds the lock, creating an asymmetric locking pattern that enables a freed struct uvcg_extension to be dereferenced. No public exploit exists and EPSS sits at 0.16% (5th percentile), but patches are confirmed across multiple stable kernel branches including 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1.

Out-of-bounds memory access in the Linux kernel's drm/msm DSI display subsystem causes a kernel panic on systems with Qualcomm MSM DSI 6G hardware. The io_offset adjustment applied to the mapped IO base address is not reflected in the ctrl_size value passed to the snapshot dump routine, so msm_disp_snapshot_add_block reads past the end of the mapped region and crashes the kernel. Only devices with Qualcomm MSM DSI 6G display hardware running an unpatched kernel from 5.14 onward are affected; no public exploit exists and EPSS of 0.17% confirms very low exploitation probability.

Kernel denial-of-service in the Linux kernel's device property firmware node subsystem results from fwnode_init() failing to zero the secondary pointer before use, leaving it with uninitialized stack or heap garbage that may be incorrectly treated as a valid pointer and dereferenced in functions such as dev_to_swnode(). Local users with low privileges on any kernel version between the introducing commit and the respective stable patch releases can trigger a kernel panic, causing system downtime. No public exploit code exists and EPSS is 0.17% (7th percentile), reflecting negligible observed exploitation activity.

Missing mutex lock in the Linux kernel lm90 hwmon driver's alert handler creates a race condition that triggers an interrupt storm on systems with LM90-family temperature sensors. When lm90_alert() fires concurrently with a sysfs write operation - both modifying the shared data->config register cache - the sysfs path's restore of data->config silently overwrites the alert handler's hardware-disable flag, re-enabling the alert line while the alarm remains active. The result is uncontrolled interrupt escalation causing system availability impact. No public exploit exists, EPSS is 0.17% (6th percentile), and no KEV listing is present; patched releases 6.18.34, 7.0.11, and 7.1 are available.

Availability loss in the Linux kernel's Tree SRCU (Sleepable Read-Copy-Update) subsystem causes system hangs by queuing workqueue handlers on CPUs that have never been-and may never be-online. Affected kernels spanning commit 61bbcfb50514 through the fix points can attempt to invoke callbacks for CPUs absent from cpu_possible_mask, a condition that is fatal on s390 (IBM mainframe) architectures not hardened to handle such scheduling anomalies. No public exploit code exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with a stability defect rather than a security attack surface; patches are available in Linux 7.0.11 and 7.1.

Information disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows a local attacker with file system access to read secret variable values stored in cleartext on disk. This occurs when the variables feature is used without selecting a vault for encryption. The vulnerability is not known to be actively exploited, and EPSS indicates a very low exploitation probability (0.08%).

OAuth refresh token disclosure in Devolutions PowerShell Universal 2026.2.2 and earlier allows authenticated users with scoped job or script read permission to extract other users' stored refresh tokens from job read API responses. The automation jobs API fails to strip the token before sending it to the client. No active exploitation is reported; EPSS score is low at 0.22%.

Information disclosure in the Keycloak Admin REST API allows a delegated administrator with view-only permissions to retrieve the resolved client secret from a secure vault instead of the vault placeholder, exposing sensitive credentials. Affected Red Hat builds include Keycloak, Single Sign-On 7, Data Grid 8, and JBoss EAP expansion pack. No active exploitation or public exploit is known; EPSS probability is low (0.21%).

Information disclosure in ABIS Technology's AVESİS software allows unauthenticated remote attackers to bypass ACLs and access restricted functionality via manipulated web parameters. Affected versions prior to build 202606251646. Exploitation likelihood is low (EPSS 0.2%), no active exploitation is known, and a vendor patch is available.

A denial-of-service vulnerability in Apache NimBLE’s Mesh Proxy SAR reassembly can be exploited by remote attackers without authentication, causing memory pressure and unstable application behavior. Affected versions include all releases through 1.9.0; a vendor patch is available in version 1.10.0. No active exploitation or public proof-of-concept has been identified, and EPSS indicates a low likelihood of widespread exploitation.

Apache NimBLE 1.9.0 and earlier mishandles multi-report HCI advertising events, potentially leaking heap memory when used with certain third-party Bluetooth controllers. The vulnerability is not under active exploitation and no public exploit code exists.

Information disclosure in Parse Server GraphQL endpoint allows unauthenticated clients to learn names of required custom fields by triggering validation errors, partially bypassing schema hiding when public introspection is disabled. Affects versions 8.2.2 to 8.6.85 and 9.0.0 to 9.9.x; patched in 8.6.86 and 9.10.0-alpha.5. No active exploitation or public exploit code identified.

Information disclosure in Parse Server GraphQL error messages exposes hidden schema class names to unauthenticated attackers when public schema introspection is disabled. Affects versions 9.0.0 before 9.10.0-alpha.6 and 8.2.2 before 8.6.87. Only class names are disclosed, not object data; no public exploit or active exploitation identified.

Denial of service in dbus-broker allows a local attacker to crash the user session bus broker when file descriptor limits are exhausted. Affected products include Red Hat Enterprise Linux 9/10, Red Hat OpenShift Container Platform 4, and Red Hat Hardened Images where dbus-broker is deployed. No active exploitation or public exploit code is known, and EPSS indicates low exploitation probability (0.11%).

Out-of-bounds read in GNU coreutils uniq allows attackers with crafted multibyte input and the -w option to crash the utility and potentially leak adjacent heap memory. Affects versions 9.5 through 9.11. No active exploitation or public exploit code is known, but a patch exists.

Unauthenticated record takeover in the Participants Database WordPress plugin (all versions ≤ 2.7.8.3) allows any remote attacker to overwrite arbitrary participant records by guessing or enumerating numeric IDs, redirect the private-access link to an attacker-controlled email, and achieve full read and edit access to victim PII including names, email addresses, and phone numbers. The attack requires no credentials - a valid nonce is freely obtainable via a plain GET request to any public page rendering the plugin's signup or record form. No CISA KEV listing or public exploit code has been identified at time of analysis, but the zero-authentication, low-complexity attack path is trivially scriptable at scale.

Microsoft Graph exposes sensitive information to authenticated network attackers through an information disclosure flaw classified under CWE-200. Any attacker holding a valid low-privilege credential can query the Microsoft Graph API over the network to retrieve data they should not have access to, without requiring additional user interaction or elevated rights. No active exploitation is confirmed (not in CISA KEV), and Microsoft has released an official fix; however, the high confidentiality impact and low attack complexity make this a meaningful risk for any organization relying on Microsoft 365 services.

Unauthenticated network asset discovery exposure in Pronetiqs IntraVUE (formerly Panduit IntraVUE) versions 3.2.1a14 and prior allows remote unauthenticated attackers to enumerate sensitive system and network asset information via the application interface. In industrial control system (ICS) and OT environments where IntraVUE is typically deployed, the disclosed asset inventory - including device types, IP addresses, and network topology - provides adversaries with reconnaissance data directly applicable to follow-on ICS-targeted attacks. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Arbitrary constructor injection in React Router's SSR hydration deserializer (deserializeErrors()) affects npm/react-router versions 6.4.0 through 7.17.x when used in Framework Mode or Data Mode with manual SSR/hydration. When application code permits attacker-supplied input to overwrite the __type or __subType fields embedded in server-side serialized error objects, the client-side hydration process can be manipulated into instantiating arbitrary constructors available on the global window object, triggering unintended outbound network requests from the victim's browser. No public exploit code or CISA KEV listing exists at time of analysis; a vendor-released patch is available in version 7.18.0.

Credential extraction in OpenStack Ironic Python Agent (IPA) allows a tenant with bootc deploy_interface access to steal operator-level OCI registry pull secrets by exploiting a Linux PID namespace escape. Affected deployments running IPA >=10.2.0 <10.2.3, >=11.0.0 <11.2.1, or >=11.3.0 <11.5.1 are at risk when the bootc deploy_interface is enabled and operator-side registry credentials are configured. The attack violates the tenant-to-operator trust boundary by reading host authentication material through /proc/1/root inside a privileged container, with no public exploit identified at time of analysis.

HTTP request smuggling in SwiftNIO HTTP/2 allows unauthenticated remote attackers to inject headers or split responses via crafted HTTP/2 HEADERS frames that pass control characters through the HTTP/2-to-HTTP/1.1 codec. The vulnerability, caused by missing CR/LF/NUL/SP validation in regular header values and pseudo-headers, can be exploited when outbound validation is disabled or headers are forwarded without rechecking. Fixed in version 1.45.0; no public exploit identified at time of analysis and EPSS score is 0.14% (low).

Out-of-bounds heap read in gdk-pixbuf's ICO parser exposes heap memory content through rendered image output, affecting Red Hat Enterprise Linux 6 through 10. When processing a crafted ICO file whose pixel indices exceed the defined palette size, the library reads beyond the palette array boundary - heap bytes are treated as palette entries and rendered as RGB pixel values in the output image, enabling an attacker to extract heap content by analyzing the rendered result. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but server-side image processing pipelines that return rendered output to untrusted callers represent a realistic exposure path.

Authorization bypass in Overseerr's push subscription API (versions through 1.35.0) allows any authenticated user to enumerate, read, and delete the push subscriptions of arbitrary other users by supplying a target userId in path parameters - no elevated privileges required. The missing ownership check bypasses the filteredFields filter applied to normal user data access, exposing sensitive PII including email addresses and plexId values. A publicly available proof-of-concept exists; no CISA KEV listing at time of analysis.

Privilege abuse in Tridium Niagara Framework and Niagara Enterprise Security allows an authenticated high-privileged user on an adjacent network to improperly access confidential data and perform limited unauthorized modifications beyond their sanctioned scope. Affected platforms span Windows, Linux, and QNX, and versions prior to 4.14.6 and 4.15.5 are vulnerable. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Hook mutation pollution in DOMPurify <= 3.4.5 allows persistent bypass of HTML sanitization defaults when application-installed hooks mutate data.allowedTags or data.allowedAttributes. Because these hook fields are direct references to the library's live DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets rather than copies, any write inside a uponSanitizeElement or uponSanitizeAttribute hook permanently widens the global allow-lists for the entire lifetime of the DOMPurify instance - meaning all subsequent sanitize() calls under default config will pass through attacker-controlled HTML using the poisoned tag or attribute name. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; real-world risk is gated on the presence of the specific hook mutation pattern in the target application.

Trusted Types policy state contamination in DOMPurify 3.0.0-3.4.8 allows a previously supplied TRUSTED_TYPES_POLICY to survive a clearConfig() call, poisoning subsequent sanitize() calls that request RETURN_TRUSTED_TYPE output. Any application that reuses a single DOMPurify instance across trust boundaries - where one integration sets a permissive or attacker-influenced TRUSTED_TYPES_POLICY and a later caller invokes clearConfig() expecting a clean slate - will receive a TrustedHTML object signed by the old policy, potentially enabling script execution at a Trusted Types sink. A public proof-of-concept is attached to the GHSA advisory; exploitation is not confirmed in CISA KEV.

JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.

Sensitive system information disclosure in the MultiVendorX WooCommerce Product Stock Alert WordPress plugin (versions through 3.0.6) allows low-privileged authenticated users to retrieve embedded sensitive data via a network-accessible endpoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/C:H) confirms that any authenticated WordPress user - such as a registered shop customer - can exploit this with low complexity and no user interaction, yielding high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, network-accessible nature of the flaw lowers the bar for abuse significantly.

Sensitive data exposure in the TinyMCE Templates WordPress plugin (versions <= 4.8.1) allows authenticated users holding the Contributor role to access information beyond their authorization boundary. The flaw is classified under CWE-497, indicating that system or application internals are being surfaced to an unauthorized control sphere - in this case, low-privileged WordPress users. No active exploitation or public proof-of-concept has been identified at time of analysis, and the CVSS score of 4.3 (Medium) reflects the limited scope: confidentiality-only impact with no integrity or availability consequences.

Unauthenticated sensitive data exposure in WP Social Ninja WordPress plugin versions 4.3.0 and earlier allows remote attackers to access sensitive information without any credentials or user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms trivial network-level exploitation with no barriers to access, though impact is bounded to low-severity confidentiality loss. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Sensitive data exposure in Ultimate Store Kit Elementor Addons (by BDThemes) versions up to and including 3.0.5 permits unauthenticated remote access to restricted system or application data. The vulnerability is reachable over the network with no credentials, no user interaction, and no special configuration, placing every WordPress installation running the affected plugin version at risk of information leakage. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS data was not provided, but the zero-barrier entry point (AV:N/AC:L/PR:N/UI:N) means opportunistic scanning is a realistic threat.

Unauthenticated sensitive data exposure in the Complianz WordPress plugin (versions up to and including 7.5.0) allows any remote, unauthenticated attacker to retrieve sensitive information from affected WordPress installations. Classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), the flaw is particularly notable because Complianz handles GDPR and cookie consent compliance data - meaning exposed information may carry regulatory implications beyond what the CVSS score alone conveys. No public exploit has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV.

Unauthenticated sensitive data exposure in the Create by Mediavine WordPress plugin (versions <= 2.5.3) allows any remote, unauthenticated user to access information that should be restricted. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is exploitable over the network with no authentication, no user interaction, and low attack complexity, placing all public-facing WordPress sites running an affected version at risk. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the low barrier to exploitation makes patching a timely priority.

Unauthenticated sensitive data exposure in the Ninja Tables WordPress plugin (versions ≤ 5.2.10) allows remote unauthenticated attackers to retrieve sensitive information without any credentials or user interaction. The flaw, classified under CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), is accessible over the network with low complexity, making it trivially exploitable against any WordPress site running an affected version of the plugin. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 5.3 (Medium) reflects limited confidentiality impact with no integrity or availability consequences.

Sensitive data exposure in Polylang WordPress plugin (versions <= 3.8.5) allows authenticated Contributors to access information beyond their authorization scope. The vulnerability, classified under CWE-497, enables low-privileged authenticated users - specifically those holding the WordPress Contributor role - to read sensitive data they should not be permitted to view. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.

Broken authentication in Easy Digital Downloads WordPress plugin (versions ≤ 3.6.7) by Sandhills Development LLC allows unauthenticated remote attackers to bypass authentication controls via an alternate path or channel (CWE-288), producing limited integrity and availability impact. The attack requires no credentials or user interaction over the network, earning a CVSS 6.5 Medium score - though Patchstack's 'Information Disclosure' tag introduces a potential confidentiality dimension not reflected in the base CVSS C:N designation, suggesting real impact may be slightly higher than the score implies. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Sensitive data exposure in PeproDev Ultimate Invoice (WordPress plugin, versions ≤ 2.2.6) allows unauthenticated remote attackers to access confidential invoice data - including likely customer PII and financial records - without authentication, contingent on some user interaction (CVSS UI:R). The root cause (CWE-201) is the inclusion of sensitive information in plugin-generated output or endpoint responses that lack proper access control. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

TTL capping bypass in PowerDNS Recursor enables ghost domain NS record injection when a slow authoritative server response arrives after the cached NS entry has already expired. Specifically, the proactive background refresh mechanism fails to cap TTLs on NS record responses when no live cache entry exists at response time, allowing attacker-controlled TTL values to persist uncapped in the recursor's cache. No active exploitation has been identified (no CISA KEV listing), no public exploit code exists, and the CVSS score of 3.7 reflects the constrained, timing-dependent nature of this attack.

Unrestricted SSH port forwarding on Ricoh printers and Multifunction Printers (MFPs) allows network-accessible devices to be used as pivot points into the local area network. When SSH is enabled on an affected device, any party able to establish an SSH connection can forward TCP traffic to arbitrary hosts and ports on the internal LAN, effectively bypassing network segmentation. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the network scope change (S:C in CVSS) reflects that impact extends beyond the printer itself to other internal hosts.

Format string vulnerability in GNU nano's multi-buffer error message handling allows a local low-privileged attacker to cause stack information disclosure, denial of service via crash, or potentially achieve arbitrary memory writes. The flaw (CWE-134) is triggered when a user opens multiple files at startup, one of which carries a specially crafted name containing printf format specifiers and another triggers an ALERT-level error - causing nano to misinterpret the filename as a format string. Reported by Red Hat and scoped to RHEL 6 through 10 and OpenShift Container Platform 4, no public exploit or CISA KEV listing exists at time of analysis.

Improper input validation in facil.io's WebSocket Frame Parser (versions up to 0.7.4) allows remote unauthenticated attackers to send crafted WebSocket frames that trigger a flaw in the `websocket_on_protocol_error` function, yielding limited confidentiality, integrity, and availability impact. A proof-of-concept exploit has been publicly published, lowering the technical barrier for exploitation. The project maintainer was notified via GitHub issue but has not responded, leaving the vulnerability unpatched at time of analysis.

Cache confusion in Next.js App Router's server-side fetch patch leaks confidential POST response bodies across unrelated requests targeting the same URL. Applications on Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 that call `fetch(new Request(init), aDifferentInit)` server-side are at risk of cross-user data exposure - one user's POST response (potentially containing session tokens, PII, or financial data) may be returned to a different user's request. No public exploit has been identified at time of analysis, and Pages Router deployments are explicitly unaffected.

Cache key collision in Next.js server-side fetch exposes confidential POST response bodies to unintended callers when request bodies contain non-UTF-8 byte sequences. Specifically, the incremental cache's key-generation routine decoded raw body bytes through a TextDecoder, causing distinct byte sequences - such as UTF-16 encodings - to collapse to the same replacement-character string (U+FFFD) and therefore the same cache key. A request whose body coincidentally produces a colliding cache key will receive a cached response intended for a different body, leaking whatever confidential data the upstream service returned. No public exploit has been identified at time of analysis; vendor-released patches are available in v15.5.21 and v16.2.11.

CPU exhaustion in the Next.js Image Optimization API allows unauthenticated remote attackers to deny service against the `/_next/image` endpoint by serving malicious image content - particularly crafted SVGs - from domains permitted by `config.images.remotePatterns`. Affected self-hosted deployments on Next.js 15.5.0-15.5.20 and 16.0.0-16.2.10 using the default image loader invoke Sharp's expensive `.metadata()` call on attacker-influenced buffers, exhausting server CPU. Vendor-released patches are available in versions 15.5.21 and 16.2.11; no public exploit or CISA KEV listing is identified at time of analysis.

Server Action endpoint IDs in Next.js App Router applications are exposed to unauthenticated users through publicly served client-side static JavaScript chunks, effectively bypassing page-level authentication gates on those endpoints. Applications running Next.js 13.0.0 through 15.5.20 or 16.0.0 through 16.2.10 with App Router and Server Actions (`use server`) or `use cache` directives are affected. Standalone exploitation provides an enumeration primitive rather than direct data access, but the disclosed IDs can amplify secondary weaknesses - particularly when Server Actions perform sensitive operations without re-authenticating callers within the action boundary itself. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.

Filesystem existence oracle in Dompdf allows attackers who can supply arbitrary HTML content for PDF rendering to enumerate files and directories on the backend server. By embedding a data-URI encoded SVG containing an `<image>` element with a `file://` URI reference, an attacker exploits differential rendering behavior - files and directories that exist cause a different visual output than paths that do not exist - creating a binary oracle for filesystem probing. A publicly available proof-of-concept is included in the GitHub Security Advisory GHSA-j8qw-6jw8-r297; no KEV listing or confirmed active exploitation has been reported at time of analysis.

HTTP/2-to-HTTP/1.x protocol translation in Netty's `netty-codec-http2` enables request routing bypass and HTTP request smuggling via duplicate `Host` header injection. When a client sends a HEADERS frame containing both the `:authority` pseudo-header and a literal `host` header, `Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter` independently translate each into `Host` headers, producing an `HttpRequest` with two attacker-controlled, differing values. Downstream HTTP/1.1 components that prioritize the second header can be manipulated into routing requests to unintended targets. No public exploit has been identified and this CVE is not in the CISA KEV catalog, but patches are vendor-released for both affected release trains.

WebSocket protocol upgrade in Netty's V07/V08 handshakers completes without enforcing RFC 6455-mandatory `Connection: Upgrade` and `Upgrade: websocket` headers, enabling an attacker to silently switch protocols in a way that upstream reverse proxies and load balancers do not recognize as an Upgrade request. This desynchronization between proxy and backend creates a classic HTTP request smuggling vector (CWE-444) that can be exploited to poison shared connections, bypass proxy-enforced access controls, or hijack other users' HTTP sessions. Affected versions are `io.netty:netty-codec-http` prior to 4.1.136.Final and 4.2.0.Final through 4.2.15.Final; no public exploit code or CISA KEV listing has been identified at time of analysis.

File existence oracle in Dompdf allows remote unauthenticated attackers to enumerate sensitive server-side files by exploiting a behavioral discrepancy in CSS @font-face processing. Crafted HTML containing thousands of @font-face declarations referencing local paths via the file:// protocol causes PHP memory exhaustion only when the target file exists, producing a detectable crash signal versus a clean render for non-existent files. Publicly available exploit code exists (detailed in the GHSA advisory); no KEV listing at time of analysis, but exploitation requires only a public HTTP endpoint that passes unsanitized HTML to Dompdf. A vendor-released patch (v3.1.6) is available.

Dompdf's chroot validation logic in versions before 3.1.6 can be bypassed by an attacker who controls HTML content rendered into a PDF, allowing files outside the configured chroot directories to be read and embedded in the output. The root cause is a flawed `strpos()` prefix check in `validateLocalUri()` that fails to enforce directory boundaries after `realpath()` strips trailing slashes, enabling sibling directories like `/var/www-admin` to satisfy a chroot configured as `/var/www`. A publicly available proof-of-concept exploit is included in the GitHub Security Advisory GHSA-wvh6-f5jh-8gw4; no active exploitation is recorded in CISA KEV, and upgrading to v3.1.6 fully resolves the issue.

Denial of service against the MongoDB mongod process is achievable by any authenticated user holding standard read/write privileges by submitting a crafted aggregation command that exploits insufficient input validation in the bundled libmongocrypt library. An integer overflow (CWE-190) in libmongocrypt allows attacker-controlled payload values to produce an excessively large memory allocation request, causing the operating system to terminate the mongod process under an out-of-memory condition. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Polkit privilege escalation in PortProtonQt 0.1.12 through 1.3.0 allows any local unprivileged user to modify system NetworkManager connections and mount or unmount arbitrary block devices without authorization. The vulnerable Polkit rule (ru.linux_gaming.PortProtonQt.rules) identifies trusted callers by inspecting process command lines via 'ps', a method trivially defeated by command-line spoofing or PID recycling races. A shell script reproducer confirmed by SUSE researchers achieves exploitation reliably and consistently. No public exploit is independently published but a working reproducer exists; no CISA KEV listing at time of analysis.

Symlink-following vulnerability (CWE-59) in systemd-tmpfiles allows a local, low-privileged user to redirect privileged file write operations to an attacker-controlled path on affected Red Hat Enterprise Linux systems. The flaw resides in the path resolution logic within chase.c, where a safety check incorrectly treats all transitions away from the root user as inherently safe - failing to detect attacker-placed symlinks at tmpfiles.d target path components. Exploitation is constrained by high attack complexity requiring a specific non-default tmpfiles.d configuration, and no public exploit code or CISA KEV listing has been identified at time of analysis.

Dell PowerProtect Data Manager's REST API exposes sensitive information to high-privileged local users in all versions prior to 20.2.0.0. An administrator-level attacker with local access can query the REST API and retrieve sensitive data that should be restricted even at the admin tier - with the CVSS Scope:Changed indicator suggesting the exposed information may include credentials or secrets belonging to systems external to the PPDM instance itself. No public exploit code or active exploitation has been identified at time of analysis; Dell has released version 20.2.0.0 to address this and multiple other vulnerabilities per advisory DSA-2026-287.

Availability loss in ISC BIND 9 DNS server arises when a stored DNS key record containing the PRIVATEDNS algorithm (algorithm number 253) carries a malformed identifier length field that exceeds the actual identifier data. BIND accepts the structurally invalid record without rejecting it at ingestion time, but when it subsequently attempts to render that record to text - during logging, zone display, or similar operations - the inconsistent length triggers a reachable assertion (CWE-617) that causes BIND to abort and exit. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, BIND 9 spans a very wide version range and is critical infrastructure, making patch urgency high despite the medium CVSS score of 6.5.

DNSSEC integrity bypass in ISC BIND 9 enables network-positioned attackers to forge authenticated NXDOMAIN responses by exploiting improper validation of NSEC3 records originating from child zones. Affected are BIND 9 versions across the 9.18, 9.20, and 9.21 branches, as well as the BIND 9 Supported Preview Edition (S-series). Because the CVSS vector carries S:C (scope changed), the integrity impact propagates beyond the resolver itself to any DNS client trusting BIND's DNSSEC-validated answers. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthenticated file read and deletion in Progress Telerik UI for ASP.NET AJAX (all versions prior to v2026.2.708) is made possible by a hardcoded cryptographic key (CWE-321) embedded in the obsolete RadChart component's ChartImage.axd HTTP handler. Remote attackers without any credentials can exploit this to read or delete image-extension files within the application directory, bypassing standard authentication controls entirely. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis, but the unauthenticated network-accessible attack vector warrants prompt patching for all affected deployments.

Parameter tampering in the DialogHandler component of Progress Telerik UI for ASP.NET AJAX (all versions prior to 2026.2.708) allows unauthenticated remote attackers to manipulate server-side dialog behavior, establishing a foothold for chained exploitation of downstream application components. The CVSS vector specifies High integrity impact with no required privileges (PR:N), making the DialogHandler endpoint a meaningful attack surface in any deployment where it is network-accessible. No public exploit code has been identified at time of analysis and no CISA KEV listing exists, but the vendor's explicit mention of chained exploitation elevates the practical risk beyond the moderate base score of 5.9.

Counter exhaustion in NLnet Labs Unbound 1.20.0 through 1.25.1 enables a remote attacker to degrade DNS resolution service by triggering a missing decrement in the serve-expired discard-timeout code path. The reply-address counter for duplicate in-flight queries is never decremented when the discard-timeout branch fires under a specific non-default misconfiguration, allowing an attacker controlling a slow authoritative zone to drive the counter to its maximum and cause silent query drops for legitimate clients. No public exploit identified at time of analysis; however, the vulnerability is exploitable remotely with no authentication required once the misconfiguration is in place.

Crash-triggering memory corruption in Unbound's DNSCrypt subsystem allows any unauthenticated network client to kill the DNS resolver with a single UDP packet. Affected versions 1.7.0 through 1.25.1, compiled with DNSCrypt support, miscount valid key slots when the dnscrypt-provider-cert list outnumbers dnscrypt-secret-key entries, leaving tail slots filled with libsodium's 0xdb debug pattern; iterating beyond valid bounds then dereferences that garbage. No public exploit has been identified at time of analysis, and no KEV listing exists, but the trigger condition is trivially constructable - one 68-byte UDP datagram.