Information Disclosure

IObit Advanced SystemCare 19 contains a symlink following vulnerability in the ASC.exe Service component that allows local authenticated attackers to achieve high-impact confidentiality and integrity violations. The vulnerability requires local access and elevated privileges (PR:L) but has high attack complexity (AC:H), making real-world exploitation difficult despite public exploit availability. CVSS 6.4 reflects the local-only attack vector and privilege requirement, though the confidentiality and integrity impacts are rated high.

OpenClaw before version 2026.4.12 contains an improper authorization flaw in helper-backed channels where empty resolved approver lists are incorrectly interpreted as explicit approval authorization. Authenticated attackers who know an approval ID can resolve pending approvals without proper authorization by exploiting this logic error, bypassing intended sender authorization checks. This vulnerability has a CVSS score of 6.5 (medium) with network attack vector and requires only low privileges, though no public exploit code or active exploitation has been identified.

Symlink traversal in OpenClaw versions 2026.3.22 before 2026.4.5 allows unauthenticated remote attackers with user interaction to read arbitrary files outside the remote marketplace repository root. The vulnerability exploits improper path canonicalization in the marketplace plugin's remote repository handler, exposing sensitive information with a CVSS score of 6.5. Vendor-released patch available in version 2026.4.5.

WordPress Plugin Backup Migration 1.2.8 contains an information disclosure vulnerability that allows unauthenticated attackers to download complete database backups by accessing predictable file. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

PaperCut Hive Ricoh embedded application logs administrative credentials in plain text when Deep Logging diagnostic mode is enabled, allowing authenticated administrators to remotely activate logging and extract device passwords after user authentication. This credential exposure enables lateral movement within the print infrastructure and unauthorized device reconfiguration, affecting organizations that depend on Hive for centralized print management.

PaperCut MF version 25.0.4 allows authenticated administrators to read arbitrary files on the server through insufficient path validation in the Shared Account Synchronization component, exposing sensitive configuration and system files via the account management interface. The vulnerability requires administrative privileges and attack complexity involves timing (AT:P), limiting real-world exploitation scope despite network accessibility.

Subscribe To Comments Reloaded plugin for WordPress up to version 240119 allows unauthenticated attackers to extract a global secret key from public post pages and forge authorization tokens, enabling unauthorized modification of comment subscription preferences for arbitrary users. The vulnerability stems from weak hash generation and key exposure, affecting all installations without authentication requirements. Active exploitation potential is high given the trivial access vector (network, no user interaction) and the ability to manipulate user subscription data.

Apache Thrift versions prior to 0.23.0 are vulnerable to a denial-of-service condition with unspecified attack mechanisms related to CWE-789 (uncontrolled memory allocation). The vulnerability affects multiple language implementations including Rust, Java, and Node.js, and can be triggered remotely without authentication or user interaction, though the technical mechanism remains partially obscured in available disclosures. With EPSS score of 0.02% (percentile 5%), active exploitation appears unlikely despite the low CVSS complexity score.

OpenStack Horizon 25.6 and 25.7 before 25.7.3 allows unauthenticated remote attackers to exhaust session storage backend resources through repeated requests that trigger write operations prior to authentication, causing denial of service. This is a regression of CVE-2014-8124 and is assigned CVSS 5.3 (network-based, low complexity, no authentication required).

Quarkus OpenAPI Generator versions before 2.16.0-lts and 2.16.0 (fixed in 2.17.0) send authentication credentials to unintended API endpoints due to overly broad path-parameter regex matching. The generated authentication filter treats OpenAPI path-template placeholders like {param} as .* patterns, allowing a single parameter to consume forward slashes and match multiple distinct operations. This causes bearer tokens, OAuth tokens, API keys, and basic credentials configured for one protected operation to be leaked to different, unprotected operations on the same service when a client invokes them through normal generated-code paths. No public exploit code has been identified, but the vulnerability is trivial to trigger and affects all authentication schemes relying on the shared path-matching logic.

Deactivated user accounts in CI4MS retain full backend access until session expiration because the authentication filter fails to re-check the active status field for existing sessions. When an administrator sets a user's active field to 0, the user's session cookie remains valid and auth()->loggedIn() continues returning true, allowing the deactivated user to access protected resources for up to 7200 seconds (default session timeout). The vulnerability exists because code to enforce this check was commented out since the filter's initial commit and never activated.

nginx-ui versions prior to 2.3.8 expose 40+ protected configuration fields through the GetSettings API to authenticated users, including JwtSecret (auth token forgery), NodeSecret (cluster impersonation), and OIDC ClientSecret (OAuth takeover). The protected tag is enforced only during writes but completely ignored during reads, allowing authenticated attackers to extract sensitive secrets and IP whitelist configurations without requiring additional privileges or user interaction.

nginx-ui prior to version 2.3.8 exposes sensitive configuration values including node.secret via an authenticated GET /api/settings endpoint, allowing an authenticated user to retrieve the shared authentication secret and subsequently impersonate the init administrative user by sending requests with the stolen node.secret via the X-Node-Secret header or node_secret query parameter. This enables privilege escalation and full administrative access to the Nginx configuration interface without additional authentication.

Traefik's errors middleware discloses sensitive HTTP headers including Authorization and Cookie to separate error page services when backends return configured error status codes. Affected versions are Traefik v2.11.43 and earlier, v3.6.14 and earlier, and v3.7.0-rc.0 through v3.7.0-rc.2. The vulnerability allows credentials meant only for backend services to be forwarded to distinct error page infrastructure, expanding exposure across service boundaries. Vendor-released patches are available; actively exploited status not confirmed.

titra 0.99.52 leaks sensitive global configuration settings to any authenticated user via an unprotected Meteor DDP publication, exposing API keys and OAuth secrets without administrative checks. Authenticated attackers can subscribe to the globalsettings publication and retrieve plaintext credentials including google_secret, openai_apikey, and google_clientid. No public patch is available at time of publication.

Information disclosure in Qualcomm Snapdragon firmware allows local authenticated attackers to read sensitive kernel memory via malformed IOCTL handler callbacks that bypass buffer size validation. The vulnerability affects multiple Snapdragon chipset versions and requires local access with limited privileges; exploitation results in confidentiality breach without direct system compromise. No active exploitation has been confirmed at the time of analysis.

HTTP response splitting in Apache HTTP Server 2.4.0 through 2.4.66 allows remote attackers to inject arbitrary HTTP headers and content when the server acts as a proxy to untrusted or compromised backend servers, enabling cache poisoning, session fixation, and cross-site scripting attacks. CVSS 6.5 (moderate) with network attack vector, no authentication required, and confirmed automatable exploitation per CISA SSVC framework. Vendor-released patch: version 2.4.67.

ILM Informatique OpenConcerto 1.7.5 stores sensitive passwords in plaintext, allowing authenticated local users to retrieve embedded credentials with low complexity. The vulnerability enables information disclosure of authentication data accessible via local file access, confirmed by CISA SSVC framework as having partial technical impact but no evidence of active exploitation.

Incorrect permission assignment in OpenConcerto 1.7.5 enables local authenticated users with UI interaction to modify critical binary files, potentially allowing privilege escalation or persistent code execution through binary replacement. CVSS score of 2.4 (Low) reflects the local-only attack vector and requirement for user interaction, though the vulnerability creates a persistent integrity risk for affected deployments.

Out-of-bounds read in mod_proxy_ajp of Apache HTTP Server through version 2.4.66 allows remote unauthenticated attackers to disclose sensitive information via a crafted AJP protocol request. The vulnerability has a CVSS score of 5.3 (moderate) with no active exploitation confirmed. Upgrade to version 2.4.67 to remediate.

Mutt before 2.3.2 mishandles the IMAP GSS security level due to improper integer casting and insufficient bounds checking, allowing remote attackers to trigger memory corruption and information disclosure via a crafted IMAP server response during GSS-API authentication. The vulnerability requires high attack complexity (malicious IMAP server) but affects all versions prior to 2.3.2.

Magic Export & Import WordPress plugin before version 1.2.0 stores exported CSV files in a publicly accessible web directory, allowing unauthenticated remote attackers to enumerate and download sensitive user data without authentication. The vulnerability affects all versions prior to 1.2.0, has publicly available proof-of-concept code, and carries moderate real-world risk due to the low attack complexity and high automatable nature of exploitation, though the actual severity is constrained by the fact that CSV export must first occur and require that files remain accessible.

mutt before version 2.3.2 fails to validate null bytes during URL percent-decoding, allowing remote attackers to inject embedded null characters into decoded URLs, potentially causing information disclosure through truncation of validation checks or bypassing of security filters that rely on string length.

Out-of-bounds read in GoBGP BMP parser allows remote attackers to trigger information disclosure via malformed BMP messages to the BMPPeerUpNotification.ParseBody and BMPStatisticsReport.ParseBody functions. Affected versions are up to 4.3.0; patch available in version 4.4.0. CVSS 6.9 reflects availability impact. No public exploit code or active exploitation has been identified.

mutt before version 2.3.2 truncates the IMAP CRAM-MD5 authentication hash by one byte due to incorrect use of strfcpy instead of memcpy, potentially allowing attackers to bypass or weaken authentication on IMAP connections through off-by-one string handling errors.

Local privilege escalation in MediaTek geniezone component due to missing bounds check allows System-privileged actors to achieve total system compromise across multiple chipset models. The vulnerability requires prior System-level access and affects 17 MediaTek chipset variants (MT6899, MT8791T, MT8786, MT6789, MT8367, MT6768, MT8766, MT6993, MT6991, MT6877, MT8788E, MT8781, MT8768, MT6989, MT8910, MT8196, MT8793). No public exploit code identified at time of analysis; exploitation remains unconfirmed in active systems despite SSVC indicating total technical impact potential.

Mutt before 2.3.2 uses an unsafe string copy function (strfcpy) instead of memcpy when handling MD5 digest data in IMAP CRAM authentication, allowing attackers to potentially forge IMAP credentials by triggering buffer manipulation during the authentication handshake. The vulnerability requires manual connection attempt to a malicious IMAP server and affects network IMAP authentication flows, though the low CVSS score (3.7) reflects high attack complexity and integrity impact only.

Integer underflow in osrg GoBGP up to version 4.3.0 allows remote attackers to trigger a crash or information disclosure via crafted MRT (Multi-Threaded Routing Toolkit) packet data in the parseRibEntry function. The vulnerability arises from improper bounds checking when processing RIB (Routing Information Base) entries, enabling network-based exploitation without authentication. Vendor-released patch version 4.4.0 addresses this issue; no active exploitation has been confirmed at time of analysis.

Time-of-check time-of-use (TOCTOU) vulnerability in Prefect's validate_restricted_url function allows remote attackers with low privileges to bypass Server-Side Request Forgery (SSRF) protections via DNS rebinding attacks during webhook and notification delivery. Publicly available exploit code exists. The vulnerability affects Prefect versions up to 3.6.28.dev1 and is fixed in 3.6.28.dev2.

Improper authorization in Calibre-Web-Automated versions up to 4.0.6 allows authenticated remote attackers to generate or revoke Kobo authentication tokens for arbitrary users via an Insecure Direct Object Reference (IDOR) vulnerability in the kobo_auth.py component. An attacker with valid login credentials can request /kobo_auth/generate_auth_token/<victim_user_id> to obtain tokens authorizing Kobo sync as any other user, or revoke their tokens to deny service. Publicly available exploit code exists and the vulnerability is confirmed patched in version 4.0.7.

Assimp version 6.0.2 is vulnerable to denial of service through improper buffer handling in the FBXConverter::ConvertMeshMultiMaterial() function when processing crafted FBX model files. A remote attacker can trigger a crash by supplying a malicious FBX file via network or local file access, causing the application to become unavailable. Publicly available exploit code exists, though the vulnerability requires user interaction to process the malicious file.

Improper authorization in Calibre-Web up to version 0.6.26 allows authenticated remote attackers to manipulate the user_id parameter in the generate_auth_token function (cps/kobo_auth.py) to access or disclose information belonging to other users. The CVSS score of 2.1 reflects the requirement for prior authentication and limited impact scope, though publicly available exploit code exists.

Improper cryptographic signature verification in Dolibarr ERP CRM up to version 23.0.2 allows remote attackers to bypass signature validation in the Online Signature Module, potentially forging or manipulating signed transactions. The vulnerability affects the dol_verifyHash function and has been publicly disclosed with exploit code available, though exploitation requires high technical complexity and is not confirmed as actively exploited in production environments.

Frontend File Manager Plugin for WordPress through version 23.6 allows authenticated Subscriber-level users and higher to read arbitrary files belonging to other users via insecure direct object reference (IDOR) in the download endpoint. By manipulating the 'file_id' parameter, attackers can bypass authorization checks and access sensitive data stored by administrators and other privileged users. Publicly available exploit code exists for this vulnerability, though EPSS scoring (0.02%) suggests limited real-world exploitation relative to its high CVSS rating.

HTTP request smuggling in Starlet through version 0.31 allows remote unauthenticated attackers to bypass header validation by exploiting incorrect precedence of Content-Length over Transfer-Encoding headers. The vulnerability violates RFC 7230 section 3.3.3, which mandates that Transfer-Encoding must take precedence when both headers are present. An attacker positioned between a client and Starlet-based backend can craft malicious requests that are interpreted differently by a front-end reverse proxy and the Starlet server, enabling request smuggling attacks with integrity impact.

Improper restriction of excessive authentication attempts in CodeWise Tornet Scooter Mobile App 4.75 on iOS and Android allows remote attackers to bypass rate-limiting controls on the /TwoFactor endpoint, potentially enabling brute-force attacks against two-factor authentication mechanisms. Publicly available exploit code exists. The vendor did not respond to early disclosure notification.

Out-of-bounds read in MikroTik RouterOS 6.49.8 SCEP endpoint allows remote unauthenticated attackers to trigger memory disclosure and potential service disruption via malformed transactionID or messageType parameters. Public exploit code exists on GitHub. CVSS 7.3 reflects network-accessible attack surface with low complexity, though impact is rated limited across confidentiality, integrity, and availability. Vendor non-responsive to coordinated disclosure attempts.

Improper authorization in ChatGPTNextWeb NextChat up to version 2.16.1 allows remote unauthenticated attackers to bypass access controls in the addMcpServer function (app/mcp/actions.ts), potentially disclosing sensitive information. The vulnerability has a CVSS score of 5.5 (moderate severity) with public exploit code available, though the vendor has not yet responded to the disclosed issue.

Permissive cross-domain policy in ChatGPTNextWeb NextChat up to version 2.16.1 allows remote attackers with user interaction to manipulate the Next.js API endpoint and enable untrusted domains to access application resources, leading to information disclosure. Public exploit code exists for this vulnerability, though the vendor has not yet responded to early disclosure notification.

External file inclusion in Totolink N300RH firmware 6.1c.1353_B20190305 allows remote unauthenticated attackers to manipulate the FileName parameter in the setUploadSetting function via /cgi-bin/cstecgi.cgi, enabling arbitrary file writes and denial of service. Publicly available exploit code exists, and the vulnerability carries a CVSS score of 6.5 reflecting network-accessible attack vector with low complexity.

Unauthenticated remote attackers can extract sensitive user information including email addresses, usernames, and user IDs through the '/dokan/v1/stores/{id}/reviews' REST API endpoint in Dokan plugin versions up to 4.3.1. The vulnerability affects only installations with the Pro version activated and store reviews enabled, allowing information disclosure of all customers who left vendor reviews. No public exploit code has been identified, but the attack requires no authentication or user interaction and can be automated at scale.

Insufficient verification of firmware authenticity in TRENDnet TEW-821DAP up to version 1.12B01 allows remote attackers to manipulate firmware updates through the cameo_dev.sh update handler, potentially leading to information disclosure. The vulnerability requires high attack complexity and difficult exploitation conditions. The affected hardware (v1.xR) reached end-of-life eight years ago and is no longer supported by the vendor, significantly limiting real-world exposure.

TRENDnet TEW-821DAP firmware version 1.12B01 transmits sensitive information in cleartext via the /www/cgi/ssi endpoint during firmware updates, allowing remote unauthenticated attackers to intercept credentials or configuration data. The vulnerability affects end-of-life hardware (version v1.xR) discontinued 8 years ago and no longer supported by the vendor. Public exploit code is available, though the attack requires high complexity conditions to execute successfully.

Insufficient verification of data authenticity in the firmware update handler of TRENDnet TEW-821DAP 1.12B01 allows remote attackers to manipulate the dest argument during firmware updates, leading to integrity violations. The vulnerability requires high attack complexity and affects only end-of-life hardware (version 1.xR) discontinued 8 years ago. CVSS score is 3.7 (low) with integrity impact but no confidentiality or availability impact; no public exploit confirmed.

My Social Feeds - Social Feeds Embedder WordPress plugin up to version 1.0.4 exposes sensitive TikTok OAuth credentials via an unauthenticated AJAX endpoint due to missing authorization and nonce checks. Authenticated attackers with Subscriber-level access can retrieve stored access_token and refresh_token values belonging to administrator-connected TikTok accounts, enabling them to impersonate the site owner in TikTok API interactions. No public exploit code or active exploitation has been reported at the time of analysis, though the vulnerability is trivial to exploit once network access is established.

Unauthenticated attackers can access and modify plugin settings in the Widgets for Social Photo Feed WordPress plugin through missing capability checks on two REST API endpoints, allowing unauthorized data access and configuration changes in all versions up to and including 1.8. The vulnerability requires only network access with no user interaction, making it trivially exploitable by remote attackers without authentication credentials.

Improper authorization in JeecgBoot up to version 3.9.1 allows authenticated remote attackers to manipulate the ruleClass parameter in the /sys/fillRule/edit endpoint, leading to unauthorized access and information disclosure. The vulnerability affects the FillRuleUtil component and has publicly available exploit code; the vendor confirmed the issue and committed to patching in an upcoming release.

HTTP request smuggling in mtrudel bandit before version 1.11.0 allows unauthenticated attackers to bypass edge security controls when the application sits behind a proxy that interprets duplicate Content-Length headers differently. The vulnerability stems from Bandit accepting only the first Content-Length header while proxies may use the last value, causing request framing desynchronization that enables smuggling past WAF rules, path-based ACLs, rate limiting, and audit logging. CVSS 6.3 (AV:N/AC:L/AT:P) indicates network-accessible exploitation with some attack timing complexity; no public exploit code or active KEV listing identified at analysis time, but RFC 9112 non-compliance creates a known attack pattern.

DTrace kernel instrumentation tool on Linux is vulnerable to a denial-of-service and potential privilege escalation attack when processing malicious ELF binaries with out-of-range sh_link fields. An unprivileged attacker can craft an ELF binary that, when instrumented by a root-level dtrace process, triggers an out-of-bounds heap read in the ELF parser. This can crash the dtrace daemon (DoS) or, depending on heap layout, lead to reading and dereferencing garbage pointers controlled by the attacker, potentially enabling code execution in a privileged context. The vulnerability requires local access and a privileged dtrace instance to be actively instrumentation the malicious process, but carries significant risk given dtrace's typical deployment in system administration and security monitoring contexts.

Incomplete validation of AI rich response messages for Instagram Reels in WhatsApp for iOS v2.25.8.0 through v2.26.15.72 and Android v2.25.8.0 through v2.26.7.10 allows authenticated attackers to trigger processing of media content from arbitrary URLs on a victim's device, potentially invoking OS-controlled custom URL scheme handlers to disclose limited information. No active exploitation has been observed in the wild, and CISA SSVC indicates no known exploitation path despite the network attack vector.

WhatsApp for Windows prior to v2.3000.1032164386.258709 permits attachment spoofing via maliciously formatted documents with embedded NUL bytes in filenames, causing the application to display files as benign types while executing them as executables upon opening. The vulnerability requires user interaction to open a crafted attachment delivered over the network, enabling an attacker to achieve code execution with the privileges of the WhatsApp process. No public exploit code or active exploitation has been confirmed at time of analysis.

Unauthenticated traffic relay vulnerability in Prosody mod_proxy65 module allows network attackers to bypass access control during SOCKS5 activation, resulting in integrity compromise and service disruption without requiring authentication. Affected versions are Prosody before 0.12.6 and 1.0.0 through 13.0.0 before 13.0.5 when mod_proxy65 is enabled. CVSS 6.5 reflects medium severity with network-accessible attack surface, low complexity, and non-privileged unauthenticated access, though confirmed availability and integrity impact limits widespread severity.

Memory leak in f2fs_rename() function allows local authenticated attackers to cause denial of service through repeated file rename operations. The vulnerability exists in the f2fs filesystem implementation when handling SELinux label initialization during whiteout file creation, due to a missing f2fs_free_filename() call introduced in commit 40b2d55e0452. Vendor patches are available for Linux 6.6.136, 6.12.84, 6.18.25, 7.0.2, and 7.1-rc1.

Wrong directory separator usage in the Linux kernel SMB client (CIFS) subsystem corrupts path handling on SMB1 UNIX mounts, causing mounted shares to become unavailable. The bug in `cifs_mount_get_tcon()` reads `cifs_sb->mnt_cifs_flags` before `reset_cifs_unix_caps()` initializes it, leaving `CIFS_MOUNT_POSIX_PATHS` and `CIFS_MOUNT_POSIXACL` bits unset and triggering a high-availability impact (CVSS A:H) for affected mounts. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche SMB1 UNIX mount prerequisite and local-only attack surface.

Use-after-free vulnerability in the ALSA caiaq USB audio driver allows local authenticated attackers to cause denial of service by triggering asynchronous card free callbacks after USB device disconnection. The vulnerability stems from missing reference counting on the parent USB device pointer, combined with an inappropriate usb_reset_device() call in the card teardown path. EPSS exploitation probability is minimal (0.02%), and no public exploit code or active exploitation has been identified.

tcm_loop target reset handler fails to drain in-flight SCSI commands, violating SCSI error handling contract and causing LUN reference leaks that deadlock configfs LUN unlink operations. Local users with appropriate privileges can trigger denial of service by initiating reset sequences while SCSI commands are in flight, leaving the kernel in an unkillable D-state waiting for LUN reference counts to clear. This is a local denial of service affecting the SCSI target core's tcm_loop loopback driver across multiple kernel versions.

Kernel denial of service via crafted btrfs metadata allowing local attackers to trigger an unguarded BUG_ON() condition during relocation recovery at mount time. The vulnerability arises when a root item on disk contains a non-zero drop_progress with zero drop_level, an invalid state that should not exist but lacks validation on read. CVSS 5.5 reflects local attack vector and availability impact; EPSS 0.02% indicates minimal real-world exploitation likelihood.

Memory exhaustion denial of service in the Linux kernel's QRTR (Qualcomm IPC Router) networking subsystem allows a local low-privileged user to leak kernel memory by triggering mid-allocation failures in the deprecated radix_tree API used for qrtr_tx_flow tracking. Orphaned intermediate radix tree nodes accumulate permanently because radix_tree_for_each_slot() only visits leaf slots and standard cleanup paths never reclaim them. The fix migrates to xarray, whose xa_destroy() correctly frees all internal nodes; no active exploitation is confirmed (EPSS 0.02%, no KEV listing), making this a routine patch-cycle priority rather than an emergency response.

Information disclosure in the Linux kernel's traffic control (tc) scheduler allows local users with low privileges to read uninitialized kernel heap memory through the tc_chain_fill_node() function, which fails to zero-initialize the tcm_info field in netlink messages before transmission to userspace. The vulnerability affects multiple stable kernel series and has a vendor-released patch available across all affected versions.

A local denial of service vulnerability in the Linux kernel bnxt_en driver allows authenticated local users to crash the system by triggering an out-of-bounds array access during backing store capability queries. The vulnerability stems from incorrect use of firmware-provided type values to index fixed metadata arrays, rather than using the known loop iteration index. Exploitation requires local access and user-level privileges (PR:L), and no active exploitation has been reported.

Denial of service in the Linux kernel NFC PN533 UART driver allows local authenticated attackers to exhaust memory by sending malformed NFC frames without valid headers, causing unbounded socket buffer growth until kernel crash. Affects Linux 5.5 through 7.0 with patches available across all maintained stable branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0); EPSS exploitation probability is minimal at 0.02%, but local privilege is required.

Information disclosure in the Linux kernel netfilter ctnetlink module allows local authenticated users to read stale NAT configuration data from kernel memory via a crafted netlink message. When ctnetlink_alloc_expect() allocates connection tracking expectations without initializing NAT fields, uninitialized memory containing sensitive data from previous slab allocations is exposed to userspace during expectation dumps. This requires local access and low-privileged authentication (PR:L) but carries a high availability impact due to potential memory disclosure vectors.

Denial of service in Linux kernel netfilter nf_tables subsystem allows local privileged users to crash the system by issuing immediate NF_QUEUE verdicts, which are not properly validated and cause kernel panic when processed through the arp family or other code paths that lack queue support. The vulnerability affects multiple kernel versions and requires local access with limited privileges (CAP_NET_ADMIN or equivalent) to exploit.

Local privilege escalation in Linux kernel Bluetooth subsystem allows authenticated local users to cause denial of service through improper resource management in hci_cmd_sync_queue_once() function. The vulnerability affects Bluetooth HCI synchronization queue handling, where the function fails to properly indicate queue item addition status, leading to potential resource leaks and system unavailability. EPSS score of 0.02% indicates minimal real-world exploitation probability despite moderate CVSS severity.

Memory and reference leaks in the Linux kernel Bluetooth hci_sync subsystem allow local authenticated attackers to cause denial of service by triggering hci_cmd_sync_queue_once() failures without invoking the destroy callback, leading to unreclaimed resources. The vulnerability affects Linux kernel versions prior to 6.19.12 and 7.0, with EPSS score of 0.02% indicating very low real-world exploitation probability despite moderate CVSS score.

Linux kernel Bluetooth MGMT subsystem fails to validate the advertised data length field in mesh send operations, allowing local authenticated attackers to trigger denial of service by reading beyond allocated buffer boundaries. The vulnerability affects the mesh_send() function which accepts a truncated MGMT_OP_MESH_SEND command that passes length checks but contains mismatched adv_data_len and actual payload, leading to out-of-bounds access during async mesh transmission. Patch versions include 6.6.134, 6.12.81, 6.1.168, 6.18.22, and 7.0.

Memory leak in the MACB (Cadence Gigabit Ethernet Controller) driver allows local authenticated attackers to cause denial of service through resource exhaustion by failing to unregister fixed-rate clocks allocated during device probe, resulting in memory and clock resource depletion. EPSS exploitation probability is minimal at 0.02%, indicating low real-world risk despite CVSS score of 5.5. Patch versions are available across all supported kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, 7.0).

A denial of service vulnerability in the Linux kernel's mlx5 (Mellanox/NVIDIA) network driver causes a kernel panic when switchdev mode initialization fails during rollback to legacy mode. A local unprivileged user on systems with affected mlx5 hardware can trigger improper netdevice unregistration, leading to a kernel BUG at net/core/dev.c:12070 and system crash. The vulnerability affects multiple stable kernel versions; vendor-released patches are available.

Denial of service in Linux kernel eBPF subsystem allows local attackers with standard privileges to crash the system by attaching sleepable eBPF kprobe_multi programs that invoke non-sleepable contexts. The vulnerability exists because bpf_kprobe_multi_link_attach() fails to validate the sleepable flag before program attachment, permitting sleepable helpers like bpf_copy_from_user() to execute in atomic RCU contexts, triggering kernel panics with 'sleeping function called from invalid context' errors. EPSS exploitation probability is very low at 0.02%, suggesting practical exploitation barriers despite local network access requirements.

Incomplete cleanup in the Linux kernel STM32 OSPI SPI driver exposes local low-privileged users to availability impact on STM32-based systems. The `spi-stm32-ospi` driver's `remove()` callback exits prematurely when `pm_runtime_resume_and_get()` fails, skipping deallocation of the SPI controller and associated resources, which can cause resource exhaustion and system instability upon device unbind or driver removal. No public exploit exists and EPSS at 0.02% (4th percentile) reflects extremely low exploitation probability; this is a narrow-impact issue constrained to embedded hardware running STM32 OSPI peripherals.

The Intel Xe GPU driver's page fault handler in the Linux kernel fails to reject write and atomic access requests targeting read-only Virtual Memory Areas (VMAs), allowing a local unprivileged user to trigger kernel instability or a system crash. Systems running Linux kernel versions prior to 6.19.12 or 7.0 that contain Intel Xe-architecture GPU hardware (Arc discrete GPUs, Meteor Lake/Lunar Lake integrated graphics) are affected. No public exploit exists and EPSS probability sits at 0.02%, indicating very low observed exploitation activity; the vulnerability is not listed in CISA KEV.

A denial-of-service vulnerability in the Linux kernel's DRM/XE PXP (Protected Execution) driver causes an infinite loop when a restart flag is not cleared after a jump operation, allowing local authenticated users to hang or crash the system. The vulnerability affects multiple kernel versions through a logic error in the pxp_start function that was resolved in stable patches for Linux 6.18.22, 6.19.12, and 7.0.

Resource leak in the Linux kernel's Amlogic A4 SPI Flash Controller (spifc-a4) driver causes availability impact on affected embedded systems. The aml_sfc_probe() function registers a NAND ECC engine but omits the corresponding nand_ecc_unregister_on_host_hw_engine() call on both probe failure unwind and device removal paths. On hardware running affected kernel versions (6.18 through pre-patch commits), this leaves a dangling registered ECC engine that can cause system instability or denial-of-service. No public exploit code exists and EPSS probability is 0.02%, reflecting this is a niche, hardware-specific driver bug with no confirmed active exploitation.

Speculative execution (Spectre v1) in the Linux kernel's DRM compat ioctl subsystem (drm/ioc32) allows a local attacker with access to a DRM device to leak kernel memory by supplying a crafted, out-of-bounds index into the kernel's compat ioctl function pointer table, which the CPU speculatively dereferences before a bounds check resolves. The 'Information Disclosure' classification from Red Hat and SUSE tagging directly contradicts the provided CVSS rating of C:N/A:H - Spectre-class gadgets canonically produce confidentiality impact, not availability impact, and this discrepancy warrants verification against the vendor's official scoring rationale. No active exploitation is confirmed (not in CISA KEV), and the EPSS of 0.02% (7th percentile) reflects the high technical bar Spectre exploitation imposes.

Denial of service in the Linux kernel ALSA ctxfi audio driver allows local authenticated attackers to crash the system via improper error handling in the daio_device_index() function. The ctxfi driver failed to validate return values from index mapping operations, enabling a local user with standard privileges to trigger an unhandled error condition that disables audio functionality or causes system instability.

Division-by-zero denial of service in Linux kernel's Intel i915 DRM driver when loading on certain machines with DSC (Display Stream Compression) enabled in command mode. The driver incorrectly applies horizontal timing adjustments based on compression ratio in command mode, causing line_time_us to become zero and triggering a kernel panic. Affects Linux kernel versions 5.6 and later; patch available via stable kernel releases.

Denial of service in the Linux kernel's mpu3050 gyroscope driver allows local authenticated attackers to crash the system via incorrect IRQ handler cleanup during module unload. A mismatch between the registered IRQ handler (mpu3050->trig) and the handler passed to free_irq() (mpu3050) causes improper cleanup, leading to resource leaks and potential kernel panic when the device is removed or the driver is unloaded. No public exploit code identified; patch available across affected kernel series.

Resource leak in the Linux kernel MPU3050 gyro driver allows local authenticated users to cause denial of service through memory exhaustion by repeatedly triggering iio_trigger_register() failures that fail to release previously allocated interrupt handlers. The vulnerability affects multiple kernel versions and requires local access with unprivileged user privileges, resulting in potential system availability impact with low real-world exploitation likelihood (EPSS 0.02%).

Memory leak in the Linux kernel's GPIB lpvo_usb driver allows local authenticated users to cause a denial of service through resource exhaustion by repeatedly connecting and disconnecting USB devices, as the driver fails to release USB device references during interface enumeration. The EPSS score of 0.02% indicates minimal real-world exploitation risk despite the moderate CVSS 5.5 severity, reflecting the combination of local-only access requirement, authentication need, and the niche nature of GPIB USB device usage.

A memory leak in the Linux kernel's USB misc usbio driver allows local attackers with low privileges to cause a denial of service by exhausting kernel memory through repeated USB device probe failures. The vulnerability arises when usb_submit_urb() fails during device initialization, leaving allocated URB structures unreleased and accumulating with each failed probe attempt.

Denial of service in Linux kernel USB dwc2 gadget driver allows local authenticated users to trigger a deadlock via improper spin lock handling in dwc2_hsotg_udc_stop(). The vulnerability stems from a locking protocol violation where dwc2_gadget_exit_clock_gating() expects a held lock but is called without one, causing spin_unlock on an unheld lock followed by a lock held indefinitely, resulting in system hang. No public exploit code identified at time of analysis.

Denial of service in Linux kernel bridge module via malformed IPv6 Neighbor Discovery options allows local authenticated attackers to crash the system by crafting packets with invalid ND option lengths that cause memory access violations in the br_nd_send() function. The vulnerability affects kernel versions 4.15 and later across multiple stable branches. EPSS exploitation probability is very low at 0.02%, reflecting the requirement for local authenticated access and low attack complexity.

Memory leak in Linux kernel comedi subsystem allows local privileged users to exhaust kernel memory and cause denial of service. The vulnerability exists in do_cmd_ioctl() where chanlist memory is not properly freed when runflags is not set following an exceptional exit, due to incomplete reference counting logic introduced in commit 4e1da516debb. CVSS 5.5 (local, low complexity, requires user privilege) with EPSS 0.02% indicates this is a lower-priority local DoS affecting systems with comedi driver loaded and untrusted local users.

Memory leak in Linux kernel s390/zcrypt subsystem allows local authenticated attackers to exhaust memory resources by repeatedly using CCA cards as accelerators for clear key RSA requests (ME and CRT operations). The vulnerability stems from incomplete refactoring where AP message allocations via ap_init_apmsg() are not properly freed in two code paths, causing heap memory exhaustion over time and enabling denial of service on s390 systems with CCA cryptographic hardware.

Denial of service via runtime PM usage count underflow in the rz-mtu3-cnt counter driver allows local privileged users to disable hardware counters and trigger kernel warnings by repeatedly writing to the sysfs enable file. Multiple writes of the same value (0 or 1) to the enable attribute cause the runtime PM reference count to become misaligned with actual hardware state, leading to register access with clocks disabled and potential PWM channel conflicts. EPSS exploitation probability is minimal (0.02%) despite local access requirement, indicating this is primarily a local reliability issue rather than a remote attack vector.

Denial of service in Linux kernel counter driver (rz-mtu3-cnt) allows local attackers with low privileges to crash the system by exploiting a race condition where counter and PWM sub-drivers overwrite a shared device pointer, causing incorrect runtime power management operations. The vulnerability affects kernel versions prior to specific patch levels across the 6.x and 7.x branches, with EPSS exploitation probability of 0.02% indicating low real-world exploitation likelihood despite the availability of a vendor patch.

Denial of service in Linux kernel VXLAN module allows local authenticated attackers to crash the system via malformed IPv6 neighbor discovery options in vxlan_na_create(). A crafted ND option with incorrect length values can cause out-of-bounds access or undersized payload reads, triggering a kernel panic. EPSS exploitation probability is low at 0.02%, but the vulnerability is confirmed patched across multiple stable kernel branches (5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12).

Memory leaks in the ftgmac100 Ethernet driver's ring allocation function allow local authenticated users to cause a denial of service through resource exhaustion on driver initialization failure. The vulnerability is triggered when ftgmac100_alloc_rings() fails during intermediate allocation stages, returning directly without freeing previously allocated resources (rx_skbs, tx_skbs, rxdes, txdes, rx_scratch). This affects Linux kernel versions prior to fixes released in stable branches 5.10.253, 5.15.203, 6.1.168, 6.6.134, 6.12.81, 6.18.22, 6.19.12, and 7.0.

Denial of service in Linux kernel scheduler extension (sched_ext) allows local privileged attackers to crash systems by triggering incorrect task migration validation. The vulnerability exists in the is_bpf_migration_disabled() function, which fails to correctly identify migration-disabled tasks on non-PREEMPT_RCU configurations, potentially dispatching such tasks to remote CPUs and triggering kernel errors in task_can_run_on_remote_rq(). EPSS exploitation probability is very low at 0.02%, but CVSS 5.5 indicates local attackers with standard user privileges can cause denial of service.

Resource leaks in the Linux kernel GPIO subsystem allow local attackers with low privileges to cause denial of service through memory exhaustion during gpiochip initialization error handling. The vulnerability arises from improper reference counting in gpiochip_add_data_with_key() after device initialization, where error paths fail to release device references, leading to memory not being freed on function failure. CVSS 5.5 with EPSS 0.02% indicates low real-world exploitation probability despite local attack vector.