Information Disclosure

Improper authorization in Wooey versions up to 0.13.2 permits any authenticated non-staff user to upload or update Python scripts via the add_or_update_script API endpoint in wooey/api/scripts.py, bypassing the intended staff-only privilege boundary. Because Wooey executes uploaded scripts on the underlying server, this flaw carries escalation potential beyond the limited CVSS 4.0 base score of 2.1 in multi-tenant or internet-facing deployments. A proof-of-concept has been publicly disclosed; the vulnerability is not in CISA KEV, and EPSS is negligible at 0.04% (13th percentile), suggesting exploitation remains opportunistic rather than widespread.

Stale KV cache data leakage in vllm's KV Block Handler (versions 0.1-0.19.0) allows partial disclosure of prior inference requests' attention key/value data to subsequent requests. The `needs_kv_cache_zeroing` property incorrectly returned `False` for FullAttention model configurations - relying solely on `has_mamba_layers` - causing recycled KV cache blocks to go unzeroed between requests; partial-block tail slots retaining NaN/Inf values from prior sessions could then leak into the masked softmax computation of the next request. A publicly available PoC exists per SSVC and CVSS 4.0 E:P, though EPSS at 0.05% (14th percentile) and absence from CISA KEV indicate very low observed exploitation in practice.

Transient execution side-channel exposure in AMD EPYC 7001 Series and EPYC Embedded 3000 Series processors permits a local low-privileged attacker to leak limited sensitive data through the floating point divisor unit's microarchitectural state during speculative execution. Exploitation is constrained to local access with specific attack conditions present (CVSS 4.0 AT:P), placing this firmly in the Spectre/Meltdown class of hardware-level vulnerabilities. No public exploit code or active exploitation has been identified; EPSS sits at 0.01% (1st percentile) and CISA SSVC rates exploitation as none with non-automatable attack path.

Out-of-bounds read in GPAC's elng_box_read function allows local attackers to trigger partial information disclosure and potential availability impact by supplying a crafted MP4 file with an oversized Extended Language Tag (elng) box. The fix commit confirms the root cause: ptr->size is not validated against GF_UINT_MAX before use, permitting a read beyond allocated memory. A publicly available proof-of-concept exploit exists (GitHub issue #3516), though EPSS sits at 0.01% and SSVC classifies exploitation as non-automatable with only partial technical impact - placing real-world priority well below the noise floor for most organizations.

Module import confusion in pip before version 26.1 allows a maliciously crafted wheel package to execute arbitrary code within pip's own process by exploiting the sequencing of pip's self-update check relative to wheel installation. Because pip deferred well-known module imports for startup performance and triggered the self-update check after wheels were installed, a freshly installed malicious module could shadow a legitimate import targeted by the self-update routine. No public exploit code is identified at time of analysis, EPSS sits at the 2nd percentile, and SSVC confirms no exploitation, though the CWE-829 root cause carries inherent supply-chain risk.

Improper certificate validation in Apache Storm Prometheus Reporter versions 2.6.3 to 2.8.6 allows man-in-the-middle attacks across all TLS connections in the Storm daemon when the skip_tls_validation configuration option is enabled. Enabling this setting for Prometheus PushGateway connections inadvertently downgrades the JVM-wide SSL context, causing all subsequent HTTPS communications (ZooKeeper, Thrift, Netty, UI) to trust arbitrary certificates without validation, enabling interception of cluster state, topology submissions, and administrative credentials. No public exploit code identified at time of analysis, and EPSS scoring of 0.01% reflects the requirement for explicit administrator misconfiguration to trigger the vulnerability.

Unhandled exception in Foxit PDF Editor and Foxit PDF Reader allows local denial of service when a user opens a maliciously crafted PDF file with insufficient parameter verification, causing the application to crash via an uncaught std::invalid_argument exception. The vulnerability requires user interaction (opening a file) and local file access but affects all versions of both products without authentication requirements.

Weak cryptographic hash usage in code-projects Chat System 1.0 allows remote attackers to compromise password security through the MD5 Hash Handler in update_user.php. The vulnerability stems from use of MD5 for password hashing, a cryptographically broken algorithm that enables rapid offline cracking of password hashes. Publicly disclosed exploit code exists, though exploitation requires high attack complexity. The vulnerability impacts password confidentiality with low direct severity but creates substantial downstream risks for user account compromise.

OPPO Wallet APP contains a trusted domain validation bypass flaw that allows local attackers with user interaction to hijack account tokens and disclose sensitive information. The vulnerability affects all versions of OPPO Wallet APP and exploits improper domain verification in protected interface access controls, enabling token theft through local attack vector.

uriparser before 1.0.1 suffers a numeric truncation vulnerability in text range comparison that causes denial of service when processing URIs with gigabyte-scale lengths. The flaw occurs because internal range comparisons truncate large numeric values, allowing maliciously crafted oversized URIs to bypass length validation and trigger memory exhaustion or processing failures. Local attackers can exploit this via specially constructed input, though practical exploitation requires an application to accept and process URIs of exceptional size.

Improper ownership management in Moxa Secure Router allows low-privileged authenticated users to access exported configuration files containing hashed administrative passwords, enabling credential disclosure. The vulnerability is confined to scenarios where configuration files have been exported and requires valid user credentials to exploit; no impact to system integrity or availability has been identified.

CodeAstro Online Job Portal 1.0 exposes file and directory information through the /users/user-cvs/ endpoint via remote unauthenticated access, allowing attackers to enumerate and retrieve sensitive resume and user data. The vulnerability has publicly available exploit code and affects all versions of the application via the CPE cpe:2.3:a:codeastro:online_job_portal:*:*:*:*:*:*:*:*. CVSS 5.5 with confirmed public exploit availability and EPSS exploitation probability indicates moderate real-world risk for deployments accessible over the network.

Information disclosure in MiroFish up to version 0.1.2 allows remote attackers to leak sensitive data through manipulation of the SECRET argument in the Werkzeug Debugger PIN Handler at the /console endpoint. The vulnerability requires high attack complexity and has a low CVSS score (3.7) indicating limited confidentiality impact, but publicly available exploit code exists and the vendor has not responded to early notification.

Insufficient credential protection in tufantunc ssh-mcp up to version 1.5.0 allows local authenticated users to disclose sensitive credentials through the Command Line Handler component. The vulnerability affects src/index.ts and has a publicly available exploit, though the low CVSS score of 1.9 reflects limited scope (confidentiality impact only, no integrity or availability effects) and requirement for local authenticated access.

SmythOS sre versions up to 0.0.15 expose sensitive information through improper validation of the baseURL argument in the Connector Service's LLM utilities component. An authenticated remote attacker with user interaction can manipulate the baseURL parameter to disclose confidential data. Public exploit code exists, and the vendor has not responded to early disclosure notifications.

Datavane Datavines up to commit 13607645e14a4982468cfdbcf75c85cde63bae71 uses a hard-coded cryptographic key in the JWT Token Handler component, allowing remote attackers to manipulate the tokenSecret parameter and bypass authentication or forge tokens. The vulnerability requires high attack complexity but has publicly available exploit code; the vendor has been informed via pull request but has not yet merged the fix.

Hickory DNS recursor versions 0.1 through 0.25.2 allow cross-zone DNS poisoning attacks due to cached DNS responses not being directly associated with the query that triggered them, enabling attackers to inject malicious DNS records across zone boundaries and potentially redirect traffic to attacker-controlled servers without user interaction or authentication.

Unintended intermediary exposure in go-kratos kratos up to 2.9.2 allows remote attackers to disclose sensitive information via manipulation of the http.DefaultServeMux fallback handler in the NewServer function. The vulnerability has publicly available exploit code and affects the HTTP transport layer with a CVSS score of 5.5, representing a confidentiality impact without availability or integrity concerns.

Improper verification of cryptographic signatures in Cesanta Mongoose versions up to 7.20 allows remote attackers to bypass GCM authentication tag validation in the mg_aes_gcm_decrypt function. The vulnerability has high attack complexity and requires no user interaction, but provides only integrity impact (not confidentiality or availability). Publicly available exploit code exists, and vendor has released patched version 7.21.

Server-side template injection in AstrBot Dashboard API (version 4.22.1 and earlier) allows remote authenticated attackers with high privileges to execute arbitrary template code via the create_template function, leading to information disclosure and potential code execution. Publicly available exploit code exists, and the vendor has not yet responded to disclosure despite early notification.

Denial-of-service in the Linux kernel's traffic control `act_csum` module allows a local low-privileged user to crash the kernel by exploiting missing VLAN header validation in `tcf_csum_act()`. Systems running any Linux kernel version from the introducing commit through the stable patch releases (pre-6.12.83, pre-6.18.24, pre-6.19.14) and configured with the `act_csum` tc action on paths carrying nested VLAN-tagged traffic are vulnerable. No public exploit has been identified and EPSS stands at 0.02% (5th percentile), indicating minimal real-world exploitation probability, but the issue is patch-confirmed across multiple stable branches.

Out-of-bounds array access in the Linux kernel's netfilter xt_multiport module enables a local attacker with low privileges to crash the system via a crafted malformed iptables rule. The checkentry validation path for multiport v1 rules fails to verify range encoding, allowing ports_match_v1() to step past the end of the ports[] array when processing rules where the last slot is flagged as a range start or when two consecutive range-start markers appear without an intervening range-end. Exploitation is confined to local actors with CAP_NET_ADMIN capability; no public exploit has been identified and EPSS sits at 0.02% (5th percentile), consistent with the narrow attack surface.

Denial of service in the Linux kernel's AF_ALG crypto socket subsystem allows a local, low-privileged user to crash or hang the system via crafted recvmsg calls. The flaw in af_alg_get_rsgl() causes receive buffer accounting to diverge from actual data attached to skcipher requests - when insufficient RX space remains, the kernel rounds the request length to zero rather than rejecting it, producing an invalid crypto operation. No exploitation has been confirmed (not in CISA KEV) and EPSS is 0.02%, reflecting the narrow local-only attack surface.

SSRF redirect bypass in langchain-text-splitters prior to 1.1.2 allows attackers who can supply URLs to applications using HTMLHeaderTextSplitter.split_text_from_url() to reach internal network endpoints, localhost services, or cloud instance metadata APIs by exploiting unvalidated HTTP redirects. The function's built-in validate_safe_url() check is circumvented because requests.get() follows 302 redirects by default without revalidating the redirect target - turning a deliberate safety feature into a false guarantee. Data exfiltration is contingent on the application returning or surfacing Document object contents to the URL-supplying party; no public exploit has been identified at time of analysis, and EPSS sits at the 9th percentile.

Traefik's BasicAuth middleware contains a timing side-channel vulnerability that allows attackers to enumerate valid usernames through response-time analysis. A map key/value confusion in the constant-time comparison fallback causes the `notFoundSecret` variable to always resolve to an empty string, causing authentication checks against non-existent users to complete in microseconds (~0.48ms) instead of performing full bcrypt evaluation (~62ms), creating a 130x timing oracle. Attackers can distinguish existing users from non-existent ones by measuring HTTP response times, enabling account enumeration without credentials.

Traefik versions prior to 2.11.43, 3.6.14, and 3.7.0-rc.2 fail to enforce cross-namespace isolation for middleware references nested inside Chain middlewares, allowing actors with permission to create CRDs in their own namespace to bypass the allowCrossNamespace=false restriction and apply middleware from arbitrary namespaces. This authorization bypass affects Kubernetes clusters relying on namespace isolation controls and can enable unauthorized reuse of security-sensitive middleware policies across namespace boundaries.

4ga Boards prior to version 3.3.5 leaks valid usernames and email addresses through response timing analysis on the login endpoint. An unauthenticated attacker can distinguish between invalid credentials (where the username/email does not exist) and valid credentials with an incorrect password by measuring response times, with a ~4.4× timing difference detectable in a single request over the network. This enables user enumeration attacks without brute-force constraints, allowing reconnaissance for subsequent account takeover attempts.

Out-of-bounds read in PJSIP pjproject 2.16 and earlier exposes SIP endpoints to remote crash and limited memory integrity corruption via a malformed Content-ID URI in a SIP multipart message body. The vulnerability requires no authentication and no user interaction, making it automatable per SSVC analysis, though exploitation probability remains very low (EPSS 0.04%, 11th percentile) with no public exploit or active exploitation recorded. The primary risk is availability - a crafted SIP multipart packet can crash the parsing component - with a secondary low-severity integrity signal per the CVSS 4.0 vector (VI:L); confidentiality impact is assessed as none.

Axios HTTP client versions prior to 1.15.1 and 0.31.1 use loose truthy/falsy comparison instead of strict boolean checks for the withXSRFToken config property, allowing XSRF tokens to be sent to cross-origin servers when the property is set to any truthy non-boolean value through prototype pollution or misconfiguration. This bypasses same-origin validation and enables attackers to exfiltrate XSRF tokens to attacker-controlled domains, compromising CSRF protection across applications using vulnerable versions.

Axios versions prior to 1.15.1 and 0.31.1 contain a character mapping flaw in the AxiosURLSearchParams.encode() function that reverses safe percent-encoding of null bytes, converting %00 back to raw null bytes. While the standard axios request flow remains unaffected, this vulnerability could enable integrity compromise in edge-case scenarios where encoded parameters are processed by downstream systems expecting percent-encoded values. No public exploit code or active exploitation has been identified.

OpenPrinting CUPS before version 2.4.17 allows network-adjacent attackers to read up to 176 bytes of stack memory via a crafted SNMP response sent to the CUPS SNMP backend, with leaked data visible to authenticated users through IPP Get-Printer-Attributes responses and the web interface. The vulnerability requires adjacency on the network but no authentication, making it a low-severity information disclosure risk in environments where SNMP-enabled printers are accessible from untrusted networks.

Memory leak in the Linux kernel's rt2x00usb WiFi driver allows a local low-privileged user to exhaust kernel memory on systems equipped with Ralink RT2x00-based USB WiFi adapters. The flaw - present since kernel 4.7 - results from USB anchor device-managed resources being incorrectly scoped to the parent USB device rather than the USB interface, so resources are not released when the driver unbinds without a physical device disconnection. No active exploitation is confirmed (not in CISA KEV) and EPSS stands at 0.02% (7th percentile), marking this as a low-urgency stability fix rather than an emergency security response.

Uninitialized kernel memory leaks to userspace through the xfrm_user subsystem's build_report() function in the Linux kernel, exposing three bytes of alignment padding in struct xfrm_user_report via Netlink before it is copied to userspace. The flaw affects virtually all Linux kernel versions from initial commit through the recently issued stable-tree patches (5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0). No public exploit has been identified at time of analysis, EPSS sits at just 0.02% (7th percentile), and it is not listed in CISA KEV; however, the breadth of affected systems is enormous given the Linux kernel's ubiquitous deployment.

Local low-privileged users can exhaust system memory on Linux systems by generating unbounded rfkill events without consuming them from the rfkill file descriptor, resulting in a potential out-of-memory condition and system crash. Affected kernel versions span a wide range across multiple stable branches, with fixes backported to 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit code or active exploitation has been identified; the EPSS score of 0.02% (7th percentile) reflects minimal real-world exploitation interest at time of analysis.

Kernel heap memory disclosure in the Linux kernel's xfrm (IPsec) subsystem exposes uninitialized heap bytes to local unprivileged users via netlink multicast. The `build_polexpire()` function omits the `memset_after()` call that its counterpart `build_expire()` correctly applies, leaving trailing padding bytes of `struct xfrm_user_polexpire` uninitialized before broadcasting the structure to XFRMNLGRP_EXPIRE listeners. Any local user able to subscribe to that netlink multicast group on a system running IPsec with expiring policies can capture these notifications and read arbitrary kernel heap contents. No public exploit has been identified at time of analysis, and EPSS is extremely low at 0.02% (7th percentile), indicating negligible automated exploitation activity.

Memory mismanagement in the Linux kernel brcmsmac WiFi driver causes a kernel availability impact through a size mismatch between DMA allocation and deallocation. The brcmsmac driver incorrectly calls dma_free_coherent() with the original requested size rather than the aligned size stored in 'alloced' by dma_alloc_consistent(), which may have grown the allocation during alignment. This affects Linux from version 3.2 (commit 5b435de0) through multiple stable branches, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low exploitation probability.

NULL dereference in the Linux kernel's pn533 NFC driver (pn532_receive_buf) can crash the kernel when a socket buffer allocation fails after bytes have already been consumed from the serial receive stream. Systems running affected kernel versions with PN532/PN533 NFC hardware attached over serial are exposed to a local denial-of-service (kernel panic). No public exploit code exists, EPSS probability is negligible (0.02%, 7th percentile), and this vulnerability is not in the CISA KEV catalog - indicating no confirmed active exploitation.

Memory leak in the Linux kernel's Altera Triple Speed Ethernet (altera-tse) driver allows a local low-privileged user on affected hardware to exhaust kernel memory over time. The flaw in tse_start_xmit() incorrectly signals successful packet transmission to the network stack when DMA mapping fails, preventing socket buffer (skb) cleanup and causing a per-failure memory leak that can escalate to availability loss. No public exploit exists and EPSS at 0.02% (7th percentile) confirms negligible exploitation interest; this is a maintenance-tier fix relevant only to specialized embedded Linux deployments on Altera/Intel FPGA hardware.

System hang exposure in the Linux kernel's i.MX 8MP (imx8mp-blk-ctrl) power management domain driver allows a local attacker with low privileges to trigger a kernel hang on affected NXP i.MX 8M Plus-based systems. The root cause is the NOC_HDCP clock being incorrectly allowed to power down, which causes the NoC ADB400 port power-down handshake to deadlock, resulting in a complete loss of system availability. No public exploit code exists and EPSS is 0.02%, indicating this is a stability defect with low opportunistic exploitation probability, though it carries meaningful availability risk on affected embedded hardware.

Memory leak in the Linux kernel's __mmap_region() function allows a local low-privileged user to incrementally exhaust kernel slab memory, potentially causing denial of service. Introduced as a regression by commit 605f6586ecf7, the bug leaves a shmem file object unreferenced when mmap() on /dev/zero with MAP_SHARED fails mid-way through VMA setup - the replacement file allocated by shmem_zero_setup_desc() is never released via fput(). No public exploit exists and EPSS sits at 0.02%, making this a low-urgency but genuine availability risk for affected kernel versions; patched upstream in stable commits 61fc8eaf and 894f99eb.

Memory leak in the Linux kernel's DAMON (Data Access MONitor) sysfs subsystem allows a local low-privileged user to exhaust kernel memory by triggering a race condition between process termination and damon_call() invocation. When DAMON is configured to monitor virtual address spaces and the target process exits before damon_call() executes, the dynamically allocated repeat_call_control structure is never freed. No public exploit exists and EPSS is 0.02% (4th percentile), placing this firmly in the low-urgency tier despite the high availability impact scored by CVSS.

Denial of service via kernel panic in the Linux kernel idpf NIC driver arises from invalid spinlock nesting in the async virtchannel message handler, most critically on PREEMPT_RT-enabled kernels. The idpf_mac_filter_async_handler acquires a BH spinlock while the workqueue thread already holds the raw spinlock embedded in the completion primitive of idpf_vc_xn, violating PREEMPT_RT lock context rules and triggering a kernel BUG that crashes the system. No public exploit identified at time of analysis; EPSS is 0.02%, indicating negligible observed exploitation interest for this narrow driver-level locking defect.

Page pool memory leaks in the Linux kernel's lan966x FDMA (Flexible DMA) network driver cause resource exhaustion when DMA allocation failures occur during driver initialization, affecting systems built on Microchip lan966x Ethernet switch hardware. The missing `page_pool_destroy()` calls in two distinct error paths - inside `lan966x_fdma_rx_alloc()` and `lan966x_fdma_init()` - allow allocated pools to persist indefinitely if initialization fails, potentially degrading host availability. With an EPSS of 0.02% and no public exploit or KEV listing, this is a low-priority maintenance issue with real-world impact limited almost exclusively to embedded and industrial Linux deployments running this specific controller hardware.

Memory exhaustion in the Linux kernel's rxrpc subsystem allows a local low-privileged user to degrade system availability by repeatedly triggering a key parsing error path that leaks kernel memory. The flaw exists in rxrpc_preparse_xdr_yfs_rxgk(), where allocations for token->rxgk are not freed on certain error branches before jumping to reject_token. With EPSS at 0.02% (5th percentile) and no CISA KEV listing, real-world exploitation is assessed as low-probability and operationally constrained to systems actively using AFS/YFS rxrpc authentication.

Reference count leak in the rxrpc subsystem of the Linux kernel allows a local low-privilege user to exhaust kernel keyring resources, causing denial of service. The flaw exists in rxrpc_alloc_client_call(), which acquires a reference to call->key but never releases it in rxrpc_destroy_call(), causing the key reference counter to increment indefinitely across repeated client call creation and destruction. EPSS at 0.02% (5th percentile) and no KEV listing confirm this carries negligible real-world exploitation urgency; no public exploit is identified at time of analysis.

Reference count leak in the Linux kernel's rxrpc subsystem (`rxrpc_server_keyring()`) causes progressive kernel resource exhaustion when `rx->securities` is already initialized and the extra reference is not decremented. Affected kernels span from version 2.6.22 through multiple stable branches, with fixes backported to 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, and 7.0. No public exploit identified at time of analysis, and EPSS sits at 0.02% (7th percentile), reflecting niche real-world exploitation probability despite the kernel's ubiquitous deployment footprint.

Memory exhaustion in the Linux kernel's rxrpc/rxgk subsystem allows a local low-privileged attacker to cause a denial-of-service condition by triggering a resource leak in rxgk_verify_response(), where allocated rxgk authentication context objects are never released. The flaw is confined to systems actively using AFS with RxGK GSS-based authentication, a non-default configuration absent from the vast majority of Linux deployments. No public exploit code exists and exploitation probability is extremely low (EPSS 0.02%), though patched stable kernel versions 6.18.23, 6.19.13, and 7.0 are available.

Cross-thread information disclosure in the Linux kernel on AMD Zen1 processors allows a low-privileged local attacker to harvest partial floating-point division results belonging to a concurrently executing victim thread. Zen1's hardware FP divider fails to fully clear intermediate state between operations, creating a side-channel leakage path exploitable by any unprivileged thread sharing the same physical CPU core. No public exploit code has been identified and CISA has not added this to the KEV catalog, but the vulnerability affects all Linux versions from inception through multiple stable branches, with patches now available across eight stable series (5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 6.19, 7.0).

Null pointer dereference in Linux kernel bnge driver occurs when auxiliary_device_add() fails and the error handling path omits a return statement after auxiliary_device_uninit(), causing subsequent code to dereference a freed and nullified auxr_dev pointer. Local users with limited privileges can trigger kernel panic (denial of service) by inducing auxiliary device initialization failure. EPSS score of 0.02% reflects low real-world exploitation probability despite availability of vendor patches in stable branches 6.19.14 and 7.0.1.

Denial of service via out-of-bounds string lookup in Linux kernel ALSA fireworks driver allows local authenticated users to crash the system by supplying an invalid status value from a firewire device. The vulnerability stems from insufficient bounds checking on a 32-bit status field before array indexing into a 17-entry string table, enabling memory access violations when the device reports unexpected values including EFR_STATUS_INCOMPLETE (0x80000000).

Memory leak in the Linux kernel ksmbd SMB server subsystem allows pre-authenticated remote clients to exhaust kernel memory by repeatedly sending malformed SPNEGO/ASN.1 BER blobs. The ksmbd_decode_negTokenInit() function allocates a mechToken buffer mid-parse via kmemdup_nul(), but if a subsequent element in the same blob is malformed (e.g., mechListMIC[3] overrunning its enclosing SEQUENCE), the decoder fails and clears use_spnego, causing the cleanup gate at smb2_sess_setup() to skip kfree() - leaking the allocation. No public exploit code has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), consistent with a slow-burn DoS rather than an immediately weaponizable condition.

Kernel oops and denial of service in the Linux kernel USB gadget HID driver (`f_hid`) occurs when `cdev_init` reinitializes an in-use character device during a USB gadget unbind/rebind cycle while `/dev/hidg*` remains open. A local attacker with low privileges who holds a file descriptor to `/dev/hidg0` open during a rebind operation can trigger a kernel oops, crashing the affected system. No public exploit exists and EPSS probability is 0.02% (5th percentile), indicating negligible exploitation interest; however, patched kernel versions are available across multiple stable branches.

Resource leak in the Linux kernel rtw88 USB WiFi driver allows a local attacker with low privileges to cause system availability degradation by triggering repeated probe failures that leave unreleased USB device references. The driver increments the USB device reference count during probe but fails to decrement it on all error exit paths - specifically when descriptor parsing fails - resulting in CWE-401 reference leaks that accumulate over time. No public exploit exists and EPSS is at the 6th percentile (0.02%), indicating negligible exploitation probability; the real-world impact is constrained to systems with Realtek rtw88 USB WiFi adapters.

Division-by-zero in the sm750fb staging framebuffer driver allows a local low-privileged user to crash the kernel. By submitting a FBIOPUT_VSCREENINFO ioctl with pixclock set to zero, an attacker triggers an unvalidated division in ps_to_hz(), called from hw_sm750_crtc_set_mode(), resulting in a kernel panic and full denial of service. No public exploit code has been identified and EPSS is 0.02% (5th percentile), consistent with a locally-reachable, hardware-dependent crash with no remote or confidentiality impact.

Kernel panic in the Linux xe/vfio driver causes a denial-of-service when a reset is triggered on SR-IOV Virtual Function (VF) devices that do not support live migration. The xe_vfio_pci_core_device struct members required by reset handling are only initialized during migration setup, leaving them NULL for non-migration VFs; writing to the sysfs reset attribute of such a VF dereferences the uninitialized pointer and crashes the kernel. No public exploit has been identified, EPSS is 0.02% (5th percentile), and exploitation requires a narrow hardware and configuration prerequisite - Intel Xe GPU with SR-IOV and VFIO passthrough enabled.

Kernel panic in the Linux pci-epf-vntb driver allows a local low-privileged user to crash the system by triggering a race between the delayed cmd_handler work queue and the epf_ntb_epc_cleanup teardown path. When cleanup frees BAR mappings and doorbells without first canceling the pending work, the handler subsequently dereferences invalid virtual addresses and produces a fatal kernel oops. Affected systems are limited to those with PCIe NTB endpoint hardware and the pci_epf_vntb module loaded; no public exploit exists and EPSS is 0.02%, reflecting negligible exploitation probability.

Kernel crash (oops) in the Linux PCI endpoint virtual NTB (pci-epf-vntb) driver allows a local user with limited privileges to trigger a use-after-free via configfs symlink operations. The driver's epf_ntb_epc_destroy() helper performs resource teardown that duplicates what the caller later executes, causing a double-free that dereferences a kernel poison pointer (0xDEAD000000000108) and crashes the system. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.02% (4th percentile), and impact is purely availability - confidentiality and integrity are not affected.

Host kernel panic in Linux KVM's AMD SEV-SNP subsystem allows a local attacker with KVM device access to crash the host by issuing a VMSA synchronization ioctl after a vCPU has already been launched and its VMSA encrypted. On SNP-enabled hosts, this write access violates the Reverse Map Table (RMP) hardware protection, producing an unrecoverable RMP page fault that panics the host kernel and terminates all co-located guest VMs simultaneously. No public exploit or active exploitation has been identified; vendor-released patches are available for stable kernel series 6.12.83, 6.18.24, 6.19.14, and 7.0.1.

State corruption and memory leak in the Linux kernel's vidtv virtual DVB test driver allow a local low-privileged user to cause kernel memory exhaustion. When vidtv_start_streaming() fails inside vidtv_start_feed(), the nfeeds counter is incremented but never rolled back, desynchronizing driver state so that subsequent start calls skip mux initialization and stop calls exit early without freeing partially allocated mux and channel resources. No public exploit exists and EPSS is 0.02% (5th percentile), reflecting the niche nature of the affected test driver component.

Race condition in the Linux kernel's userfaultfd hugetlb path allows a local low-privilege user to crash the kernel by triggering a BUG_ON assertion in resv_map_release(). The root cause is a unit mismatch in mfill_atomic_hugetlb(): linear_page_index() returns a PAGE_SIZE-unit index while hugetlb_fault_mutex_hash() expects a huge-page-granularity index, causing concurrent fault threads within the same huge page to acquire different mutexes and corrupt the reservation map. No public exploit has been identified and EPSS is 0.02% (4th percentile), placing real-world risk firmly in the low tier despite reliable kernel crash reproducibility under the right conditions.

Timer interrupt starvation in the Linux kernel clockevents subsystem results from the `next_event_forced` flag not being reset across three distinct code paths: clock event state transitions (shutdown/startup), non-forced event arming when a far-future event follows, and the suspend wakeup handler. This stale flag prevents timer rearming and causes system stalls, confirmed by multiple user reports. The vulnerability carries a CVSS 5.5 (Medium) score, is not listed in CISA KEV, and EPSS rates it at 0.02% (5th percentile), placing it firmly in the reliability-defect category rather than active exploitation risk. Patch commit 9401b593fa48218d2667df1610b0ebc518554880 is available in Linux 7.0.1.

Kernel panic in the Linux hantro_vpu media driver (verisilicon subsystem) allows a local low-privileged user to crash the system by triggering a device probe deferral or unbind-bind cycle on affected NXP i.MX8MQ hardware. The root cause is an incorrect __initconst annotation on the imx8mq_vpu_shared_resources array, which causes the kernel to free that data after module initialization while variant structures retain a live pointer to it; subsequent probe calls dereference freed memory and fault. No public exploit or PoC exists and this CVE is not in CISA KEV; the EPSS score of 0.02% (5th percentile) confirms negligible real-world exploitation probability.

NULL pointer dereference in the Linux kernel's i2c:designware:amdisp driver exposes AMD ISP-equipped systems to a local denial-of-service via a race condition between runtime PM resume and driver probe. The race exists because pm_runtime_get_sync() called before i2c_dw_probe() triggers PM resume, which powers on the ISP and simultaneously invokes the amdisp i2c runtime resume callback before probe initialization is complete - dereferencing an uninitialized pointer and causing a kernel panic. The flaw predates its detection but became reproducible in kernel v7.0 after commit 38fa29b01a6a reorganized init functions; no public exploit identified at time of analysis.

State ordering regression in the Linux kernel's drm/i915 Intel graphics driver causes unlink_nv12_plane() to clobber plane state already computed by plane_atomic_check(), resulting in a kernel WARN and availability disruption on systems with Intel i915 GPUs. The flaw affects local users with DRM device access who configure a plane previously used as an NV12 Y plane back to a normal plane. No public exploit exists and EPSS sits at 0.02% (4th percentile), confirming this as a low-probability exploitation scenario; however, the patch is available across multiple stable kernel branches.

Spurious WARN_ON() in the Linux kernel's PM sleep subsystem (pm_restore_gfp_mask()) can be triggered by defensive hibernation code paths, causing kernel warning floods or, on systems with panic_on_warn=1, a full kernel panic and denial of service. Affected kernels contain commit 35e4a69b2003f introducing refcount-based GFP mask stacking but lack the corrective fix removing the assertion from the zero-count guard. No active exploitation confirmed (not in CISA KEV), and EPSS is 0.02% (4th percentile), consistent with a low-risk code-quality defect rather than a targeted vulnerability.

Deadlock in the Linux kernel's RDMA/irdma subsystem (CVE-2026-31565) causes an indefinite system hang when a netdev reset is performed on Intel ice Ethernet hardware while active RDMA/iWARP applications hold Queue Pair connections. The ice driver's removal of the irdma auxiliary driver triggers a circular dependency: uverbs_client waits for QP reference count to reach zero while cma_client holds the final reference in iWARP mode, neither releasing first. No public exploit has been identified at time of analysis; an EPSS of 0.02% (7th percentile) and absence of CISA KEV listing confirm this is currently a low exploitation-priority issue concentrated in HPC and data center environments with Intel RDMA hardware.

Pointer arithmetic type confusion in the Linux kernel's LoongArch KVM EIOINTC register access handler allows a local low-privileged attacker to crash the host kernel. The function kvm_eiointc_regs_access() stores the register array base address as a u64 rather than a void pointer, causing byte offsets to be scaled incorrectly during address calculation and producing out-of-bounds memory accesses that result in a kernel panic. No public exploit code exists and EPSS sits at 0.02%, consistent with the narrow LoongArch KVM attack surface; the vulnerability is not listed in CISA KEV.

Missing lock release in the Linux kernel's XFS quota scrub subsystem allows a local, low-privileged user to trigger a dquot lock leak that can cause deadlocks in subsequent quota operations. The flaw exists in xchk_quota_item, which can exit early after xchk_fblock_process_error without releasing dq->q_qlock. This denial-of-service condition affects kernels from the introducing commit 7d1f0e167a06 through the respective stable branch fix points; no public exploit exists and EPSS is at the 5th percentile, indicating low real-world exploitation probability.

Stale pointer dereference in the Linux kernel's futex Priority Inheritance lock path (futex_lock_pi(), kernel/futex/core.c) exposes systems running affected kernel versions to local denial of service by low-privileged users. The flaw manifests in a three-way race between a PI futex owner exiting, a concurrent FUTEX_LOCK_PI attempt, and a futex value modification - causing a freed task_struct pointer to be re-used on the retry path, violating the wait_for_owner_exiting() invariant and triggering WARN_ON_ONCE. No active exploitation is confirmed (EPSS 0.02% at 7th percentile, not in CISA KEV); vendor-released patches are available across all maintained stable LTS branches.

Race condition in the Linux kernel's mac80211 WiFi subsystem allows a local low-privileged attacker to trigger a static_branch_dec() integer underflow via concurrent writes to the AQL debugfs control file, causing a kernel WARNING and potential availability impact. Affected kernels span from the introduction of the aql_disable static key (v5.12) through multiple stable branches, with fixes backported to 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10, and 7.0. EPSS is 0.02% (7th percentile) and no active exploitation is recorded in CISA KEV, placing this firmly in the low-real-world-risk category despite its availability impact.

Insufficient ASB polling timeout in the Linux kernel's bcm2835-power pmdomain driver intermittently fails to complete the V3D AXI Slave Bridge handshake on BCM2711 hardware during runtime PM suspend, leaving the VideoCore 3D GPU in a broken power state. Systems running intensive V3D workloads on BCM2711 (e.g., Raspberry Pi 4) may subsequently experience bus faults or full system hangs on later GPU accesses. No public exploit code exists and EPSS is 0.02% (7th percentile), consistent with a hardware-specific reliability defect rather than a broadly exploitable security attack; the vulnerability is not in CISA KEV.

Missing runtime power management reference in the Linux kernel's Intel Xe GPU driver (drm/xe) allows a local low-privileged user to trigger a kernel WARNING and cause system instability via the ccs_mode sysfs attribute. When ccs_mode_store() invokes xe_gt_reset() without first acquiring an outer runtime PM reference, the internal xe_pm_runtime_get_noresume() call detects the unprotected state and emits a kernel WARNING, with potential for device reset failures and availability loss. No public exploit code exists and EPSS is 0.02%, consistent with a driver correctness bug rather than a targeted security vulnerability; patches are available in stable kernel trees.

The NXP-NCI NFC driver in the Linux kernel triggers a kernel WARN_ON and fails to operate correctly when firmware and enable GPIOs are routed through I2C GPIO expanders, causing denial of service to NFC subsystem functionality on affected hardware. Systems running kernel versions from 5.4 through pre-patch releases across multiple stable branches are affected when using NXP NCI NFC chipsets with I2C-connected GPIO expanders. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit code identified at time of analysis, this is a low-risk operational reliability defect relevant primarily to embedded and IoT deployments.

Denial of service in Linux kernel x86/platform/uv module when sockets are deconfigured, causing kernel panic during UV hub info structure allocation on systems with SGI UV architecture. Affects authenticated local attackers with standard user privileges. Vendor-released patches available for multiple kernel versions (6.6.130, 6.12.78, 6.18.20, 6.19.10 and others). EPSS score of 0.02% indicates exploitation is unlikely in typical environments despite low CVSS score barrier.

Denial of service in Linux kernel SMB server implementation allows local authenticated users to crash the system by triggering data stream corruption through improper credit management in smbdirect socket operations. The vulnerability affects kernel versions prior to 6.18.11, 6.19.1, and 7.0, and requires local access with limited privileges to exploit.

A race condition in the Linux kernel SMB client's recv_io credit management allows local authenticated users to cause a denial of service through timing-sensitive credit accounting between incoming data reception and completion processing. The vulnerability affects SMBDirect socket credit handling where credits may be granted to peers before corresponding recv buffers are actually posted, creating a window where credit accounting becomes inconsistent. Exploitation requires local access and moderate complexity but is not confirmed as actively exploited (not listed in CISA KEV).

Apache Airflow versions prior to 3.2.1 allow authenticated users with read access to at least one directed acyclic graph (DAG) to enumerate and discover the names and existence of all other DAGs and assets in the deployment, regardless of their assigned permissions. This information disclosure vulnerability enables privilege escalation reconnaissance by revealing the complete asset topology to users with limited scope authorization. The vulnerability requires valid user credentials but no elevated privileges, and has no known public exploit code at time of analysis.

Apache Airflow versions prior to 3.2.1 fail to enforce per-DAG access control on the /ui/dags endpoint, allowing authenticated users with read access to at least one DAG to retrieve Human-in-the-Loop prompts and full TaskInstance details for DAGs outside their authorized scope. This information disclosure bypasses the intended per-DAG RBAC boundary, exposing operator parameters and task context data to all authenticated users regardless of their assigned DAG permissions.

Heap over-read in OVN's ICMP error response generation allows remote attackers to leak sensitive memory contents, causing information disclosure and potential denial of service. The vulnerability affects OVN versions prior to the 2026 security update, exploitable over the network without authentication or user interaction via crafted ICMP packets. No public exploit code has been identified, but the attack vector is network-accessible with high complexity requirements.

Out-of-bounds read in libXpm's xpmNextWord() parser function can be triggered by a local attacker with low privileges, crashing any X11 application that processes a maliciously crafted XPM image file, resulting in a denial of service. The vulnerability was disclosed via the oss-security mailing list on 2026-04-21 by X.Org and is tracked under CWE-125. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score was not provided in available intelligence.

Liaison Site Prober plugin for WordPress allows unauthenticated attackers to retrieve sensitive audit log data including IP addresses, user IDs, usernames, and login events through an improperly secured REST API endpoint (/wp-json/site-prober/v1/logs) in all versions up to 1.2.1. The vulnerability stems from a permission callback that unconditionally returns true without validating user capabilities, enabling information disclosure with network-level access and no authentication required. No public exploit code or active exploitation has been identified at time of analysis.

HubSpot All-In-One Marketing plugin for WordPress (versions up to 11.3.32) exposes sensitive information via the class-adminconstants.php file, allowing authenticated users with Contributor-level access or higher to retrieve a complete list of installed plugins and their versions. This information disclosure enables reconnaissance for follow-on attacks targeting vulnerable plugins, though exploitation requires valid WordPress authentication and contributor-level privileges.

Improper session lifetime enforcement in SenseLive X3050's web management interface allows attackers with access to a previously authenticated session to maintain administrative access without re-authentication, potentially enabling unauthorized configuration changes or information disclosure. The vulnerability affects the product's session management mechanism, permitting extended session validity beyond legitimate user activity windows. CVSS 6.9 indicates moderate risk; exploitation requires prior session compromise but no special configuration.

Information disclosure in Canon production printers and office/small office multifunction printers allows authenticated administrators to access sensitive device information through crafted requests to the browser-based remote management interface. The vulnerability affects multiple printer models and requires high-privilege administrative access; no active exploitation has been confirmed at time of analysis, though the remote network vector and low attack complexity indicate practical exploitability by privileged internal users.

SenseLive X3050 web management interface transmits all administrative communication including authentication credentials and configuration data over unencrypted HTTP, allowing network-adjacent attackers to intercept sensitive operational information without authentication or user interaction. The vulnerability affects all versions of the X3050 and is classified as information disclosure with confirmed CISA ICS advisory coverage.

Approval integrity bypass in OpenClaw's pnpm dlx command-planning path (all versions up to 2026.4.1) allows a low-privileged local attacker to replace an approved local script between the approval decision and actual execution, running arbitrary code under a still-valid approval plan. The root cause is a TOCTOU flaw (CWE-367): unlike the parallel pnpm exec flow, pnpm dlx did not bind local script operands into the approval plan's mutable-file tracking, leaving the script file unmonitored after approval. No active exploitation is confirmed (EPSS 0.01%, SSVC exploitation: none), though SSVC rates technical impact as total given full C/I/A exposure on the vulnerable system.

Environment variable leakage in OpenClaw (npm package, versions ≤2026.3.28) occurs because SSH-based sandbox backends pass the full unsanitized Node.js `process.env` object to SSH child processes, potentially exposing secrets such as API keys or credentials stored in the parent process environment. Exploitation is gated behind two non-default prerequisites: the SSH-based sandbox backend must be in use, and SSH environment variable forwarding must be enabled in the host's SSH daemon configuration. No active exploitation or public exploit code has been identified; EPSS sits at 0.01% (1st percentile) and SSVC rates exploitation as none, consistent with the vendor's own triage of this as a narrow, low-severity issue.

Silent message suppression in OpenClaw's Zalo webhook integration allows deduplicate key collisions across distinct conversations and senders, causing legitimate bot events to be silently dropped. All OpenClaw npm installations prior to version 2026.4.2 are affected via CPE cpe:2.3:a:openclaw:openclaw. An unauthenticated network attacker who can send or replay Zalo webhook events with a predictable message_id can cause cross-chat or cross-sender deduplication collisions, disrupting bot workflows without any visible error. No public exploit has been identified at time of analysis; EPSS is 0.04% (11th percentile) and SSVC confirms no active exploitation.

OpenClaw npm package versions up to and including 2026.3.28 leaks Authorization headers to attacker-controlled servers by forwarding them intact across cross-origin HTTP redirects during media downloads. An attacker who can induce a victim's OpenClaw instance to fetch a media URL that redirects cross-origin - to an attacker-controlled host - receives the victim's full Authorization bearer token. No public exploit or CISA KEV listing exists; EPSS of 0.03% (9th percentile) and SSVC exploitation status of 'none' indicate low current exploitation activity, though the credential-theft impact class is high for any user whose authorization tokens are intercepted.

Resource exhaustion in OpenClaw npm package versions up to 2026.3.28 allows remote unauthenticated attackers to degrade availability of the LINE webhook integration by flooding the endpoint with concurrent requests before signature verification occurs. The CVSS 4.0 score of 6.9 reflects network-accessible, zero-privilege exploitation with bounded low availability impact; the vendor's own triage classifies severity as low due to the transient, non-persistent nature of the disruption. No public exploit code exists and no active exploitation is confirmed - SSVC marks exploitation status as none, though the attack is rated automatable.