Information Disclosure

The BitFire Security - Firewall, WAF, Bot/Spam Blocker, Login Security plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.5 via the bitfire_*. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Partner Software's Partner Software Product and corresponding Partner Web application use the same default username and password for the administrator account across all versions. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Partner Software's Partner Software application and Partner Web application do not sanitize files uploaded on the "reports" tab, allowing an authenticated attacker to upload a malicious file and. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Rated low severity (CVSS 2.8), this vulnerability is low attack complexity. No vendor patch available.

Cursor is a code editor built for programming with AI. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. Rated critical severity (CVSS 9.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available.

Vault and Vault Enterprise (“Vault”) TLS certificate auth method did not correctly validate client certificates when configured with a non-CA certificate as [+trusted. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Vault and Vault Enterprise’s (“Vault”) TOTP Secrets Engine code validation endpoint is susceptible to code reuse within its validity period. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A timing side channel in Vault and Vault Enterprise’s (“Vault”) userpass auth method allowed an attacker to distinguish between existing and non-existing users, and potentially enumerate valid. Rated low severity (CVSS 3.7), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

uploadsm in ChargePoint Home Flex 5.5.4.13 does not validate a user-controlled string for bz2 decompression, which allows command execution as the nobody user. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

Institute-of-Current-Students 1.0 is vulnerable to Incorrect Access Control in the mydetailsstudent.php endpoint. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

A flaw was found in the Linux kernel's ksmbd component. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required.

Insecure permissions in LangChain-ChatGLM-Webui commit ef829 allows attackers to arbitrarily view and download sensitive files via supplying a crafted request. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

jose v6.0.10 was discovered to contain weak encryption. Rated high severity (CVSS 7.0), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Hangzhou Shunwang Rentdrv2 before 2024-12-24 allows local users to terminate EDR processes and possibly have unspecified other impact via DeviceIoControl with control code 0x22E010, as exploited in. Rated low severity (CVSS 3.2), this vulnerability is low attack complexity. No vendor patch available.

It was discovered that uscan, a tool to scan/watch upstream sources for new releases of software, included in devscripts (a collection of scripts to make the life of a Debian Package maintainer. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The IDonate - Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the admin_donor_profile_view(). Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Rejected reason: Not used. No vendor patch available.

Quantum SuperLoader 3 V94.0 005E.0h devices allow attackers to access the hardcoded fa account because there are only 65536 possible passwords. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Sensitive information disclosure in AVer PTC310UV2 professional PTZ tracking camera firmware version 0.1.0000.59 allows a remote, unauthenticated attacker to retrieve confidential data by sending a specially crafted request to the device. The flaw (CWE-200) carries a high CVSS 8.1 and has publicly available exploit code (GitHub weedl/CVE-2025-45620), though it is not listed in CISA KEV and EPSS remains low at 0.96% (57th percentile), indicating no confirmed widespread exploitation yet.

Denial of service via mount namespace privilege escalation in Linux kernel allows local authenticated users to crash the system by changing propagation settings on mounts outside their namespace. The do_change_type() function in the mount subsystem failed to validate that mounts belong to the caller's namespace, enabling unprivileged users with local access to trigger an availability impact. CVSS 5.5 reflects local authentication requirement and denial of service scope; EPSS 0.04% indicates low real-world exploitation probability despite the vulnerability being patched upstream.

Out-of-bounds read in Apple Safari and system WebKit implementations allows local attackers to disclose internal application state by processing maliciously crafted web content, affecting Safari 18.5 and earlier, iOS 18.5 and earlier, iPadOS 18.5 and earlier, macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. The vulnerability requires local access and user interaction but poses information disclosure risk with CVSS 4.0 and EPSS 0.02% (very low exploitation probability); no public exploit code or active exploitation has been identified.

Improper sandbox enforcement in macOS allows local applications to read files outside their designated sandbox boundaries without user authorization. The vulnerability affects macOS Sequoia before 15.6, macOS Sonoma before 14.7.7, and macOS Ventura before 13.7.7. An attacker controlling a sandboxed application can bypass file access restrictions through a permissions validation flaw, enabling confidentiality breaches of user data outside the app's intended scope. No public exploit code or active exploitation has been confirmed; the EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite the medium CVSS rating.

Safari and macOS contain a logic flaw that allows incorrect association of a download's origin, potentially disclosing information about file provenance to local attackers. The vulnerability affects Safari 18.6 and earlier, plus macOS Sequoia 15.6 and earlier, and requires local access (no authentication needed) to exploit. This is a low-exploitation-probability issue (EPSS 0.03%) with no confirmed active exploitation or public POC at time of analysis.

Insufficient permission checks in Apple operating systems allow local apps to access user-sensitive data without proper authorization. The vulnerability affects iOS 18.5 and earlier, iPadOS 18.5 and earlier (and iPadOS 17.7.8 and earlier), macOS Sequoia 15.5 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. An unprivileged local application can exploit this to read sensitive user information by circumventing the permission model. No public exploit code has been identified at time of analysis, and EPSS scoring (0.02%, 4th percentile) indicates very low real-world exploitation probability despite the information disclosure impact.

Information disclosure vulnerability in WebKit across Apple's ecosystem allows unauthenticated remote attackers to extract sensitive user information through maliciously crafted web content. The flaw affects Safari 18.x, iOS/iPadOS 18.x, macOS Sequoia 15.x, tvOS 18.x, visionOS 2.x, and watchOS 11.x, stemming from improper state management (CWE-359). Despite a CVSS score of 7.5, real-world exploitation risk remains relatively low with 0.13% EPSS probability and no public exploit identified at time of analysis. Vendor-released patches are available across all affected platforms.

Out-of-bounds memory read in Apple's image processing component allows local attackers without privileges to disclose sensitive process memory by supplying a maliciously crafted image, affecting iOS 18.5 and earlier, iPadOS 17.7.8 and earlier, macOS Sequoia 15.5 and earlier, macOS Sonoma 14.7.6 and earlier, tvOS 18.5 and earlier, visionOS 2.5 and earlier, and watchOS 11.5 and earlier. No public exploit code or active exploitation has been identified; exploitation requires local access and user interaction to process the malicious image. The EPSS score of 0.02% (5th percentile) indicates minimal real-world exploitation likelihood despite the broad platform impact.

Local apps can access sensitive user data through inadequate log redaction in iPadOS and macOS, allowing information disclosure when a user interacts with a malicious application. Apple has released patches for iPadOS 17.7.9 and macOS versions 15.6 (Sequoia), 14.7.7 (Sonoma), and 13.7.7 (Ventura) that implement improved data redaction in logging. The EPSS score of 0.01% and absence of public exploit code indicate low real-world exploitation likelihood despite moderate CVSS scoring.

Privacy indicator bypass in Apple iOS and iPadOS allows local attackers to determine microphone or camera access without user notification. The vulnerability affects iOS 18.6 and earlier, and iPadOS 17.7.9 and earlier, enabling unauthorized monitoring of privacy-sensitive device activity. Apple has released patched versions (iOS 18.6, iPadOS 18.6, and iPadOS 17.7.9) that add logic to correctly display privacy indicators when microphone or camera access occurs. EPSS exploitation probability is very low at 0.02%, and no public exploit code has been identified.

Path traversal vulnerability in macOS allows local applications to bypass directory path validation and access protected user data without authentication. Affecting macOS Ventura, Sonoma, and Sequoia, the flaw stems from improper path parsing that enables an unprivileged app to read sensitive files outside intended boundaries. Apple has released patches for all affected versions (Ventura 13.7.7, Sonoma 14.7.7, Sequoia 15.6); exploitation requires local access and app execution capability, resulting in low real-world risk despite moderate CVSS score.

Applications on Apple operating systems can fingerprint users through a permissions flaw that bypasses privacy restrictions. Affects macOS Ventura 13.x, Sonoma 14.x, Sequoia 15.x, and iPadOS 17.x with patches released in versions 13.7.7, 14.7.7, 15.6, and 17.7.9 respectively. CVSS 9.8 critical severity contradicts the low EPSS score (0.07%, 22nd percentile) and information disclosure nature, suggesting scoring misalignment. No public exploit identified at time of analysis, but the low technical barrier (network accessible, no authentication required per CVSS vector) makes this concerning for privacy-focused environments despite the limited impact scope of user fingerprinting.

Unauthenticated sensitive information disclosure in Grandstream UCM6510 unified communications appliances (firmware v.1.0.20.52 and earlier) exposes data via the Login function at the /cgi and /webrtccgi CGI endpoints. The CVSS vector (PR:N/UI:N/AV:N) confirms exploitation requires no authentication or user interaction from any network position. A public proof-of-concept is available on GitHub; EPSS is low at 0.40% (32nd percentile) suggesting limited opportunistic scanning activity to date, but internet-exposed deployments are concretely at risk from targeted reconnaissance.

Unlimited brute-force authentication attempts against Grandstream UCM6510 IP PBX firmware v1.0.20.52 and earlier allow unauthenticated network attackers to enumerate and compromise user accounts through credential stuffing or dictionary attacks. The device imposes no rate limiting, lockout, or CAPTCHA mechanism on login attempts (CWE-307), making full account takeover feasible against any account with a weak or guessable password. No public exploit confirmation via CISA KEV exists, though a researcher-published GitHub gist documents the issue and EPSS sits at a low 0.28% (20th percentile), suggesting limited observed exploitation at this time.

SQL injection in Z-Push IMAP backend allows unauthenticated remote attackers to access, modify, or delete data in linked third-party databases via malicious username values in basic authentication headers. Exploitation requires non-default IMAP_FROM_SQL_QUERY configuration. Publicly available exploit code exists (GitHub PR #161 demonstrates the vulnerability). CVSS 7.9 with network attack vector and no authentication required, though attack complexity increases due to the specific configuration prerequisite. Affects Z-Push versions before 2.7.6.

Session hijacking in PHPGurukul Car Rental Project v3.0 stems from the /carrental/update-password.php endpoint failing to invalidate existing sessions after a password change, allowing an attacker who has captured or been handed a valid session identifier to retain authenticated access even after the victim resets credentials. Publicly available exploit code exists (GitHub), but the issue is not in CISA KEV, and EPSS is modest at 0.40% (32nd percentile), indicating no evidence of widespread automated exploitation. Confidence is reduced by conflicting source metadata (see confidence notes).

Session hijacking in PHPGurukul Online Course Registration v3.1 stems from the /crm/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who has captured or replayed a victim's session identifier retain authenticated access even after the credential is rotated. Publicly available exploit code exists (GitHub), but the flaw is not listed in CISA KEV and carries a low EPSS score of 0.40% (32nd percentile), indicating limited observed exploitation. The issue chiefly threatens confidentiality of the affected user's CRM account.

DNS resolve confusion in netavark, the Rust-based network stack for Podman containers, causes container name lookups to be forwarded to unexpected external DNS servers due to a regression that removed the dns.podman search domain. Affected deployments on Red Hat Enterprise Linux 8/9/10 and OpenShift Container Platform 4.0 running netavark < 1.15.1 are subject to misdirected container DNS resolution when host resolv.conf search domains contain a record matching a running container's hostname. The impact is limited to information disclosure (CVSS 3.7, Low), with no confirmed active exploitation and no public exploit identified at time of analysis.

Session hijacking in PHPGurukul Blood Bank & Donor Management System v2.4 stems from the /bbdms/change-password.php component failing to invalidate existing sessions after a password change, letting an attacker who obtains or captures a valid session token retain authenticated access even after the victim rotates credentials. Publicly available exploit code exists (GitHub, VasilVK), though the flaw is not listed in CISA KEV and carries a low EPSS score of 0.32% (24th percentile), indicating no evidence of widespread automated exploitation. The issue primarily threatens confidentiality of donor and blood-bank records in this niche PHP application.

Session hijacking in PHPGurukul Small CRM v3.0 stems from improper session invalidation in /crm/change-password.php, where existing session tokens are not revoked after a password change, letting an attacker who obtains or retains a valid session ID continue accessing the victim's authenticated account. Public exploit code exists (GitHub PoC by VasilVK), though there is no confirmed active exploitation (not in CISA KEV) and EPSS probability is low at 0.32% (24th percentile). Impact is primarily confidentiality of CRM data with limited integrity effect.

Session hijacking in PHPGurukul e-Diary Management System v1.0 stems from the /edms/change-password.php endpoint failing to invalidate existing sessions after a password change, so a previously captured session identifier remains valid and grants continued authenticated access. Remote attackers who obtain a victim's session token can therefore retain or take over the account even after the legitimate user rotates their password. There is no CISA KEV listing and no confirmed active exploitation; a GitHub reference (VasilVK/CVE) tracking this CVE likely contains a proof-of-concept or write-up, though PoC status is not explicitly confirmed in the source data, and EPSS is low at 0.55% (42nd percentile).

Session hijacking in PHPGurukul Bank Locker Management System v1.0 lets remote attackers reuse valid session tokens because the /banker/change-password.php component fails to invalidate existing sessions after a password change. Any session token captured before the change (via a shared machine, network capture, or referrer/log leakage) remains usable, letting an attacker impersonate the banker account. A GitHub reference (VasilVK/CVE) is published for this issue, and EPSS risk is low at 0.34% (27th percentile) with no active exploitation reported.

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from the /srms/change-password.php component failing to invalidate existing sessions after a password change, so an attacker holding a previously captured session token retains authenticated access even after the victim rotates their credentials. Publicly available exploit code exists on GitHub, though the flaw is not listed in CISA KEV and carries a modest EPSS score of 0.62% (45th percentile), indicating low observed exploitation activity. The vulnerability primarily undermines the account-recovery security guarantee that changing a password should terminate compromised sessions.

Session hijacking in PHPGurukul Online Library Management System v3.0 stems from improper session invalidation in /library/change-password.php, where sessions are not properly terminated after credential changes, allowing an attacker who obtains or reuses a still-valid session token to impersonate a victim. Publicly available exploit code exists (GitHub, VasilVK), though there is no public exploit identified as actively exploited in the wild and it is not listed in CISA KEV. EPSS is low at 0.39% (31st percentile), indicating limited predicted mass-exploitation activity despite the available POC.

Session hijacking in PHPGurukul Car Washing Management System v1.0 allows attackers to retain or reuse a doctor account session because the /doctor/change-password.php component fails to invalidate existing sessions after a credential change, publicly available exploit code exists (per the referenced GitHub PoC), though EPSS estimates only a 0.50% exploitation probability and the issue is not on CISA KEV. No public exploit identified as actively used in the wild; the flaw affects only the single unpatched v1.0 release of this niche PHP application.

Session hijacking in PHPGurukul Doctor Appointment Management System v1.0.0 stems from improper session invalidation in /doctor/change-password.php, where doctor account sessions are not terminated after a password change. A publicly available exploit code exists (GitHub, VasilVK), but there is no public exploit identified as actively exploited and it is not in CISA KEV. EPSS is low at 0.41% (33rd percentile), indicating limited real-world exploitation interest to date.

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.

Improper export of Android application components in bsc Peru Cocktails App 1.0.0 allows local authenticated attackers to access unexported activities, services, or broadcast receivers defined in AndroidManifest.xml, leading to information disclosure. The vulnerability has been publicly disclosed with exploit code available, though real-world risk is minimal given the low CVSS score (1.9) and EPSS exploitation probability (0.02%), indicating this affects only authenticated users with local device access and results in limited confidentiality impact.

Privilege escalation in Beamsec PhishPro before version 7.5.4.2 allows authenticated low-privileged users to abuse privileged API calls, resulting in full confidentiality, integrity, and availability compromise (CVSS 8.8). The root cause is CWE-648 (Incorrect Use of Privileged APIs), meaning the application exposes or incorrectly gates privileged API operations that low-privileged users can invoke directly. No public exploit exists at time of analysis, and EPSS sits at 0.25% (49th percentile), but the network-accessible, low-complexity attack path warrants prioritized remediation for any internet-facing PhishPro deployment.

A race condition in the Linux kernel's MPTCP (Multipath TCP) protocol implementation allows local attackers with limited privileges to trigger a kernel warning and denial of service by causing non-atomic fallback decisions and actions during connection establishment. The vulnerability (CWE-667: Improper Locking) arises from unsynchronized access to fallback state in mptcp_do_fallback() when processing incoming TCP options, enabling a local user to crash the system or hang connections via crafted MPTCP packets. EPSS score of 0.03% indicates low real-world exploitation probability despite moderate CVSS impact severity.

A race condition in the Linux kernel's net/sched sch_qfq module allows local authenticated attackers to cause denial of service through NULL pointer dereference or use-after-free errors when concurrent threads modify queue aggregation structures during packet scheduling. The vulnerability requires low privileges and has a low real-world exploitation probability (EPSS 0.02%), though a vendor patch is available.

Use-after-free in Linux kernel TLS implementation allows local authenticated users to achieve high confidentiality, integrity, and availability impact through memory corruption. The vulnerability, triggered by aggressive TCP SKB compaction in net-next, causes TLS to operate on freed socket buffers when checking decrypt state. A vendor patch is available across multiple kernel versions (6.1-rc2 through 6.1-rc5 and later stable branches). No active exploitation confirmed, but CWE-416 use-after-free bugs are frequently targeted due to their code execution potential. EPSS data not provided.

Memory leak and refcount imbalance in Linux kernel VLAN 0 handling allows local attackers with low privileges to trigger denial of service via kernel panic when toggling the rx-vlan-filter feature at runtime on bonded or team interfaces. The vulnerability affects kernel versions 6.16-rc1 through rc3 and potentially earlier versions; vendor-released patches are available across affected stable branches.

Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.

Weak cryptographic hashing (CWE-327) in VaelsysV4's PHP web interface exposes sensitive information to authenticated remote attackers who can manipulate the xajaxargs parameter of /grid/vgrid_server.php. Affected versions span the 5.1.0 and 5.4.0 release lines; patched releases 5.1.1 and 5.4.1 are available. No public exploit identified at time of analysis per CISA KEV, but a public proof-of-concept exists, and the EPSS score of 0.03% confirms very limited real-world exploitation activity to date.

Cool Mo Maigcal Number App versions 1.0.0 through 1.0.3 on Android contain improper export of application components in AndroidManifest.xml, allowing local authenticated attackers to access sensitive functionality of the com.sdmagic.number component. While CVSS severity is minimal (1.9), publicly available exploit code exists; exploitation requires local device access and authenticated privileges but carries information disclosure impact.

Improper export of Android application components in Lobby Universe Lobby App versions 2.0 through 2.8.0 allows local attackers with user-level privileges to access sensitive functionality via the com.maverick.lobby component. The vulnerability stems from AndroidManifest.xml misconfiguration that exposes internal application activities without proper permission protection, enabling local privilege escalation or information disclosure. Publicly available exploit code exists, though exploitation requires local device access and authenticated user privileges.

ChanCMS up to version 3.1.2 permits information disclosure through improper validation of accessKey and secretKey parameters in the /sysApp/find endpoint, allowing authenticated remote attackers to access sensitive data. The vulnerability has a low CVSS score of 2.1 (CVSS:4.0/AV:N/AC:L/PR:L) reflecting limited confidentiality impact and requirement for low-privilege authentication, but publicly available exploit code exists and exploitation probability (EPSS 0.09%) is extremely low, suggesting this is a narrow-scope, low-urgency issue despite public disclosure.

Memory leak in GNU Binutils 2.44 DWARF section handler allows local authenticated users to consume memory resources, potentially leading to denial of service. The vulnerability exists in the process_debug_info function of binutils/dwarf.c and is triggered during DWARF debug information parsing. Publicly available exploit code exists, and a vendor patch has been released.

Improper export of Android application components in Yeelink Yeelight App up to version 3.5.4 allows local attackers with user-level privileges to access sensitive application functions through the AndroidManifest.xml configuration of the com.yeelight.cherry component. The vulnerability has a very low real-world impact (CVSS 1.9, EPSS 0.03%) despite public exploit availability, as exploitation requires local device access and user-level privileges, limiting practical attack scenarios to compromised or physically accessible devices.

Improper export of Android application components in Canara ai1 Mobile Banking App version 3.6.23 allows local attackers with user-level privileges to access sensitive exported components via AndroidManifest.xml misconfigurations. The vulnerability enables information disclosure with low confidentiality impact. Public exploit code exists but real-world exploitation risk is minimal (EPSS 0.03%, CVSS 1.9) due to requirement for local device access and authenticated user privileges.

Comodo Dragon up to version 134.0.6998.179 transmits sensitive DNS information in cleartext via its IP DNS Leakage Detector component, allowing remote attackers to intercept and read this data. The vulnerability has a low CVSS score of 2.9 (limited confidentiality impact) but is marked as having publicly available exploit code with difficult exploitation complexity. The vendor was notified but did not respond, and active exploitation is not confirmed despite public disclosure.

Comodo Dragon browser versions up to 134.0.6998.179 contain an HSTS Handler vulnerability that bypasses security checks for standard compliance, allowing remote attackers with user interaction to disclose sensitive information. The CVSS score of 1.3 reflects high attack complexity and limited integrity impact, but public exploit code is available and the vendor did not respond to early disclosure, leaving affected users without official patches.

Weak password requirements in Tenda AC18 firmware version 15.03.05.19 allow remote attackers to conduct brute-force attacks against Samba authentication via the /etc_ro/smb.conf configuration file. The vulnerability requires high attack complexity and has been publicly disclosed, though exploitation difficulty remains elevated. CVSS 2.9 and EPSS 0.07% (20th percentile) indicate low real-world risk despite proof-of-concept availability.

Remote root access in Gardyn Home Kit Firmware via SSH private key compromise allows authenticated remote attackers with high privileges to execute arbitrary commands as root on affected devices. The vulnerability stems from improper cryptographic key management (CWE-321) and carries a CVSS score of 6.6; no public exploit code or active exploitation has been independently confirmed at the time of analysis.

Linux kernel uprobes implementation allows local privileged users to cause denial of service by placing probes at invalid instruction boundaries, exploiting variable-length instruction decoding and mixing of data in text segments on architectures like ARM64. The vulnerability requires CAP_SYS_ADMIN capability, limiting exposure to privileged local attackers. Patch available across multiple stable kernel branches (6.16-rc1 through rc4 and earlier versions).

Integer wraparound in Linux kernel netlink socket receive buffer accounting allows local authenticated attackers to exhaust kernel memory by bypassing receive buffer limits via integer overflow in sk_rmem_alloc comparison. An attacker with local access can set SO_RCVBUFFORCE to INT_MAX, causing the receive buffer check to always evaluate false and permitting unlimited socket buffer allocation until out-of-memory conditions occur. CVSS 5.5 indicates local denial of service with potential system-wide impact; no active exploitation confirmed but vulnerability affects all Linux distributions.

Denial of service in Linux kernel traffic control (qdisc) subsystem allows local authenticated attackers to crash the system by creating or modifying queue disciplines with invalid parent class references. When certain qdiscs (fq, hhf, choke, etc.) invoke qdisc_tree_reduce_backlog during initialization with a null parent class, they trigger an unhandled null pointer dereference. No active exploitation confirmed (KEV not listed), but CVSS 5.5 reflects local privilege requirement with high availability impact.

A general protection fault (GPF) in the Linux kernel's md-bitmap module affects the bitmap_get_stats() function when reading bitmap statistics for RAID devices with external bitmaps. Local users with sufficient privileges can trigger a kernel panic by accessing bitmap statistics through the /proc interface, causing denial of service. The vulnerability stems from incomplete validation of bitmap storage configuration introduced by a prior fix that failed to properly check superblock validity for both internal and external bitmap modes.

Linux kernel DRM scheduler fails to signal scheduled fences when killing job entities, causing dependent applications to hang indefinitely waiting for unresolved dependencies. Authenticated local users can trigger this denial of service by terminating applications whose job dependencies are not properly cleared during entity kill operations. The vulnerability affects multiple Linux kernel versions and has been patched upstream.

Denial of service in Linux kernel nfsd (NFS server daemon) allows local authenticated attackers to crash the system by triggering undefined behavior in nfsd4_spo_must_allow() when non-v4 compound RPC requests are processed. The vulnerability stems from missing validation that incoming RPC procedures are NFSv4 COMPOUND requests before examining internal state structures, causing memory access violations and system unavailability.

Linux kernel NFS subsystem fails to clean up /proc/net/rpc/nfs directory when nfs_fs_proc_net_init() encounters a memory allocation failure, causing a warning when rpc_proc_exit() later attempts to remove the non-empty parent directory. The vulnerability affects kernel versions 6.16-rc1 through 6.16-rc3 and likely earlier versions, and requires local privileges to trigger via fault injection or memory pressure. While marked as availability impact (DoS via kernel warning), the practical severity is limited as it primarily causes a procfs resource leak rather than direct system compromise.

Race condition in Linux kernel NFSv4/pNFS layout draining allows local authenticated users to trigger denial of service through system hangs in writeback operations. The vulnerability exists in pnfs_update_layout() where a waiter on the NFS_LAYOUT_DRAIN bit can race with the waker when plh_outstanding count reaches zero, causing threads to block indefinitely on page locks. Patch available from upstream kernel stable branches.

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Firefox and Thunderbird URL truncation flaw enables spoofing attacks by displaying misleading origins in the address bar. Affects all Firefox versions prior to 141 and corresponding Thunderbird releases. Attackers can craft URLs that hide the true destination, tricking users into visiting malicious sites. Publicly available exploit code exists. CVSS 9.8 critical rating reflects network-based attack requiring no authentication, though real-world exploitation requires social engineering (user interaction despite UI:N vector).

Search term leakage in Mozilla Firefox and Thunderbird URL bars exposes sensitive user queries to unauthorized parties when URLs are shared or logged. Firefox versions prior to 141 (regular) and 140.1 (ESR), and Thunderbird versions prior to 141 (regular) and 140.1 (ESR) fail to properly clear search parameters from the URL bar after navigation, enabling information disclosure through shoulder surfing, screenshot sharing, browser history exports, or URL-based tracking. No public exploit identified at time of analysis, though the attack requires only user interaction (EPSS data not provided). CVSS 8.1 reflects high confidentiality and integrity impact despite requiring user interaction.

Frame navigation validation bypass in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to violate security boundaries due to improper path checking (CWE-345). Affects Firefox <141, Firefox ESR <140.1, Thunderbird <141, and Thunderbird ESR <140.1. The CVSS 9.8 critical score reflects network-based exploitation with no user interaction required, enabling potential unauthorized access, data manipulation, and service disruption. No public exploit identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) suggest straightforward exploitation once technical details emerge.

Cookie shadowing in Mozilla Firefox (versions prior to 141 and ESR prior to 140.1) and Thunderbird (versions prior to 141 and ESR prior to 140.1) allows remote unauthenticated attackers to bypass Secure cookie protections and access or modify session data. A nameless cookie containing an equals sign set over insecure HTTP can override cookies with the Secure attribute, enabling session hijacking or authentication bypass. No public exploit identified at time of analysis, though the attack complexity is low (CVSS AC:L) with network-based attack vector requiring no user interaction.

DNS rebinding attacks can bypass Cross-Origin Resource Sharing (CORS) protections in Mozilla Firefox and Thunderbird due to improper cache invalidation of CORS preflight responses when target IP addresses change. Remote attackers can exploit this via malicious websites to access confidential cross-origin data without user authentication (CVSS: PR:N, UI:R). No public exploit identified at time of analysis, though CERT VU#652514 provides technical disclosure. EPSS data not provided, but the combination of network-accessible attack vector, low complexity, and no required privileges warrants attention for organizations using affected Mozilla products.

WebAssembly JIT compiler on ARM64 architectures incorrectly calculates branch addresses when processing WASM br_table instructions with numerous entries, enabling remote code execution in Firefox <141, Firefox ESR <115.26/128.13/140.1, and Thunderbird <141/128.13/140.1. The vulnerability requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), allowing network-based attackers to potentially execute arbitrary code through malicious WASM content. Vendor-released patches are available across all affected product lines. No public exploit identified at time of analysis, though the CVSS 9.8 critical rating reflects the theoretical severity of unauthenticated remote code execution.

Information disclosure in Mozilla Firefox and Thunderbird on 64-bit platforms allows remote attackers to leak sensitive memory contents via specially crafted web content. The IonMonkey JIT compiler writes only 32 bits of the 64-bit return value space on the stack, while the Baseline JIT reads the entire 64 bits, exposing uninitialized stack memory. Exploitation requires user interaction (UI:R) and no authentication. Fixes are available: Firefox 141+, Firefox ESR 115.26+, Firefox ESR 128.13+, Firefox ESR 140.1+, Thunderbird 141+, Thunderbird 128.13+, and Thunderbird 140.1+.