Information Disclosure

Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. [CVSS 5.1 MEDIUM]

Permission control vulnerability in the Notepad module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. [CVSS 4.7 MEDIUM]

Man-in-the-middle attack vulnerability in the Clone module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. [CVSS 5.7 MEDIUM]

Permission verification bypass vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. [CVSS 6.2 MEDIUM]

ITeC ITeCProteccioAppServer contains an unquoted service path vulnerability that allows local attackers to execute code with elevated system privileges. Attackers can insert a malicious executable in the service path to gain elevated access during service restart or system reboot. [CVSS 8.4 HIGH]

Mobiletrans versions up to 3.5.9 contains a vulnerability that allows attackers to potentially execute code with elevated system privileges (CVSS 8.4).

Out-of-bounds memory read in Substance 3D Modeler 1.22.4 and earlier allows disclosure of sensitive information from application memory. Exploitation requires a local user to open a specially crafted malicious file. No patch is currently available for this vulnerability.

Out-of-bounds memory read in Substance 3D Modeler 1.22.4 and earlier enables disclosure of sensitive data from process memory when a user opens a crafted file. The vulnerability requires user interaction to exploit but carries no availability or integrity impact. No patch is currently available for affected versions.

Out-of-bounds memory read in Substance 3D Designer 15.0.3 and earlier allows attackers to disclose sensitive information from application memory by tricking users into opening malicious files. The vulnerability requires local access and user interaction but carries no patch availability. This medium-severity flaw affects designers and creative professionals using vulnerable versions of the software.

An arbitrary file deletion vulnerability has been identified in the command-line interface of mobility conductors running either AOS-10 or AOS-8 operating systems. [CVSS 6.5 MEDIUM]

Arbitrary file deletion vulnerability have been identified in a system function of mobility conductors running AOS-8 operating system. [CVSS 8.2 HIGH]

Memory disclosure in Adobe InDesign versions 21.0, 19.5.5 and earlier through out-of-bounds read allows attackers to access sensitive information from application memory when users open specially crafted malicious files. This vulnerability requires user interaction to exploit but requires no special privileges to trigger. No patch is currently available for affected versions.

Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. [CVSS 6.4 MEDIUM]

Uninitialized memory in the Dynamic Root of Trust for Measurement (DRTM) component of Windows 11 25h2, Windows Server 2019, Windows 10 22h2, Windows 10 1809, and Windows 11 23h2 allows a high-privileged local attacker to read sensitive information from kernel memory. The vulnerability requires administrative or equivalent privileges to exploit and carries no patch availability. This issue is tracked under CWE-908 with a CVSS score of 4.4.

Windows File Explorer information disclosure affects Windows 10 and 11 systems, allowing local authenticated attackers to access sensitive data through improper access controls. The vulnerability requires valid user credentials and local system access, posing a risk in multi-user or shared computing environments where sensitive files may be exposed to other authorized users.

Windows File Explorer improperly restricts access to sensitive information, enabling authenticated local users to read confidential data without authorization. This vulnerability affects Windows 10 across multiple versions (1607, 1809, 21H2, 22H2) and requires valid user credentials and local system access to exploit. Currently, no patch is available to remediate this information disclosure issue.

Information disclosure in Windows NDIS allows a privileged local attacker with physical access to read sensitive kernel memory regions on Windows 10 and Windows 11 systems. The vulnerability requires both authentication and direct hardware interaction, limiting its practical exploitation to scenarios where an attacker has already compromised system access. No patch is currently available for affected Windows versions including 10 (21h2, 22h2) and 11 (25h2).

Information disclosure in Windows VBS Enclave protection across Windows 11 versions (23h2, 24h2, 25h2) results from unsafe pointer handling that allows local attackers to read sensitive data without authentication. The vulnerability requires local access and carries medium severity with no available patch, making it a persistent risk for systems relying on virtualization-based security controls.

Windows File Explorer information disclosure allows local authenticated users to access sensitive data without authorization. This medium-severity vulnerability affects multiple Windows versions including Windows 11 (24h2 and 25h2), Windows 10 1809, and Windows Server 2019, but no patch is currently available.

Windows SMB Server denial of service via race condition affects Windows 10 21h2, Windows 11 24h2, and Windows Server 2022, allowing authenticated attackers to disrupt service availability through improper synchronization of shared resources. The vulnerability requires network access and specific conditions to trigger but carries no patch availability at this time. Impact is limited to availability with no confidentiality or integrity compromise.

Windows Management Services on Windows 10, 11, and Server 2022 expose sensitive information through an information disclosure vulnerability that allows authenticated local users to read confidential data. An attacker with valid credentials can exploit this to access information they should not be authorized to view, though no remote exploitation or system modification is possible. No patch is currently available for affected systems.

Information disclosure in Windows Capability Access Management Service (camsvc) enables local attackers to read sensitive data from memory without authentication on Windows 11 24h2, Windows 11 25h2, and Windows Server 2025. The out-of-bounds read vulnerability requires local access but no special privileges or user interaction to trigger. No patch is currently available for this issue.

Windows Shell information disclosure in Windows 10, 11, and Server 2019/2022 permits authenticated network attackers to conduct spoofing attacks by accessing sensitive data. The vulnerability requires valid credentials and network access, with no active exploits currently documented. No patch is available at this time.

Sensitive information disclosure in the Windows Kernel error message handling allows local authenticated users to read confidential data they shouldn't have access to. The vulnerability affects Windows and Windows Server 2022/2025 platforms and requires valid credentials to exploit, limiting its attack surface. No patch is currently available for this medium-severity issue.

Information disclosure in Windows Capability Access Management Service (camsvc) allows authenticated local users to read out-of-bounds memory and access sensitive data on Windows 11 24h2, Windows 11 25h2, Windows Server 2022 23h2, and Windows Server 2025. The vulnerability requires valid user credentials and local system access, posing a risk to multi-user environments where privilege escalation chains could amplify the impact. No patch is currently available.

Out-of-bounds read in Windows TPM allows an authorized attacker to disclose information locally. [CVSS 5.5 MEDIUM]

Windows Internet Connection Sharing (ICS) contains an out-of-bounds read vulnerability affecting Windows 7 through Windows 11 24H2 and Windows Server 2008-2019, enabling information disclosure through physical access to an affected system. An attacker with direct hardware access can exploit this flaw to read sensitive data from memory, though no patch is currently available. The attack requires physical presence and does not provide code execution or availability impact.

Information disclosure in Windows Tablet UI (TWINUI) subsystem allows authenticated local users to read sensitive data on affected Windows 11 and Windows Server systems. An attacker with local access can exploit this to retrieve confidential information without requiring user interaction. No patch is currently available for this medium-severity vulnerability.

Information disclosure in Windows File Explorer enables local authenticated users to read sensitive data on affected Windows systems including Windows 10 and Windows Server 2025. An attacker with valid local credentials can exploit this vulnerability to access confidential information without requiring user interaction. No patch is currently available for this issue.

Windows RPC implementation leaks sensitive information to local attackers on Windows 10, Windows 11, and Windows Server 2022. An unauthenticated local attacker can exploit this information disclosure vulnerability without user interaction to access confidential data. No patch is currently available for this medium-severity vulnerability.

Improper pointer validation in Windows VBS Enclave allows authenticated local users to read sensitive information on Windows 11 systems across multiple versions. An attacker with local access and valid credentials can exploit this memory safety flaw to bypass enclave protections and disclose confidential data. No patch is currently available.

Windows LDAP input validation bypass in Windows 10 21H2, Windows 11 24H2, and Windows Server 2022 23H2 enables authenticated network attackers to modify data integrity without detection. The vulnerability requires valid credentials and network access but does not provide elevation of privilege or confidentiality breaches. No patch is currently available for this medium-severity issue.

router mode configuration of HPE Instant On Access Points exposed certain network configuration details to unintended interfaces. A malicious actor is affected by information exposure (CVSS 7.5).

Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of privileges. [CVSS 7.5 HIGH]

Dell SupportAssist OS Recovery, versions prior to 5.5.15.1, contain a Creation of Temporary File With Insecure Permissions vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Information Tampering. [CVSS 6.6 MEDIUM]

A hardware vulnerability allows exfiltration of intermediate register values from secure workloads running in ARM TrustZone or similar TEE environments. Non-secure applications can read secure-world register contents.

In the Linux kernel, the following vulnerability has been resolved: platform/x86: hp-bioscfg: Fix out-of-bounds array access in ACPI package parsing The hp_populate_*_elements_from_package() functions in the hp-bioscfg driver contain out-of-bounds array access vulnerabilities.

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Fix potential UAF in xe_oa_add_config_ioctl() In xe_oa_add_config_ioctl(), we accessed oa_config->id after dropping metrics_lock.

In the Linux kernel, the following vulnerability has been resolved: ipv4: Fix reference count leak when using error routes with nexthop objects When a nexthop object is deleted, it is marked as dead and then fib_table_flush() is called to flush all the routes that are using the dead nexthop.

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly The netlink response for RDMA_NL_LS_OP_IP_RESOLVE should always have a LS_NLA_TYPE_DGID attribute, it is invalid if it does not.

In the Linux kernel, the following vulnerability has been resolved: net: usb: asix: validate PHY address before use The ASIX driver reads the PHY address from the USB device via asix_read_phy_addr().

In the Linux kernel, the following vulnerability has been resolved: e1000: fix OOB in e1000_tbi_should_accept() In e1000_tbi_should_accept() we read the last byte of the frame via 'data[length - 1]' to evaluate the TBI workaround.

In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:59!

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfsd_file reference leak in nfsd4_add_rdaccess_to_wrdeleg() nfsd4_add_rdaccess_to_wrdeleg() unconditionally overwrites fp->fi_fds[O_RDONLY] with a newly acquired nfsd_file.

In the Linux kernel, the following vulnerability has been resolved: ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() There exists a kernel oops caused by a BUG_ON(nhead < 0) at net/core/skbuff.c:2232 in pskb_expand_head().

In the Linux kernel, the following vulnerability has been resolved: RDMA/cm: Fix leaking the multicast GID table reference If the CM ID is destroyed while the CM event for multicast creating is still queued the cancel_work_sync() will prevent the work from running which also prevents destroying the ah_attr.

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data.

In the Linux kernel, the following vulnerability has been resolved: ASoC: stm32: sai: fix OF node leak on probe The reference taken to the sync provider OF node when probing the platform device is currently only dropped if the set_sync() callback fails during DAI probe.

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT On PREEMPT_RT kernels, after rt6_get_pcpu_route() returns NULL, the current task can be preempted.

In the Linux kernel, the following vulnerability has been resolved: net: nfc: fix deadlock between nfc_unregister_device and rfkill_fop_write A deadlock can occur between nfc_unregister_device() and rfkill_fop_write() due to lock ordering inversion between device_lock and rfkill_global_mutex.

In the Linux kernel, the following vulnerability has been resolved: powerpc/64s/slb: Fix SLB multihit issue during SLB preload On systems using the hash MMU, there is a software SLB preload cache that mirrors the entries loaded into the hardware SLB buffer.

CVE-2025-71077 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Limit num_syncs to prevent oversized allocations The OA open parameters did not validate num_syncs, allowing userspace to pass arbitrarily large values, potentially leading to excessive allocations.

In the Linux kernel, the following vulnerability has been resolved: scsi: aic94xx: fix use-after-free in device removal path The asd_pci_remove() function fails to synchronize with pending tasklets before freeing the asd_ha structure, leading to a potential use-after-free vulnerability.

In the Linux kernel, the following vulnerability has been resolved: functionfs: fix the open/removal races ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object.

In the Linux kernel, the following vulnerability has been resolved: Input: lkkbd - disable pending work before freeing device lkkbd_interrupt() schedules lk->tq via schedule_work(), and the work handler lkkbd_reinit() dereferences the lkkbd structure and its serio/input_dev fields.

In the Linux kernel, the following vulnerability has been resolved: shmem: fix recovery on rename failures maple_tree insertions can fail if we are seriously short on memory; simple_offset_rename() does not recover well if it runs into that. The same goes for simple_offset_rename_exchange().

In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors.

Local privilege-adjacent memory corruption in the Linux kernel ublk (userspace block driver) subsystem allows a ublk server process to trigger use-after-free-style access on completed I/O requests by exiting while requests are still in flight. The regression, introduced by commit e63d2228ef83 which stopped decrementing the request reference count in __ublk_fail_req(), leaves a leaked UBLK_REFCOUNT_INIT reference that permits illegitimate user-copy and zero-copy operations on already-completed requests and trips WARN_ON_ONCE reference-count assertions during queue teardown. It carries a CVSS 7.8 (high) with local vector and low privileges, EPSS is negligible at 0.03% (7th percentile), and there is no public exploit identified at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: svcrdma: bound check rq_pages index in inline path svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array.

Local privilege escalation in the Linux kernel's ETS (net/sched) packet scheduler arises from a use-after-free on a struct Qdisc object, caused by a race between ets_qdisc_dequeue and ets_qdisc_change. When bands are reconfigured, a class can retain its entry on the active list after its child qdisc is freed and nulled, letting a concurrent dequeue operate on freed memory. Trend Micro ZDI reports a working reproducer and that an attacker able to create user and network namespaces can trigger the flaw and, per their analysis, control RIP; there is no CISA KEV listing and EPSS is very low (0.05%), so no public evidence of active exploitation.

In the Linux kernel, the following vulnerability has been resolved: ublk: fix deadlock when reading partition table When one process(such as udev) opens ublk block device (e.g., to read the partition table via bdev_open()), a deadlock[1] can occur: 1. bdev_open() grabs disk->open_mutex 2. [CVSS 5.5 MEDIUM]

Local privilege-escalation-capable memory corruption in the Linux kernel's ALPS PS/2 touchpad driver (drivers/input/mouse/alps.c) lets a use-after-free be triggered when an ALPS touchpad is detached while the dev3_register_work delayed work item is still pending. Because psmouse_disconnect() only flushes work already queued, alps_register_bare_ps2_mouse() can run and dereference the alps_data structure (priv->dev3) after alps_disconnect() has kfree()'d it, corrupting freed kernel heap memory. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the flaw was found by static analysis rather than in-the-wild activity.

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in ksmbd_tree_connect_put under concurrency Under high concurrency, A tree-connection object (tcon) is freed on a disconnect path while another path still holds a reference and later executes *_put()/write on it. [CVSS 7.8 HIGH]

Local privilege escalation and kernel memory corruption in the Linux kernel's net/sched ETS (Enhanced Transmission Selection) qdisc allows a user with network-configuration capability to corrupt an internal linked list by toggling a scheduling class between DRR and strict modes. When an active DRR class is reconfigured to strict, ets_qdisc_change() fails to remove it from the active list, so switching it back to DRR performs a double list_add, corrupting kernel list pointers. No public exploit has been identified at time of analysis and the EPSS score is very low (0.05%), but the flaw is a classic kernel list-corruption primitive that can escalate to arbitrary write and full compromise.

Kernel memory corruption in the Linux svcrdma transport (server-side NFS-over-RDMA) arises because svc_rdma_copy_inline_range() added the page index (rc_curpage) instead of the byte offset (rc_pageoff) when computing the memcpy destination, so inline payload copies land at the wrong location within the receive pages. On systems exporting NFS over RDMA, a client on the RDMA fabric can drive copies that miscalculate their target offset, leading to out-of-bounds reads/writes in kernel page memory and potential information disclosure or corruption. There is no public exploit identified at time of analysis, EPSS is negligible (0.02%), and the issue is not in CISA KEV, but distro fixes (Ubuntu USN-8177-1) and upstream stable commits are available.

Local privilege escalation and memory corruption in the Linux kernel's KVM subsystem allows a user with VM control (e.g. a QEMU/hypervisor process) to trigger a use-after-free by clearing the KVM_MEM_GUEST_MEMFD flag on a memslot that was created with a guest_memfd binding. KVM blocks enabling the flag on an existing memslot but never blocked disabling it, leaving the guest_memfd instance bound to freed memory that is later written during kvm_gmem_release. The flaw carries a CVSS of 7.8 and has a vendor-released fix; it is not in CISA KEV and no public exploit has been identified at time of analysis, with an EPSS of 0.02%.

Concurrent SMB delete-on-close handling in the Linux kernel's in-kernel SMB3 server (ksmbd) mishandles locking on the ksmbd_inode->m_flags field, letting racing open/close/delete operations corrupt delete-on-close and pending-delete state. Affected builds ship the pre-fix ksmbd vfs_cache code where helpers such as ksmbd_inode_pending_delete() and ksmbd_fd_set_delete_on_close() read and modify m_flags without holding ci->m_lock. The result is inconsistent delete semantics - files that persist after a delete-on-close or vanish while still in use - with no public exploit identified at time of analysis and a very low EPSS score (0.03%).

Local privilege escalation risk in the Linux kernel's vidtv (Virtual Digital TV) media test driver stems from a double-free and use-after-free condition in vidtv_channel_si_init(), where local pointers are not reset to NULL after ownership of program/service/event list memory is transferred to the PAT/SDT/EIT tables. When vidtv_psi_pmt_create_sec_for_each_pat_entry() fails and control jumps to the free_eit error path, already-freed memory is destroyed a second time. Publicly this is patched upstream and shipped via Ubuntu USN-8096-1, but with EPSS at 0.05% and no public exploit identified at time of analysis, real-world exploitation is unlikely and confined to systems that actually load this virtual test driver.

Out-of-bounds buffer handling in the Linux kernel's ksmbd (in-kernel SMB3 server) Extended Attribute code allows a remote attacker to disclose adjacent kernel memory by sending a crafted SMB2 SET_INFO request. The smb2_set_ea() function validated the request buffer without accounting for the null-terminator byte of the EA name, so the size check under-counted the required length and permitted reads past the intended boundary. No public exploit is identified at time of analysis and EPSS probability is low (0.04%), but a vendor/upstream fix is available and it is not listed in CISA KEV.

Local privilege escalation and memory corruption in the Linux kernel FUSE subsystem's io-uring path allows an unprivileged local user to trigger list corruption and a resulting use-after-free. The flaw stems from a terminated-but-not-committed FUSE io-uring request never being unlinked from the queue's list, leaving a dangling entry that corrupts kernel memory. EPSS is very low (0.03%, 7th percentile) and there is no public exploit identified at time of analysis; a fix has been merged upstream and shipped by distributions such as Ubuntu.

Incorrect access-control enforcement in the Linux kernel's NFSv4 server (nfsd) causes POSIX ACLs supplied during file creation to be silently discarded, so a client that sets an ACL with a named principal ends up with only a default mode-derived ACL instead. This violates RFC 8881 6.4.1.3 and means files intended to carry restrictive or explicitly-granted permissions are instead governed by permissive default mode bits, potentially exposing their contents to unintended principals on the export. There is no public exploit identified at time of analysis, EPSS is very low (0.05%), and it is not on CISA KEV - this is a security-relevant correctness defect rather than an actively exploited threat.

Local privilege-holder-triggered use-after-free in the Linux kernel's mlxsw Spectrum switch driver (drivers/net/ethernet/mellanox/mlxsw) lets a network-admin operation on Nvidia/Mellanox Spectrum ASIC hardware dereference a freed neighbour object during RIF teardown. The driver cached a neighbour pointer without holding a reference, so freeing the neighbour (e.g. while removing a device from a VRF) leaves a dangling pointer that mlxsw_sp_neigh_entry_update() reads, corrupting kernel memory. CVSS is 7.8 (local, low privilege in the automated NVD scoring) but EPSS is only 0.05% (16th percentile) and there is no public exploit or CISA KEV listing - the flaw was found via an internal stress test, not observed attacks.

Local privilege escalation potential arising from a use-after-free in the Linux kernel's mlxsw Spectrum driver (spectrum_mr) allows an attacker with network-administration rights on a Mellanox Spectrum switch to trigger memory corruption during multicast route replacement. A prior fix introduced a dedicated mutex to protect the multicast route list, but one list-entry deletion path during route replace was missed, so the periodic mlxsw_sp_mr_stats_update worker can read a freed route object. EPSS is low (0.05%) and there is no public exploit identified at time of analysis; a vendor patch is available across multiple stable branches.

Denial of service and potential kernel memory disclosure in the Linux kernel's CAIF protocol stack arises because cffrml_receive() subtracts 2 from a packet-derived length field without checking that the value is at least 2 when FCS checking is disabled. An adjacent attacker sending a CAIF frame whose length field is 0 or 1 triggers an integer underflow, leading to memory exhaustion, kernel instability, and possible leakage of uninitialized kernel memory contained in packet padding. There is no public exploit identified at time of analysis, EPSS risk is very low (0.05%), and the flaw is not in CISA KEV.

Out-of-bounds read range miscalculation in the Linux kernel iomap subsystem allows a local attacker who can mount a crafted filesystem image (demonstrated against erofs via syzbot) to trigger a length underflow that returns a read position beyond the folio, leading to information disclosure or memory corruption during buffered reads. The flaw lives in iomap_adjust_read_range(), which incorrectly assumed block-aligned positions and lengths. No public exploit identified at time of analysis; EPSS exploitation probability is very low (0.03%), and it is not listed in CISA KEV.

Local privilege escalation or kernel memory disclosure in the Linux kernel's amdgpu DRM driver stems from a use-after-free during GPU recovery, where a race between the scheduler timeout callback (drm_sched_job_timedout) and the TDR work queue can free a job structure before amdgpu_device_gpu_recover reads its pasid field. Affected systems are those running vulnerable kernels with AMD GPUs using the amdgpu driver; a local attacker able to submit GPU work and induce a GPU hang could trigger the freed-memory access, as demonstrated by the supplied KASAN slab-use-after-free trace. There is no public exploit identified at time of analysis, and the EPSS score is negligible (0.03%, 7th percentile), consistent with a difficult-to-win kernel race rather than a broadly exploited flaw.

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. No vendor patch available.

Remote denial of service in the Linux kernel SCSI target (LIO) subsystem allows an initiator to crash a storage server by triggering a NULL-pointer dereference on the command error path. When allocation of the per-command CDB buffer (cmd->t_task_cdb) fails, the pointer is left NULL yet subsequently dereferenced in the 'err' cleanup path, panicking the kernel. No public exploit identified at time of analysis and EPSS is very low (0.05%), consistent with a hard-to-trigger memory-pressure condition rather than a reliably weaponizable flaw.

Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).

Denial of service in the Linux kernel's HFS+ (hfsplus) filesystem driver allows a local user with access to a mounted HFS+ volume to crash the kernel via a reference-counting race in __hfs_bnode_create(). When sync() and link() operations run concurrently, two threads can both attempt to create the same B-tree node; the thread that loses the race reuses the already-hashed node without incrementing its refcount, so a later put trips BUG_ON(!atomic_read(&node->refcnt)) and panics the system. No public exploit has been identified at time of analysis, EPSS risk is very low (0.05%), and the issue is not in CISA KEV.

Denial of service in the Linux kernel's bnxt_en driver (Broadcom NetXtreme-E) affects systems running an XDP program that uses the XDP_TX action. Incorrect clearing of NAPI event flags in the XDP_TX path causes the TX doorbell to be skipped when the TX ring is full, stalling the associated RX ring so it is never refilled and all subsequent packets are silently dropped. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%, 6th percentile); an upstream fix is available in mainline and stable kernels.

fabricators Ltd Vanilla OS 2 Core image v1.1.0 was discovered to contain static keys for the SSH service, allowing attackers to possibly execute a man-in-the-middle attack during connections with other hosts. [CVSS 6.4 MEDIUM]

A CORS misconfiguration in Eramba Community and Enterprise Editions v3.26.0 allows an attacker-controlled Origin header to be reflected in the Access-Control-Allow-Origin response along with Access-Control-Allow-Credentials: true. [CVSS 6.5 MEDIUM]

Firefox and Thunderbird versions before 147 contain an information disclosure vulnerability in their XML processing component that allows unauthenticated attackers to access sensitive data over the network with minimal attack complexity. The vulnerability requires no user interaction and affects the confidentiality of information without impacting system integrity or availability. No security patch is currently available.

The PDF Viewer component in Firefox and Thunderbird is vulnerable to clickjacking attacks that enable information disclosure through UI redressing techniques. Attackers can manipulate user interactions to trick victims into unintentionally revealing sensitive information, affecting Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available for this vulnerability.

Memory corruption in Firefox and Thunderbird's JavaScript garbage collection engine allows remote attackers to crash the application or potentially leak sensitive information without user interaction. The vulnerability affects Firefox versions below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7, with no patch currently available.

The Networking component in Firefox and Thunderbird discloses sensitive information to unauthenticated remote attackers over the network. Affected versions include Firefox below 147, Firefox ESR below 140.7, Thunderbird below 147, and Thunderbird ESR below 140.7. No patch is currently available to remediate this vulnerability.

The EventPrime - Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.7.0 via the REST API. [CVSS 5.3 MEDIUM]

Hermes versions up to 0.9.1 is affected by insertion of sensitive information into log file (CVSS 5.9).