Information Disclosure

Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.

Rejected reason: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. No vendor patch available.

Unrestricted file upload in Esri ArcGIS Server 11.5 and earlier on Windows and Linux allows remote, unauthenticated attackers to write arbitrary files into the server's designated upload directories. The server architecture confines uploaded content to non-executable storage and prevents replacement or modification of existing application components and system configuration, so there is no path to code execution, privilege escalation, or sensitive data access; exploitation also requires a race condition, knowledge of secret values, or a man-in-the-middle position, and no public exploit code was identified at time of analysis. Our assessment narrows the impact to integrity-only (C:N/I:L/A:N), making this a low-priority issue despite the CWE-434 unrestricted-upload classification.

Weak password recovery in Badaso's authentication controller (up to v2.9.7) allows remote attackers to exploit a flawed token-handling mechanism in the `forgetPassword` function to compromise victim accounts without prior authentication. The vulnerability, classed as CWE-640, indicates the reset token is either predictable, improperly scoped, or insufficiently protected, enabling account takeover when an attacker can trigger and then exploit the recovery flow. A public proof-of-concept exists documenting step-by-step exploitation; the vendor was notified but did not respond, leaving no official patch available. EPSS is 0.04% (14th percentile), consistent with the high-complexity attack requirement and niche product footprint.

Resource lock poisoning in ZwiiCMS prior to 13.7.00 allows authenticated low-privilege users to deny administrators access to administrative functionality by exploiting a race between lock acquisition and authorization. The application incorrectly acquires and binds a temporary resource lock to the requesting session before completing the authorization check - meaning even a request that ultimately returns 404 holds the lock until the attacker's session is cleared. No public exploit has been identified and the vulnerability is not listed in CISA KEV; real-world risk is bounded by the requirement for a pre-existing authenticated session.

Code injection in KodiCMS (Kohana-based) up to version 13.82.135 exposes the Layout API endpoint to remote authenticated attackers who can manipulate the `content` argument of the `Save` function in `file.php` to inject and potentially execute arbitrary code server-side. A public proof-of-concept has been disclosed via VulDB (submission 718290), though EPSS sits at just 0.06% (19th percentile), indicating limited observed exploitation activity. No vendor patch exists - the vendor did not respond to coordinated disclosure - leaving deployed instances with no official remediation path.

WP Messiah BoomDevs WordPress Coming Soon plugin through version 1.0.4 exposes sensitive system information to unauthorized access, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability stems from improper access controls on sensitive data endpoints, classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere). With an EPSS score of 0.01% (2nd percentile), exploitation likelihood is minimal despite the information disclosure nature of the defect.

Direct Payments WP WordPress plugin through version 1.3.2 exposes embedded sensitive system information to unauthorized parties via CWE-497 exposure mechanisms, allowing attackers to retrieve confidential data without requiring authentication. The vulnerability affects all versions up to and including 1.3.2, with an EPSS score of 0.01% indicating minimal observed exploitation probability despite the information disclosure nature of the flaw.

Local privilege escalation and unauthorized raw-disk access in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22) arise because the SYSTEM-level regService applies a security descriptor with no explicit DACL to a device object, letting a low-privileged local user open the object and issue raw disk operations that can disrupt the system, expose sensitive data, or elevate privileges. Exploitation is local-only (AV:L, PR:L, UI:N, 7.8) and publicly available exploit code exists (a PoC gist is linked from NVD), though the product's narrow maritime-navigation deployment base limits broad exposure and no active exploitation is confirmed (no CISA KEV listing).

Post Video Players WordPress plugin through version 1.163 exposes sensitive embedded data to unauthorized users via improper information disclosure mechanisms. The vulnerability allows attackers to retrieve sensitive system information that should be restricted from public access, affecting the plugin's core video playlist and gallery functionality. With an extremely low EPSS score of 0.04%, active exploitation appears minimal despite the information disclosure risk.

Information disclosure in Razvan Stanga's Varnish/Nginx Proxy Caching WordPress plugin through version 1.8.3 allows sensitive data embedded in cached responses to be exposed to unauthorized users. The vulnerability stems from improper handling of sensitive information during proxy caching operations, enabling attackers to retrieve cached data containing credentials, tokens, or other confidential material. No authentication is required to exploit this issue, and EPSS analysis indicates a 4.43% probability of exploitation (89th percentile), suggesting moderate real-world risk despite the lack of known public exploits.

Download Media Library WordPress plugin through version 0.2.1 exposes sensitive system information to unauthorized users via embedded data retrieval. The vulnerability allows unauthenticated attackers to access restricted system details without proper access controls, though real-world exploitation probability remains low (EPSS 0.04%). No public exploit code or active exploitation has been confirmed.

The Efí Bank Gerencianet Oficial WordPress plugin through version 3.1.3 exposes sensitive data by embedding it into sent HTTP requests or responses, allowing attackers to retrieve payment-related information without authentication. This information disclosure vulnerability (CWE-201) affects all installations of the affected plugin versions and is classified as low-risk based on EPSS score (0.04%, 12th percentile), with no public exploit code or active exploitation confirmed.

The Terms descriptions WordPress plugin versions 3.4.10 and earlier expose sensitive data through embedded information in sent data, allowing unauthenticated attackers to retrieve embedded sensitive information. This information disclosure vulnerability (CWE-201) affects all installations of the plugin up to version 3.4.10. No public exploit code has been identified, and the EPSS score of 0.04% indicates minimal real-world exploitation probability, though the vulnerability remains a concern for sites storing sensitive term metadata.

ColorWay WordPress theme through version 4.2.3 embeds sensitive information in sent data, allowing unauthenticated attackers to retrieve embedded data without authentication. The vulnerability has an exceptionally low exploitation probability (EPSS 0.03%, 9th percentile) despite being information disclosure in nature, suggesting the sensitive data exposure requires specific conditions or limited practical impact. No active exploitation or public exploit code is documented at time of analysis.

Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.

Credential leakage in the Ruby URI gem's `+` operator allows sensitive userinfo (username and password embedded in URIs) to persist when the host portion of a URI is replaced, violating RFC3986. This flaw affects URI gem versions bundled across the Ruby 3.2, 3.3, and 3.4 release series and represents a bypass of the prior fix for CVE-2025-27221, which patched equivalent behavior in `URI#join` and `URI#merge` but left `URI#+` unaddressed. No public exploit code has been identified and EPSS is 0.01%, but applications that embed credentials in URIs and dynamically combine them using `+` are concretely at risk of sending those credentials to attacker-controlled hosts.

Code injection in 08CMS Novel System (versions up to 3.4) allows remote authenticated administrators to inject and execute arbitrary code via the Template Handler component (admina/mtpls.inc.php). The vulnerability requires high privileges to exploit, limiting its scope to users with admin-level access to the CMS. A public proof-of-concept exploit has been disclosed, though EPSS stands at 0.06% (17th percentile), indicating no widespread opportunistic exploitation has been observed. No CISA KEV listing confirms active exploitation at time of analysis.

In the Linux kernel, the following vulnerability has been resolved: arm64: set __exception_irq_entry with __irq_entry as a default filter_irq_stacks() is supposed to cut entries which are related irq. No vendor patch available.

Local file inclusion in the Lekker WordPress theme (all versions through 1.8) by Qodeinteractive allows a remote attacker without authentication to supply a crafted filename parameter that reaches an unsanitized PHP include or require statement, potentially exposing arbitrary server-side files. The CVSS 3.1 vector rates impact as C:H/I:H/A:H, though the primary real-world impact is confidentiality loss through file read (e.g., wp-config.php, .env files containing database credentials). No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits at 0.06% (20th percentile), indicating very limited observed exploitation activity.

Roxnor PopupKit popup-builder-block plugin through version 2.2.4 exposes sensitive system information to authenticated users via an information disclosure vulnerability. An authenticated attacker can retrieve embedded sensitive data that should not be accessible, potentially gaining insight into system configuration or other restricted information. The CVSS 4.3 score reflects low real-world impact (confidentiality only, low privileges required), and EPSS exploitation probability is minimal at 0.04%, indicating this is a lower-priority vulnerability despite affecting a WordPress plugin.

Aethonic Poptics WordPress plugin through version 1.0.20 exposes sensitive system information to authenticated users through an information disclosure vulnerability. Authenticated attackers with low-level privileges can retrieve embedded sensitive data without user interaction, though exploitation requires valid login credentials. The issue carries a modest CVSS score of 4.3 and extremely low EPSS probability (0.04th percentile), indicating real-world exploitation risk is minimal despite the confirmed vulnerability.

Local file inclusion in WebCodingPlace Responsive Posts Carousel Pro plugin for WordPress allows authenticated attackers to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability affects versions <= 15.1 and requires low-privilege user authentication. At time of analysis, no public exploit code is known and exploitation probability is low based on EPSS (0.12%).

Sensitive data exposure in Contact Form 7 Mailchimp Extension plugin for WordPress (versions ≤0.9.68) allows unauthenticated remote attackers to retrieve embedded sensitive information through network-accessible endpoints. The vulnerability enables unauthorized access to confidential data with low attack complexity and no user interaction required. EPSS score of 0.05% (14th percentile) indicates low observed exploitation probability, and no public exploit identified at time of analysis.

Unauthorized remote attackers can retrieve embedded sensitive system information from o2oe E-Invoice App Malaysia plugin versions 1.3.0 and earlier without authentication (CVSS:3.1 AV:N/AC:L/PR:N). The vulnerability exposes confidential data through information disclosure, with EPSS exploitation probability at 0.05% (14th percentile). No public exploit identified at time of analysis, though the low attack complexity and unauthenticated attack vector make exploitation straightforward for adversaries with network access to vulnerable WordPress installations.

Local file inclusion in Edge-Themes Cinerama WordPress theme versions ≤2.9 enables unauthenticated remote attackers to read arbitrary server files through PHP file inclusion weaknesses. Despite the CVSS critical rating of 9.8, EPSS probability is low (0.17%, 38th percentile) with no public exploit identified at time of analysis. The vulnerability allows server-side file reading which could expose configuration files, credentials, and sensitive data without authentication requirements.

Local file inclusion in the Aora WordPress theme (<=1.3.15) allows authenticated attackers with low privileges to read arbitrary files on the server. The high attack complexity and lack of known public exploit code currently limit widespread abuse, but the high CVSS impact scores indicate a potential to escalate to code execution if combined with other techniques. This vulnerability is not listed in CISA KEV and has a very low EPSS (0.17%), suggesting it is not currently a priority target for mass exploitation.

Local file inclusion in the Puca WordPress theme (versions ≤2.6.39) allows authenticated attackers with low-privilege access to include arbitrary local PHP files. Successful exploitation can lead to sensitive data exposure or code execution, but requires high attack complexity. No public exploit or active exploitation has been reported.

Local File Inclusion vulnerability in Greenmart WordPress theme versions up to and including 4.2.11 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure or remote code execution. No active exploitation nor public exploit code has been identified, and EPSS predicts a low likelihood of widespread exploitation (0.17%).

Local file inclusion in miniOrange Social Login and Register plugin for WordPress allows authenticated attackers with administrative privileges to read arbitrary files on the server, potentially leading to full site compromise. The vulnerability affects all plugin versions up to 7.7.0, and while no active exploitation or public exploit has been identified, EPSS data indicates a low probability of exploitation. High attack complexity and the requirement for administrative access limit immediate urgency but still pose a risk in environments where admin credentials could be abused.

Race condition in the Purchase Request Handler of PHPEMS up to version 11.0 allows remote attackers to corrupt purchase data integrity under precise timing conditions. Exploitation requires high complexity and many attempts, with limited impact on information disclosure. A public proof-of-concept is available, but no active exploitation has been confirmed.

Race condition in PHPEMS Coupon Handler component up to version 11.0 allows authenticated remote attackers to manipulate coupon processing logic, potentially resulting in integrity compromise. The vulnerability requires high attack complexity and authenticated access, limiting practical exploitation despite publicly available proof-of-concept code. EPSS score of 0.04% indicates low real-world exploitation probability despite public POC availability.

Information disclosure vulnerability in Student File Management System 1.0 allows low-privileged authenticated users to access arbitrary files via the store_id parameter in /download.php. A public proof-of-concept exploit exists, but EPSS is 0.03% (very low exploitation probability) and no active exploitation has been reported. Exploitation requires authentication, limiting the attack surface.

WP Project Manager plugin through version 3.0.1 exposes sensitive information in sent data due to improper information handling, allowing attackers to retrieve embedded sensitive data without authentication. The vulnerability affects all installations of the weDevs plugin and has been identified with an extremely low EPSS score (0.05%, 14th percentile), suggesting minimal practical exploitation likelihood despite the information disclosure classification.

Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.

Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.

Sensitive information disclosure in Gmission Web Fax 3.0 (before 3.0.1) enables a locally authenticated low-privileged user to access protected fax data without proper authorization. The root cause is missing authorization checks (CWE-200) that can be abused by an authenticated local actor to read confidential information beyond their intended access scope. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Information disclosure in PbootCMS up to 3.2.12 allows remote attackers to directly request and download the SQLite database file /data/pbootcms.db, potentially exposing sensitive data. A public exploit is available, but exploitation is difficult and EPSS (0.06%) indicates very low probability of widespread exploitation. No active exploitation has been confirmed.

Information disclosure in Halo up to 2.21.10 can be triggered by a remote attacker with low privileges via high-complexity manipulation of the /actuator configuration handler, potentially leaking limited configuration data. Public exploit code exists, but active exploitation has not been confirmed and EPSS indicates a negligible exploitation probability (0.03%). The low CVSS 4.0 score and high attack complexity further reduce the real-world

Code injection in the Administrative Panel of SyCms allows remote authenticated administrators to execute arbitrary code. The vulnerability resides in the addPost function of FileManageController.class.php, permitting an attacker with high privileges to inject and run malicious PHP. The product is unmaintained and no patch is available, though public exploit code exists.

Improper authorization in JeecgBoot's position management API allows authenticated low-privilege users to enumerate personnel assigned to arbitrary organizational positions by manipulating the positionId parameter at the /sys/position/getPositionUserList endpoint. All versions up to and including 3.9.0 are confirmed affected per NVD CPE data. A publicly available proof-of-concept exploit exists on GitHub, though the CVSS 4.0 score of 1.3 and EPSS of 0.04% (11th percentile) indicate this is a limited-impact, difficult-to-exploit information disclosure - no active exploitation has been confirmed.

Improper authorization in JeecgBoot up to 3.9.0 allows low-privileged authenticated attackers to enumerate department permission information via a crafted request to /sys/permission/queryDepartPermission, leading to limited information disclosure. The vulnerability requires high attack complexity, and while a public exploit is available, no active

Improper authorization in Jeecg Boot up to 3.9.0 allows authenticated remote attackers to bypass permission checks and access sensitive information by manipulating the 'departId' parameter in the /sys/sysDepartPermission/list API endpoint. Exploitation requires low privileges and high attack complexity, and a proof-of-concept exploit is publicly available. EPSS indicates a 0.03% probability of exploitation.

Improper authorization in JeecgBoot up to 3.9.0 allows remote attackers with low privileges to access restricted data rule configuration information. The vulnerability resides in the /sys/sysDepartPermission/datarule/ endpoint and requires high attack complexity. A public exploit is available, but no active exploitation has been confirmed; EPSS indicates very low exploitation probability.

Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to manipulate departId and roleId parameters in the /sys/sysDepartRole/datarule/ endpoint to disclose sensitive information. The vulnerability requires legitimate user access and high exploitation complexity, but publicly available exploit code exists and the vendor did not respond to early disclosure attempts.

Improper authorization in JeecgBoot up to version 3.9.0 allows authenticated remote attackers to access unauthorized department role data via manipulation of the departId parameter in the getDeptRoleList endpoint, resulting in information disclosure of sensitive role assignments. The vulnerability requires login credentials and high attack complexity but has publicly available exploit code; however, real-world exploitation risk remains minimal given the 0.03% EPSS score and authentication prerequisite.

Information disclosure in Jeecg Boot up to version 3.9.0 allows authenticated low-privilege users to access department role data by manipulating the deptId parameter in the /sys/sysDepartRole/list endpoint. The vulnerability has high attack complexity and publicly available exploit code exists, though no active exploitation has been confirmed by CISA KEV. Impact is limited to low confidentiality loss with no integrity or availability impact.

Improper authorization in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to modify member address information via the /member/address/update/ endpoint, resulting in unauthorized data manipulation. The vulnerability affects the Member Endpoint component and has publicly available exploit code, though real-world exploitation risk is low based on EPSS scoring (0.05%, 14th percentile) and the requirement for prior authentication.

OpenCart versions up to 4.1.0.3 are vulnerable to a race condition in the Single-Use Coupon Handler component that allows remote attackers to perform unauthorized manipulation resulting in information disclosure. The attack requires high complexity and no authentication, with a CVSS score of 2.9 indicating low impact. Publicly available exploit code exists, though the vendor did not respond to early disclosure notification.

PandaX JWT Secret Handler uses hard-coded cryptographic keys in the config.yml file, allowing remote attackers to bypass authentication and decrypt sensitive JWT tokens with high attack complexity. The vulnerability affects the product up to commit fb8ff40f7ce5dfebdf66306c6d85625061faf7e5, and although public exploit code exists, the extremely low EPSS score (0.05%) and high attack complexity suggest limited real-world exploitation despite network accessibility.

Actiontech SQLE up to version 4.2511.0 uses a hard-coded cryptographic key in its JWT Secret Handler (sqle/utils/jwt.go), allowing remote attackers with no authentication or user interaction to gain limited information disclosure. The vulnerability results from improper handling of the JWTSecretKey argument, though exploitation is rated as difficult due to high attack complexity. Publicly available exploit code exists, and the vendor has committed to addressing this in an upcoming release.

Improper authorization in getmaxun maxun up to version 0.0.28 allows authenticated remote attackers to access unauthorized resources via manipulation of the authentication endpoint router in server/src/routes/auth.ts, with publicly available exploit code and an EPSS score of 0.15% indicating low real-world exploitation probability despite confirmed public disclosure.

Use of hard-coded cryptographic keys in getmaxun maxun up to version 0.0.28 allows remote unauthenticated attackers to manipulate the api_key parameter in the authentication route, potentially disclosing sensitive information with high attack complexity. Publicly available exploit code exists, though EPSS scoring (0.07%) and vendor non-responsiveness suggest limited real-world exploitation pressure despite confirmed POC availability.

Improper authorization in Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate the orderSn parameter in the submitOrderPayment function, potentially disclosing or modifying payment information for orders they do not own. The vulnerability requires valid user authentication and has publicly available exploit code; however, the EPSS score of 0.06% indicates exploitation is unlikely in practice despite the disclosed POC.

Improper access controls in Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose member information via the getMemberByMobile endpoint in MemberController.java. The vulnerability has publicly available exploit code and affects a core user management function, though the EPSS score of 0.04% suggests limited real-world exploitation despite public availability of proof-of-concept.

Improper authorization in the MemberController.deductBalance() function of Youlai Mall 1.0.0 and 2.0.0 allows authenticated remote attackers to manipulate user balance operations without proper authorization checks, resulting in limited confidentiality impact. Public exploit code exists for this vulnerability, though the extremely low CVSS score (2.1) and EPSS percentile (15th) suggest minimal real-world exploitation risk despite public availability.

Improper access controls in the Order Payment Handler (orderService.payOrder method) of Youlai Mall 1.0.0 and 2.0.0 allow authenticated remote attackers to disclose sensitive information through the OrderController component. The vulnerability requires high attack complexity and authenticated access (PR:L), limiting real-world exploitation despite publicly available proof-of-concept code. EPSS exploitation probability is 0.06% (17th percentile), suggesting low practical risk despite public POC availability.

UART interface debug and test access control bypass in TOZED ZLT M30s firmware versions up to 1.47 allows physical attackers to access on-chip debug interfaces with improper authentication, leading to information disclosure and potential system manipulation. Exploitation requires direct physical device access and is difficult to execute, but publicly available exploit code exists and the vendor has not responded to disclosure. With an EPSS score of 0.03% and CVSS 0.3, real-world risk is minimal despite public POC availability.

Availability impact in the Linux kernel's Intel VPU accelerator driver (accel/ivpu) stems from a race condition between Buffer Object (BO) freeing and context teardown. A local, low-privileged user on a system with Intel VPU/NPU hardware can trigger the ivpu_gem_bo_free() path to remove a BO from the list before it is fully unmapped, causing file_priv_unbind() to encounter an unclean memory manager state and trigger a drm_mm_takedown() warning, ultimately resulting in a kernel availability impact. No public exploit exists and EPSS sits at the 1st percentile, indicating negligible real-world exploitation interest at this time.

Local privilege escalation and memory corruption in the Linux kernel's drm/panthor GPU driver arises from a use-after-free race between device unplug (panthor_fw_unplug()) freeing firmware memory sections and the asynchronous process_fw_events_work() handler, which can still access those freed FW memory regions. An attacker with local access to a system using an ARM Mali CSF-based GPU can potentially corrupt kernel memory or leak information by racing device teardown against pending firmware event processing. CVSS is 7.8 (High) with full confidentiality/integrity/availability impact; no public exploit has been identified and it is not in CISA KEV.

Local privilege escalation and memory corruption in the Linux kernel's Panthor DRM driver (ARM Mali GPU) arises from a use-after-free on kernel buffer-object virtual-address nodes; when the GPU MMU is down, panthor_vm_unmap_range() returns early and leaves a va_node stuck in the drm_mm tree, so removing adjacent nodes later dereferences freed memory. A local user with GPU/render access can trigger the condition to corrupt kernel memory (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis; an upstream fix has been merged to stable trees.

Use-after-free in the Linux kernel's Tegra210 QSPI (tegra210-quad) SPI controller driver arises when a transfer times out before the threaded IRQ handler runs, leaving the curr_xfer field pointing at freed memory that the IRQ thread may later dereference. Local low-privileged users on NVIDIA Tegra-based systems could trigger memory corruption affecting confidentiality, integrity, and availability, though exploitation depends on winning a narrow timing race. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the fix is delivered as upstream stable-tree commits.

Kernel instability in the Linux qla2xxx SCSI driver (QLogic Fibre Channel target/host adapter) allows a chip-reset event to leave in-flight commands stuck and never freed, and can trigger a BUG_ON kernel panic (BUG_ON(cmd->sg_mapped) or BUG_ON(!valid_dma_direction(dir))) when two CPUs race to unmap the same scatter-gather list. This fix reverts commit 26f9ce53817a and partially reverts aefed3e5548f at __qla2x00_abort_all_cmds to restore correct command cleanup after a firmware/chip reset. No public exploit identified at time of analysis; the NVD-assigned CVSS of 9.8 (AV:N) is inconsistent with the local, hardware-dependent nature of the bug.

Access-control inconsistency in the Linux kernel's Landlock LSM allows a sandboxed local task to widen its effective filesystem access rights by operating on "disconnected" directories - files opened through a bind mount and then renamed or moved out of scope of the mount point. Because the mount point could not be located during the hierarchy walk, Landlock collected access rights straight down to the filesystem root, ignoring the more restrictive mount-point hierarchy and permitting renames (notably under LANDLOCK_ACCESS_FS_REFER) that should have been denied. Only Linux systems actively enforcing Landlock sandboxing are affected; there is no public exploit identified at time of analysis and EPSS is negligible (0.02%, 6th percentile).

Sensitive information exposure in WPXPO PostX plugin for WordPress (version 5.0.3 and below) allows remote unauthenticated attackers to retrieve embedded sensitive data via network-based requests. The vulnerability carries a CVSS 5.3 (Medium) score, with low EPSS exploitation probability (0.05%) and no known active exploitation or public exploit code. It involves improper exposure of system information to an unauthorized control sphere.

Sensitive information disclosure in the Virusdie WordPress plugin up to version 1.1.6 allows authenticated, low-privileged attackers to retrieve embedded sensitive data. The vulnerability, classified as CWE-497, enables unauthorized access to system information through the plugin's normal interface. Despite a medium CVSS score (4.3), EPSS indicates very low risk of exploitation, and no active exploitation or public exploit code is reported.

Local file inclusion in the Subscribe to Unlock Lite WordPress plugin (≤1.3.0) allows authenticated users with low privileges to include arbitrary local files under high-complexity conditions. Attackers may potentially read sensitive configuration files or escalate to remote code execution using additional techniques, though the exploitation probability is assessed as very low (EPSS 0.17%). No active exploitation or public proof-of-concept has been reported.

Local file inclusion in the Fana WordPress theme up to version 1.1.35 allows authenticated attackers with low privileges to read arbitrary files on the server, potentially escalating to full compromise including code execution and data manipulation. No active exploitation or public exploit code is currently confirmed.

Local file inclusion in thembay's Zota WordPress theme (≤1.3.14) enables authenticated attackers to read arbitrary files on the server. This can expose sensitive data such as configuration files, potentially leading to further compromise. No known active exploitation, but given the low attack complexity, it remains a credible threat for sites using the vulnerable theme.

Local file inclusion in the Bookory WordPress theme through version 2.2.7 enables authenticated attackers with low privileges to include arbitrary local files. This can lead to sensitive information disclosure or remote code execution, resulting in full site compromise. No active exploitation is currently reported (KEV absent) and EPSS score of 0.17% suggests low near-term exploitation probability, but the high CVSS score reflects severe potential impact.

Sensitive information disclosure in Essekia Tablesome WordPress plugin versions up to 1.1.35.1 allows authenticated attackers to retrieve embedded sensitive data from other users. The flaw, classed as CWE-201, stems from insertion of sensitive information into sent data, and carries a medium CVSS score of 5.0. No active exploitation or public exploit code is known at this time, and EPSS indicates a low (0.05%) probability of exploitation.

Local file inclusion vulnerability in the WordPress Docket Cache plugin (versions up to 24.07.03) allows remote attackers to include arbitrary local files, potentially exposing sensitive data or leading to code execution. The flaw has a CVSS 8.1 rating due to high impact but is tempered by high attack complexity; no active exploitation or public proof-of-concept exists, and EPSS probability is low (0.17%).

Sensitive information exposure in Leap13 Premium Addons for Elementor WordPress plugin up to 4.11.53 permits unauthenticated attackers to retrieve embedded sensitive data (e.g., API keys, tokens) via network requests. The flaw has a CVSS base score of 5.3 (Medium) with low confidentiality impact and no known active exploitation or public exploit code at this time.

Sensitive data exposure in the Eight Day Week Print Workflow WordPress plugin allows authenticated attackers with subscriber-level access to retrieve embedded sensitive data such as API keys or tokens. No public exploit or active exploitation has been identified, and the EPSS score is low (0.05%), indicating minimal current risk.

Kernel panic in the Linux octeontx2-af driver exposes Marvell CN103XX OcteonTX2 systems to a denial-of-service crash when firmware reports a physical link change event with an invalid lmac_type_id value. The driver's cgx_link_change_handler() uses the unvalidated firmware-supplied ID to index into an array and calls strncpy with the resulting out-of-bounds pointer, producing a fatal kernel Oops in a workqueue context. No public exploit has been identified and EPSS sits at 0.17% (6th percentile), but the crash is deterministic once the invalid firmware value is processed, making Availability impact high on affected hardware.

Use-after-free in the Linux kernel NTFS3 filesystem driver allows a local attacker with low privileges to corrupt kernel heap memory via a crafted NTFS volume with malformed extended attributes. The `ntfs_read_ea` function fails to propagate error codes on encountering inconsistent EA structures, causing `ntfs_set_ea` to perform a 4-byte write to already-freed memory - confirmed by an in-description KASAN trace captured at 6.2.0-rc1+. No active exploitation is confirmed (not in CISA KEV), and an EPSS of 0.16% (6th percentile) signals very low observed exploitation activity, though a researcher-developed proof-of-concept is implied by the kernel trace.

Local privilege-tier memory corruption in the Linux kernel's Intel VPU/NPU accelerator driver (accel/ivpu) arises from a dangling buffer object left on a per-device list after a failed allocation, later dereferenced in ivpu_bo_unbind_all_bos_from_context() to cause a page fault. A local user with access to the ivpu device can trigger this use-after-free via the DRM/accel interface, with CVSS 7.8 (High) and CISA-style impact of confidentiality, integrity, and availability all High. There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; the primary observed effect is a kernel page fault (crash), though the dangling-pointer condition carries corruption potential.

BPF test infrastructure in the Linux kernel allows a local user with BPF program execution privileges to emit packets with malformed GSO (Generic Segmentation Offload) metadata to the network stack via bpf_clone_redirect(), triggering skb_warn_bad_offload() and disabling GSO-related offload features - a denial-of-service condition. The root cause is convert___skb_to_skb() populating gso_segs and gso_size without a corresponding gso_type, producing an internally inconsistent socket buffer that fails GSO validation in netif_skb_features(). No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; the issue was originally surfaced through fuzzing by Yinhao et al. Patches across six stable kernel branches have been released.

In the Linux kernel, the following vulnerability has been resolved: scsi: smartpqi: Fix device resources accessed after device removal Correct possible race conditions during device removal. Previously, a scheduled work item to reset a LUN could still execute after the device was removed, leading to use-after-free and other resource access issues. This race condition occurs because the abort handler may schedule a LUN reset concurrently with device removal via sdev_destroy(), leading to use-after-free and improper access to freed resources. - Check in the device reset handler if the device is still present in the controller's SCSI device list before running; if not, the reset is skipped. - Cancel any pending TMF work that has not started in sdev_destroy(). - Ensure device freeing in sdev_destroy() is done while holding the LUN reset mutex to avoid races with ongoing resets.

Local privilege-limited denial of service in the Linux kernel's CoreSight TMC (Trace Memory Controller) driver allows a user with performance-monitoring access to trigger a kernel oops via an invalid pointer dereference in tmc_etr_get_buffer(). The flaw occurs because the perf event handle was not attached to the coresight_path, so dependent devices such as the CATU could not retrieve the per-CPU AUX_EVENT during path enablement. It is reproducible with a standard perf record command against CoreSight ETM tracing; there is no public exploit identified at time of analysis and EPSS is low (0.16%).

Denial of service in the Linux kernel's ntfs3 filesystem driver stems from a run_lock rwsem that is never initialized when the special $Extend metadata inode is loaded. When $Extend's inode mode is set to a regular file, a truncate() call reaches ntfs_set_size() and acquires the uninitialized lock, tripping lockdep and risking kernel instability. The regression was introduced by commit 4e8011ffec79 and was found via syzbot fuzzing; no public exploit identified at time of analysis, and EPSS is low at 0.17%.

Uninitialized memory use in the Linux kernel NTFS3 filesystem driver (fs/ntfs3) enables a local low-privileged user to trigger a kernel crash, causing a denial of service. The `__getname()` function allocates slab memory via `kmem_cache_alloc()` without zeroing it; `ntfs_read_hdr` and `bcmp` then operate on this indeterminate data, as detected by KMSAN. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.18% at the 7th percentile reflects very low real-world exploitation probability. Upstream patches are available across multiple stable kernel branches.

In the Linux kernel, the following vulnerability has been resolved: bpf: Check skb->transport_header is set in bpf_skb_check_mtu The bpf_skb_check_mtu helper needs to use skb->transport_header when the BPF_MTU_CHK_SEGS flag is used: bpf_skb_check_mtu(skb, ifindex, &mtu_len, 0, BPF_MTU_CHK_SEGS) The transport_header is not always set. There is a WARN_ON_ONCE report when CONFIG_DEBUG_NET is enabled + skb->gso_size is set + bpf_prog_test_run is used: WARNING: CPU: 1 PID: 2216 at ./include/linux/skbuff.h:3071 skb_gso_validate_network_len bpf_skb_check_mtu bpf_prog_3920e25740a41171_tc_chk_segs_flag # A test in the next patch bpf_test_run bpf_prog_test_run_skb For a normal ingress skb (not test_run), skb_reset_transport_header is performed but there is plan to avoid setting it as described in commit 2170a1f09148 ("net: no longer reset transport_header in __netif_receive_skb_core()"). This patch fixes the bpf helper by checking skb_transport_header_was_set(). The check is done just before skb->transport_header is used, to avoid breaking the existing bpf prog. The WARN_ON_ONCE is limited to bpf_prog_test_run, so targeting bpf-next.

Memory corruption (double free) in the Linux kernel btrfs filesystem's quota group (qgroup) accounting affects the add_delayed_ref_head() code path when a qgroup record is reported as already existing but a subsequent error occurs, causing both caller and callee to free the same 'qrecord' object. The flaw is a local btrfs-triggered condition on systems using btrfs with quota groups; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a very low EPSS of 0.17%. Despite an automated CVSS of 9.8, the realistic attack surface is local to the machine and gated by a hard-to-reach error path.

In the Linux kernel, the following vulnerability has been resolved: arm64: mm: fix VA-range sanity check Both create_mapping_noalloc() and update_mapping_prot() sanity-check their 'virt' parameter,. No vendor patch available.

Improper validation of permissions/ticket revocation in eProsima Fast-DDS 3.3.0 allows revoked or no-longer-valid security credentials to be accepted, permitting unauthorized participants to join a secured DDS domain and exchange data over connections that should have been refused. The flaw sits in the DDS Security access-control layer (Permissions handling) and undermines the confidentiality and integrity guarantees of an otherwise authenticated domain. Rated CVSS 10.0 with a scope change, but EPSS is low (0.30%, 22th percentile) and there is no public exploit identified at time of analysis, so real-world risk is narrower than the base score implies.

Concurrency-driven information disclosure in the Linux kernel's veth (virtual Ethernet) driver allows old or uninitialized packet descriptors to be exposed to AF_XDP consumers when veth is run in threaded-NAPI mode with an XDP program attached. Because the BPF redirect/return context was moved from per-CPU storage into the 'current' task_struct (commit 401cb7dae813), two concurrent veth_poll() invocations can nest the xdp_set/clear_return_frame_no_direct() section and race, corrupting the shared BPF net context. Despite an NVD CVSS of 9.8, this is a local, configuration-dependent kernel race with EPSS at 0.16% (6th percentile), no KEV listing, and no public exploit identified at time of analysis.

Type confusion in the Linux kernel's team network driver (team_port_add) allows a local user with CAP_NET_ADMIN to corrupt a team device's header_ops state, leading to a kernel hang or BUG(). When an already-UP GRE device is added as a team port, the operation fails but not before team_dev_type_check_change irreversibly replaces eth_header with ipgre_header on the team device; subsequent packet transmission causes ipgre_header() to dereference struct team private data as struct ip_tunnel, triggering a local denial-of-service. No active exploitation has been confirmed (not in CISA KEV), though a syzbot reproducer demonstrates the issue reliably.

Local file inclusion vulnerability in CodexThemes TheGem Theme Elements (for Elementor) WordPress plugin through version 5.10.5.1 allows attackers to read arbitrary files from the server via improper control of filename parameters in PHP include/require statements. The vulnerability carries a low EPSS score of 0.17% (38th percentile), indicating minimal real-world exploitation probability despite being a classic PHP file inclusion flaw affecting an Elementor page builder plugin.

VPSUForm WordPress plugin versions 3.2.24 and earlier expose sensitive embedded system information to unauthorized users via improper access controls, allowing attackers to retrieve data that should be restricted to administrators or authenticated users. The vulnerability affects a widely-deployed WordPress form plugin and has an EPSS score of 0.05% (low exploitation probability), with no confirmed active exploitation or public exploit code at the time of analysis.