Information Disclosure

Local privilege escalation in macOS allows authenticated applications to access sensitive user data through insufficient permission restrictions on Sequoia, Sonoma, and Tahoe versions. The vulnerability requires local access and low-privilege user context but enables high-impact confidentiality compromise without requiring user interaction or elevated privileges to trigger. A vendor-released patch is available across all affected macOS versions.

Local privilege escalation in Apple's spellcheck API allows authenticated users to inappropriately access files on macOS, iOS, and related platforms through a logic flaw in access controls. Affected versions include macOS Sonoma 14.x and earlier, macOS Sequoia 15.7.2 and earlier, iOS 18.x and earlier, iPadOS 18.x and earlier, and watchOS 11.x and earlier. This vulnerability requires local access and user-level privileges but carries a low EPSS score (0.01%, percentile 3%) indicating minimal real-world exploitation likelihood at present. No public exploit code or active exploitation has been identified.

macOS logging system fails to redact protected user data from log entries, allowing local authenticated applications to access sensitive information through log files across Sequoia, Sonoma, and Tahoe versions. Apple addressed this privacy issue by improving data redaction mechanisms in patched versions (macOS Sequoia 15.7.3, Sonoma 14.8.3, Tahoe 26.2). No public exploit identified at time of analysis, with EPSS exploitation probability at 0.01% (3rd percentile), indicating minimal real-world risk despite local attack vector.

Session fixation in macOS Voice Control allows authenticated local users to transcribe another user's activity on the same system, disclosing sensitive information without user interaction. The vulnerability affects macOS Sequoia, Sonoma, and Tahoe and is fixed in versions 15.7.3, 14.8.3, and 26.2 respectively. Real-world risk is minimal due to low EPSS (0.01%), requirement for local access and prior authentication, and the need for Voice Control to be explicitly enabled.

Local arbitrary applications on macOS can read sensitive location information due to a permissions validation flaw (CWE-284), affecting macOS Sequoia, Sonoma, and Tahoe. The vulnerability requires user interaction to trigger but grants unauthorized access to location data without proper authorization checks. Apple has released patches in macOS Sequoia 15.7.3, macOS Sonoma 14.8.3, and macOS Tahoe 26.2 to remediate the issue by removing the vulnerable code. No public exploit or active exploitation has been confirmed.

Improper data access control in macOS allows local applications to read sensitive user data without explicit user consent, exploitable through user interaction. The vulnerability affects macOS Sequoia (before 15.7.3), macOS Sonoma (before 14.8.3), and macOS Tahoe (before 26.2). No public exploit code or active exploitation has been identified; EPSS probability is extremely low at 0.01%, indicating minimal real-world attack likelihood despite the moderate CVSS score.

Sensitive user data exposure in Apple macOS allows a locally-installed application to bypass access controls and read data outside its authorized scope, exploiting improper state management. Affected systems include macOS Sequoia prior to 15.7.4, macOS Sonoma prior to 14.8.4, and macOS Tahoe prior to 26.1. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) warrants prompt patching on systems where untrusted applications may execute.

Path traversal vulnerability in macOS directory path handling allows local apps with user privileges to read sensitive user data through improper path validation. Affects macOS Sequoia (before 15.7.3), Sonoma (before 14.8.3), and Tahoe (before 26.1). EPSS score of 0.01% indicates minimal real-world exploitation likelihood despite moderate CVSS severity.

Local authenticated applications can access protected user data on macOS due to improper access control restrictions (CWE-284). This affects macOS Sequoia, Sonoma, and Tahoe across multiple versions and is fixed in Sequoia 15.7.3, Sonoma 14.8.3, and Tahoe 26.2. The vulnerability requires local access and authenticated user privileges to exploit, limiting real-world risk despite the confidentiality impact; no public exploit code or confirmed active exploitation has been identified.

Improper cache handling in macOS allows attackers with physical access to recover deleted notes from memory. The vulnerability affects macOS Sequoia (before 15.7.2), macOS Sonoma (before 14.8.2), and macOS Tahoe (before 26.2), exposing sensitive user data through inadequate data sanitization. No public exploit code has been identified, and the extremely low EPSS score (0.02%) reflects the requirement for physical device access, making real-world exploitation unlikely outside of targeted scenarios involving stolen or temporarily compromised hardware.

Yalantis uCrop 2.2.11 contains an improperly exported Android application component (UCropActivity) in AndroidManifest.xml that allows local attackers with application-level privileges to access the component via intent manipulation, potentially disclosing sensitive information. The vulnerability requires local access and user application permissions but affects confidentiality with low impact. Public exploit code is available, though the EPSS score of 0.06% suggests limited real-world exploitation despite public disclosure.

FreePBX Endpoint Manager versions before 16.0.96 and 17.0.1 through 17.0.9 ship with a weak default app_password of only six numeric digits, which unauthenticated remote attackers can brute force to recover the credential; depending on local mapping that same password may grant access to extension, voicemail, User Manager, DPMA, or EPM phone admin functions. Severity is moderate and the impact is bounded to low confidentiality and integrity effects (CVSS v4.0 base 6.9 with AV:N/AC:L/AT:N/PR:N/UI:N; the independent assessment confirms remote unauthenticated reach with low C/I impact and no availability impact). EPSS is 0.27% (17th percentile) and no public exploit or CISA KEV listing was identified at time of analysis. Vendor fixes are available in 16.0.96 and 17.0.10.

Okta Java SDK versions 11.0.0 through 20.0.0 allow concurrent ApiClient requests to cross-contaminate response status codes and headers, which can undermine access-control decisions in multithreaded applications. This is a timing-dependent race condition (CWE-362) that is not remotely exploitable against default deployments; exploitation requires an application that invokes ApiClient concurrently and bases authorization on its response status or headers. No public exploit or active exploitation has been identified, and EPSS is low at 0.21%, but a vendor patch is available in version 20.0.1 (GHSA text says 21.0.0+).

Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) firmware automatically collect and transmit sensitive information over the network in cleartext, with no user disclosure or opt-in, in the devices' default operating mode. Because the data is not encrypted, anyone positioned to observe the hubs' traffic - a device on the same LAN/Wi-Fi segment or an on-path upstream device - can read the collected information; no authentication or user interaction is required (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N per this assessment; NVD rates it AV:N for 7.5). This is a privacy/data-protection weakness rather than a high-severity remote compromise: EPSS is 0.19% (8th percentile), no public exploit code has been identified at time of analysis, and there is no CISA KEV entry indicating active exploitation.

Aqara Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025) accept firmware images without properly validating their signatures and rely on outdated cryptographic primitives that can be abused to forge a signature that passes verification, allowing a remote attacker to install arbitrary malicious firmware on the hub. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication or user interaction is needed, but high attack complexity because the attacker must be positioned to deliver the image to the device - typically by intercepting the OTA/update channel. Publicly available exploit code exists per the referenced report, but there is no evidence of confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile), so risk is serious in impact yet low in observed urgency for most defenders.

Aqara Hub devices including Hub M2 4.3.6_0027, Hub M3 4.3.6_0025, and Camera Hub G3 4.1.9_0027 fail to validate TLS server certificates in discovery services and CoAP gateway communications, enabling man-in-the-middle attacks that can control or monitor connected devices. An unauthenticated on-path attacker (e.g., with a compromised router or rogue access point) can exploit this without user interaction, though the high attack complexity (AC:H) reflects the need for a MITM position. Publicly available exploit code exists, but EPSS is low (0.18%), and no active exploitation is confirmed.

Aqara Hub devices - Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027) and Hub M3 (4.3.6_0025) - skip TLS server-certificate validation when fetching firmware over HTTPS, so an attacker holding a man-in-the-middle position on the network path can intercept the OTA session and potentially deliver modified firmware to the device. The weakness is remotely triggerable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, 7.4), but exploitation is conditional: the attacker must already control the network path and must catch the device during an actual firmware-download window. Exploit detail is publicly available, and EPSS is low at 0.18% (6th percentile); there is no indication of confirmed active exploitation (not in CISA KEV).

Local information disclosure in Zoom Rooms for macOS before version 6.6.0 allows an authenticated local user to exploit external control of a file name or path, potentially reading arbitrary files accessible to the Zoom Rooms process. The vulnerability requires an existing authenticated session on the host (PR:L) and cannot be triggered remotely or without authentication. With a CVSS base score of 5.5 and an EPSS score of 0.14%, it poses a low-priority risk; no public exploit code or active exploitation has been identified at time of analysis.

User enumeration in Pega Platform can reveal whether a supplied username is valid when the deprecated basic-credentials authentication service type is enabled, affecting versions 7.1.0 through Infinity 25.1.0. The issue depends on measurable response-time differences during authentication, and the independent assessment rates it low priority because it requires the deprecated service and reliable timing discrimination; no credentials, data, or system control are obtained. Patches are available in 24.1.4, 24.2.4, and 25.1.1; EPSS is 0.44% (36th percentile) and no public exploit identified at time of analysis.

Keycloak Admin REST API discloses sensitive role metadata through insufficient authorization checks on the /admin/realms/{realm}/roles endpoint, allowing high-privileged authenticated users to access role information they should not have permission to view. With a CVSS score of 2.7 and EPSS of 0.01%, this is a low-severity information disclosure affecting confidentiality only; no public exploit identified at time of analysis.

Wireless network compromise of EZCast Pro II dongles before version 1.17478.177 occurs because the device's Access Point mode uses a predictable default Wi-Fi password derived from observable identifiers, allowing any attacker within radio range to compute the credential and join the dongle's network. CVSS 4.0 score 9.3 reflects adjacent-network attack vector with no authentication required, and no public exploit identified at time of analysis, though the algorithm is reportedly reversible from broadcast data.

Remote code execution in Google Cloud Data Fusion (built on the CDAP platform) allows an authenticated principal who holds artifact-upload permissions on an instance to execute arbitrary code inside the core AppFabric component through unsafe deserialization of a crafted artifact. Successful exploitation gives the attacker control of the Data Fusion instance, enabling unauthorized access to sensitive data, tampering with data pipelines, and reconnaissance of the underlying infrastructure. No public exploit code has been identified at time of analysis, the EPSS score is low (0.44%, 36th percentile), and the issue is not listed in CISA KEV, so it is a credible but non-emergency authenticated RCE that still warrants prompt patching. Vendor-released fixes are available in CDAP 6.10.6+ and 6.11.1+.

The CNI portmap plugin versions 1.6.0 through 1.8.0 contain a traffic interception vulnerability when configured with the nftables backend, allowing containers to receive and intercept all traffic destined for their configured HostPort regardless of destination IP address. This affects Linux Foundation's CNI Network Plugins, and an attacker with local privileges and control over a container can intercept traffic intended for other containers or services on the same node. The vulnerability has a published patch available in version 1.9.0, an extremely low EPSS score of 0.02% indicates minimal real-world exploitation likelihood, and there is no indication of active exploitation in the wild.

Out-of-bounds read in Adobe Acrobat and Acrobat Reader (versions 24.001.30264, 20.005.30793, 25.001.20982, 24.001.30273, 20.005.30803 and earlier across Classic and Continuous tracks) can lead to arbitrary code execution in the context of the current user when a crafted PDF file is opened. The attack vector is local (AV:L) and requires user interaction (UI:R) - no authentication (PR:N) or special configuration is needed, but the victim must be socially engineered into opening a malicious file, and code runs only at the user's privilege level (S:U). No public exploit code or confirmed active exploitation is identified at time of analysis; this is a genuine patch-priority issue for endpoints rather than an emergency for internet-facing infrastructure.

Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.

Unauthenticated remote attackers who already know a target FortiWeb appliance's serial number can forge a cookie that the device accepts without integrity checking, allowing arbitrary operations through a single crafted HTTP or HTTPS request. Affected releases are FortiWeb 8.0.0 through 8.0.1, 7.6.0 through 7.6.5, 7.4.0 through 7.4.10, 7.2.0 through 7.2.11, and 7.0.0 through 7.0.11; no public exploit code has been identified and the flaw is not listed in CISA KEV at time of analysis. CVSS 3.1 scores this 8.1 with AC:H solely because of the serial-number prerequisite, which narrows opportunistic mass exploitation but does not protect a targeted attacker who can obtain or enumerate the serial, so this remains a real priority despite that mitigating access-complexity factor.

Local file inclusion in the Hara WordPress theme (versions <= 1.2.17) allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to sensitive data exposure, code execution via PHP file inclusion chains, or full site takeover. The attack requires high complexity, and no exploit code or active exploitation has been publicly identified at the time of analysis.

Local File Inclusion vulnerability in the Turitor WordPress theme before version 1.5.3 allows authenticated attackers with low privileges to include arbitrary local files, potentially leading to information disclosure, code execution, or denial of service. No public exploit or active exploitation known at this time.

Local file inclusion vulnerability in thembay's Besa WordPress theme (versions <=2.3.15) allows authenticated users with low privileges to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The CVSS 3.1 base score of 7.5 reflects high impact but requires authentication and high attack complexity. No active exploitation or public exploit code is known at the time of analysis.

Authenticated local file inclusion in the Fashion WordPress theme versions below 5.3.0 allows low-privilege attackers to read arbitrary files and potentially execute code through path traversal in include/require statements. No active exploitation or public proof of concept is known at this time; EPSS probability of exploitation is low (0.22%).

Local file inclusion in the Urna WordPress theme version 2.5.12 and earlier allows authenticated low-privilege users to include arbitrary local files, potentially leading to remote code execution. The vulnerability is not known to be actively exploited and has a very low EPSS score, though the CVSS base score is 7.5 due to potential for full system compromise.

Local File Inclusion in the Digiqole WordPress theme allows authenticated users to include arbitrary local files, leading to potential full system compromise. Versions prior to 2.2.7 are affected. The vulnerability has a high CVSS score but low EPSS exploitation probability and no known public exploit or active exploitation.

Local file inclusion in the ThimPress Sailing WordPress theme before version 4.4.6 allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving remote code execution. The vulnerability carries a CVSS 3.1 base score of 7.5 (High) with a low EPSS probability (0.22%), indicating no active exploitation or publicly available exploit code at this time.

Authenticated local file inclusion in the ekommart WordPress theme before version 4.3.1 allows low-privileged users to read arbitrary files on the server, potentially leading to remote code execution. The vulnerability stems from improper validation of user-supplied input used in PHP include statements.

Local file inclusion in Jobmonster Elementor Addon up to 1.1.4 allows authenticated attackers with low privileges to include arbitrary local files. Successful exploitation can lead to high confidentiality, integrity, and availability impacts. No active exploitation or public exploit code is currently known; EPSS score is low.

Local File Inclusion in the Exhibz WordPress theme (version ≤ 3.0.9) allows authenticated attackers with low privileges to include arbitrary local files on the server, potentially leading to sensitive data exposure or-when combined with file upload-remote code execution. Exploitation requires high attack complexity and no user interaction; there is no evidence of active exploitation or public exploit code as of this analysis.

Local file inclusion in Jobmonster theme (≤4.8.2) allows authenticated attackers to include arbitrary local files, potentially exposing sensitive data or achieving code execution via chaining. The vulnerability requires low-privileged access (PR:L) and high attack complexity (AC:H), reducing real-world exploitability. EPSS score 0.22% suggests low exploitation probability, and no active exploits are confirmed.

Authenticated local file inclusion in Select Core WordPress plugin versions <2.6 allows low-privileged attackers to include arbitrary local files. Under certain configurations, this can escalate to full site compromise, including information disclosure and code execution. At time of analysis, no public exploit or active exploitation has been identified; CVSS 7.5 and EPSS 0.22% indicate a high-severity but currently low-probability risk.

Local file inclusion in Wilmër WordPress theme versions before 3.5 allows authenticated attackers to include arbitrary local files, leading to sensitive information disclosure and potential remote code execution. No public exploit or active exploitation has been reported at time of analysis; EPSS score is low (0.22%).

Insertion of sensitive information into sent data in auxin-elements WordPress plugin versions up to 2.17.15 allows unauthenticated remote attackers to retrieve embedded sensitive data through network-accessible responses. The vulnerability exposes information with low confidentiality impact and affects the Shortcodes and extra features for Phlox theme plugin across all versions through 2.17.15, with EPSS scoring indicating 0.04% likelihood of exploitation.

Local file inclusion in WordPress UDesign Core plugin up to 4.14.0 allows authenticated low-privilege attackers to include arbitrary local files, potentially exposing sensitive data or enabling code execution. The vulnerability requires high attack complexity and is not known to be actively exploited, but carries high impact if successfully leveraged.

Custom Field Template WordPress plugin through version 2.7.6 exposes sensitive system information to high-privilege local users via embedded data retrieval, allowing administrators to access confidential data they should not have access to. The vulnerability requires high administrative privileges and local access, limiting real-world exploitation risk despite the complete confidentiality impact. EPSS probability is minimal at 0.02%, indicating low likelihood of opportunistic exploitation.

A local file inclusion vulnerability in the Ronneby Theme Core WordPress plugin (≤1.5.68) allows authenticated low-privilege attackers to include arbitrary local PHP files, potentially leading to sensitive data exposure or code execution. Exploitation requires an account on the WordPress site and high attack complexity due to filename manipulation. No active exploitation or public exploit code has been reported.

Authenticated information disclosure in ThimPress WP Hotel Booking plugin for WordPress up to version 2.2.7 allows low-privileged users to retrieve embedded sensitive data, such as configuration details. No active exploitation or public exploit code is known at this time, and EPSS indicates a very low probability of widespread exploitation.

Sensitive data exposure in the INFINITUM FORM Geo Controller (cf-geoplugin) WordPress plugin through version 8.9.4 allows unauthenticated remote attackers to retrieve embedded sensitive data via network requests. The vulnerability, categorized as CWE-201, has low detection complexity without user interaction. While no active exploitation (CISA KEV) or public proof-of-concept is reported, the EPSS probability is low at 0.06%, and the publicly disclosed Patchstack advisory indicates a fix is available.

A slab use-after-free in the Linux kernel's Intel AVS (Audio Voice Speech / Smart Sound Technology) ASoC driver lets a local user with access to a HOST HDAudio PCM stream corrupt kernel memory by racing PCM close against period-elapsed IRQ work. When avs_dai_fe_shutdown() frees the DAI's private context while the period-elapsed work is still servicing interrupts, the freed structure can be accessed concurrently, yielding a use-after-free with high confidentiality, integrity and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.20%, 10th percentile), reflecting the local-only, hardware-specific nature of the flaw.

Denial-of-service (kernel use-after-free/double-free) in the Linux kernel's nvmet-fc NVMe-over-Fibre-Channel target driver allows a local privileged operator to crash the kernel by forcibly shutting down an NVMe target port via configfs. When a port is torn down, nvmet_port_subsys_drop_link() calls both nvmet_port_del_ctrls() and nvmet_disable_port(), each of which can schedule the same association-deletion work item; the first run frees all resources and the second reuses freed memory. This is a fix already merged upstream in the stable trees, with no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile).

Denial of service and potential memory corruption in the Linux kernel's NVMe over Fibre Channel (nvme-fc) transport arises because nvme_fc_create_association reads the remote port_state and increments the rport active count without holding a lock, racing against nvme_fc_unregister_remote which can free the remote port when no active association exists. An attacker or fault condition on the FC fabric able to trigger reconnect events concurrently with port teardown can drive a use-after-free style condition on the rport object. There is no public exploit identified at time of analysis and this is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile).

Data-integrity corruption in the Linux kernel's stmmac (Synopsys DesignWare/STMMAC) Ethernet driver allows malformed packets that failed hardware checksum validation to be accepted as valid by the network stack. When hardware checksum offload (CoE) is enabled, the Rx path marked known IP-ethertype frames as CHECKSUM_UNNECESSARY without honoring the hardware's reported header/payload checksum error, so corrupt frames bypass the stack's own validation. There is no public exploit identified at time of analysis, KEV status is not listed, and EPSS is low (0.20%, 11th percentile).

Local privilege-escalation and memory-disclosure flaw in the Linux kernel's DRM GPU SVM (Shared Virtual Memory) subsystem, where incorrect use of hmm_pfn_to_map_order() mishandles an HMM range that only partially covers a huge page (e.g. 2MB), causing the driver to map physical memory outside the intended range - memory that may not even belong to the faulting process's address space. Affecting recent kernels carrying the drm/gpusvm code (associated with the Intel Xe GPU driver's userptr/SVM path), a local user with GPU access can trigger cross-boundary mappings leading to information disclosure or memory corruption. There is no public exploit identified at time of analysis, and EPSS is low at 0.19% (9th percentile).

Local memory-safety flaw in the Linux kernel's AMD GPU (amdgpu) driver allows an authenticated local user to submit a user queue (userq) whose buffer virtual address and size are not validated against a legitimate VM mapping. Because the driver failed to confirm the userq object resides in a valid GPU virtual-memory mapping before use, a low-privileged process with GPU device access could reference out-of-bounds or unmapped memory, tagged as an information-disclosure issue with additional integrity and availability impact. No public exploit identified at time of analysis; EPSS is low (0.19%, 9th percentile), consistent with a local-only kernel driver bug rather than a mass-exploited network flaw.

Use-after-free in the Linux kernel's SMB client (cifs) cached-directory handling lets a race between find_or_create_cached_dir() and smb2_close_cached_fid() free a cfid object while a new reference is being taken, corrupting kernel memory on a host mounting an SMB/CIFS share. The flaw is a reference-counting gap fixed by switching to kref_put_lock() so cfid_release() runs under cfid_list_lock. No public exploit identified at time of analysis, EPSS is low (0.20%, 11th percentile), and it is not listed in CISA KEV.

Remote code execution in Mozilla Firefox and Thunderbird (pre-146) allows unauthenticated network attackers to execute arbitrary code via a use-after-free flaw in the GMP (Gecko Media Plugin) audio/video component. Despite a critical CVSS 9.8 rating, EPSS probability remains low (0.08%, 23rd percentile), and no public exploit identified at time of analysis. Mozilla patched both products in version 146, with vendor advisories and technical details available via Bugzilla.

JIT compiler miscompilation in Mozilla Firefox and Thunderbird's JavaScript engine enables remote attackers to achieve limited confidentiality, integrity, and availability impact without authentication or user interaction. Affects Firefox < 146, Firefox ESR < 140.6, Thunderbird < 146, and Thunderbird ESR < 140.6. Vendor-released patches available in Firefox 146, Firefox ESR 140.6, Thunderbird 146, and Thunderbird 140.6. No public exploit identified at time of analysis, with EPSS score of 0.11% (30th percentile) indicating low predicted exploitation probability.

Sandbox escape in Mozilla Firefox and Thunderbird's CanvasWebGL component allows remote attackers to bypass security boundaries via crafted web content with user interaction. Affects Firefox <146, Firefox ESR <115.31 and <140.6, Thunderbird <146 and Thunderbird ESR <140.6. EPSS probability is low (0.06%, 20th percentile), and no public exploit identified at time of analysis. The CVSS score of 8.0 reflects high confidentiality and integrity impact with scope change, though attack complexity is high and requires user interaction.

Remote code execution via use-after-free in Mozilla Firefox and Thunderbird WebRTC signaling allows unauthenticated network attackers to execute arbitrary code without user interaction. Affects Firefox <146, Firefox ESR <140.6, Thunderbird <146, and Thunderbird ESR <140.6. Vendor-released patches available (Firefox 146, Firefox ESR 140.6, Thunderbird 146, Thunderbird 140.6). CVSS 9.8 (critical) reflects maximum technical severity, though EPSS 0.09% (25th percentile) and absence from CISA KEV suggest limited real-world exploitation at time of analysis. No public exploit identified at time of analysis.

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.18 could disclose sensitive user credentials in log files.

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 stores unencrypted sensitive information in environmental variables files which can be obtained by an authenticated user.

IBM Controller 11.1.0 through 11.1.1 and IBM Cognos Controller 11.0.0 through 11.0.1 FP6 is vulnerable to creation of temporary files without atomic operations which may expose sensitive information to an authenticated user due to race condition attacks.

A cryptanalytic break in Altcha Proof-of-Work obfuscation mode version 0.8.0 and later allows for remote visitors to recover the Proof-of-Work nonce in constant time via mathematical deduction. NOTE: this is disputed by the Supplier because the product's objective is "to discourage automated scraping / bots, not guarantee resistance to determined attackers." The documentation states “the goal is not to provide a secure cryptographic algorithm but to use a proof-of-work mechanism that allows any capable device to decrypt the hidden data.”

A security vulnerability in NUT-14 (CVSS 9.1) that allows cashu tokens. Risk factors: public PoC available.

CVE-2025-14261 is a security vulnerability (CVSS 7.1). High severity vulnerability requiring prompt remediation.

In isValidMediaUri of SettingsProvider.java, there is a possible cross user media read due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

A memory disclosure vulnerability exists in libcoap's OSCORE configuration parser in libcoap before release-4.3.5-patches. An out-of-bounds read may occur when parsing certain configuration values, allowing an attacker to infer or read memory beyond string boundaries in the .rodata section. This could potentially lead to information disclosure or denial of service.

In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Rejected reason: This CVE ID has been withdrawn by its CVE Numbering Authority. No vendor patch available.

A remote code execution vulnerability in A security vulnerability (CVSS 4.7). Risk factors: public PoC available.

A security vulnerability in KNIME Business Hub (CVSS 4.3). Remediation should follow standard vulnerability management procedures.

App lock verification bypass vulnerability in the file management app. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Multi-thread race condition vulnerability in the network management module. Impact: Successful exploitation of this vulnerability may affect availability.

Race condition vulnerability in the network module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Permission control vulnerability in the media library module. Impact: Successful exploitation of this vulnerability may affect service confidentiality.

Race condition vulnerability in the audio module. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2025-66323 is a security vulnerability (CVSS 5.3). Remediation should follow standard vulnerability management procedures.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

Multi-thread race condition vulnerability in the camera framework module. Impact: Successful exploitation of this vulnerability may affect availability.

In the Linux kernel, the following vulnerability has been resolved: virt/coco/sev-guest: Double-buffer messages The encryption algorithms read and write directly to shared unencrypted memory, which may leak information as well as permit the host to tamper with the message integrity. Instead, copy whole messages in or out as needed before doing any computation on them.

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k_qmi_driver_event_work() Currently the buffer pointed by event is not freed in case ATH12K_FLAG_UNREGISTERING bit is set, this causes memory leak. Add a goto skip instead of return, to ensure event and all the list entries are freed properly. Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0.1-00029-QCAHKSWPL_SILICONZ-1

In the Linux kernel, the following vulnerability has been resolved: dm cache: free background tracker's queued work in btracker_destroy Otherwise the kernel can BUG with: [ 2245.426978] ============================================================================= [ 2245.435155] BUG bt_work (Tainted: G B W ): Objects remaining in bt_work on __kmem_cache_shutdown() [ 2245.445233] ----------------------------------------------------------------------------- [ 2245.445233] [ 2245.454879] Slab 0x00000000b0ce2b30 objects=64 used=2 fp=0x000000000a3c6a4e flags=0x17ffffc0000200(slab|node=0|zone=2|lastcpupid=0x1fffff) [ 2245.467300] CPU: 7 PID: 10805 Comm: lvm Kdump: loaded Tainted: G B W 6.0.0-rc2 #19 [ 2245.476078] Hardware name: Dell Inc. PowerEdge R7525/0590KW, BIOS 2.5.6 10/06/2021 [ 2245.483646] Call Trace: [ 2245.486100] <TASK> [ 2245.488206] dump_stack_lvl+0x34/0x48 [ 2245.491878] slab_err+0x95/0xcd [ 2245.495028] __kmem_cache_shutdown.cold+0x31/0x136 [ 2245.499821] kmem_cache_destroy+0x49/0x130 [ 2245.503928] btracker_destroy+0x12/0x20 [dm_cache] [ 2245.508728] smq_destroy+0x15/0x60 [dm_cache_smq] [ 2245.513435] dm_cache_policy_destroy+0x12/0x20 [dm_cache] [ 2245.518834] destroy+0xc0/0x110 [dm_cache] [ 2245.522933] dm_table_destroy+0x5c/0x120 [dm_mod] [ 2245.527649] __dm_destroy+0x10e/0x1c0 [dm_mod] [ 2245.532102] dev_remove+0x117/0x190 [dm_mod] [ 2245.536384] ctl_ioctl+0x1a2/0x290 [dm_mod] [ 2245.540579] dm_ctl_ioctl+0xa/0x20 [dm_mod] [ 2245.544773] __x64_sys_ioctl+0x8a/0xc0 [ 2245.548524] do_syscall_64+0x5c/0x90 [ 2245.552104] ? syscall_exit_to_user_mode+0x12/0x30 [ 2245.556897] ? do_syscall_64+0x69/0x90 [ 2245.560648] ? do_syscall_64+0x69/0x90 [ 2245.564394] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 2245.569447] RIP: 0033:0x7fe52583ec6b ... [ 2245.646771] ------------[ cut here ]------------ [ 2245.651395] kmem_cache_destroy bt_work: Slab cache still has objects when called from btracker_destroy+0x12/0x20 [dm_cache] [ 2245.651408] WARNING: CPU: 7 PID: 10805 at mm/slab_common.c:478 kmem_cache_destroy+0x128/0x130 Found using: lvm2-testsuite --only "cache-single-split.sh" Ben bisected and found that commit 0495e337b703 ("mm/slab_common: Deleting kobject in kmem_cache_destroy() without holding slab_mutex/cpu_hotplug_lock") first exposed dm-cache's incomplete cleanup of its background tracker work objects.

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Handle lock during peer_id find ath12k_peer_find_by_id() requires that the caller hold the ab->base_lock. Currently the WBM error path does not hold the lock and calling that function, leads to the following lockdep_assert()in QCN9274: [105162.160893] ------------[ cut here ]------------ [105162.160916] WARNING: CPU: 3 PID: 0 at drivers/net/wireless/ath/ath12k/peer.c:71 ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160933] Modules linked in: ath12k(O) qrtr_mhi qrtr mac80211 cfg80211 mhi qmi_helpers libarc4 nvme nvme_core [last unloaded: ath12k(O)] [105162.160967] CPU: 3 PID: 0 Comm: swapper/3 Tainted: G W O 6.1.0-rc2+ #3 [105162.160972] Hardware name: Intel(R) Client Systems NUC8i7HVK/NUC8i7HVB, BIOS HNKBLi70.86A.0056.2019.0506.1527 05/06/2019 [105162.160977] RIP: 0010:ath12k_peer_find_by_id+0x52/0x60 [ath12k] [105162.160990] Code: 07 eb 0f 39 68 24 74 0a 48 8b 00 48 39 f8 75 f3 31 c0 5b 5d c3 48 8d bf b0 f2 00 00 be ff ff ff ff e8 22 20 c4 e2 85 c0 75 bf <0f> 0b eb bb 66 2e 0f 1f 84 00 00 00 00 00 41 54 4c 8d a7 98 f2 00 [105162.160996] RSP: 0018:ffffa223001acc60 EFLAGS: 00010246 [105162.161003] RAX: 0000000000000000 RBX: ffff9f0573940000 RCX: 0000000000000000 [105162.161008] RDX: 0000000000000001 RSI: ffffffffa3951c8e RDI: ffffffffa39a96d7 [105162.161013] RBP: 000000000000000a R08: 0000000000000000 R09: 0000000000000000 [105162.161017] R10: ffffa223001acb40 R11: ffffffffa3d57c60 R12: ffff9f057394f2e0 [105162.161022] R13: ffff9f0573940000 R14: ffff9f04ecd659c0 R15: ffff9f04d5a9b040 [105162.161026] FS: 0000000000000000(0000) GS:ffff9f0575600000(0000) knlGS:0000000000000000 [105162.161031] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [105162.161036] CR2: 00001d5c8277a008 CR3: 00000001e6224006 CR4: 00000000003706e0 [105162.161041] Call Trace: [105162.161046] <IRQ> [105162.161051] ath12k_dp_rx_process_wbm_err+0x6da/0xaf0 [ath12k] [105162.161072] ? ath12k_dp_rx_process_err+0x80e/0x15a0 [ath12k] [105162.161084] ? __lock_acquire+0x4ca/0x1a60 [105162.161104] ath12k_dp_service_srng+0x263/0x310 [ath12k] [105162.161120] ath12k_pci_ext_grp_napi_poll+0x1c/0x70 [ath12k] [105162.161133] __napi_poll+0x22/0x260 [105162.161141] net_rx_action+0x2f8/0x380 [105162.161153] __do_softirq+0xd0/0x4c9 [105162.161162] irq_exit_rcu+0x88/0xe0 [105162.161169] common_interrupt+0xa5/0xc0 [105162.161174] </IRQ> [105162.161179] <TASK> [105162.161184] asm_common_interrupt+0x22/0x40 Handle spin lock/unlock in WBM error path to hold the necessary lock expected by ath12k_peer_find_by_id(). Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.0-03171-QCAHKSWPL_SILICONZ-1

In the Linux kernel, the following vulnerability has been resolved: USB: usbtmc: Fix direction for 0-length ioctl control messages The syzbot fuzzer found a problem in the usbtmc driver: When a user submits an ioctl for a 0-length control transfer, the driver does not check that the direction is set to OUT: ------------[ cut here ]------------ usb 3-1: BOGUS control dir, pipe 80000b80 doesn't match bRequestType fd WARNING: CPU: 0 PID: 5100 at drivers/usb/core/urb.c:411 usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Modules linked in: CPU: 0 PID: 5100 Comm: syz-executor428 Not tainted 6.3.0-syzkaller-12049-g58390c8ce1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/14/2023 RIP: 0010:usb_submit_urb+0x14a7/0x1880 drivers/usb/core/urb.c:411 Code: 7c 24 40 e8 1b 13 5c fb 48 8b 7c 24 40 e8 21 1d f0 fe 45 89 e8 44 89 f1 4c 89 e2 48 89 c6 48 c7 c7 e0 b5 fc 8a e8 19 c8 23 fb <0f> 0b e9 9f ee ff ff e8 ed 12 5c fb 0f b6 1d 12 8a 3c 08 31 ff 41 RSP: 0018:ffffc90003d2fb00 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff8880789e9058 RCX: 0000000000000000 RDX: ffff888029593b80 RSI: ffffffff814c1447 RDI: 0000000000000001 RBP: ffff88801ea742f8 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffff88802915e528 R13: 00000000000000fd R14: 0000000080000b80 R15: ffff8880222b3100 FS: 0000555556ca63c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9ef4d18150 CR3: 0000000073e5b000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> usb_start_wait_urb+0x101/0x4b0 drivers/usb/core/message.c:58 usb_internal_control_msg drivers/usb/core/message.c:102 [inline] usb_control_msg+0x320/0x4a0 drivers/usb/core/message.c:153 usbtmc_ioctl_request drivers/usb/class/usbtmc.c:1954 [inline] usbtmc_ioctl+0x1b3d/0x2840 drivers/usb/class/usbtmc.c:2097 To fix this, we must override the direction in the bRequestType field of the control request structure when the length is 0.

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: mcq: Fix &hwq->cq_lock deadlock issue When ufshcd_err_handler() is executed, CQ event interrupt can enter waiting for the same lock. This can happen in ufshcd_handle_mcq_cq_events() and also in ufs_mtk_mcq_intr(). The following warning message will be generated when &hwq->cq_lock is used in IRQ context with IRQ enabled. Use ufshcd_mcq_poll_cqe_lock() with spin_lock_irqsave instead of spin_lock to resolve the deadlock issue. [name:lockdep&]WARNING: inconsistent lock state [name:lockdep&]-------------------------------- [name:lockdep&]inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. [name:lockdep&]kworker/u16:4/260 [HC0[0]:SC0[0]:HE1:SE1] takes: ffffff8028444600 (&hwq->cq_lock){?.-.}-{2:2}, at: ufshcd_mcq_poll_cqe_lock+0x30/0xe0 [name:lockdep&]{IN-HARDIRQ-W} state was registered at: lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufs_mtk_mcq_intr+0x60/0x1bc [ufs_mediatek_mod] __handle_irq_event_percpu+0x140/0x3ec handle_irq_event+0x50/0xd8 handle_fasteoi_irq+0x148/0x2b0 generic_handle_domain_irq+0x4c/0x6c gic_handle_irq+0x58/0x134 call_on_irq_stack+0x40/0x74 do_interrupt_handler+0x84/0xe4 el1_interrupt+0x3c/0x78 <snip> Possible unsafe locking scenario: CPU0 ---- lock(&hwq->cq_lock); <Interrupt> lock(&hwq->cq_lock); *** DEADLOCK *** 2 locks held by kworker/u16:4/260: [name:lockdep&] stack backtrace: CPU: 7 PID: 260 Comm: kworker/u16:4 Tainted: G S W OE 6.1.17-mainline-android14-2-g277223301adb #1 Workqueue: ufs_eh_wq_0 ufshcd_err_handler Call trace: dump_backtrace+0x10c/0x160 show_stack+0x20/0x30 dump_stack_lvl+0x98/0xd8 dump_stack+0x20/0x60 print_usage_bug+0x584/0x76c mark_lock_irq+0x488/0x510 mark_lock+0x1ec/0x25c __lock_acquire+0x4d8/0xffc lock_acquire+0x17c/0x33c _raw_spin_lock+0x5c/0x7c ufshcd_mcq_poll_cqe_lock+0x30/0xe0 ufshcd_poll+0x68/0x1b0 ufshcd_transfer_req_compl+0x9c/0xc8 ufshcd_err_handler+0x3bc/0xea0 process_one_work+0x2f4/0x7e8 worker_thread+0x234/0x450 kthread+0x110/0x134 ret_from_fork+0x10/0x20