Information Disclosure

A potential vulnerability was reported in some Lenovo Tablets that could allow a local authenticated user or application to gain access to sensitive device specific information. Rated medium severity (CVSS 6.8), this vulnerability is low attack complexity. No vendor patch available.

Nagios XI versions prior to 2024R1.1.3, under certain circumstances, disclose sensitive user account information (including API keys and hashed passwords) to authenticated users who should not have. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable. No vendor patch available.

Rejected reason: DO NOT USE THIS CVE RECORD. No vendor patch available.

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

An issue in Raspberry Pi Imager version 1.9.6 for Windows, affecting its OS customization feature. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A vulnerability was detected in PHPGurukul News Portal 1.0. Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

A security vulnerability has been detected in PHPGurukul News Portal 1.0. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.

Web UI Malfunction when setting unexpected locale via API.19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Multiple Devices are Sharing the Same Secrets for SDKSocket (TCP/5000).19.5; BLU-IC4: through 1.19.5. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Import WP - Export and Import CSV and XML files to WordPress plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 2.14.16. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Advanced Ads - Ad Manager & AdSense plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.12 via the select_one() function. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The WP Discourse plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.5.9. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The List category posts plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 0.92.0 via the 'catlist' shortcode due to insufficient restrictions on which. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Document Library and the Adaptive Media modules in Liferay Portal 7.4.0 through 7.4.3.111, and older unsupported versions, and Liferay DXP 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

LogicalDOC Community Edition up to 9.2.1 fails to implement rate limiting on the admin login page (/login.jsp), allowing remote attackers to conduct brute-force authentication attacks with high complexity but difficult exploitability. Publicly available exploit code exists, though the vendor has not responded to early disclosure notification, and real-world exploitation risk remains low given the EPSS score of 0.16% and high attack complexity.

Local privilege-agnostic code execution in Trimble SketchUp desktop 2025 for Windows occurs when its helper process sketchup_webhelper.exe loads an attacker-supplied libcef.dll from an insecure search path (CWE-427). A local attacker who can drop a crafted DLL into a directory searched by the helper gains full confidentiality, integrity, and availability impact in the context of the running process. No public exploit identified in the provided data, though a third-party technical writeup (yawataa.github.io) documenting the issue exists; EPSS is low at 0.17% (7th percentile), indicating negligible measured exploitation activity.

Local file inclusion in Consulting Elementor Widgets 1.4.2 and earlier allows authenticated attackers with low privileges to read arbitrary files on the server, potentially leading to full compromise. The flaw arises from improper filename validation in PHP include/require calls. While the CVSS score is high (7.5), exploitation requires authentication and high attack complexity; EPSS indicates very low exploitation probability (0.05%) and no active exploitation has been confirmed.

Local File Inclusion in the StylemixThemes 'Consulting' WordPress theme (all versions up to but not including 6.7.5) lets an authenticated attacker control a filename passed to a PHP include/require statement, forcing the server to include and execute local files. Because arbitrary local PHP files can be executed, this can escalate to disclosure of sensitive files (wp-config.php credentials) and potential code execution via log poisoning or session/upload files. Reported by Patchstack; no public exploit identified at time of analysis, and EPSS is low at 0.05% (16th percentile).

Authentication cache collision in Dovecot mail server allows remote attackers to gain unauthorized access to other users' accounts under specific caching configurations. When passdb/userdb caching is enabled, certain drivers incorrectly use identical cache keys for multiple distinct users, causing authentication data from one user to be applied to subsequent login attempts by different users. This vulnerability enables attackers to authenticate as other users after the legitimate user's credentials are cached, with no public exploit identified at time of analysis. Despite low EPSS probability (0.03%), the network-accessible attack vector and potential for unauthorized email access warrants immediate remediation in environments using affected caching configurations.

Memory-management flaw in the Linux kernel VFS layer allows a local user with handle-lookup privileges to leak disconnected directory dentries by calling open_by_handle_at() on uncached inodes, eventually producing a 'Busy inodes after unmount' condition and unreclaimed kernel memory. The bug surfaces when reconnect_one() fails to find the target dentry and creates a replacement that is not flagged as disconnected, so dput() never immediately reclaims it - a regression exposed by commit f1ee616214cb, which stopped tracking most disconnected dentries on sb->s_anon. There is no public exploit identified at time of analysis, EPSS is low (0.19%, 9th percentile), and this is not in CISA KEV.

Out-of-bounds memory access in the Linux kernel's CIFS/SMB client (parse_dfs_referrals) allows a malicious or compromised SMB server to trigger memory corruption on connecting clients by returning a malformed FSCTL_DFS_GET_REFERRALS reply. The flaw affects Linux systems that mount SMB/CIFS shares and process DFS referrals, where a reply shorter than struct get_dfs_referral_rsp or claiming more referrals than it contains drives reads past the buffer. No public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with a client-side, server-triggered condition rather than mass-exploitable exposure.

Local memory corruption in the Linux kernel's DRM GPU scheduler (drm/sched) stems from a double free in drm_sched_job_add_resv_dependencies(), where a dma_fence reference that drm_sched_job_add_dependency() already consumed on its failure path is released a second time when the backing xarray fails to expand. Any local user able to submit GPU jobs on an affected kernel can trigger the flaw, leading to kernel memory corruption and denial of service. There is no public exploit identified at time of analysis, EPSS is low (0.19%), and it is not listed in CISA KEV.

Recursive rwsem deadlock in the Linux kernel's ksmbd SMB server subsystem causes ksmbd worker threads to hang indefinitely when any SMB client opens a named pipe, resulting in denial of service for all SMB connections. The flaw was introduced by commit 305853cce3794, which fixed a race condition in RPC handle list access but inadvertently created a deadlock: ksmbd_session_rpc_open acquires sess->rpc_lock as a write lock, then calls ksmbd_rpc_open → ksmbd_session_rpc_method, which attempts to re-acquire the same lock as a read lock - blocking the kernel worker thread indefinitely. No public exploit code exists and EPSS is 0.14% (4th percentile), but the trigger is deterministic and reliable against any ksmbd deployment once valid SMB credentials are obtained. This vulnerability is not in CISA KEV.

Out-of-bounds read in the Linux kernel's ksmbd in-kernel SMB server allows a 4-byte read past a declared IPC payload boundary when handle_response() in transport_ipc.c dereferences a message handle without first validating that the payload is at least 4 bytes long. The flaw is triggered by a malformed or truncated message from the userspace ksmbd.mountd helper, potentially leaking a small amount of adjacent kernel memory or crashing the kernel. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.19% (9th percentile).

Arbitrary file read vulnerability in Anti-Malware Security and Brute-Force Firewall WordPress plugin (versions up to 4.23.81) allows authenticated Subscriber-level users to read sensitive files from the server via unprotected AJAX endpoints. The vulnerability combines missing capability checks with information exposure in multiple GOTMLS_* AJAX actions, enabling attackers with minimal WordPress privileges to access arbitrary file contents including configuration files and credentials. No public exploit code has been confirmed at this time, though the vulnerability is trivial to exploit given the low authentication barrier.

Information disclosure in BESSystem (Baolande) BES Application Server through version 9.5.x lets remote unauthenticated attackers retrieve sensitive data by abusing the "pre-resource" option in the bes-web.xml deployment descriptor. The flaw exposes protected resources or configuration content over the network with no authentication (CVSS 7.5, C:H). No public exploit identified at time of analysis, though a third-party gist referencing the issue is linked in NVD; EPSS is low at 0.34% (26th percentile).

Information disclosure in IBM Concert Software 1.0.0 through 2.0.0 allows an authenticated local user to read sensitive data that the application leaves behind in heap buffers it frees without first clearing (CWE-244). Exploitation is confined to the local host and requires low privileges (CVSS 3.1 AV:L/AC:L/PR:L, medium 5.5, confidentiality-only impact), and because the attacker cannot control which residual data happens to remain in freed memory, any leak is opportunistic rather than deterministic. No public exploit code is identified, the issue is not in CISA KEV, and EPSS is negligible at 0.12% (1st percentile), so this rates as a genuinely low-priority finding despite the medium base score.

Use-after-free vulnerability in Mozilla Firefox 142 and 143 enables compromised renderer processes to trigger memory corruption in the GPU or browser process via malicious WebGPU IPC calls, potentially achieving sandbox escape. Affecting Firefox versions 142.0 through 144.0.1, this CWE-416 flaw carries CVSS 9.8 despite low real-world exploitation probability (EPSS 0.06%, 18th percentile). No public exploit identified at time of analysis. Patched in Firefox 144.0.2 released January 2025.

Incorrect privilege assignment in the TrustyAI component of Red Hat OpenShift AI exposes pod, PersistentVolumeClaim, and LMEvalJob metadata cluster-wide to every authenticated user or service account. The TrustyAI operator automatically provisions a ClusterRoleBinding that binds the role `trustyai-service-operator-lmeval-user-role` to `system:authenticated`, the built-in Kubernetes group encompassing all authenticated identities - meaning any user or workload with valid cluster credentials inherits get/list/watch permissions on pods in every namespace. No special conditions are required beyond holding any valid credential on the cluster. No public exploit has been identified at time of analysis, and the EPSS score of 0.03% reflects low opportunistic exploitation probability, though the misconfiguration is trivially leveraged by any cluster tenant.

Out-of-bounds slab read in the Linux kernel's HFS+ filesystem driver (fs/hfsplus/unicode.c) allows a local low-privileged attacker to read adjacent kernel heap memory by triggering hfsplus_uni2asc() through the listxattr() path on a crafted/malformed HFS+ image. Because hfsplus_listxattr() passes a struct hfsplus_attr_unistr* whose layout differs from the struct hfsplus_unistr* the earlier fix (commit 94458781aee6) assumed, an oversized ustrlen drives the Unicode buffer pointer past the allocation. There is no public exploit identified at time of analysis, and EPSS is low (0.18%), consistent with a memory-disclosure primitive requiring local filesystem access rather than remote mass exploitation.

In the Linux kernel, the following vulnerability has been resolved: nbd: restrict sockets to TCP and UDP Recently, syzbot started to abuse NBD with all kinds of sockets. Commit cf1b2326b734 ("nbd: verify socket is supported during setup") made sure the socket supported a shutdown() method. Explicitely accept TCP and UNIX stream sockets.

Kernel panic (and potential memory corruption) in the Linux kernel BPF JIT on the RISC-V architecture allows a local privileged actor to crash the system when a BPF struct_ops program (such as a bpf_qdisc scheduler) returns a pointer. The RISC-V JIT epilogue sign-extended struct_ops return values as if they were 32-bit scalars, violating the RISC-V calling convention and corrupting the returned 64-bit pointer, which the network qdisc path then dereferences. No public exploit identified at time of analysis; EPSS is low (0.18%, 8th percentile) and this affects only RISC-V builds using the BPF qdisc/struct_ops feature.

In the Linux kernel, the following vulnerability has been resolved: bpf: Explicitly check accesses to bpf_sock_addr Syzkaller found a kernel warning on the following sock_addr program: 0: r0 = 0 1: r2 = *(u32 *)(r1 +60) 2: exit which triggers: verifier bug: error during ctx access conversion (0) This is happening because offset 60 in bpf_sock_addr corresponds to an implicit padding of 4 bytes, right after msg_src_ip4. Access to this padding isn't rejected in sock_addr_is_valid_access and it thus later fails to convert the access. This patch fixes it by explicitly checking the various fields of bpf_sock_addr in sock_addr_is_valid_access. I checked the other ctx structures and is_valid_access functions and didn't find any other similar cases. Other cases of (properly handled) padding are covered in new tests in a subsequent patch.

Information disclosure and memory-safety risk in the Linux kernel's TCP metrics (tcp_metrics) subsystem stems from three call sites using the non-lockdep-safe dst_dev() accessor, now replaced by the RCU-aware dst_dev_net_rcu() helper. Affected are Linux kernel builds prior to the fixing stable commits; a race in device/net dereference during TCP metric handling could expose kernel memory or destabilize the network stack. There is no public exploit identified at time of analysis, EPSS is low (0.18%), and the issue is not listed in CISA KEV.

Use-after-free in the Linux kernel IPv4 networking stack allows potential kernel memory disclosure or corruption when destination (dst) entries are accessed without proper RCU protection during ICMP rate-limiting, IP fragment reassembly, and multicast forwarding. The fix converts icmpv4_xrlim_allow(), ip_defrag(), the ipmr multicast transmit paths, and ipv4_neigh_lookup() to the lockdep-enabled dst_dev_rcu() accessor. No public exploit identified at time of analysis, and EPSS probability is low (0.17%, 7th percentile), consistent with a hard-to-win kernel race rather than a readily weaponized flaw.

In the Linux kernel, the following vulnerability has been resolved: pps: fix warning in pps_register_cdev when register device fail Similar to previous commit 2a934fdb01db ("media: v4l2-dev: fix error handling in __video_register_device()"), the release hook should be set before device_register(). Otherwise, when device_register() return error and put_device() try to callback the release function, the below warning may happen. ------------[ cut here ]------------ WARNING: CPU: 1 PID: 4760 at drivers/base/core.c:2567 device_release+0x1bd/0x240 drivers/base/core.c:2567 Modules linked in: CPU: 1 UID: 0 PID: 4760 Comm: syz.4.914 Not tainted 6.17.0-rc3+ #1 NONE RIP: 0010:device_release+0x1bd/0x240 drivers/base/core.c:2567 Call Trace: <TASK> kobject_cleanup+0x136/0x410 lib/kobject.c:689 kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0xe9/0x130 lib/kobject.c:737 put_device+0x24/0x30 drivers/base/core.c:3797 pps_register_cdev+0x2da/0x370 drivers/pps/pps.c:402 pps_register_source+0x2f6/0x480 drivers/pps/kapi.c:108 pps_tty_open+0x190/0x310 drivers/pps/clients/pps-ldisc.c:57 tty_ldisc_open+0xa7/0x120 drivers/tty/tty_ldisc.c:432 tty_set_ldisc+0x333/0x780 drivers/tty/tty_ldisc.c:563 tiocsetd drivers/tty/tty_io.c:2429 [inline] tty_ioctl+0x5d1/0x1700 drivers/tty/tty_io.c:2728 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:598 [inline] __se_sys_ioctl fs/ioctl.c:584 [inline] __x64_sys_ioctl+0x194/0x210 fs/ioctl.c:584 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x5f/0x2a0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e </TASK> Before commit c79a39dc8d06 ("pps: Fix a use-after-free"), pps_register_cdev() call device_create() to create pps->dev, which will init dev->release to device_create_release(). Now the comment is outdated, just remove it. Thanks for the reminder from Calvin Owens, 'kfree_pps' should be removed in pps_register_source() to avoid a double free in the failure case.

Memory/object reference leak in the Linux kernel's drm/msm (Qualcomm Adreno GPU) driver lets a local user with GPU device access leak kernel object references when the VM_BIND ioctl error path fails a handle lookup partway through, dropping already-obtained GEM object references incorrectly. It affects Linux kernels carrying the newer MSM VM_BIND uAPI and is patched upstream via kernel.org stable commits. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and it is not listed in CISA KEV.

Local filesystem corruption / potential memory corruption in the Linux kernel's ntfs3 driver arises when an index allocation is performed against a $BITMAP attribute that is empty while index blocks already exist on disk. An attacker who can get a victim to mount a malformed NTFS image can drive the driver into an inconsistent index state during rename() of long filenames, causing subsequent operations to fail (-ENOENT) and reflecting on-disk corruption that the driver previously failed to reject. There is no public exploit identified at time of analysis, the EPSS probability is low (0.19%, 9th percentile), and it is not listed in CISA KEV.

Local privilege escalation and memory corruption in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger a use-after-free of a net_device during a connect() call on an SMC socket. The flaw lives in smc_pnet_find_ism_resource() / smc_pnet_find_roce_resource(), which dereference a destination device (dst->dev) that can be freed and swapped for blackhole_netdev before RTNL is acquired in pnet_find_base_ndev(). It was discovered by syzbot fuzzing; there is no public exploit identified at time of analysis, it is not on CISA KEV, and its EPSS probability is very low (0.17%, 7th percentile).

Memory corruption in the Linux kernel's crypto compression subsystem (scomp/acomp) arises because struct layout randomization can reorder the alloc_ctx and free_ctx function pointers in scomp_alg independently of the crypto_acomp_streams struct that was built to mirror them, introduced by commit 42d9f6c77479. When the CONFIG_RANDSTRUCT hardening feature reorders these pure ops structures inconsistently, the kernel invokes the wrong context allocation/free callback, leading to high-impact confidentiality, integrity, and availability effects for a local low-privileged actor. No public exploit identified at time of analysis and EPSS probability is low (0.17%), so this is a hardening-regression fix rather than an actively exploited flaw.

Local privilege escalation via use-after-free in the Linux kernel's RDMA/rxe (Soft-RoCE) driver allows a low-privileged local user to corrupt kernel memory by winning a race in do_task(). When the task loop exhausts its iteration budget it blindly resets state to TASK_STATE_IDLE, overwriting a concurrent TASK_STATE_DRAINING set during rxe_cleanup_task()/rxe_disable_task() teardown, so a task reschedules against freed structures. No public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.

Improper enablement of IOMMU dirty page tracking in the Intel VT-d (iommu/vt-d) driver of the Linux kernel allows a misconfiguration where dirty tracking is offered even when the IOMMU performs incoherent page walks. Because the hardware cannot atomically update A/EA/D bits in non-snooped paging-structure entries, this triggers a non-recoverable fault and can corrupt or silently drop dirty-page state used during operations like VM live migration. No public exploit identified at time of analysis; EPSS is low (0.20%, 10th percentile) and this is a corrective hardening patch rather than an actively exploited flaw.

Improper return-value handling in the Linux kernel's vhost vringh host-side virtqueue library allows a local low-privileged actor (including a malicious or misbehaving guest driving a vhost/vDPA backend) to trigger processing of partially-copied descriptor data, potentially disclosing kernel memory. The vringh code checked copy_from_iter/copy_to_iter results for a negative error that these functions cannot return, so short (incomplete) copies were silently treated as success. No public exploit identified at time of analysis; EPSS is low at 0.20% (10th percentile) and the CVE is not in CISA KEV.

Denial of service in the Linux kernel's uio_hv_generic driver affects Hyper-V guest VMs that expose VMBus channels to userspace UIO drivers, where the kernel driver improperly manipulated the ring-buffer interrupt mask concurrently with user space. This race causes the guest user-mode driver to miss a host interrupt and hang indefinitely inside pread(), stalling the affected service. No public exploit identified at time of analysis; EPSS is low (0.21%, 12th percentile) and it is not on the CISA KEV list.

Local privilege escalation risk in the Linux kernel's io_uring waitid handling stems from a race condition in io_waitid_wait(), where a successful return failed to prune the task's entry from the wait queue when a cancelation was concurrently in progress, allowing the wait queue callback to be invoked twice against a stale entry. Authenticated local attackers (PR:L per CVSS) could exploit this to corrupt kernel memory with high confidentiality, integrity, and availability impact (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS is low (0.20%).

Improper accounting in the Linux kernel's io_uring zero-copy receive (zcrx) path allows a zcrx recv request to return more data than the caller requested, caused by desc->count being adjusted for all received buffers and then double-counted during recursive processing of frag-list skbs, leading to counter underflow. Affected are Linux kernels shipping the io_uring zcrx feature, where a local process using this interface can read beyond the intended receive limit. There is no public exploit identified at time of analysis, and EPSS is low (0.19%, 9th percentile), consistent with an internal kernel-hardening fix rather than an actively exploited flaw.

Uninitialized-memory disclosure in the Linux kernel's NFC NCI subsystem lets a local actor with access to the NCI interface trigger reads of unallocated skb->data by submitting NCI control packets whose declared header length passes the weak nic_valid_size() check but does not match the actual buffer layout expected per opcode. The flaw, found by Syzbot in nci_init_req, affects Linux kernels built with the NFC/NCI stack; it is tagged Information Disclosure with an EPSS of 0.21% (11th percentile) and no public exploit identified at time of analysis. Upstream fixes add per-handler parameter validation and silently drop malformed packets.

Kernel panic (denial of service) in the Linux kernel's LoongArch BPF JIT compiler affects systems running on LoongArch (Loongson) 64-bit CPUs when BPF struct_ops programs - such as a BPF-based qdisc - are attached and their pointer return values are consumed by the kernel networking path. The LoongArch JIT epilogue sign-extended 32-bit return values as it does for ordinary BPF programs, but struct_ops functions must follow the LoongArch calling ABI, so a returned pointer (e.g. an skb from bpf_fifo_dequeue) was truncated/sign-extended into an invalid address that the kernel then dereferenced, causing an unhandled paging fault in __qdisc_run(). This is no public exploit identified at time of analysis and is not on CISA KEV; EPSS is low (0.19%, 9th percentile).

Race conditions in the ksmbd in-kernel SMB server's RPC handle list (sess->rpc_handle_list XArray) expose systems to use-after-free and kernel availability loss. ksmbd_session_rpc_open() incorrectly acquired only a read lock before performing mutating XArray operations, and ksmbd_session_rpc_method() performed xa_load() with no lock at all - creating a window where concurrent session operations can corrupt or dereference freed memory. No public exploit exists and EPSS is 0.13% (3rd percentile), placing real-world exploitation risk very low, though the use-after-free primitive carries latent potential beyond the scored availability impact.

Host denial-of-service in the Linux kernel's KVM AMD (SVM) subsystem allows a guest VM to crash or hang the hypervisor host when the CPU/host is running with next-RIP support disabled (nrips=false). In that mode the WRMSR, HLT and INVD VM-Exit fastpath handlers attempt to decode and emulate the guest instruction to advance RIP, which reads guest memory and can sleep - but these handlers run with IRQs disabled, triggering a 'sleeping function called from invalid context' BUG and destabilizing the host. There is no public exploit identified at time of analysis, and EPSS is low (0.20%, 10th percentile); despite the 7.1 CVSS the scope-changed availability impact is gated by a non-default configuration.

Local privilege escalation and memory corruption in the Linux kernel's Android binder IPC driver arises from a double-free in the dynamic bitmap (dbitmap) allocator used for per-process reference tracking. When a process's dmap expansion fails, dbitmap_grow() frees the old bitmap, but the pointer is not cleared, so binder_proc_dec_tmpref() frees it a second time at process teardown, corrupting the kernel heap. This is a memory-safety flaw exploitable by any local user with binder access (default on Android and many Linux systems); there is no public exploit identified at time of analysis and the EPSS score is low (0.19%).

Local privilege escalation and denial of service in the Linux kernel's 9p (Plan 9) filesystem transport (net/9p/trans_fd.c) arises from a double request free in p9_fd_cancelled(). A race between p9_read_work() cancelling pending requests and p9_fd_cancelled() cleaning up a flush request causes the same req_list entry to be removed twice via list_del(), corrupting kernel list pointers (the classic 0xdead000000000100 poison), yielding a GPF/KASAN wild-memory-access that a local user can trigger by mounting a malicious 9p share. No public exploit identified at time of analysis; the flaw was found by the Linux Verification Center with Syzkaller, and EPSS is low at 0.22% (12th percentile).

Path normalization bypass in Keycloak allows unauthenticated network attackers to circumvent reverse proxy access controls protecting the /admin interface by submitting HTTP requests with non-normalized paths (containing `..` or `//`). Proxies such as HAProxy perform literal string matching on the raw request URI and do not block these crafted paths, while Keycloak internally normalizes them to resolve to /admin — effectively defeating the proxy-layer security control. This vulnerability is not in CISA KEV and carries a low EPSS score (0.38%), but is directly relevant to any proxy-protected Keycloak deployment following the vendor's own recommended hardening guidance.

Link following vulnerability in AntiDupl.NET.WinForms.exe (versions through 2.3.12) allows local authenticated users to manipulate file operations during duplicate image deletion, potentially achieving unauthorized file access or modification with elevated integrity. Proof-of-concept exploit code exists (CVSS E:P). The vendor (ermig1979) was notified but has not responded, leaving users without an official patch.

Improper authorization in TIME-SEA-PLUS PayController.java alipayIsSucceed function allows authenticated remote attackers to disclose sensitive information related to order status handling. The vulnerability affects versions up to commit fb299162f18498dd9cf17da906886d80a077d53b, with publicly available exploit code disclosed but low real-world exploitation probability (EPSS 0.03%). Attack requires valid user credentials and network access but does not enable privilege escalation or data modification.

Denial of service in Apache Tomcat occurs when multipart upload errors leave temporary disk files uncleaned, allowing attackers to exhaust disk space faster than garbage collection reclaims it. Affected versions 8.5.0-8.5.100 (EOL), 9.0.0-M1-9.0.109, 10.1.0-M1-10.1.46, and 11.0.0-M1-11.0.11 require authenticated access (PR:L) and high attack complexity, making real-world exploitation limited despite the medium CVSS score.

Unauthenticated authenticated users can disclose sensitive information through an unknown function in UserApiController.java in atjiu pybbs up to version 6.0.0 via remote network access. The vulnerability has a CVSS score of 2.1 with low confidentiality impact and publicly available exploit code, but extremely low real-world exploitation probability (EPSS 0.03%, 8th percentile) and requires authenticated access, limiting practical risk despite public POC availability.

Information disclosure in LearnHouse Image Handler component allows authenticated remote attackers to access sensitive data via the image handling functionality. The vulnerability affects all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca, with publicly available exploit code documented. Due to LearnHouse's rolling-release model, specific patched version numbers are unavailable, and the vendor has not responded to disclosure attempts.

LearnHouse allows authenticated remote attackers to access unauthorized student assignment files through improper control of resource identifiers in the Student Assignment Submission Handler API endpoint, enabling information disclosure of sensitive academic materials. The vulnerability affects all versions up to commit 98dfad76aad70711a8113f6c1fdabfccf10509ca, with publicly available exploit code disclosed. EPSS exploitation probability is 0.04% (13th percentile), indicating low real-world exploitation likelihood despite public POC availability.

Unquoted service path privilege escalation in Hasleo Backup Suite up to version 5.2 exposes local users to SYSTEM-level code execution via the HasleoImageMountService and HasleoBackupSuiteService Windows services. A low-privileged local attacker who can write to a directory resolved before the legitimate service binary can plant a malicious executable that runs as SYSTEM on the next service start or system reboot. A public proof-of-concept exists per the CVSS 4.0 E:P metric and referenced GitHub repositories, though EPSS at 0.01% (3rd percentile) indicates no observed widespread exploitation.

Sensitive data exposure in the Publitio WordPress plugin (versions ≤2.2.5) allows unauthenticated remote attackers to retrieve embedded sensitive information through network requests. The vulnerability exposes confidential data with high impact to confidentiality (CVSS C:H), though exploitation probability remains low (EPSS 3rd percentile). No public exploit identified at time of analysis, and exploitation requires no privileges or user interaction (PR:N/UI:N), making it trivially exploitable if targeted.

Sensitive system information disclosure in ThemeHunk WP Popup Builder plugin for WordPress (versions ≤1.3.8) allows unauthenticated remote attackers to retrieve embedded sensitive data without authentication. The vulnerability presents a CVSS 7.5 HIGH severity with confirmed network-based exploitation requiring no user interaction. EPSS score of 0.03% (10th percentile) indicates minimal observed exploitation activity, and no public exploit identified at time of analysis. The flaw stems from improper exposure of sensitive information to unauthorized control spheres (CWE-497).

Sensitive data exposure in Atarim Visual Collaboration WordPress plugin (versions through 4.2.1) allows unauthenticated remote attackers to retrieve embedded confidential information via network-accessible endpoints. The vulnerability enables direct extraction of sensitive data with no authentication required and low attack complexity. EPSS score of 0.03% (10th percentile) indicates minimal current exploitation probability, and no public exploit code or CISA KEV listing exists at time of analysis.

Privileged debug shell activation on WatchGuard Firebox allows authenticated administrators to exceed normal operational boundaries by invoking a residual diagnostic command. An admin holding simultaneous access to both the management WebUI and CLI can upload a platform- and version-specific diagnostic package and trigger a leftover diagnostic command (CWE-489) to enable an otherwise-inaccessible debug shell with elevated system access. No public exploit code has been identified and this is not listed in the CISA KEV, though the CVSS 4.0 score of 8.9 reflects the high subsequent-system impact should an attacker reach this state.

Arbitrary file deletion in PerfreeBlog 4.0.11 lets attackers remove files outside the intended theme directory by abusing the unInstallTheme theme-management function. Publicly available exploit code exists, though the flaw is not on CISA KEV and carries a low EPSS score (0.31%, 22nd percentile), indicating limited real-world exploitation to date. The CVSS 3.1 vector (PR:N/UI:R) implies an unauthenticated attacker who tricks an interacting user into triggering the deletion, consistent with a CSRF-style delivery against an administrator.

Information disclosure in CBK Soft enVision before version 250566 allows remote unauthenticated attackers to perform account footprinting by observing response discrepancies, enabling enumeration of valid user accounts and exposure of private personal information. No public exploit identified at time of analysis, and EPSS scoring (0.04%, 14th percentile) indicates very low near-term exploitation probability despite the High CVSS rating of 7.5.

Use-after-free in the Linux kernel vhost subsystem allows a local attacker with access to vhost worker devices to trigger access to a freed task_struct, potentially leading to privilege escalation or a kernel crash on hosts running virtio/vhost-backed virtualization. The flaw occurs when a vhost_task exits early via a signal and a pending vhost_task_wake() dereferences the released task structure. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a local race-condition bug rather than a mass-exploitation target.

Use-after-free in the Linux kernel's IPVS (IP Virtual Server) FTP application helper (ip_vs_ftp) allows local privileged users to corrupt kernel memory during network namespace teardown. On the netns cleanup path, __ip_vs_ftp_exit() could unregister ip_vs_ftp before connections still holding valid cp->app pointers were flushed, leaving dangling references that are later dereferenced. The flaw is fixed upstream with stable-tree backports; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.20%, 10th percentile).

Remote file inclusion in ArkSigner AcBakImzala versions before 5.1.4 allows unauthenticated attackers to coerce the PHP application into including attacker-controlled files, resulting in local file inclusion and potential remote code execution. The CVSS 9.8 score reflects network-reachable, no-authentication exploitation with full confidentiality, integrity, and availability impact, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

FreeBSD kernel fails to properly validate socket connection state when adding sockets to SO_REUSEPORT_LB load-balancing groups, allowing connected sockets to receive packets from arbitrary hosts instead of only from their connected peer. This breaks the fundamental contract of the connect(2) system call and sendto(2), creating a spoofing vulnerability where applications believe they are receiving authenticated peer traffic but may actually receive unsolicited packets from any host. The vulnerability affects remote attackers with user-level privileges on systems running vulnerable FreeBSD versions.

Sensitive data exposure in ThemeRuby Easy Post Submission plugin for WordPress (<=1.7.0) allows authenticated administrators to retrieve embedded sensitive information from outbound data transmissions. The flaw leverages CWE-201 to leak low-impact confidentiality, integrity, and availability with high attack complexity and changed scope. No active exploitation or public exploit exists; EPSS probability is very low (0.04%).

Information disclosure in the MasterStudy LMS WordPress plugin up to version 3.6.20 allows high-privilege authenticated admins to retrieve embedded sensitive data. With a CVSS score of 4.9 and EPSS probability of 0.04%, no active exploitation or public exploit is known. The vulnerability requires administrative access, limiting real-world risk.

Local File Inclusion in ThemeMove Businext theme versions prior to 2.4.4 allows unauthenticated attackers to include arbitrary local PHP files, potentially leading to information disclosure or remote code execution. Exploitation is complex and requires the ability to place PHP code in a file accessible by the server. No known public exploit or active exploitation has been identified at this time, and EPSS estimates a low probability of exploitation.

Local file inclusion in the SmilePure WordPress theme before version 1.8.5 allows unauthenticated remote attackers to read arbitrary files on the server, leading to sensitive information disclosure such as database credentials. Exploitation requires high complexity and no exploit code or active attacks have been observed.

Local file inclusion in the WoodMart WordPress theme before version 8.3.2 allows authenticated low-privilege users (e.g., subscribers) to include arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. Exploitation requires only low-level access but is of high complexity (CVSS 7.5, EPSS 0.13%), and no public exploit or active exploitation has been observed at the time of analysis.

Local file inclusion in Crocoblock JetReviews plugin versions through 3.0.0 allows authenticated attackers with low-level privileges to read arbitrary files on the WordPress server via PHP file inclusion flaws. With EPSS at 0.13% (33rd percentile), exploitation likelihood is currently low. No active exploitation confirmed (not in CISA KEV), but Patchstack has cataloged the vulnerability indicating professional security research attention. Attackers can access sensitive configuration files, credentials, and potentially chain with other vulnerabilities for code execution.

Local file inclusion in WP Abstracts (wp-abstracts-manuscripts-manager) plugin for WordPress versions ≤ 2.7.4 allows unauthenticated attackers to read arbitrary local files. Exploitation requires user interaction and high attack complexity, potentially leading to full server compromise. The EPSS probability is very low (0.05%), and no active exploitation or public exploit code is currently known.

Unauthorized data access in Oracle Java SE JAXP component allows remote unauthenticated attackers to exfiltrate sensitive information from multiple Java platforms including Oracle Java SE (8u461 through 25), GraalVM for JDK (17.0.16, 21.0.8), and GraalVM Enterprise Edition (21.3.15). Exploitation requires no authentication, low complexity, and can occur through web services supplying malicious data to JAXP APIs or via sandboxed Java Web Start/applet deployments loading untrusted code. Oracle released patches in October 2025 Critical Patch Update with EPSS data unavailable at time of analysis. CVSS 7.5 reflects pure confidentiality impact with network attack vector.

Unauthorized account access in AutoBizLine (Android package com.mysecondline.app) version 1.2.91 lets remote attackers authenticate as other users due to an incomplete identity-verification mechanism, exposing victims' personal information. The flaw is tagged as both an authentication bypass and information disclosure, and the affected user endpoint (/secondline/user/get_user/) suggests server-side access control that fails to bind a session to the correct account. No public exploit is confirmed in the input, though a third-party technical write-up exists on GitHub, and the EPSS score is low (0.33%, 25th percentile).

Information disclosure in Beyaz Bilgisayar CityPLus versions before V24.29500.1.0 allows remote unauthenticated attackers to discover unpublicized web pages and sensitive system information. The flaw is reported by Turkey's national CERT (USOM) and carries a CVSS 8.2 score reflecting network-reachable exposure of confidential data without authentication. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Use-after-free and kernel WARNING in the Linux kernel's SMC (Shared Memory Communications) subsystem allows a local user to trigger memory corruption via the splice() path on an SMC socket. The smc_lo_register_dmb() loopback path allocates DMB buffers with kzalloc() (kmalloc memory, not page-backed), which are later handed to get_page() in smc_rx_splice(); this fires WARN_ON_ONCE() and can leave the buffer freed before splice_to_pipe() completes, creating a use-after-free. CVSS 7.8 (local, C:H/I:H/A:H); EPSS is low (0.22%, 13th percentile) and there is no public exploit identified at time of analysis.

Local denial of service (and potential memory corruption) in the Linux kernel's hugetlbfs subsystem occurs because remove_inode_single_folio checks folio mapping state without holding the folio lock, racing with page migration; when a hugepage is migrated to a migration entry, folio_mapped() wrongly returns false, migration is then reverted, and the folio ends up mapped after deletion, tripping a BUG in filemap_unaccount_folio. Affected are kernels using hugetlbfs with hole-punch fallocate concurrent with migration (observed on 6.17-rc5 and backported to multiple stable branches). No public exploit identified at time of analysis; EPSS is low (0.24%, 15th percentile) and the issue is not in CISA KEV.

Use of default credentials in the 70mai X200 dashcam HTTP web server allows remote unauthenticated attackers to access the device with root privileges. All firmware versions up to 20251010 are affected, and a publicly available exploit exists. The vendor was contacted but did not respond, and no official patch is available.

Improper access controls in Sismics Teedy up to version 1.11 allow authenticated remote attackers to manipulate the /api/file endpoint, leading to unauthorized information disclosure. The vulnerability has publicly available exploit code and affects all versions through 1.11, though the vendor has not responded to disclosure notifications. With an EPSS score of 0.05% and low CVSS impact severity despite network accessibility, real-world exploitation appears limited to scenarios where attackers already possess valid authentication credentials.

GNU Binutils 2.45 allows local privilege-escalable information disclosure through an unchecked return value in the tg_tag_type function of prdbg.c, enabling authenticated local attackers to trigger unvalidated memory reads that leak sensitive data. CVSS score of 1.9 reflects minimal impact (availability only), though publicly available exploit code exists; EPSS 0.02% indicates negligible real-world exploitation probability despite POC availability.

Local applications on macOS can bypass access controls to read sensitive user data through a logic flaw in permission enforcement, fixed in macOS Sequoia 15.6, Sonoma 14.7.7, and Ventura 13.7.7. The vulnerability requires user interaction to trigger (such as launching a malicious app) and affects all three recent macOS versions. With an EPSS score of 0.01% and no confirmed active exploitation, this represents a low real-world exploitation probability despite moderate CVSS severity.

Mail in Lockdown Mode on iOS and iPadOS allows information disclosure through remote image loading when forwarding emails, bypassing Lockdown Mode's protections designed to prevent such tracking. Apple released patches in iOS 18.6 and iPadOS 18.6 that prevent remote image loading in this scenario. The vulnerability requires user interaction (forwarding an email) and affects unauthenticated remote attackers, with an EPSS score of 0.03% indicating low real-world exploitation probability despite the network attack vector.