Information Disclosure

A security vulnerability in A data corruption vulnerability (CVSS 4.4). Remediation should follow standard vulnerability management procedures.

A buffer under-read in the Snort 3 HTTP decoder lets unauthenticated, remote attackers crash the detection engine or expose adjacent memory by sending crafted HTTP packets containing malformed MIME header fields. Any deployment where attacker-controlled HTTP traffic is inspected by Snort 3 is exposed - including standalone Snort 3 and Cisco intrusion prevention deployments such as Firepower/FTD that run the Snort 3 engine - and the flaw carries a CVSS 3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) for high confidentiality and availability impact. No public exploit code or CISA KEV listing was identified at time of analysis, and EPSS is low at 0.42% (36th percentile).

Unauthenticated attackers can access sensitive information through publicly exposed log files in the Content Writer WordPress plugin versions up to 3.6.8. The plugin fails to properly restrict access to log files, allowing remote attackers without authentication or user interaction to view potentially sensitive data stored in these logs. This vulnerability carries a moderate CVSS score of 5.3 with confirmed public information disclosure impact.

A use-after-free write in the Linux kernel's Realtek rtw89 Wi-Fi driver lets kernel memory be corrupted when rtw89_core_tx_kick_off_and_wait() races with the TX-completion/status path (rtw89_pci_release_txwd_skb) and dereferences an skb_data buffer that was already freed back to skbuff_head_cache. The flaw was caught by KFENCE during Wi-Fi scan completion and is triggered by a timing race between the waiting and signaling sides of a completion object, affecting systems using Realtek rtw89-supported chipsets. There is no public exploit identified at time of analysis, it is not in CISA KEV, and the EPSS probability is low (0.19%, 9th percentile); the fix has been merged upstream.

Local privilege escalation and memory corruption in the Linux kernel's xc5000 DVB tuner driver (media subsystem) arises from a use-after-free in xc5000_release(): the function used cancel_delayed_work() which does not wait for an already-running timer_sleep delayed work item, so the xc5000_priv structure can be kfree()'d while the work callback still dereferences it. An attacker able to trigger tuner device teardown while the delayed work is active can win the race and cause the callback to operate on freed memory, potentially corrupting kernel memory. There is no public exploit identified at time of analysis and the flaw carries a low EPSS (0.22%); it was found via static analysis and fixed upstream.

Use-after-free in the Linux kernel's iMON RC (remote control) driver (drivers/media/rc/imon.c) allows a local user with access to the device's VFD/LCD character-device interface to trigger memory corruption by racing writes against USB disconnect. The imon_disconnect() path unconditionally calls usb_put_dev() on usbdev_intf0/usbdev_intf1 without coordinating with in-flight writers, so a concurrent vfd_write()/send_packet() dereferences a freed usb_device pointer. Discovered via Syzkaller by the Linux Verification Center; no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.22%).

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix NULL dereference in ath11k_qmi_m3_load() If ab->fw.m3_data points to data, then fw pointer remains null. Further, if m3_mem is not allocated, then fw is dereferenced to be passed to ath11k_err function. Replace fw->size by m3_len. Found by Linux Verification Center (linuxtesting.org) with SVACE.

Local privilege escalation / memory-safety flaw in the Linux kernel eBPF verifier, where get_helper_proto could return a NULL helper function pointer when a required config option was disabled, causing the verifier to accept BPF programs referencing an invalid helper. On affected kernels a local user able to load eBPF programs can trigger a NULL/invalid function pointer condition leading to kernel crash or potential code execution (CVSS 7.8, high confidentiality/integrity/availability impact). No public exploit identified at time of analysis and EPSS is low (0.18%), consistent with a config-dependent, local-only bug rather than a widely exploited one.

Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_conn.c) allows an in-range attacker to corrupt kernel memory when the host processes an HCI_EV_NUM_COMP_PKTS event without properly locking hdev, letting hci_conn_tx_dequeue read a connection object already freed by a concurrent hci_conn_del/abort path. The flaw was found via KASAN fuzzing on kernel 6.16-rc7 and is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.17%).

Use-after-free in the Linux kernel Bluetooth stack (net/bluetooth/hci_sync.c) lets an in-range attacker corrupt kernel memory during HCI ACL/LE connection setup. When a connection object is still pending command submission (conn->state == BT_OPEN), a concurrent HCI Connection Complete event can free the hci_conn structure while hci_acl_create_conn_sync (and hci_le_create_conn_sync) still writes to it. CVSS is 8.8 over an adjacent (Bluetooth-range) vector; there is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile).

Local privilege escalation via memory corruption in the Linux kernel Bluetooth management (MGMT) subsystem allows a local attacker with Bluetooth management access to trigger a use-after-free of a struct mgmt_pending object. The flaw arises from a race between MGMT command completion callbacks and the pending-command list being freed (e.g. during device power-off), enabling reads/writes of freed slab memory that can corrupt kernel state. No public exploit identified at time of analysis, and EPSS is very low (0.03%); it is a KASAN-detected, fuzzer-reported issue rather than one with confirmed in-the-wild use.

Local privilege escalation and memory corruption in the Linux kernel's Mellanox/NVIDIA mlx5 networking driver arises from a use-after-free in the hardware-steering (HWS) flow-counter release path. When a flow rule tied to a local flow counter is deleted via the RDMA/InfiniBand verbs interface, mlx5_cmd_hws_delete_fte() releases an HWS action whose refcount and mutex were never initialized, and the counter struct may already be freed - allowing a local attacker with the ability to create and destroy flow rules to corrupt kernel memory. No public exploit has been identified at time of analysis; EPSS probability is low (0.17%, 7th percentile), and the issue is not in CISA KEV.

Local privilege-escalation-class use-after-free in the Linux kernel's futex subsystem (requeue-PI path) lets a low-privileged local user race futex_wait_requeue_pi() against futex_requeue() so a kernel wakeup dereferences an on-stack futex_q structure that has already been freed and returned to userland. The flaw carries high confidentiality, integrity, and availability impact (CVSS 7.8, AV:L). There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 15th percentile), consistent with a hard-to-weaponize timing race.

Local privilege escalation and memory corruption in the Linux kernel process-creation path arises because copy_process() takes the wrong error-exit label after futex_hash_allocate_default() fails, releasing tasklist_lock and siglock that were never acquired. This lock imbalance can corrupt kernel synchronization state on the fork error path, with a potential for kernel crash or exploitation to gain elevated privileges. No public exploit identified at time of analysis and EPSS is low (0.17%), consistent with a subtle, hard-to-trigger error-handling defect rather than a widely-weaponized bug.

Guest-to-host memory corruption in the Linux kernel's Intel i40e Ethernet driver arises because the `ring_len` value supplied by an SR-IOV virtual function is written straight into the hardware memory context (HMC) with no bounds or alignment checking. A malicious or compromised VF owner (typically a guest VM given passthrough access to an Intel 700-series NIC) can specify out-of-range or misaligned Tx/Rx queue lengths, corrupting host-side descriptor context and impacting the host beyond the VF's boundary (CVSS 8.8, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.20%, 10th percentile), consistent with a driver-level bug requiring a specific virtualization deployment.

Out-of-bounds array access in the Linux kernel's Intel i40e Ethernet driver allows a privileged virtual-function (VF) context to trigger memory corruption on the host by supplying an unvalidated traffic-class index. The flaw is in i40e_validate_queue_map(), where idx was not bounded against the number of active/initialized TCs before indexing vf->ch[idx] during SR-IOV channel/ADQ configuration. No public exploit identified at time of analysis; EPSS is low (0.20%) and it is not listed in CISA KEV, but the CVSS:3.1 score of 8.8 with scope change reflects the guest-to-host boundary crossing.

Privilege escalation and host memory corruption in the Linux kernel's i40e Intel Ethernet driver allows a malicious or buggy SR-IOV virtual function to send a crafted 'config queues' mailbox message with an out-of-range channel index, causing out-of-bounds access to the vf->ch[idx] array in i40e_vc_config_queues_msg(). Exploitation crosses the VF-to-host trust boundary (CVSS scope change) and can disclose or corrupt host kernel memory. The issue is fixed upstream across multiple stable trees; no public exploit and no CISA KEV listing exist, and EPSS is low (0.20%, 10th percentile), indicating no public exploit identified at time of analysis.

Out-of-bounds access in the Linux kernel's Intel i40e (40GbE) Ethernet driver arises from a flawed bounds check on the 'action_meta' value used during traffic-control/hardware-offload configuration, allowing a local user with network-configuration privileges to trigger an out-of-bounds dereference. The upstream fix corrects the comparison to 'greater or equal' so that indices at the array boundary are rejected. No public exploit identified at time of analysis, EPSS is low (0.20%), and the issue is not in CISA KEV; the assigned CVSS is 8.8 (Local, low complexity), reflecting high impact to a system carrying this Intel NIC and driver.

Improper VF-state validation in the Linux kernel's i40e (Intel Ethernet 700-series) driver lets a virtual function request PF resources it should not be able to obtain, because the resource-allocation check keyed on I40E_VF_STATE_ACTIVE rather than the narrower I40E_VF_STATE_RESOURCES_LOADED state. In SR-IOV deployments this can allow a low-privileged local actor controlling a VF to cross the VF/host trust boundary (CVSS scope-change), with claimed high confidentiality, integrity and availability impact. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not in CISA KEV.

Resource-exhaustion denial of service in the Linux kernel's Intel i40e (700-series Ethernet) driver allows a malicious or compromised Virtual Function to request an unbounded number of MAC/VLAN filters against its Physical Function, because the driver never enforced a maximum filter count. A guest controlling an SR-IOV VF can degrade or crash networking for the host PF and other VFs (CVSS 7.3, scope-changed). There is no public exploit identified at time of analysis, and the EPSS probability is low (0.20%, 10th percentile).

Local privilege escalation via memory corruption in the Linux kernel's iommufd subsystem allows a low-privileged local user to trigger a use-after-free by racing the abort path of IOMMU object allocation. Because fput() defers file release to a workqueue while the code immediately kfree()s the tied iommufd_object, the deferred release() decrements a users refcount on already-freed memory, corrupting the slab. Only pre-release 6.17-rc kernels are affected; EPSS is 0.10% (1st percentile) and there is no public exploit identified at time of analysis.

Privilege escalation in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows an authenticated network attacker to elevate privileges due to weak authentication mechanisms (CWE-1390). With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this represents a significant risk to mail infrastructure, though no public exploit identified at time of analysis.

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Sensitive 2FA-related information is written to FortiOS log files and exposed via diagnose commands, allowing a highly privileged attacker with at least read-only administrative access to recover two-factor authentication data. Affected versions span FortiOS 6.4 through 7.6.3 and FortiProxy across all versions per CPE data, representing a wide installed base. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.04% at the 13th percentile reflects minimal real-world exploitation pressure at this time.

Man-in-the-middle interception is possible against the ZTNA proxy in FortiProxy 7.6.1 and earlier, 7.4.8 and earlier, and all 7.2/7.0 versions, as well as FortiOS 7.6.2 and earlier, 7.4.8 and earlier, and all 7.2/7.0 versions, due to improper certificate-host validation (CWE-297). An adjacent network attacker in a privileged path-position can intercept and tamper with ZTNA proxy connections, undermining a control specifically deployed to enforce zero-trust authentication. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Session replay in FortiOS SSL VPN enables former administrators, whose accounts have been revoked and sessions explicitly terminated, to reactivate those terminated VPN sessions by submitting previously captured SAML authentication records to the SSL VPN endpoint. Affected versions span FortiOS 6.4 (all versions), 7.0.0-7.0.16, 7.2.0-7.2.10, 7.4.0-7.4.6, and 7.6.0-7.6.2, covering a broad swathe of current enterprise deployments. No CISA KEV listing or public exploit code is confirmed at time of analysis, but the threat is most acute in incident-response scenarios where organizations revoke access believing the session termination is complete.

User interface spoofing in Firefox and Firefox Focus for Android's custom tab implementation allows remote attackers to misrepresent subdomain origins, enabling phishing attacks through crafted URLs. The custom tab feature truncates displayed hostnames to show only the parent domain, allowing malicious content on attacker-controlled subdomains (e.g., evil.example.com) to appear as legitimate sibling subdomains (e.g., legitimate.example.com). With CVSS 8.1 (High Confidentiality/Integrity impact) and no authentication required, this represents significant phishing risk for Android Firefox users. Patched in Firefox 144; no public exploit identified at time of analysis, though the UI flaw is straightforward to exploit.

Firefox on Android allows remote attackers to display a fake address bar by exploiting the visibilitychange event when the legitimate address bar is hidden due to scrolling, enabling phishing attacks and user deception. The vulnerability affects Firefox versions prior to 144 and requires user interaction (clicking on the fake address bar). Mozilla released patched version Firefox 144 to address this issue, and there is no evidence of active exploitation at the time of analysis.

Firefox for Android leaks password-related screen content through the Android task switcher card carousel, exposing sensitive information to local attackers with physical or remote access to the device. Affects Firefox for Android versions prior to 144. No public exploit identified at time of analysis, but exploitation is trivial requiring only device access and standard OS features. CVSS 9.1 reflects the unauthenticated network attack vector, though real-world exploitation typically requires local device access, making the practical risk moderate for most threat models.

Command injection via Firefox/Thunderbird 'Copy as cURL' feature on Windows allows remote attackers to execute arbitrary commands when users copy network requests as cURL commands and paste them into terminals. Affects Firefox <144, Firefox ESR <140.4, Thunderbird <144, and Thunderbird <140.4 exclusively on Windows platforms. No public exploit identified at time of analysis, but attack vector requires only user interaction (CVSS PR:N/UI:R) with no privileges needed.

Modify read-only JavaScript Object properties in Firefox and Thunderbird via crafted web content, allowing attackers to bypass property immutability protections and alter application state. Affects Firefox versions below 144, Firefox ESR below 115.29 and 140.4, Thunderbird below 144 and 140.4. Requires user interaction (malicious website visit) but no authentication. CVSS 6.5 reflects high integrity impact with user-interaction requirement; no evidence of active exploitation or public exploit code at time of analysis.

Information disclosure in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to extract privileged browser process memory via malicious IPC messages from a compromised web content process. Affects Firefox <144, Firefox ESR <115.29 and <140.4, and Thunderbird <144 and <140.4. CVSS 9.8 indicates network-exploitable with no auth required, though actual exploitation requires first compromising a web content process. Vendor-released patches available (Firefox 144, Firefox ESR 115.29/140.4, Thunderbird 144/140.4). No public exploit identified at time of analysis; EPSS data not provided.

Remote code execution in Mozilla Firefox (all versions prior to 144, ESR prior to 140.4) and Thunderbird (all versions prior to 144, ESR prior to 140.4) allows unauthenticated remote attackers to execute arbitrary code, disclose sensitive information, or cause denial of service through a use-after-free vulnerability in MediaTrackGraphImpl::GetInstance(). With a critical CVSS score of 9.8 and no authentication required, this memory corruption flaw represents a severe security risk. No public exploit identified at time of analysis, though EPSS data not available to assess exploitation probability.

Session hijacking against Rolantis Information Technologies Agentis prior to version 4.44 is possible because the application fails to regenerate session identifiers across authentication state changes, letting a remote attacker who can lure a victim into using an attacker-supplied session token take over the authenticated session. CVSS 8.8 reflects full confidentiality, integrity, and availability impact once hijacked, but no public exploit identified at time of analysis and the issue is not on the CISA KEV list.

Use-after-free in the Linux kernel xfrm subsystem allows a local low-privileged user to crash the kernel via improper SPI=0 handling introduced by commit 94f39804d891. The regression causes xfrm_alloc_spi to insert states with SPI value 0 (the sentinel for 'no SPI assigned') into the byspi hash table, while __xfrm_state_delete skips cleanup of those entries on deletion, leaving dangling pointers that produce a UAF on next byspi traversal. No public exploit code exists and EPSS probability is 0.17% (7th percentile), indicating no active exploitation pressure.

Weak cryptographic hash implementation in Tomofun Furbo 360 and Furbo Mini firmware allows local attackers with low privileges to compromise password security through use of insecure encryption algorithms in the password handler. The vulnerability affects Furbo 360 up to firmware version FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though real-world exploitation requires physical device access and high technical complexity.

Information disclosure vulnerability in Tomofun Furbo 360 and Furbo Mini dog cameras allows local network attackers to extract sensitive DeviceToken data via manipulation of GATT Service arguments. The attack requires high technical complexity and adjacency to the target network. Publicly available exploit code exists; however, the extremely low EPSS score (0.03%) and requirement for local network access and high attack complexity suggest limited real-world exploitation likelihood despite POC availability.

Improper access controls in the GATT Service of Tomofun Furbo 360 and Furbo Mini dog cameras allow local network attackers to disclose sensitive information without authentication. Affected firmware versions are Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. Publicly available exploit code exists, though the low CVSS score of 2.1 and minimal EPSS (0.03%) reflect the local network-only attack vector and information disclosure impact.

Insecure storage of authentication tokens in Tomofun Furbo Mobile App for Android up to version 7.57.0a allows local attackers with physical device access to extract sensitive credential information from the device storage. The vulnerability affects the Authentication Token Handler component and has been publicly disclosed with exploit details available. Despite early vendor contact, no patch or remediation response has been provided by Tomofun.

Insecure storage of sensitive information in Tomofun Furbo 360 and Furbo Mini dog cameras via UART interface allows physical attackers to extract unencrypted credentials and private data from firmware versions Furbo 360 up to FB0035_FW_036 and Furbo Mini up to MC0020_FW_074. The vulnerability requires physical device access and high technical complexity but publicly available exploit code exists. Vendor did not respond to early disclosure notification.

Hard-coded cryptographic key in express-session component of code-projects Hospital Management System 1.0 allows remote attackers to bypass session security and disclose sensitive information. The vulnerability stems from use of a fixed secret parameter in the session middleware, enabling attackers to forge or predict session tokens. While a public exploit exists, the attack requires high complexity and difficult exploitation, reflected in the low CVSS 2.9 score and minimal EPSS probability (0.19%), suggesting limited real-world risk despite information disclosure impact.

Unauthenticated attackers can access sensitive information through publicly exposed log files in the Code Quality Control Tool WordPress plugin versions 2.1 and earlier, due to inadequate access controls on the error_logger.php component. The vulnerability allows remote attackers to read potentially sensitive data without authentication or user interaction, presenting a confidentiality risk to WordPress installations using affected versions.

Authorization bypass and sensitive information disclosure in Usta Information Systems Inc. Aybs Interaktif allows a locally authenticated low-privilege user to access unauthorized data through forceful browsing, parameter injection, and input data manipulation. The vulnerability chain - CWE-639 (user-controlled key bypass) combined with CWE-862 (missing authorization) and CWE-200 (information disclosure) - permits manipulation of application parameters to circumvent access controls and retrieve sensitive records belonging to other users or restricted contexts. No confirmed active exploitation (not in CISA KEV), and the EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation pressure at time of analysis.

Privilege abuse and authentication bypass in Aybs Interaktif (by Usta Information Systems Inc.) expose high-confidentiality and high-integrity impacts to local attackers who require no prior privileges. The vulnerability cluster - spanning incorrect permission assignment, missing authorization, incorrect authorization, and sensitive data exposure (CWE-200) - enables an actor with local system access to bypass access controls, potentially reading sensitive resources and modifying data without authorization. No public exploit or CISA KEV listing is identified at time of analysis, but the Turkish National CERT (USOM) has issued advisory TR-25-0329 covering all versions from 2024 through build 28082025.

Information disclosure in HCL AION 2.0 allows remote unauthenticated attackers to bypass Content Security Policy due to missing trusted types enforcement. The weakness permits low-confidentiality data exposure via cross-origin window.opener access, but high attack complexity and a very low EPSS score (0.03%) indicate minimal practical risk. No public exploit or active exploitation is known.

HCL AION 2.0 improperly caches sensitive SSL/HTTPS page content, allowing attackers or local users with device or browser access to retrieve cached credentials, system identifiers, and internal file paths. The vulnerability has a CVSS score of 3.7 (low severity) due to high attack complexity and local/physical access requirements, with no public exploit or active exploitation confirmed.

Content security policy bypass in HCL AION v2.0 enables inline script injection, allowing remote attackers to modify web page content and potentially access sensitive information via cross-site scripting. The vulnerability requires user interaction and has no authentication requirement; no active exploitation or public proof-of-concept has been reported. EPSS probability is extremely low (0.04%), indicating negligible exploitation likelihood.

Information disclosure in HCL AION 2.0 allows unauthenticated remote attackers to access sensitive information via a high-complexity attack. No active exploitation or public exploit code has been identified, and EPSS score is very low (0.03%). The vulnerability affects only version 2.0.

Session hijacking vulnerability in HCL AION 2.0 due to missing 'Secure' flag on SSL session cookies allows unauthenticated remote attackers to intercept cookies over unencrypted channels under specific network conditions. Successful exploitation can lead to unauthorized access to sensitive data and limited integrity impact. No evidence of active exploitation or public exploit code exists.

HCL AION 2.0 exposes sensitive information to unauthorized actors via a high-complexity network attack. An unauthenticated attacker can remotely retrieve limited data without user interaction. No public exploit or active exploitation is known, and patch availability is unconfirmed.

Insecure inherited permissions in Portabilis i-Educar up to version 2.9.10 allow authenticated remote attackers to escalate privileges through the User Type Handler component in AccessLevelController.php, potentially gaining unauthorized access to protected functionality. The vulnerability requires valid login credentials (PR:L) but carries low confidentiality, integrity, and availability impact (VC:L/VI:L/VA:L). Publicly available exploit code exists, though EPSS score of 0.06% (19th percentile) suggests limited real-world exploitation despite public disclosure.

Local privilege-boundary corruption in the Linux kernel's io_uring zero-copy notification path (io_link_skb) affects the 6.17 release-candidate series (rc1 through rc6). A copy-paste style bug assigned prev_notif from the current 'nd' instead of 'prev_nd', so the context-validation check compares a notification against itself and never enforces the intended same-context constraint, allowing a local low-privileged user to link skb notifications across mismatched io_uring contexts with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).

Race condition in the Linux kernel's AMD IOMMU host page table subsystem (iommu/amd/pgtbl) allows a local low-privileged attacker to cause IOMMU unmap failures and trigger WARN_ON conditions, resulting in a denial of service. The flaw arises because iommu_v1_unmap_pages() calls fetch_pte() to read pgtable->root and pgtable->mode without holding the spinlock, while increase_address_space() updates those fields non-atomically under lock on another CPU, creating a window where the reader observes a torn state (new root, old mode). No active exploitation is confirmed - EPSS stands at 0.10% (1st percentile) and this CVE is not in CISA KEV - making this primarily a kernel stability and reliability concern for systems with AMD IOMMU hardware.

Local privilege escalation and kernel memory disclosure in the Linux kernel's GPIO ACPI subsystem (gpiolib) affects development builds 6.17-rc1 through 6.17-rc6, where an uninitialized acpi_gpio_info structure is passed to __acpi_find_gpio() and its stale info->quirks field is later consumed in acpi_populate_gpio_lookup(). The regression, introduced by commit 7c010d463372, breaks the i2c_hid_acpi driver (probe fails with -EINVAL / 'has not been provided an Int IRQ') and causes the kernel to act on uninitialized stack memory. No public exploit identified at time of analysis, and EPSS is low at 0.14% (4th percentile), consistent with a hard-to-weaponize local memory-safety regression confined to release candidates.

Denial of wireless scanning in the Linux kernel's mac80211 subsystem occurs on Sub-1GHz (S1G / 802.11ah) hardware because the S1G capability element is not counted in scan_ies_len, causing a buffer-length validation failure in ieee80211_prep_hw_scan() and a triggered WARN in __ieee80211_start_scan(). Affected builds are Linux 6.17 release candidates (rc1-rc4); the result is that hardware scanning stops functioning on S1G-capable adapters. There is no public exploit identified at time of analysis, EPSS is very low (0.14%), and the upstream fix is available via kernel.org stable commits.

A local privilege-boundary/state-handling flaw in the Linux kernel's TCP stack lets an unprivileged user leave a stale TCP Fast Open request socket (fastopen_rsk) attached to a socket after tcp_disconnect(), which the retransmit timer later dereferences. By abusing accept() → connect(AF_UNSPEC) → connect() on a server-side TFO socket before the 3-way handshake completes, an attacker drives the socket into TCP_ESTABLISHED while retaining fastopen_rsk, triggering a kernel WARNING in tcp_retransmit_timer() and a failed retransmission. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV; it was found by syzbot and resolved upstream by calling reqsk_fastopen_remove() in tcp_disconnect().

Symlink following in DesktopCommanderMCP up to version 0.2.13 allows local authenticated attackers to read files outside intended directory boundaries through the isPathAllowed function in filesystem.ts. The vulnerability requires local access and authenticated user privileges, with high attack complexity and low exploitability difficulty despite public availability of proof-of-concept code. This affects only unsupported product versions and carries minimal real-world risk (CVSS 1.1, EPSS 0.02%), though the vendor acknowledges the issue as a guardrail limitation rather than a hardened security boundary.

OpnForm versions up to 1.9.3 expose sensitive information through a timing-based discrepancy in the forgotten password handler endpoint (/api/password/email), allowing remote unauthenticated attackers to enumerate valid email addresses or extract partial account information with high attack complexity. The vulnerability is rooted in a Laravel framework issue (Laravel #46465) for which the vendor has taken no mitigation action. Publicly available exploit code exists, though EPSS scoring (0.04%) indicates low real-world exploitation likelihood despite theoretical exploitability.

OpnForm versions up to 1.9.3 fail to properly restrict excessive authentication attempts when the X-Forwarded-For HTTP header is manipulated, allowing remote attackers to bypass rate-limiting controls. An attacker can exploit this by spoofing their source IP address through header manipulation to conduct brute-force attacks against user credentials without triggering account lockout mechanisms. Publicly available exploit code exists; however, the CVSS score of 2.9 and EPSS percentile of 35% indicate low real-world exploitation likelihood despite the public POC, suggesting this requires specific application configurations or deployment contexts to be practically exploitable.

Improper access controls in OpnForm versions up to 1.9.3 allow authenticated remote attackers to manipulate the /edit function, gaining unauthorized access to resources or functionality. The CVSS score of 2.1 reflects low severity due to authentication requirements and limited confidentiality impact, though the exploit has been publicly disclosed and an upstream patch is available. Real-world risk is minimal given the low EPSS score (0.03%, 8th percentile) despite public POC availability.

Information disclosure in kaifangqian-base's SysUserController.getAllUsers endpoint allows authenticated remote attackers to retrieve sensitive user data. The vulnerability affects the function up to commit 7b3faecda13848b3ced6c17c7423b76c5b47b8ab and requires login credentials (PR:L in CVSS 4.0), limiting exposure to authenticated users. Public exploit code exists, but the low CVSS score (2.1) and minimal EPSS percentile (8%) suggest limited real-world exploitation despite public availability.

ZIP64 archive parsing inconsistency in Python's standard library zipfile module enables crafting specially constructed ZIP archives that Python processes differently than spec-compliant ZIP implementations, facilitating security control bypass in dual-parser pipelines. The module failed to use the offset field from the ZIP64 End of Central Directory Locator record to locate the ZIP64 EOCD record, instead assuming it was always the immediately preceding structure in the byte stream. No active exploitation is confirmed (not in CISA KEV), no public exploit code has been identified, and EPSS probability is low at 0.35% - real-world risk is concentrated in security tooling that uses Python's zipfile for validation while a separate implementation performs extraction.

An information leak vulnerability exists in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem within the tipc_topsrv_kern_subscr() function. The vulnerability occurs due to incomplete initialization of the sub.usr_handle field, leaving four bytes uninitialized when setsockopt() is called with SOL_TIPC options, allowing kernel memory contents to be leaked to user space. This affects Linux kernel versions including 6.1-rc1 and potentially others; while the EPSS score is extremely low at 0.01% percentile, the vulnerability requires local access and low privileges to trigger, making it a lower-priority but real information disclosure issue that has been patched by multiple vendors.

A memory leak vulnerability exists in the Linux kernel's test_firmware module initialization function (test_firmware_init) where allocated memory for test_fw_config->name is not properly freed when misc_register() fails. This affects all versions of the Linux kernel with the test_firmware module compiled, allowing local authenticated attackers to exhaust kernel memory and cause a denial of service. The vulnerability has a patch available from the Linux kernel maintainers, with an EPSS score of 0.01% indicating very low real-world exploitation probability despite the moderate CVSS score.

A memory leakage and potential segmentation fault vulnerability exists in the Linux kernel's AMD KFD (Kernel Fusion Driver) GPU memory management subsystem, specifically in the _gpuvm_import_dmabuf() function. The vulnerability affects Linux kernel versions across multiple branches and can be exploited by local users with low privilege levels to cause denial of service through memory corruption. Patches are available from the Linux kernel stable branches, and while the EPSS score is very low (0.01%, percentile 3%), the vulnerability has moderate CVSS severity (5.5) due to its ability to cause system availability impact.

CVE-2022-50522 is a security vulnerability (CVSS 3.3). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

A memory corruption vulnerability in the Linux kernel's huge page (THP) split handling causes a soft lockup and denial of service when page->private is incorrectly clobbered during transparent huge page operations. The vulnerability affects Linux kernel versions 5.19 through 6.1-rc1, and while it requires local privilege access to trigger via madvise syscalls, it can reliably cause system hangs under stress conditions such as memory pressure or aggressive swapping scenarios. The EPSS score of 0.02% and lack of widespread active exploitation indicate low real-world risk, though the availability of patches makes remediation straightforward.

WP Reset plugin for WordPress versions up to 2.05 expose sensitive license keys and site data through unauthenticated access to the WF_Licensing::log() method when debugging is enabled by default. Remote attackers can extract confidential information including license credentials without authentication, creating a direct pathway to account compromise and unauthorized access to site administration features. No public exploit code or active exploitation has been confirmed, but the low attack complexity and default dangerous configuration significantly elevate real-world risk.

Improper output encoding in Logo Cloud before version 2.57 enables phishing attacks by allowing injected or unescaped content to be rendered in the application context. The CVSS vector (PR:H/UI:R) narrows the realistic threat to authenticated high-privilege users who can introduce malicious output that is then presented to other users without proper sanitization. No active exploitation is confirmed - no CISA KEV listing and an EPSS score of 0.03% (10th percentile) both signal this is low-priority in the broader threat landscape.

Weak password requirements in Mangati NovoSGA up to version 2.2.12 allow remote attackers to bypass password policy validation during user account creation via manipulation of the Senha/Confirmação da senha (password/password confirmation) parameters on the /novosga.users/new endpoint. The vulnerability is difficult to exploit (CVSS AC:H) and offers only low confidentiality impact, but public exploit code is available and enables brute-force attacks against weak user credentials. EPSS score of 0.04% (percentile 12%) indicates limited real-world exploitation likelihood despite CVE publication.

Mentor LMS up to version 1.1.1 allows permissive cross-domain policies with untrusted domains through an unspecified API component, enabling information disclosure via remote unauthenticated requests with user interaction. The CVSS 2.1 score reflects limited confidentiality impact; however, EPSS indicates very low real-world exploitation probability (0.02nd percentile), and the vulnerability requires user interaction, substantially limiting practical risk despite publicly available exploit code.

CRMEB up to version 5.6.1 uses a hard-coded cryptographic key in its JWT HMAC Secret Handler when the secret argument defaults to a known value, allowing remote attackers to forge JWT tokens and bypass authentication. Despite a low CVSS score of 2.9 reflecting high attack complexity, public exploit code exists and the vendor has not responded to disclosure. The practical impact depends on how JWT validation is implemented in the application stack.

Frappe LMS 2.35.0 contains improper access controls in the Unpublished Course Handler component at the /courses/ endpoint that allows authenticated remote attackers to access unauthorized information. The vulnerability requires high attack complexity and authenticated access, limiting real-world exploitation despite publicly available exploit code. CVSS 1.3 and EPSS 0.04% (11th percentile) indicate low practical risk despite public POC availability.

Information disclosure vulnerability in Frappe LMS 2.35.0 allows remote unauthenticated attackers to access sensitive assignment picture data through direct requests to the /files/ endpoint with high attack complexity. The vulnerability carries a CVSS score of 2.9 with low confidentiality impact, and publicly available exploit code exists, though real-world exploitation risk remains minimal given the high complexity requirement and low EPSS score of 0.04%.

A security vulnerability in SeriaWei ZKEACMS (CVSS 5.4). Remediation should follow standard vulnerability management procedures.

In the Linux kernel, the following vulnerability has been resolved: jfs: fix invalid free of JFS_IP(ipimap)->i_imap in diUnmount syzbot found an invalid-free in diUnmount: BUG: KASAN: double-free in slab_free mm/slub.c:3661 [inline] BUG: KASAN:...

In the Linux kernel, the following vulnerability has been resolved: mm/ksm: fix race with VMA iteration and mm_struct teardown exit_mmap() will tear down the VMAs and maple tree with the mmap_lock held in write mode.

In the Linux kernel, the following vulnerability has been resolved: ipmi_si: fix a memleak in try_smi_init() Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid...

CVE-2023-53610 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

CVE-2023-53609 is a security vulnerability (CVSS 5.5). Risk factors: public PoC available. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix potential UAF of struct nilfs_sc_info in nilfs_segctor_thread() The finalization of nilfs_segctor_thread() can race with nilfs_segctor_kill_thread() which terminates...

CVE-2023-53606 is a security vulnerability (CVSS 5.5). Remediation should follow standard vulnerability management procedures. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: drm: amd: display: Fix memory leakage This commit fixes memory leakage in dc_construct_ctx() function.

CVE-2023-53604 is a security vulnerability (CVSS 7.8). High severity vulnerability requiring prompt remediation. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix memory leak in WMI firmware stats Memory allocated for firmware pdev, vdev and beacon statistics are not released during rmmod.

CVE-2023-53601 is a security vulnerability (CVSS 5.5). Risk factors: public PoC available. Vendor patch is available.

In the Linux kernel, the following vulnerability has been resolved: tunnels: fix kasan splat when generating ipv4 pmtu error If we try to emit an icmp error in response to a nonliner skb, we get BUG: KASAN: slab-out-of-bounds in...

In the Linux kernel, the following vulnerability has been resolved: cifs: fix mid leak during reconnection after timeout threshold When the number of responses with status of STATUS_IO_TIMEOUT exceeds a specified threshold (NUM_STATUS_IO_TIMEOUT),...

In the Linux kernel, the following vulnerability has been resolved: drivers: base: Free devm resources when unregistering a device In the current code, devres_release_all() only gets called if the device has a bus and has been probed.

In the Linux kernel, the following vulnerability has been resolved: driver core: fix resource leak in device_add() When calling kobject_add() failed in device_add(), it will call cleanup_glue_dir() to free resource.