Information Disclosure

Session hijacking in PHPGurukul Car Washing Management System v1.0 allows attackers to retain or reuse a doctor account session because the /doctor/change-password.php component fails to invalidate existing sessions after a credential change, publicly available exploit code exists (per the referenced GitHub PoC), though EPSS estimates only a 0.50% exploitation probability and the issue is not on CISA KEV. No public exploit identified as actively used in the wild; the flaw affects only the single unpatched v1.0 release of this niche PHP application.

Session hijacking in PHPGurukul Doctor Appointment Management System v1.0.0 stems from improper session invalidation in /doctor/change-password.php, where doctor account sessions are not terminated after a password change. A publicly available exploit code exists (GitHub, VasilVK), but there is no public exploit identified as actively exploited and it is not in CISA KEV. EPSS is low at 0.41% (33rd percentile), indicating limited real-world exploitation interest to date.

Session hijacking in PHPGurukul Student Result Management System v2.0 stems from improper session invalidation in the employee change-password handler (/elms/emp-changepassword.php), letting attackers reuse session tokens that should have been terminated to take over an authenticated account. A public proof-of-concept exists (VasilVK GitHub), but there is no public exploit identified as actively exploited; EPSS is low at 0.52% (40th percentile) and it is not on CISA KEV. This is a niche PHP educational application, so real-world exposure is limited despite the network-facing nature of the flaw.

Improper export of Android application components in bsc Peru Cocktails App 1.0.0 allows local authenticated attackers to access unexported activities, services, or broadcast receivers defined in AndroidManifest.xml, leading to information disclosure. The vulnerability has been publicly disclosed with exploit code available, though real-world risk is minimal given the low CVSS score (1.9) and EPSS exploitation probability (0.02%), indicating this affects only authenticated users with local device access and results in limited confidentiality impact.

Privilege escalation in Beamsec PhishPro before version 7.5.4.2 allows authenticated low-privileged users to abuse privileged API calls, resulting in full confidentiality, integrity, and availability compromise (CVSS 8.8). The root cause is CWE-648 (Incorrect Use of Privileged APIs), meaning the application exposes or incorrectly gates privileged API operations that low-privileged users can invoke directly. No public exploit exists at time of analysis, and EPSS sits at 0.25% (49th percentile), but the network-accessible, low-complexity attack path warrants prioritized remediation for any internet-facing PhishPro deployment.

Buffer under-allocation in the Linux kernel HID (Human Interface Device) core subsystem allows a local low-privileged user to cause a kernel denial of service. When HID report IDs are not used, the transport layer expects the first byte to be 0x00 as a placeholder, but the allocated report buffer fails to account for this reserved byte - yielding only 7 usable bytes instead of 8. No active exploitation has been identified (not in CISA KEV; EPSS at 0.20%, 10th percentile), and impact is limited to availability with no confidentiality or integrity exposure.

A race condition in the Linux kernel's MPTCP (Multipath TCP) protocol implementation allows local attackers with limited privileges to trigger a kernel warning and denial of service by causing non-atomic fallback decisions and actions during connection establishment. The vulnerability (CWE-667: Improper Locking) arises from unsynchronized access to fallback state in mptcp_do_fallback() when processing incoming TCP options, enabling a local user to crash the system or hang connections via crafted MPTCP packets. EPSS score of 0.03% indicates low real-world exploitation probability despite moderate CVSS impact severity.

Kernel panic via memory corruption in the Qualcomm SoundWire driver affects Linux 6.16-rc1 through 6.16-rc6 on systems using Qualcomm SDM845 SoC (e.g., Dragonboard 845c). The faulty commit introduced three distinct bugs in qcom_swrm_set_channel_map: an off-by-one that clobbers pconfig[0], an out-of-bounds write due to mismatched array sizes (tx_ch[] has 16 entries but pconfig[] only 15), and RX data overwriting TX channel configuration - collectively triggering a BRK exception at EL1 and kernel panic during audio subsystem probe. No public exploit is identified and EPSS is 0.12%, consistent with a regression bug rather than an attacker-targeted vulnerability; the primary risk is system unavailability on affected hardware.

Uninitialized kernel memory access in the Linux kernel's comedi data acquisition subsystem allows local low-privilege users to crash the system by submitting crafted ioctl instructions targeting subdevice handlers. The do_insn_ioctl() and do_insnlist_ioctl() functions allocate MIN_SAMPLES (16) data elements but only copy the first insn->n elements from user space for write-type instructions, leaving the remainder uninitialized; certain subdevice handlers read beyond insn->n, triggering undefined behavior that results in denial of service. No public exploit identified at time of analysis; EPSS of 0.16% (5th percentile) reflects very low exploitation probability, consistent with a niche kernel subsystem requiring specialized hardware.

A race condition in the Linux kernel's net/sched sch_qfq module allows local authenticated attackers to cause denial of service through NULL pointer dereference or use-after-free errors when concurrent threads modify queue aggregation structures during packet scheduling. The vulnerability requires low privileges and has a low real-world exploitation probability (EPSS 0.02%), though a vendor patch is available.

Local privilege escalation and memory corruption in the Linux kernel's IPv6 RPL (Routing Protocol for Low-Power and Lossy Networks) source-routing subsystem, affecting the 6.16-rc development series. The rpl_do_srh_inline() function in net/ipv6/rpl_iptunnel.c dereferences a stale pointer to the IPv6 header after skb_cow_head() may have freed the underlying buffer, producing a use-after-free (CWE-416) that a local attacker can trigger by sending IPv6 packets through an RPL lightweight-tunnel route. No public exploit is identified at time of analysis and EPSS is very low (0.15%), consistent with a bug found via internal KASAN selftesting rather than in-the-wild abuse.

Use-after-free in Linux kernel TLS implementation allows local authenticated users to achieve high confidentiality, integrity, and availability impact through memory corruption. The vulnerability, triggered by aggressive TCP SKB compaction in net-next, causes TLS to operate on freed socket buffers when checking decrypt state. A vendor patch is available across multiple kernel versions (6.1-rc2 through 6.1-rc5 and later stable branches). No active exploitation confirmed, but CWE-416 use-after-free bugs are frequently targeted due to their code execution potential. EPSS data not provided.

Memory leak and refcount imbalance in Linux kernel VLAN 0 handling allows local attackers with low privileges to trigger denial of service via kernel panic when toggling the rx-vlan-filter feature at runtime on bonded or team interfaces. The vulnerability affects kernel versions 6.16-rc1 through rc3 and potentially earlier versions; vendor-released patches are available across affected stable branches.

Improper authorization in Vaelsys VaelsysV4 4.1.0 exposes the User Creation Handler at /grid/vgrid_server.php to potential unauthorized user creation via remote network requests. A publicly available proof-of-concept demonstrates the technique, though the vendor formally disputes the finding, asserting the endpoint enforces authenticated administrative context and no unauthorized escalation is possible. EPSS stands at 0.12% (30th percentile), no CISA KEV listing exists, and the real-world exploitability remains contested - making this a low-confidence finding that nonetheless warrants verification by affected operators.

Weak cryptographic hashing (CWE-327) in VaelsysV4's PHP web interface exposes sensitive information to authenticated remote attackers who can manipulate the xajaxargs parameter of /grid/vgrid_server.php. Affected versions span the 5.1.0 and 5.4.0 release lines; patched releases 5.1.1 and 5.4.1 are available. No public exploit identified at time of analysis per CISA KEV, but a public proof-of-concept exists, and the EPSS score of 0.03% confirms very limited real-world exploitation activity to date.

Cool Mo Maigcal Number App versions 1.0.0 through 1.0.3 on Android contain improper export of application components in AndroidManifest.xml, allowing local authenticated attackers to access sensitive functionality of the com.sdmagic.number component. While CVSS severity is minimal (1.9), publicly available exploit code exists; exploitation requires local device access and authenticated privileges but carries information disclosure impact.

Improper export of Android application components in Lobby Universe Lobby App versions 2.0 through 2.8.0 allows local attackers with user-level privileges to access sensitive functionality via the com.maverick.lobby component. The vulnerability stems from AndroidManifest.xml misconfiguration that exposes internal application activities without proper permission protection, enabling local privilege escalation or information disclosure. Publicly available exploit code exists, though exploitation requires local device access and authenticated user privileges.

ChanCMS up to version 3.1.2 permits information disclosure through improper validation of accessKey and secretKey parameters in the /sysApp/find endpoint, allowing authenticated remote attackers to access sensitive data. The vulnerability has a low CVSS score of 2.1 (CVSS:4.0/AV:N/AC:L/PR:L) reflecting limited confidentiality impact and requirement for low-privilege authentication, but publicly available exploit code exists and exploitation probability (EPSS 0.09%) is extremely low, suggesting this is a narrow-scope, low-urgency issue despite public disclosure.

Memory leak in GNU Binutils 2.44 DWARF section handler allows local authenticated users to consume memory resources, potentially leading to denial of service. The vulnerability exists in the process_debug_info function of binutils/dwarf.c and is triggered during DWARF debug information parsing. Publicly available exploit code exists, and a vendor patch has been released.

Improper export of Android application components in Yeelink Yeelight App up to version 3.5.4 allows local attackers with user-level privileges to access sensitive application functions through the AndroidManifest.xml configuration of the com.yeelight.cherry component. The vulnerability has a very low real-world impact (CVSS 1.9, EPSS 0.03%) despite public exploit availability, as exploitation requires local device access and user-level privileges, limiting practical attack scenarios to compromised or physically accessible devices.

Improper export of Android application components in Canara ai1 Mobile Banking App version 3.6.23 allows local attackers with user-level privileges to access sensitive exported components via AndroidManifest.xml misconfigurations. The vulnerability enables information disclosure with low confidentiality impact. Public exploit code exists but real-world exploitation risk is minimal (EPSS 0.03%, CVSS 1.9) due to requirement for local device access and authenticated user privileges.

Comodo Dragon up to version 134.0.6998.179 transmits sensitive DNS information in cleartext via its IP DNS Leakage Detector component, allowing remote attackers to intercept and read this data. The vulnerability has a low CVSS score of 2.9 (limited confidentiality impact) but is marked as having publicly available exploit code with difficult exploitation complexity. The vendor was notified but did not respond, and active exploitation is not confirmed despite public disclosure.

Comodo Dragon browser versions up to 134.0.6998.179 contain an HSTS Handler vulnerability that bypasses security checks for standard compliance, allowing remote attackers with user interaction to disclose sensitive information. The CVSS score of 1.3 reflects high attack complexity and limited integrity impact, but public exploit code is available and the vendor did not respond to early disclosure, leaving affected users without official patches.

Weak password requirements in Tenda AC18 firmware version 15.03.05.19 allow remote attackers to conduct brute-force attacks against Samba authentication via the /etc_ro/smb.conf configuration file. The vulnerability requires high attack complexity and has been publicly disclosed, though exploitation difficulty remains elevated. CVSS 2.9 and EPSS 0.07% (20th percentile) indicate low real-world risk despite proof-of-concept availability.

Remote root access in Gardyn Home Kit Firmware via SSH private key compromise allows authenticated remote attackers with high privileges to execute arbitrary commands as root on affected devices. The vulnerability stems from improper cryptographic key management (CWE-321) and carries a CVSS score of 6.6; no public exploit code or active exploitation has been independently confirmed at the time of analysis.

Linux kernel uprobes implementation allows local privileged users to cause denial of service by placing probes at invalid instruction boundaries, exploiting variable-length instruction decoding and mixing of data in text segments on architectures like ARM64. The vulnerability requires CAP_SYS_ADMIN capability, limiting exposure to privileged local attackers. Patch available across multiple stable kernel branches (6.16-rc1 through rc4 and earlier versions).

Integer wraparound in Linux kernel netlink socket receive buffer accounting allows local authenticated attackers to exhaust kernel memory by bypassing receive buffer limits via integer overflow in sk_rmem_alloc comparison. An attacker with local access can set SO_RCVBUFFORCE to INT_MAX, causing the receive buffer check to always evaluate false and permitting unlimited socket buffer allocation until out-of-memory conditions occur. CVSS 5.5 indicates local denial of service with potential system-wide impact; no active exploitation confirmed but vulnerability affects all Linux distributions.

Use-after-free in the Linux kernel's TIPC (Transparent Inter-Process Communication) topology server allows a local attacker to corrupt kernel memory by racing network-namespace teardown against TIPC connection handling. The flaw, CWE-416, occurs because tipc_topsrv_stop() dereferences a tipc_conn after dropping the IDR lock while tipc_conn_recv_work() may have concurrently released the object's final reference. It carries a 7.8 (High) CVSS and is fixed upstream; there is no public exploit identified at time of analysis and its EPSS score is very low (0.17%).

Kernel denial-of-service in the Linux vsock subsystem allows a local low-privileged user to crash the system by winning a race between transport assignment and module unload, causing a stale pointer dereference in `vsock_assign_transport()`. The impact is limited strictly to availability - a kernel panic/oops - with no confidentiality or integrity loss. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.11% (2nd percentile) reflects the high attack complexity required to reliably win the race condition.

Denial of service in Linux kernel traffic control (qdisc) subsystem allows local authenticated attackers to crash the system by creating or modifying queue disciplines with invalid parent class references. When certain qdiscs (fq, hhf, choke, etc.) invoke qdisc_tree_reduce_backlog during initialization with a null parent class, they trigger an unhandled null pointer dereference. No active exploitation confirmed (KEV not listed), but CVSS 5.5 reflects local privilege requirement with high availability impact.

Use-after-free in the Linux kernel io_uring msg_ring subsystem allows a local, low-privileged attacker to crash the kernel via denial of service. Specifically, io_kiocb request objects allocated by msg_ring are freed immediately rather than deferred through an RCU grace period, creating a race where task_work addition races against premature object reclamation. Confirmed by KASAN via syzbot on 6.16-rc4; no public exploit identified at time of analysis and EPSS is negligible at 0.14% (4th percentile).

A general protection fault (GPF) in the Linux kernel's md-bitmap module affects the bitmap_get_stats() function when reading bitmap statistics for RAID devices with external bitmaps. Local users with sufficient privileges can trigger a kernel panic by accessing bitmap statistics through the /proc interface, causing denial of service. The vulnerability stems from incomplete validation of bitmap storage configuration introduced by a prior fix that failed to properly check superblock validity for both internal and external bitmap modes.

Use-after-free in the Linux kernel's DRM/GEM graphics subsystem allows a local user to crash the kernel by prematurely releasing a GEM handle while its buffer object remains attached to a DRM framebuffer, freeing the underlying dma-buf. Drivers using shadow planes to vmap the dma-buf during page flips (notably drm_gem_shmem-based drivers) then dereference the freed pointer during mode-setting, producing a kernel OOPS or WARNING and a denial of service. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.15% (4th percentile) confirms exploitation is rare and targeted rather than opportunistic.

Out-of-bounds page table read in the Linux kernel's memory-management rmap subsystem (mm/rmap) allows a local low-privileged user to trigger disclosure of adjacent kernel memory or a crash via the batched unmap path in try_to_unmap_one(). The flaw affects 6.16 release-candidate kernels (6.16-rc1 through rc5) where a large folio's PTE mappings span beyond a single page table, causing folio_unmap_pte_batch scanning to read past the end of a PTE table. Rated CVSS 7.1 (high) with high confidentiality and availability impact; EPSS is very low at 0.16% and there is no public exploit identified at time of analysis.

Out-of-bounds memory access in the Linux kernel's NXP i.MX clock driver (clk-imx) affects 6.16 release candidates rc1 through rc5 running on i.MX95 hardware, where the dispmix_csr_clk_dev_data table uses a hardcoded parent-name count that overruns the parent_names array when num_parents is 4. Triggered automatically during device probe (imx95_bc_probe → __clk_register), it reads eight bytes past a global array, causing memory disclosure into pointer handling and potential kernel instability, as caught by KASAN. There is no public exploit identified at time of analysis and EPSS is negligible (0.15%, 5th percentile), consistent with a hardware- and pre-release-specific defect rather than a broadly exploitable flaw.

Incorrect DMA unmap length in the Linux kernel bnxt_en driver during XDP_REDIRECT packet transmission triggers kernel warnings and potential availability disruption on systems with IOMMU enabled. Systems running Broadcom NetXtreme Ethernet adapters with IOMMU active and XDP_REDIRECT workloads are affected across multiple stable kernel branches. No public exploit exists and EPSS sits at 0.17% (7th percentile), marking this as a stability and correctness bug rather than a targeted security threat; no active exploitation has been identified.

Local privilege escalation and memory corruption in the Linux kernel's ksmbd in-kernel SMB3 server arises from a use-after-free in the oplock/lease break acknowledgment path, where a failed ksmbd_iov_pin_rsp() response allocation leads to opinfo->state being accessed after free and opinfo_put()/ksmbd_fd_put() being invoked twice. Affected builds include the 6.16 release-candidate series and Debian-packaged stable kernels running ksmbd; an authenticated SMB client interacting with a shared file can trigger the flaw for potential code execution or information disclosure. There is no public exploit identified at time of analysis and EPSS is low (0.15%), but the fix is already merged upstream and shipped via Debian LTS.

Linux kernel DRM scheduler fails to signal scheduled fences when killing job entities, causing dependent applications to hang indefinitely waiting for unresolved dependencies. Authenticated local users can trigger this denial of service by terminating applications whose job dependencies are not properly cleared during entity kill operations. The vulnerability affects multiple Linux kernel versions and has been patched upstream.

Vector register context corruption in the Linux kernel's RISC-V xtheadvector extension causes registers v8-v31 to be damaged during context save/restore operations, breaking userspace processes that rely on those registers. Affected systems must be running RISC-V hardware with the T-Head (xtheadvector) vendor extension and a Linux kernel prior to the stable tree fix. No public exploit exists and EPSS is extremely low (0.14%, 4th percentile), reflecting both the narrow hardware scope and the local-only attack vector; no active exploitation confirmed.

Kernel denial-of-service on RISC-V Linux systems stems from a flawed optimization to the access_ok() boundary check that allowed invalid addresses between TASK_SIZE and LONG_MAX to pass validation. Commit ad5643cf2f69 set TASK_SIZE_MAX to LONG_MAX for performance, but get_user_pages_fast() - invoked by syscalls such as futex() - trusts access_ok() and does not rely on hardware-level rejection of those addresses, triggering kernel faults. A local low-privileged user on an affected RISC-V system can cause a kernel crash; no public exploit is identified and EPSS probability is 0.16% (5th percentile), consistent with RISC-V's limited deployment footprint.

Denial of service in Linux kernel nfsd (NFS server daemon) allows local authenticated attackers to crash the system by triggering undefined behavior in nfsd4_spo_must_allow() when non-v4 compound RPC requests are processed. The vulnerability stems from missing validation that incoming RPC procedures are NFSv4 COMPOUND requests before examining internal state structures, causing memory access violations and system unavailability.

Race condition in the Linux kernel's MHI (Mobile Host Interface) endpoint driver allows a local low-privileged user to trigger data corruption by exploiting a premature read pointer update in mhi_ep_ring_add_element. Specifically, rd_offset is advanced before the ring buffer element is fully written, allowing the remote host to read uninitialized or incomplete data from the MHI ring - resulting in data corruption and potential availability loss. No public exploit identified at time of analysis; four stable-branch patches are available at kernel.org.

Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra I2C driver (i2c-tegra) lets a malicious or malfunctioning SMBus peripheral trigger a buffer over-read during an SMBus block read, because the driver trusted the device-supplied message length without validating it. A local attacker able to control an attached I2C/SMBus device, or to drive such a transfer, can leak adjacent kernel memory or crash the system. No public exploit identified at time of analysis; EPSS is low (0.16%, 6th percentile) and it is not on CISA KEV.

Out-of-bounds read/write in the Linux kernel's lan743x network driver affects systems using Microchip PCI1xxxx (hearthstone) Ethernet controllers, where incorrect OTP (8 Kb) and EEPROM (64 Kb) maximum size definitions allowed access beyond the intended memory bounds during EEPROM/OTP operations. A local user with the ability to invoke the driver's EEPROM/OTP read/write paths could trigger memory corruption, potentially leading to code execution or privilege escalation (CVSS 7.8). This is fixed upstream; there is no public exploit identified at time of analysis and EPSS risk is low (0.16%, 6th percentile).

Local privilege escalation and denial of service in the Linux kernel's AMD Platform Management Framework (amd-pmf) driver stems from a double-free (CWE-415) triggered when Smart PC setup fails: dev->buf is freed but not nulled, then freed again during amd_pmf_remove(). The fix converts the driver's allocations to device-managed (devm_*) allocations. No public exploit identified at time of analysis, and EPSS probability is low (0.15%), consistent with a hard-to-reach local-only kernel bug affecting AMD systems on kernels around 6.14-6.16-rc.

Local privilege-relevant memory-safety flaw in the Linux kernel's NFC NCI UART line-discipline driver (drivers/nfc/nci/uart.c) allows a local attacker to trigger use of a partially-initialized tty->disc_data pointer. The driver assigned tty->disc_data before the NCI device was successfully opened, so if the underlying hardware sent data (or the NCIUARTSETDRIVER ioctl failed) during that window, code paths could operate on a device object that was never fully set up or was torn down on error. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.18%, 8th percentile); the issue was fixed upstream by exposing disc_data only on the success path.

Incorrect frame length validation in the Linux kernel's virtio-net XDP socket (AF_XDP/XSK) receive path allows a local low-privileged attacker to trigger a kernel availability failure. The `buf_to_xdp` function incorrectly permits the first receive buffer's frame data to reach `xsk_pool_get_rx_frame_size() + vi->hdr_len` bytes, when the virtio header already occupies space within that first buffer, capping valid data at `xsk_pool_get_rx_frame_size()`. No public exploit code has been identified and EPSS sits at the 5th percentile, reflecting low real-world exploitation probability at this time.

Denial of service in the Linux kernel's dell-wmi-sysman platform driver allows a local low-privileged user to crash the system by triggering an invalid pointer dereference in sysfs callbacks. The driver fails to validate WMI data block pointers after retrieval before dereferencing them, affecting Dell hardware running unpatched kernel versions including the 6.16-rc series and Debian Linux 11.0. No active exploitation has been confirmed - EPSS sits at the 5th percentile and the vulnerability is absent from CISA KEV, making this a low-urgency patch for most environments.

Local privilege escalation and memory corruption in the Linux kernel's netfs (network filesystem) subsystem affects development builds 6.16-rc1 through 6.16-rc4, where a reference-counting error causes a double put of a netfs request. When a netfs request completes during the pause loop, the reference tied to the IN_PROGRESS flag is dropped, but the subsequent final wait loop erroneously drops it again, leading to a use-after-free/double-free condition (CWE-415). CVSS is 7.8 (High) requiring low-privileged local access; EPSS is low at 0.15% and there is no public exploit identified at time of analysis.

Continuous kernel memory exhaustion in the Linux nvmet (NVMe-over-Fabrics target) subsystem leaks kmalloc-128 slab entries via bio->bi_integrity on every NVMe command with metadata, eventually degrading or denying service on affected target systems. Systems running Linux kernel through 6.16-rc4 as NVMe-oF targets and processing metadata-bearing I/O commands are affected. No public exploit code exists and EPSS is 0.15% (5th percentile), indicating low near-term exploitation probability; this is a correctness regression from a kernel block-layer change rather than a security-targeted attack surface.

Linux kernel NFS subsystem fails to clean up /proc/net/rpc/nfs directory when nfs_fs_proc_net_init() encounters a memory allocation failure, causing a warning when rpc_proc_exit() later attempts to remove the non-empty parent directory. The vulnerability affects kernel versions 6.16-rc1 through 6.16-rc3 and likely earlier versions, and requires local privileges to trigger via fault injection or memory pressure. While marked as availability impact (DoS via kernel warning), the practical severity is limited as it primarily causes a procfs resource leak rather than direct system compromise.

Out-of-bounds access in the Linux kernel's GPIO-based regulator driver (regulator/gpio) allows a local, low-privileged actor to trigger memory corruption on systems where the regulator is configured with more than one GPIO (config::ngpios > 1). The driver under-allocated the drvdata::gpiods array to hold a single gpio_desc pointer instead of ngpios pointers, so subsequent indexing reads beyond the allocation. No public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and it is not in CISA KEV.

Race condition in Linux kernel NFSv4/pNFS layout draining allows local authenticated users to trigger denial of service through system hangs in writeback operations. The vulnerability exists in pnfs_update_layout() where a waiter on the NFS_LAYOUT_DRAIN bit can race with the waker when plh_outstanding count reaches zero, causing threads to block indefinitely on page locks. Patch available from upstream kernel stable branches.

Btrfs log replay in the Linux kernel crashes due to use of an uninitialized variable in extended reference (extref) iteration, causing a kernel denial of service for local users. In `__inode_add_ref()`, a `goto` jump skips the initialization of `victim_name.len`, so the next loop iteration reads an undefined stack value and performs an invalid memory access. No public exploit code exists and EPSS places exploitation probability at 0.16% (5th percentile), confirming negligible active-exploitation risk; this is not listed in the CISA KEV catalog.

Kernel warning triggering denial of service in the Linux SMB client subsystem affects systems using SMB multichannel. During channel reconnection in smb2_reconnect_server(), a dummy tcon structure with an uninitialized ->query_interface pointer is incorrectly passed to smb2_reconnect(), which then calls queue_delayed_work() on the invalid struct, firing a WARN_ON in the kernel workqueue at __queue_delayed_work+0x1d2/0x200. The result is potential kernel instability or crash on any Linux host using CIFS multichannel mounts; no active exploitation is confirmed, EPSS is 0.15% (4th percentile), and upstream patch commits are available across multiple stable branches.

Local privilege escalation via use-after-free in the Linux kernel's ROSE (amateur-radio X.25 PLP) networking stack, where rose_rt_device_down() mishandles neighbour-array compaction and leaves dangling rose_neigh pointers. A local attacker able to manipulate ROSE routing/devices can trigger access to freed kernel memory (CWE-416), enabling memory corruption that can lead to full compromise (confidentiality, integrity, and availability all High). No public exploit identified at time of analysis; EPSS is very low at 0.16% (6th percentile) and it is not on CISA KEV.

Out-of-bounds read in the Linux kernel virtio-net driver (through 6.16-rc3 and affected stable branches) lets a malicious or buggy virtio backend trigger a read past the allocated buffer inside xdp_linearize_page when XDP is used on the interface. The flaw stems from the driver reading follow-on ring buffers without validating that the reported received length fits within the allocated page, enabling potential information disclosure or a guest crash. There is no public exploit identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), consistent with a hard-to-weaponize local kernel memory-safety bug.

Unsafe XArray access in the Linux kernel's RDMA mlx5_ib driver causes a lockdep warning and potential kernel panic on systems using Mellanox/NVIDIA InfiniBand hardware with implicit On-Demand Paging (ODP). The non-locking xarray variants __xa_store() and __xa_erase() were called inside the mlx5 page fault handler pagefault_mr() without holding the required XArray spinlock, violating RCU protection invariants. A local low-privilege user on an affected system can trigger this condition via RDMA page fault events, causing kernel denial of service. No public exploit exists and EPSS is at the 4th percentile, indicating this is a kernel stability concern rather than an imminent exploitation target.

Kernel WARN triggered in the Linux kernel FUSE filesystem allows a local user mounting a DAX-backed FUSE filesystem to hit an unhandled warning in truncate_folio_batch_exceptionals() during inode eviction (fuse_evict_inode) on file close. The FUSE driver was missing the DAX-entry cleanup fix that xfs and ext4 already received (commit 0e2f80afcfa6), so DAX exceptional entries remained on the mapping at truncate time. Only pre-release kernels 6.16-rc1 through 6.16-rc3 are affected; no public exploit identified at time of analysis and EPSS probability is very low (0.15%).

Medtronic MyCareLink Patient Monitor has a built-in user account with an empty password, which allows an attacker with physical access to log in with no password and access modify system. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Medtronic MyCareLink Patient Monitor uses an unencrypted filesystem on internal storage, which allows an attacker with physical access to read and modify files. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Firefox and Thunderbird URL truncation flaw enables spoofing attacks by displaying misleading origins in the address bar. Affects all Firefox versions prior to 141 and corresponding Thunderbird releases. Attackers can craft URLs that hide the true destination, tricking users into visiting malicious sites. Publicly available exploit code exists. CVSS 9.8 critical rating reflects network-based attack requiring no authentication, though real-world exploitation requires social engineering (user interaction despite UI:N vector).

Search term leakage in Mozilla Firefox and Thunderbird URL bars exposes sensitive user queries to unauthorized parties when URLs are shared or logged. Firefox versions prior to 141 (regular) and 140.1 (ESR), and Thunderbird versions prior to 141 (regular) and 140.1 (ESR) fail to properly clear search parameters from the URL bar after navigation, enabling information disclosure through shoulder surfing, screenshot sharing, browser history exports, or URL-based tracking. No public exploit identified at time of analysis, though the attack requires only user interaction (EPSS data not provided). CVSS 8.1 reflects high confidentiality and integrity impact despite requiring user interaction.

Frame navigation validation bypass in Mozilla Firefox and Thunderbird allows unauthenticated remote attackers to violate security boundaries due to improper path checking (CWE-345). Affects Firefox <141, Firefox ESR <140.1, Thunderbird <141, and Thunderbird ESR <140.1. The CVSS 9.8 critical score reflects network-based exploitation with no user interaction required, enabling potential unauthorized access, data manipulation, and service disruption. No public exploit identified at time of analysis, though the network attack vector (AV:N) and low complexity (AC:L) suggest straightforward exploitation once technical details emerge.

Cookie shadowing in Mozilla Firefox (versions prior to 141 and ESR prior to 140.1) and Thunderbird (versions prior to 141 and ESR prior to 140.1) allows remote unauthenticated attackers to bypass Secure cookie protections and access or modify session data. A nameless cookie containing an equals sign set over insecure HTTP can override cookies with the Secure attribute, enabling session hijacking or authentication bypass. No public exploit identified at time of analysis, though the attack complexity is low (CVSS AC:L) with network-based attack vector requiring no user interaction.

DNS rebinding attacks can bypass Cross-Origin Resource Sharing (CORS) protections in Mozilla Firefox and Thunderbird due to improper cache invalidation of CORS preflight responses when target IP addresses change. Remote attackers can exploit this via malicious websites to access confidential cross-origin data without user authentication (CVSS: PR:N, UI:R). No public exploit identified at time of analysis, though CERT VU#652514 provides technical disclosure. EPSS data not provided, but the combination of network-accessible attack vector, low complexity, and no required privileges warrants attention for organizations using affected Mozilla products.

WebAssembly JIT compiler on ARM64 architectures incorrectly calculates branch addresses when processing WASM br_table instructions with numerous entries, enabling remote code execution in Firefox <141, Firefox ESR <115.26/128.13/140.1, and Thunderbird <141/128.13/140.1. The vulnerability requires no authentication or user interaction (CVSS AV:N/AC:L/PR:N/UI:N), allowing network-based attackers to potentially execute arbitrary code through malicious WASM content. Vendor-released patches are available across all affected product lines. No public exploit identified at time of analysis, though the CVSS 9.8 critical rating reflects the theoretical severity of unauthenticated remote code execution.

Information disclosure in Mozilla Firefox and Thunderbird on 64-bit platforms allows remote attackers to leak sensitive memory contents via specially crafted web content. The IonMonkey JIT compiler writes only 32 bits of the 64-bit return value space on the stack, while the Baseline JIT reads the entire 64 bits, exposing uninitialized stack memory. Exploitation requires user interaction (UI:R) and no authentication. Fixes are available: Firefox 141+, Firefox ESR 115.26+, Firefox ESR 128.13+, Firefox ESR 140.1+, Thunderbird 141+, Thunderbird 128.13+, and Thunderbird 140.1+.

Uninitialized variable in libssh's privatekey_from_file() function can cause heap corruption or signing failures when a non-existent key file is specified, allowing local authenticated attackers to trigger memory corruption with potential for information disclosure. CVSS 3.6 reflects local attack vector and high complexity; exploitation requires authenticated access and specific file conditions.

HTTP Response Splitting in HotelRunner's B2B hospitality platform stems from improper certificate-host mismatch validation (CWE-297), enabling an authenticated low-privilege attacker to inject crafted headers into HTTP responses when a victim user interacts with the vulnerable flow. Successful exploitation can lead to cache poisoning, session hijacking, or content injection with limited confidentiality and integrity impact (C:L/I:L). No public exploit exists and EPSS sits at 0.07% (21st percentile), indicating no observed widespread exploitation at time of analysis.

Weak password recovery in jshERP up to version 3.5 allows authenticated remote attackers to compromise user accounts via the /jshERP-boot/user/updatePwd endpoint. The vulnerability enables password reset functionality without adequate protection mechanisms, classified as problematic with CVSS 2.1 and EPSS 0.06%. Publicly available exploit code exists but active exploitation remains unconfirmed.

Improper authorization in jshERP up to version 3.5 allows authenticated remote attackers to modify or delete user accounts via manipulation of the ID parameter in the /user/delete endpoint, potentially resulting in unauthorized account manipulation and information disclosure. Publicly available exploit code exists for this vulnerability.

Improper export of Android application components in Genshin Albedo Cat House App 1.0.2 allows local attackers with user privileges to access sensitive information through AndroidManifest.xml misconfigurations in the com.house.auscat component. The vulnerability requires local access and authenticated user privileges but carries minimal real-world risk due to low EPSS (0.02%) and the constraint of local-only exploitation.

Cleartext identity exposure in the TRENDnet TEW-WLC100P wireless controller (firmware 2.03b03) stems from its bundled racoon IKE daemon shipping with aggressive mode as the first exchange_mode entry. Because IKE Phase 1 aggressive mode transmits identity payloads in plaintext and sends a hash of the pre-shared key that can be captured, any party observing or initiating a negotiation can harvest identities and mount offline dictionary attacks against the PSK. No public exploit identified at time of analysis and the EPSS probability is low (0.27%, 19th percentile), consistent with a configuration-hardening weakness rather than a mass-exploited flaw.

Pre-Shared Key hash disclosure affects the TRENDnet TEW-WLC100P wireless LAN controller running firmware 2.03b03, whose bundled strongSwan configuration ships with the i_dont_care_about_security_and_use_aggressive_mode_psk option enabled by default. Because the IKE responder accepts IKEv1 Aggressive Mode with PSK, it transmits the PSK hash in the clear during negotiation, letting a network-positioned attacker capture it and mount an offline dictionary/brute-force crack to recover the VPN pre-shared secret. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low (0.36%), reflecting an information-disclosure weakness rather than direct remote code execution.

RuoYi up to version 4.8.1 uses hardcoded default credentials in the Druid database configuration file (application-druid.yml), allowing authenticated remote attackers to gain low-impact information disclosure. The vulnerability requires prior authentication (PR:L per CVSS 4.0) and has been publicly disclosed with exploit details available, though EPSS scoring (0.05%) and the low CVSS impact (VC:L only) suggest limited real-world exploitation risk despite the proof-of-concept availability.

Foresight News App for Android versions up to 2.6.4 improperly exports application components via AndroidManifest.xml, allowing local attackers with limited privileges to access sensitive information. The CVSS 1.9 score reflects low actual impact (information disclosure only, no integrity or availability loss), though the vulnerability is publicly exploitable. EPSS percentile of 13% indicates minimal real-world exploitation likelihood despite public POC availability, suggesting this is a low-priority issue for most deployments.

IDnow App for Android up to version 9.6.0 improperly exports application components via AndroidManifest.xml misconfiguration, allowing local attackers with user-level privileges to access sensitive functionality or information disclosure. The vulnerability is classified as low severity (CVSS 1.9) with publicly available exploit code, but the vendor has not responded to disclosure and no patch has been released. While exploitation requires local device access and legitimate app installation, the improper component export could enable privilege escalation or data theft when combined with other vulnerabilities.

InstantBits Web Video Cast on Android versions up to 5.12.4 improperly exports application components via AndroidManifest.xml configuration, allowing local attackers with user privileges to access sensitive functionality without authentication. The vulnerability has a CVSS score of 1.9 with low confidentiality impact and no integrity or availability impact, but is rated problematic due to the disclosure of exploitation techniques and vendor non-responsiveness. This is a local, low-severity information disclosure issue affecting only users with direct device access.

Dunamu StockPlus Android app versions up to 7.62.10 improperly export application components via AndroidManifest.xml configuration, allowing local attackers with low privileges to access sensitive functionality. The vulnerability requires local device access and affects the com.dunamu.stockplus component, resulting in limited information disclosure. Publicly available exploit code exists, and the vendor did not respond to early disclosure notification.

CallApp Caller ID App versions up to 2.0.4 on Android improperly export application components via AndroidManifest.xml misconfiguration, allowing local authenticated attackers to access sensitive functionality with limited information disclosure impact. The vulnerability has been publicly disclosed with exploit code available, though the CVSS score of 1.9 and EPSS of 0.03% indicate minimal real-world exploitation risk despite public POC availability.

Eluktronics Control Center 5.23.51.41 permits local authenticated users to bypass data authenticity verification in the REG File Handler component, resulting in potential information disclosure. The vulnerability requires local access and authenticated privileges but carries minimal real-world impact given the CVSS 1.9 score and EPSS exploitation probability of 0.01% (third percentile). Public exploit code has been disclosed, though vendor has not responded to disclosure notifications.

Improper brute-force protection in the Mercusys MW301R router allows local network attackers to conduct excessive authentication attempts against the login component without rate limiting. The vulnerability affects firmware version 1.0.2 Build 190726 Rel.59423n and permits attackers to bypass authentication attempt restrictions, though actual credential compromise requires additional attack complexity. Public exploit code exists, but the vendor has not responded to disclosure and provided no patch.

Weak password recovery in Mercusys MW301R 1.0.2 Build 190726 allows high-privileged authenticated attackers to manipulate the code argument in the web interface to disclose or modify password recovery mechanisms, with publicly available exploit code. The vendor has not responded to early disclosure notification. EPSS exploitation probability is 0.04% (13th percentile), indicating minimal real-world exploitation likelihood despite public POC availability.

Use-after-free in Linux Kernel traffic control (qdisc) subsystem allows local authenticated attackers to execute arbitrary code, escalate privileges, or cause denial of service. Affects Linux Kernel versions prior to vendor-released patches across multiple stable branches (6.6.x, 6.12.x, 6.15, 6.16-rc1). Triggered when classful qdiscs like DRR and HFSC incorrectly handle child class deactivation during enqueue operations, leaving stale class pointers that can be exploited after deletion. Vendor patches available from kernel.org git stable tree; no active exploitation confirmed (not in CISA KEV), but PoC reproducer exists in public advisory.

Server-Side Request Forgery in Agorum core open's TunnelServlet component exposes internal and external network resources to unauthenticated remote attackers through crafted HTTP requests. Affected versions are 11.9.2 and 11.10.1 of the agorum Software GmbH document management platform. No active exploitation is confirmed and the EPSS score sits at the 10th percentile (0.20%), indicating low observed exploitation pressure at time of analysis, though the zero-authentication requirement lowers the barrier for opportunistic scanning.

Plaintext credential storage in agorum core open versions 11.9.2 and 11.10.1 exposes stored account credentials to anyone able to read the underlying storage, undermining the confidentiality of any account whose secrets are persisted by this German enterprise content and document management platform. The flaw, tracked as CWE-256 and reported in usd HeroLab advisory usd-2025-0023, carries a vendor/NVD CVSS of 8.2 but no public exploit identified at time of analysis and no CISA KEV listing. Disclosed credentials can be reused to impersonate users or pivot into connected systems.

XML External Entity (XXE) injection in agorum core open's RSSReader endpoint enables remote attackers to exfiltrate sensitive server-side data by submitting crafted XML payloads. Affected versions are v11.9.2 and v11.10.1 of this document management platform. EPSS exploitation probability sits at 0.22% (13th percentile), no public exploit code has been identified, and the vulnerability is not listed in CISA's KEV catalog - indicating low observed exploitation pressure despite the network-accessible, unauthenticated attack surface described by the CVSS vector.

Splashin iOS v2.0 fails to enforce server-side rate limiting on location update frequency for free-tier accounts, allowing free users to bypass tier-based restrictions and submit location updates at an unrestricted rate. Confirmed by CPE (cpe:2.3:a:splashin:splashin:2.0:*:*:*:*:iphone_os:*:*), this business logic flaw exposes the platform's API to abuse by any free-tier account holder. A publicly available proof-of-concept is referenced via NVD exploit tag; EPSS sits at 0.36% (28th percentile), indicating low probability of widespread automated exploitation.

Token generation in Xuxueli xxl-job up to version 3.1.1 uses password hashing with insufficient computational effort (weak bcrypt configuration or equivalent), allowing attackers to crack authentication tokens through brute force. The vulnerability affects the makeToken function in IndexController.java and has low practical impact (confidentiality impact only, no integrity or availability damage), but exploitation requires high attack complexity and is not known to be actively exploited at scale despite public disclosure of the vulnerability.