Ctrl + K

Latest intel// live feed

25 results//sorted by published//last sync 2026-10-20 04:15Z
2025-09-15
2025-09-15 15:15Z
CRIT

CVE-2022-50335 — Linux Linux_kernel: It will use a uninitialized req, which will result in a bad request data

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50335

In the Linux kernel, the following vulnerability has been resolved: 9p: set req refcount to zero to avoid uninitialized usage When a new request is allocated, the refcount will be zero if it is reused, but if the request is newly allocated from slab, it is not fully initialized before being added to idr. If the p9_read_work got a response before the refcount initiated. It will use a uninitialized req, which will result in a bad request data struct. Here is the logs from s CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

CWECWE 908TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2023-53194 — Linux Linux_kernel: [ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53194

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add length check in indx_get_root This adds a length check to guarantee the retrieved index root is legit. [ 162.459513] BUG: KASAN: use-after-free in hdr_find_e.isra.0+0x10c/0x320 [ 162.460176] Read of size 2 at addr ffff8880037bca99 by task mount/243 [ 162.460851] [ 162.461252] CPU: 0 PID: 243 Comm: mount Not tainted 6.0.0-rc7 #42 [ 162.461744] Hardware name: QEMU Standard PC (i440FX + PII CVSSv3.1 8.4 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-09-15
2025-09-15 14:15Z
CRIT

CVE-2023-53192 — Linux Linux_kernel: Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53192

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix nexthop hash size The nexthop code expects a 31 bit hash, such as what is returned by fib_multipath_hash() and rt6_multipath_hash(). Passing the 32 bit hash returned by skb_get_hash() can lead to problems related to the fact that 'int hash' is a negative number when the MSB is set. In the case of hash threshold nexthop groups, nexthop_select_path_hthr() will disproportionately select the first n CVSSv3.1 9.8 (CRITICAL) · EPSS 5th percentile

CWECWE 129TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2023-53186 — Linux Linux_kernel: Later when SKB(@to) is released, it frees the page directly even though the page

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2023-53186

In the Linux kernel, the following vulnerability has been resolved: skbuff: Fix a race between coalescing and releasing SKBs Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment recycling") allowed coalescing to proceed with non page pool page and page pool page when @from is cloned, i.e. to->pp_recycle --> false from->pp_recycle --> true skb_cloned(from) --> true However, it actually requires skb_cloned(@from) to hold true until coalescing finishes in CVSSv3.1 8.1 (HIGH) · EPSS 1th percentile

CWECWE 362TYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-15
2025-09-15 14:15Z
HIGH

CVE-2022-50241 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50241

In the Linux kernel, the following vulnerability has been resolved: NFSD: fix use-after-free on source server when doing inter-server copy Use-after-free occurred when the laundromat tried to free expired cpntf_state entry on the s2s_cp_stateids list after inter-server copy completed. The sc_cp_list that the expired copy state was inserted on was already freed. When COPY completes, the Linux client normally sends LOCKU(lock_state x), FREE_STATEID(lock_state x) and CLOSE(op CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 416TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-15
2025-09-15 14:15Z
CRIT

CVE-2022-50235 — Linux Linux_kernel: In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2022-50235

In the Linux kernel, the following vulnerability has been resolved: NFSD: Protect against send buffer overflow in NFSv2 READDIR Restore the previous limit on the @count argument to prevent a buffer overflow attack. CVSSv3.1 9.8 (CRITICAL) · EPSS 7th percentile

CWECWE 787TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-15
2025-09-15 12:15Z
HIGH

CVE-2025-10443 — Tenda Ac9_firmware: Such manipulation of the argument cmdinput leads to buffer overflow.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10443

A vulnerability was identified in Tenda AC9 and AC15 15.03.05.14/15.03.05.18. This vulnerability affects the function formexeCommand of the file /goform/exeCommand. Such manipulation of the argument cmdinput leads to buffer overflow. The attack can be executed remotely. The exploit is publicly available and might be used. CVSSv3.1 8.8 (HIGH) · EPSS 91th percentile

CWECWE 120CWECWE 119VNDTendaTYPVulnerability
8.8
CVSS v3.1
95
Edit Score
728 × 90 / responsive · programmatic ad slot
2025-09-15
2025-09-15 11:15Z
MED

CVE-2025-10442 — Tenda Ac9_firmware: This manipulation of the argument cmdinput causes os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10442

A vulnerability was determined in Tenda AC9 and AC15 15.03.05.14. This affects the function formexeCommand of the file /goform/exeCommand. This manipulation of the argument cmdinput causes os command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. CVSSv3.1 6.3 (MEDIUM) · EPSS 95th percentile

CWECWE 77CWECWE 78VNDTendaTYPVulnerability
6.3
CVSS v3.1
84
Edit Score
2025-09-15
2025-09-15 11:15Z
MED

CVE-2025-10441 — The manipulation of the argument path results in os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10441

A vulnerability was found in D-Link DI-8100G, DI-8200G and DI-8003G 17.12.20A1/19.12.10A1. Affected by this issue is the function sub_433F7C of the file version_upgrade.asp of the component jhttpd. The manipulation of the argument path results in os command injection. The attack may be launched remotely. The exploit has been made public and could be used. CVSSv3.1 6.3 (MEDIUM) · EPSS 96th percentile

CWECWE 77CWECWE 78TYPVulnerability
6.3
CVSS v3.1
85
Edit Score
2025-09-15
2025-09-15 10:15Z
MED

CVE-2025-10440 — The manipulation of the argument hname leads to os command injection.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-10440

A vulnerability has been found in D-Link DI-8100, DI-8100G, DI-8200, DI-8200G, DI-8003 and DI-8003G 16.07.26A1/17.12.20A1/19.12.10A1. Affected by this vulnerability is the function sub_4621DC of the file usb_paswd.asp of the component jhttpd. The manipulation of the argument hname leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. CVSSv3.1 6.3 (MEDIUM) · EPSS 96th percentile

CWECWE 77CWECWE 78TYPVulnerability
6.3
CVSS v3.1
85
Edit Score
2025-09-12
2025-09-12 18:15Z
CRIT

CVE-2025-58434 — Flowiseai Flowise: This enables any attacker to generate a reset token for arbitrary users and directly

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the `forgot-password` endpoint in Flowise returns sensitive information including a valid password reset `tempToken` without authentication or verification. This enables any attacker to generate a reset token for arbitrary users and directly reset their password, leading to a complete account takeover (ATO). This vulnerability applies to both the cloud servic CVSSv3.1 9.8 (CRITICAL) · EPSS 99th percentile

CWECWE 306VNDFlowiseaiVNDFlowiseTYPVulnerability
9.8
CVSS v3.1
100
Edit Score
2025-09-12
2025-09-12 16:15Z
CRIT

CVE-2025-55835 — Sueamcms_project Sueamcms: File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-55835

File Upload vulnerability in SueamCMS v.0.1.2 allows a remote attacker to execute arbitrary code via the lack of filtering. CVSSv3.1 9.8 (CRITICAL) · EPSS 62th percentile

CWECWE 434VNDSueamcms ProjectTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-12
2025-09-12 14:15Z
CRIT

CVE-2025-9556 — Langchaingo: Gonja supports include and extends syntax to read files, which leads to a server

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-9556

Langchaingo supports the use of jinja2 syntax when parsing prompts, which is in turn parsed using the gonja library v1.5.3. Gonja supports include and extends syntax to read files, which leads to a server side template injection vulnerability within langchaingo, allowing an attacker to insert a statement into a prompt to read the "etc/passwd" file. CVSSv3.1 9.8 (CRITICAL) · EPSS 51th percentile

VNDLangchaingoTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-12
2025-09-12 08:15Z
HIGH

CVE-2025-21043 — Samsung Android: Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21043in the wild

Out-of-bounds write in libimagecodec.quram.so prior to SMR Sep-2025 Release 1 allows remote attackers to execute arbitrary code. CVSSv3.1 8.8 (HIGH) · EPSS 81th percentile

CWECWE 787VNDSamsungTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
95
Edit Score
2025-09-12
2025-09-12 08:15Z
HIGH

CVE-2025-21042 — Samsung Android: Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-21042in the wild

Out-of-bounds write in libimagecodec.quram.so prior to SMR Apr-2025 Release 1 allows remote attackers to execute arbitrary code. CVSSv3.1 8.8 (HIGH) · EPSS 98th percentile

CWECWE 787VNDSamsungTYPVulnerabilitySTAitw exploited
8.8
CVSS v3.1
100
Edit Score
2025-09-12
2025-09-12 06:15Z
HIGH

CVE-2025-6454 — Gitlab Gitlab: An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-6454

An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 18.1.6, 18.2 before 18.2.6, and 18.3 before 18.3.2 that could have allowed authenticated users to make unintended internal requests through proxy environments by injecting crafted sequences. CVSSv3.1 8.5 (HIGH) · EPSS 53th percentile

CWECWE 918VNDGitlabTYPVulnerability
8.5
CVSS v3.1
93
Edit Score
2025-09-11
2025-09-11 21:15Z
HIGH

CVE-2025-36222 — Ibm Storage_fusion: Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-36222

IBM Fusion 2.2.0 through 2.10.1, IBM Fusion HCI 2.2.0 through 2.10.0, and IBM Fusion HCI for watsonx 2.8.2 through 2.10.0 uses insecure default configurations that could expose AMQStreams without client authentication that could allow an attacker to perform unauthorized actions. CVSSv3.1 8.7 (HIGH) · EPSS 30th percentile

CWECWE 1188VNDIbmTYPVulnerability
8.7
CVSS v3.1
94
Edit Score
2025-09-11
2025-09-11 18:15Z
HIGH

CVE-2025-43790 — Liferay Digital_experience_platform: Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-43790

Insecure Direct Object Reference (IDOR) vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.6, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows remote authenticated users to from one virtual instance to access, create, edit, relate data/object entries/definitions to an object in a different virtual instance. CVSSv3.1 8.1 (HIGH) · EPSS 26th percentile

CWECWE 639VNDLiferayVNDDirectTYPVulnerability
8.1
CVSS v3.1
91
Edit Score
2025-09-11
2025-09-11 17:15Z
HIGH

CVE-2025-39790 — Linux Linux_kernel: This works when processing completion for chained transactions, but can lead to nasty results

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39790

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Detect events pointing to unexpected TREs When a remote device sends a completion event to the host, it contains a pointer to the consumed TRE. The host uses this pointer to process all of the TREs between it and the host's local copy of the ring's read pointer. This works when processing completion for chained transactions, but can lead to nasty results if the device sends an event for a si CVSSv3.1 8.4 (HIGH) · EPSS 4th percentile

CWECWE 415TYPVulnerability
8.4
CVSS v3.1
92
Edit Score
2025-09-11
2025-09-11 17:15Z
HIGH

CVE-2025-39761 — Linux Linux_kernel: This could lead to out-of-bounds access in peer->rx_tid[].

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39761

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Decrement TID on RX peer frag setup error handling Currently, TID is not decremented before peer cleanup, during error handling path of ath12k_dp_rx_peer_frag_setup(). This could lead to out-of-bounds access in peer->rx_tid[]. Hence, add a decrement operation for TID, before peer cleanup to ensures proper cleanup and prevents out-of-bounds access issues when the RX peer frag setup fails. Fou CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-11
2025-09-11 17:15Z
CRIT

CVE-2025-39758 — Linux Linux_kernel: With the recent slab allocator changes being slowly introduced into next (that disallow sendpage

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39758

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix the sendmsg byte count in siw_tcp_sendpages Ever since commit c2ff29e99a76 ("siw: Inline do_tcp_sendpages()"), we have been doing this: static int siw_tcp_sendpages(struct socket *s, struct page **page, int offset, size_t size) [...] /* Calculate the number of bytes we need to push, for this page * specifically */ size_t bytes = min_t(size CVSSv3.1 9.8 (CRITICAL) · EPSS 4th percentile

TYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-11
2025-09-11 17:15Z
HIGH

CVE-2025-39750 — Linux Linux_kernel: Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-39750

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: Correct tid cleanup when tid setup fails Currently, if any error occurs during ath12k_dp_rx_peer_tid_setup(), the tid value is already incremented, even though the corresponding TID is not actually allocated. Proceed to ath12k_dp_rx_peer_tid_delete() starting from unallocated tid, which might leads to freeing unallocated TID and cause potential crash or out-of-bounds access. Hence, fix by cor CVSSv3.1 8.8 (HIGH) · EPSS 5th percentile

CWECWE 125TYPVulnerability
8.8
CVSS v3.1
94
Edit Score
2025-09-11
2025-09-11 15:48Z
HIGH

kernel-exploits — My proof-of-concept exploits for the Linux kernel

GitHub · kernel exploits·github.comGITHUB POCCVE-2016-2384CVE-2016-9793CVE-2017-1000112CVE-2017-18344CVE-2017-6074CVE-2017-7308CVE-2025-38494CVE-2025-38495

xairy's kernel-exploits repository is a curated collection of proof-of-concept Linux kernel exploits spanning 2016–2025, covering double-free vulnerabilities, signedness issues, memory corruption, and integer underflow flaws across USB, socket, and HID subsystems. The collection includes both privilege escalation and information-leak primitives, with the most recent additions (CVE-2025-38494/38495) targeting HID core integer underflow.

SRFOsTACTA0004TACTA0005OSLinuxTYPWriteupTYPExploitSTGDefense EvasionSTGPrivesc
78
Edit Score
2025-09-11
2025-09-11 14:15Z
CRIT

CVE-2025-58143 — Xen Xen: A NULL pointer dereference in the updating of the reference TSC area.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58143

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE CVSSv3.1 9.8 (CRITICAL) · EPSS 29th percentile

CWECWE 366VNDXenVNDCnaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score
2025-09-11
2025-09-11 14:15Z
CRIT

CVE-2025-58142 — Xen Xen: A NULL pointer dereference in the updating of the reference TSC area.

NVD (auto-promoted CVEs)·nvd.nist.govCVE-2025-58142

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE CVSSv3.1 9.8 (CRITICAL) · EPSS 39th percentile

CWECWE 395VNDXenVNDCnaTYPVulnerability
9.8
CVSS v3.1
99
Edit Score