SQL injection in Spring AI's CosmosDBVectorStore component (versions 1.0.0-1.0.5 and 1.1.0-1.1.4) enables authenticated remote attackers to execute arbitrary SQL queries through malicious document IDs, potentially achieving full database compromise including data exfiltration, modification, and denial of service. VMware has released patches in versions 1.0.6 and 1.1.5. CVSS score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires low-privilege authenticated access to the vector store API.
Renderer-level arbitrary code execution in Google Chrome's Media component affects all desktop builds prior to 147.0.7727.138, where a use-after-free (CWE-416) lets a remote attacker run code inside the browser sandbox when a victim loads a crafted HTML page. Google's own Chrome team reported it and Chromium rated it Medium severity because execution is confined to the sandboxed renderer rather than the host. There is no public exploit identified at time of analysis, and EPSS is very low at 0.04% (11th percentile), so no confirmed active exploitation exists.
Remote code execution in Google Chrome desktop before 147.0.7727.138 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the media component. Google rates the Chromium severity High and has shipped a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 11th percentile). Notably the description confines code execution to inside the sandbox, so a separate sandbox-escape bug would be required for full host compromise.
Remote code execution in Google Chrome desktop builds prior to 147.0.7727.138 arises from a use-after-free in the Navigation component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code in the renderer context. Chromium rates the flaw High severity and CVSS scores it 8.8, but there is no public exploit identified at time of analysis and EPSS is very low at 0.04% (11th percentile). A vendor patch is available and CISA's SSVC framework currently records exploitation as none.
Sandboxed arbitrary code execution in Google Chrome for Android (WebView component) before 147.0.7727.138 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is very low (0.03%). Exploitation requires user interaction (visiting attacker content) and, per the description, execution is contained inside the sandbox rather than achieving a full sandbox escape.
Heap corruption in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to trigger a heap buffer overflow when a victim visits a crafted HTML page, potentially leading to memory corruption and arbitrary code execution within the renderer process. Reported internally by the Chrome team and rated Medium by Chromium, it carries a CVSS of 8.8 driven by high confidentiality/integrity/availability impact plus required user interaction. There is no public exploit identified at time of analysis, and EPSS is very low (0.03%, 8th percentile), indicating no observed exploitation activity.
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a type confusion condition rated High severity by Chromium; there is no public exploit identified at time of analysis and EPSS is very low (0.01%, 2nd percentile), and SSVC records no observed exploitation, though the technical impact is total. A vendor patch is available.
Remote code execution in Google Chrome desktop before 147.0.7727.138 stems from a use-after-free in the browser's Codecs component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code within Chrome's renderer sandbox. Rated High severity by Chromium with CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.01%.
Out-of-bounds read/write in Google Chrome's ANGLE graphics layer lets a remote attacker who lures a victim to a crafted HTML page corrupt GPU-process memory and potentially escape the browser sandbox, on all Chrome builds before 147.0.7727.138. Rated High by Chromium with CVSS 8.8; a vendor patch is available and no public exploit identified at time of analysis. EPSS is very low (0.01%) and SSVC records exploitation status 'none', so risk is currently theoretical despite the total technical impact.
Heap corruption in the Views UI component of Google Chrome on macOS (versions prior to 147.0.7727.138) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution. Rated High by Chromium with a CVSS of 8.8; no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome desktop before 147.0.7727.138 arises from a use-after-free in the Animation component (CWE-416), allowing a remote attacker who lures a victim to a crafted HTML page to execute arbitrary code, though execution is constrained to inside the renderer sandbox. Chromium rates the severity High and a vendor patch is available; there is no public exploit identified at time of analysis, EPSS is very low (0.01%), and CISA SSVC marks exploitation as none.
Sandbox escape in Google Chrome's ANGLE graphics abstraction layer (versions prior to 147.0.7727.138) lets an attacker who already controls a compromised renderer process break out of the browser sandbox by loading a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, it is a use-after-free (CWE-416) memory-corruption bug used as the second stage of a browser exploit chain. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA's SSVC framework records exploitation status as none.
Sandbox escape in Google Chrome on Windows (versions prior to 147.0.7727.138) leverages a use-after-free flaw in the browser's Accessibility component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain higher-privileged code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.8, the bug is patched but has no public exploit identified at time of analysis, and its EPSS score is very low (0.01%). This is a second-stage primitive typically chained with a separate renderer-RCE bug rather than exploited in isolation.
Heap corruption via use-after-free in Google Chrome (iOS) before 147.0.7727.138 allows a remote attacker to potentially execute code or crash the browser when a victim opens a crafted HTML page. Chromium rates the flaw Critical severity, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible (0.01%). Exploitation requires the victim to load attacker-controlled web content (UI:R).
Remote code execution in Google Chrome (Canvas component) on Linux and ChromeOS before 147.0.7727.138 lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated Critical by Chromium, the flaw is a Canvas use-after-free (CWE-416); code execution is confined to the sandboxed renderer rather than the host OS. No public exploit identified at time of analysis and EPSS is very low (0.01%), though SSVC rates technical impact as total and the attack as automatable.
Sandboxed remote code execution in Google Chrome's WebRTC component affects all desktop builds prior to 147.0.7727.138, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code within the renderer sandbox. Google rates the Chromium severity as High and has shipped a fix in the Stable channel; there is no public exploit identified at time of analysis and the EPSS probability is negligible (0.01%). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and code execution is confined to the sandbox unless chained with a separate sandbox-escape bug.
Remote code execution in Google Chrome's WebRTC component (versions prior to 147.0.7727.138) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free memory corruption reported by Google's own Chrome team; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is very low (0.01%), and CISA SSVC scores exploitation as 'none', indicating no observed exploitation despite the high technical severity.
Resource exhaustion in OpenClaw before 2026.3.31 allows remote unauthenticated attackers to crash servers by sending malicious Microsoft Teams webhook payloads. The application parses request bodies before performing JWT validation, enabling attackers to bypass authentication and trigger denial-of-service conditions. A vendor patch is available via GitHub commit 3834d47, with no evidence of active exploitation (not in CISA KEV) and no public POC identified at time of analysis.
Unauthenticated remote denial-of-service in CoreDNS' DNS-over-QUIC (DoQ) server (versions before 1.14.3) lets an attacker exhaust memory and goroutines by opening many QUIC streams and sending only a single byte on each, stalling the DoQ length-prefix read. Because CoreDNS spawns a goroutine per accepted stream even when the configured worker_pool_size is full, and workers block indefinitely in io.ReadFull() with no per-stream read deadline, the process grows unbounded until OOM-kill. Publicly available exploit code exists (a Python reproducer demonstrating goroutine growth from 17 to over 15,000), though EPSS remains low at 0.14%; this stems from an incomplete fix/regression of CVE-2025-47950.
Remote unauthenticated denial-of-service in CoreDNS (all versions < 1.14.3) lets an attacker exhaust CPU and memory by flooding the DNS-over-HTTPS GET endpoint (/dns-query?dns=...) with oversized base64 payloads. Because the GET path performs URL query unescaping, base64 decoding, and DNS message unpacking before any size check, each request consumes significant resources despite ultimately returning 400 Bad Request. A detailed proof-of-concept with profiling data is published in the vendor advisory; publicly available exploit code exists, though EPSS is low (0.10%) and it is not on CISA KEV.
TSIG authentication bypass in CoreDNS before 1.14.3 lets unauthenticated remote clients defeat the tsig plugin's `require all` policy on every encrypted transport (DoT, DoH, DoH3, DoQ, and gRPC). Because the plugin trusts each transport writer's TsigStatus() rather than verifying the signature itself, transports that never populate a TSIG secret return a nil status and treat invalid or unsigned requests as authenticated, granting access to zone data or privileged queries the operator meant to restrict. Publicly available exploit code (a reproducer PoC) exists, but EPSS is low (0.07%, 21st percentile) and it is not on CISA KEV, so there is no confirmed active exploitation at time of analysis.
Denial of service in OpenClaw (pre-2026.3.28) allows remote unauthenticated attackers to exhaust server resources by flooding the application with concurrent WebSocket upgrade requests. The vulnerability stems from lack of rate-limiting and resource budgeting before authentication, enabling attackers to monopolize socket and worker thread capacity and block legitimate WebSocket clients. No active exploitation confirmed (not in CISA KEV), but the technical barrier is low given unauthenticated network access (CVSS:4.0 AV:N/AC:L/PR:N). VulnCheck reported this vulnerability with vendor advisory available on GitHub.
Uncontrolled recursion in Apache Thrift Node.js library's skip() function enables remote denial of service via crafted protocol messages. Attacker sends specially-crafted Thrift messages triggering deep recursion in the skip() deserialization routine, exhausting stack memory and crashing the Node.js process. CVSS 8.7 High severity with network attack vector requiring no authentication. Disclosed via oss-security mailing list on 2026-04-28 alongside three related Thrift vulnerabilities (C++ JSON OOB read CVE-2026-41607, c_glib dispatch stack overflow CVE-2026-41606, Swift Compact Protocol issue CVE-2026-41605), suggesting coordinated security audit results. EPSS data not yet available for 2026 CVE.
Improper authorization in OpenClaw before 2026.4.8 lets users holding the broad operator.write scope approve node pairing that should require the narrower operator.pairing scope plus admin, granting them unauthorized control of exec-capable nodes. Reported by VulnCheck and credited to Tencent Zhuque Lab, it carries a CVSS 4.0 score of 8.7 with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%). A vendor patch (npm 2026.4.8) is available.
Penetration Testing engineers at Amazon have identified a security flaw related to request handling in the web server component that could, under certain conditions, lead to unintended access to. Rated high severity (CVSS 8.7), this vulnerability is no authentication required, low attack complexity. This Missing Authentication for Critical Function vulnerability could allow attackers to access critical functionality without authentication.
Filter expression injection in Spring AI 1.0.0-1.0.5 and 1.1.0-1.1.4 allows remote unauthenticated attackers to manipulate vector store queries through unescaped keys and values in FilterExpressionConverter implementations. The vulnerability enables query language injection across multiple vector database backends, potentially exposing sensitive data (CVSS:C:H) and modifying query results (CVSS:I:L). VMware has released patches in versions 1.0.6 and 1.1.5. No active exploitation confirmed (not in CISA KEV), but the network-accessible attack vector (AV:N/AC:L/PR:N) and code injection classification (CWE-94) indicate significant risk for applications processing untrusted filter expressions.
Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting malicious prompts that bypass sandbox access controls. The vulnerability affects the sandbox initialization component and enables information disclosure without requiring any authentication or user interaction (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Cross-scope impact (S:C) indicates the attack breaks out of the intended sandbox boundary to access host-level secrets. EPSS and KEV status not available; this appears to be a recently disclosed AI/LLM agent security issue.
Privilege escalation in MphRx Minerva V3.6.0 allows authenticated users with user modification privileges to gain administrator access by manipulating the 'identifier' field in direct HTTP requests to the '/minerva/moUser/update' endpoint. While the vulnerability requires existing low-level authenticated access and cannot be exploited through the graphical interface, the CVSS v4.0 score of 8.5 reflects high impact across confidentiality, integrity, and availability in the subsequent system context (SC:H/SI:H/SA:H). No public exploit identified at time of analysis, with EPSS data unavailable for this recent CVE.
Insecure direct object reference in MphRx Minerva V3.6.0 allows authenticated attackers to enumerate and exfiltrate sensitive user data across the entire application by manipulating user IDs in the '/minerva/moUser/show/' endpoint. The CVSS 4.0 score of 8.5 reflects high confidentiality impact to both vulnerable (VC:H) and subsequent (SC:H) systems, with subsequent high integrity (SI:H) and availability (SA:H) impacts indicating potential for lateral movement or privilege escalation after initial data disclosure. Coordinated disclosure by INCIBE-CERT suggests vendor notification occurred, though no public exploit code is currently identified and EPSS/KEV data are unavailable for this 2026 CVE.
Penetration Testing engineers at Amazon discovered a vulnerability where the camera system failed to properly validate input, allowing specially crafted requests containing malicious commands to be. Rated high severity (CVSS 8.5), this vulnerability is low attack complexity. This OS Command Injection vulnerability could allow attackers to execute arbitrary operating system commands on the host.
OpenClaw package manager allows supply chain attacks through incomplete environment variable sanitization before version 2026.3.22. Attackers can hijack approved package installation or execution requests by injecting environment variables that redirect package resolution to malicious infrastructure, enabling trojanized code execution with high impact to confidentiality, integrity, and availability. This requires local access and user interaction to trigger package manager operations, limiting remote exploitation but creating significant insider threat and social engineering risk vectors.
Local privilege escalation in eMPIA Technology AVACAST allows authenticated local users to execute arbitrary code with SYSTEM privileges by placing a malicious DLL in a specific directory exploited during application startup. This DLL hijacking vulnerability (CWE-427) requires low-complexity exploitation with no user interaction once local access is obtained. Taiwan's TWCERT issued advisories on this vulnerability, indicating regional awareness though no CISA KEV listing or public exploit code has been identified at time of analysis.
Environment variable injection in OpenClaw's CLI backend runner enables local attackers to achieve arbitrary code execution or exfiltrate sensitive data by manipulating workspace configuration files. Attackers with the ability to supply malicious workspace configs can inject environment variables into backend processes during spawning, exploiting CWE-15 (external control of system or configuration setting). Vendor patch available via GitHub commit c2fb7f1. CVSS 8.5 reflects high impact across confidentiality, integrity, and availability, though exploitation requires local access and user interaction to load the malicious workspace config. No evidence of active exploitation (not in CISA KEV) or public proof-of-concept at time of analysis.
Local attackers can execute malicious code in OpenClaw versions before 2026.3.31 by placing crafted .env files in workspaces to override the OPENCLAW_BUNDLED_PLUGINS_DIR variable, bypassing plugin trust verification. The vulnerability enables code injection through untrusted plugins masquerading as verified components when users open compromised workspace configurations. EPSS data not available; CVSS v4.0 rates this 8.5 HIGH with local attack vector requiring user interaction. Vendor patch available via GitHub commit 330a9f98cb and release 2026.3.31.
Privilege escalation in OpenClaw chat.send API allows low-privileged gateway callers with write scope to execute admin-only session management operations. Attackers can forcibly reset user sessions, rotate session IDs, and archive chat transcripts without admin authorization by exploiting broken access control in the chat messaging path. This enables session hijacking and data manipulation attacks against legitimate users. Reported by VulnCheck disclosure team with vendor security advisory published; no public exploit or active exploitation confirmed at time of analysis.
Unquoted service path vulnerability in AVACAST by eMPIA Technology enables local privilege escalation from high-privileged user to SYSTEM. Attackers with administrative access can plant malicious executables in unquoted paths, achieving arbitrary code execution with system-level privileges upon service restart. Taiwan CERT (TWCERT) published advisories confirming the vulnerability. No public exploit code identified at time of analysis, and exploitation requires existing administrative privileges, limiting practical risk to environments where privileged user compromise is a concern.
Client-side authentication bypass in mpGabinet 23.12.19 and earlier allows local authenticated attackers to impersonate arbitrary users by patching the application binary. An attacker with legitimate low-privilege access to the system can manipulate the compiled application code to skip login verification entirely, gaining unauthorized access as any user including administrators. EPSS score not available for this 2026 CVE; no active exploitation or public POC confirmed at time of analysis.
Sandbox escape in Google Chrome before 147.0.7727.138 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted HTML to the Feedback component, which insufficiently validates untrusted input. The flaw (CWE-20, Chromium severity High, CVSS 8.3 with a scope change) is a second-stage privilege boundary bypass rather than an initial-access bug. No public exploit is identified at time of analysis, and the EPSS score is very low (0.05%, 14th percentile), consistent with a vulnerability that requires a prior renderer compromise to reach.
Sandbox escape in Google Chrome for Android (Media component) prior to 147.0.7727.138 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Chromium rates the severity High and a vendor patch is available; no public exploit is identified, EPSS is very low (0.01%, 1st percentile), and SSVC records exploitation status 'none'. It is a second-stage escape rather than an initial-access primitive, so it must be chained with a prior renderer compromise to have real impact.
Sandbox escape in Google Chrome's WebMIDI component (versions prior to 147.0.7727.138) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and carrying a CVSS of 8.3 with a scope-change (S:C) impact, it is a use-after-free (CWE-416) that Google has patched in the Stable channel. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.01%.
Heap buffer overflow in Chrome's Skia graphics library (versions prior to 147.0.7727.138) lets an attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, reported by Google's own Chrome team. Chromium rates it High severity and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is near zero (0.01%). SSVC records exploitation as none, meaning this is a defense-in-depth second-stage bug rather than a standalone entry point.
TSIG authentication bypass in CoreDNS before v1.14.3 allows unauthenticated network attackers to defeat TSIG protections on the gRPC, QUIC, DoH, and DoH3 transports and reach TSIG-gated functionality such as AXFR/IXFR zone transfers and dynamic updates. The gRPC/QUIC paths validate only the TSIG key name and never call dns.TsigVerify(), while DoH/DoH3 hardcode TsigStatus() to nil so any TSIG record - even one with an invalid key name and garbage MAC - is treated as verified. A detailed PoC demonstrates full zone dumps over forged requests; this is confirmed actively exploited status is not present (no public exploit identified at time of analysis beyond the reporter's PoC), and EPSS is low at 0.05%.
Improper authorization in CoreDNS' transfer plugin (versions before 1.14.3) lets a remote client bypass a restrictive subzone AXFR/IXFR ACL and dump the subzone's full contents. The flaw stems from longestMatch() selecting the transfer stanza by lexicographic string comparison instead of true longest-suffix match, so a permissive parent-zone rule can override a stricter child-zone rule for certain zone names. Publicly available exploit code exists (author-provided PoC) but there is no evidence of active exploitation, and EPSS is very low at 0.04%.
Authentication bypass in Netmaker (Gravitl) versions prior to 1.5.0 lets remote unauthenticated attackers forge host JWTs because VerifyHostToken in logic/jwts.go never validates the token signature. An attacker can sign a token with any arbitrary key to impersonate any host and reach host-scoped API endpoints, exposing sensitive network topology and peer information. SSVC lists a public proof-of-concept and rates the flaw automatable; EPSS is low (0.04%) and it is not on CISA KEV, so publicly available exploit code exists but no active exploitation is confirmed.
Webhook replay attacks in OpenClaw before 2026.3.28 allow remote attackers to trigger duplicate voice-call processing by reordering query parameters in captured Plivo V3 signed webhooks. The vulnerability stems from inconsistent canonicalization: signature verification sorts query parameters before validation, but replay detection hashes the raw URL with original parameter ordering. Attackers possessing a single valid signed webhook can bypass replay cache indefinitely by permuting query string order, causing repeated execution of voice-call workflows without requiring authentication or cryptographic breaks. No public exploit identified at time of analysis, though attack complexity is low (CVSS AC:L) with network vector (AV:N) requiring no privileges (PR:N).
Out-of-bounds read vulnerability in Apache Thrift Swift implementation allows remote unauthenticated attackers to trigger denial of service and disclose limited memory contents via malformed skip() operations during protocol deserialization. Affects all versions prior to 0.23.0, with publicly disclosed exploit details on oss-security mailing list. EPSS exploitation probability remains low (5th percentile) despite network-accessible attack vector, suggesting limited real-world targeting to date. Vendor patch released in version 0.23.0 addresses all six concurrently disclosed Thrift vulnerabilities (CVE-2026-41602 through CVE-2026-41607).
Out-of-bounds memory access in Google Chrome's Tint shader compiler (part of the Dawn/WebGPU stack) affects desktop builds prior to 147.0.7727.138 and lets a remote attacker who lures a victim to a crafted HTML page read or corrupt memory outside intended bounds. Rated High by Chromium and CVSS 8.1, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and EPSS is very low (0.03%), but the technical impact is total per CISA SSVC.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component affects all desktop versions prior to 147.0.7727.138, where a use-after-free flaw lets a remote attacker corrupt memory and run arbitrary code by sending malicious network traffic to an active remote-desktop session. Google rates it High severity; there is no public exploit identified at time of analysis and it is not in CISA KEV, with an EPSS probability of only 0.01% (2nd percentile). A vendor patch is available, and SSVC scores exploitation as none but technical impact as total.
Remote code execution in OpenClaw gateway versions before 2026.3.31 allows attackers with trusted paired node credentials (role=node) to escalate privileges and execute arbitrary code on the gateway by abusing unrestricted agent.request dispatch functionality. The vulnerability stems from insufficient access controls on node.event agent requests, enabling low-privilege paired nodes to invoke gateway-side tools without restriction. EPSS exploitation probability and KEV status not yet available for this recently disclosed vulnerability, but a vendor patch and exploit details are publicly documented.
Privilege escalation in OpenClaw's trusted-proxy authentication mode allows low-privileged authenticated users to gain operator.admin privileges by declaring operator scopes on non-Control-UI clients. The incomplete scope-clearing mechanism fails to sanitize self-declared scopes when identity-bearing authentication paths process requests, enabling attackers to bypass authorization checks and achieve full administrative access. Vendor patch available via commit 8b88b927 in version 2026.3.31; no confirmed active exploitation (not in CISA KEV) but publicly disclosed with detailed GitHub security advisory increasing attack feasibility.