Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
Cross-tenant information disclosure in Hatchet's `GET /api/v1/stable/dags/tasks` endpoint permits any authenticated user on a multi-tenant instance to read task metadata belonging to other tenants by supplying a victim's tenant UUID and DAG UUID in query parameters. The CVSS 5.3 (AV:N/AC:H/PR:L) reflects that an attacker must hold a valid account and obtain victim UUIDs through out-of-band channels before exploitation - but on Hatchet Cloud, where account registration is open by default, the account prerequisite is trivially satisfied. No public exploit code exists, no exploitation was observed prior to patching, and vendor-released fix v0.83.39 was deployed within hours of the April 23, 2026 report.
Uninitialized GPU memory disclosure in Google Chrome for Android (prior to 148.0.7778.96) enables a post-exploitation information leak from process memory. Exploitation requires that the attacker has already compromised the renderer process - making this a chained vulnerability, not a standalone entry point. No active exploitation is confirmed (not in CISA KEV, SSVC exploitation status: none), and EPSS sits at 0.03% (8th percentile), consistent with a low-real-world-priority issue despite the C:H confidentiality rating.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
Authorization bypass in FlowiseAI Flowise up to version 3.0.12 allows authenticated users to manipulate userId, organizationId, workspaceId, and email parameters in the User Controller Handler, potentially gaining unauthorized access to other users' data or organizational resources. The vulnerability requires valid user authentication and remote network access, resulting in confidentiality impact with low attack complexity. No active exploitation in CISA KEV has been confirmed at time of analysis.
Unauthenticated attackers can retrieve PIX payment QR code images for arbitrary WooCommerce orders via the unprotected 'mp_pix_image' API endpoint in Mercado Pago payments for WooCommerce plugin versions up to 8.7.11, exposing sensitive merchant data including PIX keys, transaction amounts, merchant identity, and Mercado Pago transaction references. The vulnerability requires no authentication, user interaction, or special configuration, and exploits a missing capability check in the WordPress REST API handler. No public exploit code or active exploitation has been confirmed at the time of analysis.
Open redirect vulnerability in Masa CMS allows unauthenticated remote attackers to craft malicious URLs on trusted Masa CMS domains that redirect victims to attacker-controlled sites via improper validation of scheme-relative URLs (paths beginning with //). This can be exploited for phishing attacks and potential token exposure in certain authentication flows. The vulnerability affects versions prior to 7.2.10, 7.3.15, 7.4.10, and 7.5.3, with CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:N/UI:P).
Local privilege escalation in ZTE PROCESS Guard Service allows authenticated local users to escalate privileges and achieve arbitrary code execution through improper access control enforcement, affecting the cloud computer client. The vulnerability requires local access and authenticated user context but operates across system boundaries, potentially compromising system integrity. No active exploitation has been confirmed at time of analysis, though the combination of privilege escalation and RCE capability makes this a moderate-priority local threat.
Zabbix Agent 2 allows remote attackers with high privileges to inject malicious Oracle TNS connection strings via the 'service' parameter, enabling credential theft from saved database sessions. The vulnerability requires network access and high-level privileges but can lead to disclosure of Oracle database credentials if they are stored in named sessions. CVSS 5.1 reflects the requirement for authenticated attacker access (PR:H), though the impact to stored credentials is significant.
Navigation restriction bypass in Google Chrome's Cast subsystem (all versions prior to 148.0.7778.96) enables a remote attacker who has already compromised the renderer process to escape browser-enforced navigation controls via a crafted HTML page. This is a chained exploit component - not an independent entry point - requiring prior renderer-level compromise, which substantially narrows the realistic threat pool. No public exploit code has been identified, EPSS sits at 0.03% (9th percentile), and CISA has not listed this in the Known Exploited Vulnerabilities catalog.
OpenClaw before version 2026.4.10 allows authenticated attackers to bypass Server-Side Request Forgery (SSRF) policy enforcement through incomplete navigation guard coverage in browser press and type interactions. Attackers can trigger unauthorized navigation actions, including pressKey and type-submit flows, that skip post-action security checks, potentially enabling SSRF attacks against restricted endpoints.
Server-side request forgery via unvalidated WebSocket URL in OpenClaw before 2026.4.5 allows authenticated attackers to pivot connections to arbitrary hosts through the Chrome DevTools Protocol (CDP) /json/version endpoint. The webSocketDebuggerUrl response field lacks validation, enabling second-hop SSRF attacks where an attacker can redirect browser profile connections to untrusted targets on internal or external networks. No public exploit code identified at time of analysis, but the vulnerability is straightforward to trigger once authenticated to the CDP endpoint.
Server-side request forgery in OpenClaw browser navigation policy before version 2026.4.10 allows authenticated attackers to bypass hostname validation through DNS rebinding attacks, enabling pivots to internal network resources via unallowlisted hostnames. The vulnerability exploits inconsistent hostname resolution between validation checks and actual network requests made by the Chromium engine, with fix confirmed in upstream commit 121c452d and released in version 2026.4.10.
Fluent Forms plugin for WordPress up to version 6.2.1 allows authenticated administrators to read arbitrary files readable by the web server through path traversal in the getAttachments() method of EmailNotificationActions. The vulnerability stems from insufficient validation of file-upload URLs in admin notification configurations, permitting attackers to supply traversal sequences like <upload_baseurl>/../../<target> to access sensitive files such as wp-config.php containing database credentials and authentication salts. While unauthenticated users can trigger email notifications, the exploit requires administrator-level access to configure the malicious notification attachment.
Race condition in the Linux kernel UFS core driver causes a system crash during suspend when the runtime power management level is set to UFS_PM_LVL_0. At this PM level the device power mode and link state remain active, yet the driver previously skipped flushing pending exception event handling work before proceeding with suspend - allowing a workqueue job to access UFS host controller registers after the hardware has entered a deep power-down state. The resulting kernel panic yields a total denial of service. No public exploit has been identified and EPSS sits at 0.02% (7th percentile), indicating low near-term exploitation likelihood.
Use-after-free in the Linux kernel's md/bitmap subsystem triggers a General Protection Fault (GPF) in write_page() during MD array resize operations, resulting in a kernel crash and denial of service. Affected are systems using Software RAID (md) with bitmap support across a wide range of stable kernel series from 3.5 through 7.0, with patches backported to 5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, and 6.19.6. No public exploit code exists and the EPSS score of 0.02% (7th percentile) indicates very low exploitation probability; however, Red Hat has issued a formal advisory (RHSA-2026:19568), confirming vendor acknowledgment.
Use-after-free vulnerability in the Linux kernel rpmsg subsystem allows local attackers with low privileges to cause denial of service by exploiting a race condition between driver_override_show() and driver_override_store() functions. The show function reads the driver_override string without holding the device_lock while the store function modifies and frees it under lock, creating a window for memory corruption. The vulnerability requires local access and non-default timing conditions (AC:H), limiting real-world exploitation probability to 0.02% per EPSS scoring.
Oracle Macaron Tool v0.22.0 fails to properly validate host addresses in HTTP requests, allowing unauthenticated remote attackers to cause information disclosure through crafted network traffic. The vulnerability requires user interaction (UI:R) and affects the confidentiality of the tool's host validation mechanism. No active exploitation has been publicly confirmed.
Race condition in the Linux kernel io_uring zero-copy receive (zcrx) subsystem allows a local low-privileged attacker on SMP systems running kernel 6.15 through 6.18.15 or 6.19.0-6.19.5 to trigger a double-free of a network I/O vector (niov) and subsequently corrupt adjacent kernel heap memory with an out-of-bounds write. The root cause is a non-atomic check-then-decrement in io_zcrx_put_niov_uref() racing against atomic_xchg() in io_zcrx_scrub(), which bypasses the rq_lock serialization. No public exploit has been identified at time of analysis; EPSS at 0.02% (4th percentile) confirms negligible current exploitation probability.
HTML injection via unvalidated JSX tag names in hono allows attackers to inject arbitrary HTML elements and attributes when untrusted input is used as tag names during server-side rendering. The vulnerability affects hono versions prior to 4.12.16 when the `jsx()` or `createElement()` APIs process attacker-controlled tag names, potentially enabling XSS attacks. User interaction (rendering untrusted content) is required, and the issue is limited to applications that dynamically construct tag names from external sources rather than using static or allowlisted tags.
HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the application to known security weaknesses. Authenticated local attackers with high complexity conditions can achieve limited information disclosure and integrity compromise (CVSS 4.6). No active exploitation or public POC identified at time of analysis.
Arbitrary directory creation outside the project root is possible in FlightPHP's `make:controller` CLI command (flightphp/core < 3.18.1) due to un-normalized path handling before input validation. The `mkdir(..., recursive: true)` call executes on attacker-controlled path segments - including `../` traversal sequences - before Nette's class-name validation can reject the input, leaving the created directories as a committed filesystem side effect. A publicly available proof-of-concept confirms the issue; exploitation is local and no CISA KEV entry exists, consistent with the low EPSS score of 0.02% (5th percentile).
Insufficient input validation in Google Chrome on Android prior to version 148.0.7778.96 allows local attackers to inject arbitrary scripts or HTML via a crafted Chrome Extension, leading to Universal Cross-Site Scripting (UXSS). The vulnerability requires user interaction and local system access but poses a medium risk due to its ability to bypass same-origin policy protections within the browser context. No public exploit has been identified at the time of analysis.
Insufficient policy enforcement in Chrome's Downloads feature prior to version 148.0.7778.96 allows local attackers with user interaction to bypass navigation restrictions and access sensitive download locations via a crafted HTML page, potentially leading to information disclosure or file manipulation. The vulnerability requires local access and user engagement with a malicious page, limiting its scope to targeted social engineering rather than remote mass exploitation.
Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.
Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.
Cisco Prime Infrastructure log file download functionality fails to enforce proper authorization checks, allowing authenticated remote attackers to download arbitrary log files beyond their access level. An attacker with valid web management interface credentials can submit crafted URL requests to the affected download service API to retrieve sensitive logs, resulting in confidential information disclosure. CVSS score of 4.3 reflects low immediate impact but legitimate data exposure risk for organizations using this management platform.
Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
Unauthorized cross-owner data access in Backstage's catalog-backend-module-unprocessed plugin allows any authenticated user to read unprocessed entity records belonging to other teams or owners, bypassing the Backstage permission framework entirely. The vulnerability affects all installations of this optional plugin running versions prior to 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, 0.0.15 of the common package, and 0.2.30 of the UI package. EPSS is 0.03% (7th percentile) and the vulnerability is not in CISA KEV, indicating low exploitation probability; however, in multi-tenant Backstage deployments the data exposure risk is real and no public exploit has been identified at time of analysis.
V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.
Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.
Cisco Identity Services Engine allows authenticated read-only administrators to bypass role-based access control on RADIUS Policy API endpoints and gain unauthorized read access to sensitive policy details through direct API calls. The vulnerability affects ISE software across versions due to improper RBAC enforcement on API endpoints, enabling privilege escalation from read-only to unauthorized data disclosure. CVSS score is 4.3 with low attack complexity, but exploitation requires valid administrative credentials.
Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.
Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.
Integer overflow in Chrome's Network component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin policy after compromising the renderer process via a crafted HTML page. The vulnerability requires renderer compromise and user interaction, limiting real-world risk despite network-accessible attack surface. No active exploitation has been confirmed; a vendor patch is available.
Integer overflow in ANGLE graphics library in Google Chrome prior to version 148.0.7778.96 allows remote attackers to leak cross-origin data by delivering a crafted HTML page that triggers the vulnerability. The vulnerability requires user interaction (visiting a malicious webpage) but can bypass same-origin policy protections, exposing sensitive data from other domains. No public exploit code or active exploitation has been confirmed at analysis time.
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
Out-of-bounds memory read in Google Chrome's font handling allows remote attackers to leak sensitive information via a crafted HTML page when users visit a malicious website. Chrome versions prior to 148.0.7778.96 are affected. The vulnerability requires user interaction (clicking a link or visiting a page) but occurs over the network without authentication. Information disclosure risk is limited (CVSS C:L) with no impact on integrity or availability, but the Chromium security severity designation of High indicates concern about potential information leakage in real-world exploitation.
Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.
Insufficient policy enforcement in Chrome's WebUI on Linux, Mac, Windows, and ChromeOS prior to 148.0.7778.96 allows a remote attacker with a compromised renderer process to bypass site isolation via a crafted HTML page, potentially exposing sensitive cross-site data. The vulnerability requires user interaction (UI:R) and prior renderer compromise, limiting its standalone exploitability. Vendor-released patch available in version 148.0.7778.96.
Insufficient data validation in DevTools in Google Chrome on Android prior to version 148.0.7778.96 allows remote attackers to bypass navigation restrictions by sending a crafted HTML page, requiring user interaction to open the malicious page. The vulnerability has a low CVSS score (4.3) due to limited confidentiality impact and requirement for user click, but affects all Android users running vulnerable versions. A vendor-released patch is available.
Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.
Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.
Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.
Same-origin policy bypass in Google Chrome's Cast feature prior to version 148.0.7778.96 enables a network-adjacent unauthenticated attacker to read limited cross-origin browser data via crafted network traffic. The vulnerability stems from insufficient input validation in the Cast subsystem (CWE-20), and is constrained to attackers sharing the same local network segment as the victim. No active exploitation has been confirmed - the issue is absent from CISA KEV, EPSS sits at 0.01% (1st percentile), and SSVC assesses exploitation status as none - making this a low-priority patching item outside of high-risk shared network environments. Google has released a fix in Chrome 148.0.7778.96.
Cisco Enterprise Chat and Email (ECE) Lite Agent feature allows authenticated remote attackers with Agent role credentials to upload files containing malicious scripts or HTML, which are then served to other users without adequate content validation. Successful exploitation enables stored cross-site scripting (XSS) attacks in victim browsers. The vulnerability requires valid user credentials and Agent role privileges but no user interaction on the victim side, affecting confidentiality and integrity but not availability.
Authenticated subscribers can create arbitrary database tables in WordPress installations running Ninja Tables plugin version 5.2.6 and earlier via missing authorization checks on the createFluentCartTable function. This allows low-privileged users to pollute the database and cause resource exhaustion without requiring administrative access, affecting any site where subscribers have plugin interaction permissions.
UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.
Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.