Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.
Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
Insufficient authorization enforcement in the Nokia MantaRay NM API allows authenticated low-privilege users to retrieve confidential data beyond their assigned role boundaries. Affected are all Nokia MantaRay NM deployments running versions prior to 25R2-NM, a telecom-focused network management platform. No public exploit code or CISA KEV listing has been identified; with EPSS at 0.18% (7th percentile), real-world exploitation pressure is currently low, though the high confidentiality impact and low attack complexity make patching a priority for any operator with untrusted authenticated users.
Cross-origin data leakage in Google Chrome's NetworkCache component affects all desktop versions prior to 150.0.7871.47, enabling remote attackers to read sensitive cached data belonging to other origins. Exploitation requires a victim to visit a specially crafted HTML page, placing this squarely in the browser-based phishing and malvertising threat model. No public exploit code or active exploitation has been identified; an EPSS score of 0.17% (7th percentile) and Chromium's own Low severity classification indicate low immediate exploitation probability despite the Medium CVSS base score.
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables remote attackers to exfiltrate cross-origin data by luring victims to a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H) with network access and no authentication required from the attacker, though user interaction is necessary. Despite the NVD Medium score of 6.5, Google's internal Chromium severity rating is Low, EPSS sits at just 0.17% (7th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis - signals that collectively indicate limited real-world exploitability.
Side-channel information leakage via the WebAudio API in Google Chrome prior to 150.0.7871.47 enables a remote attacker to extract cross-origin data from a victim's browser session through a crafted HTML page. The vulnerability abuses WebAudio's timing or spectral measurement capabilities to infer data that should be isolated by the Same-Origin Policy, exposing potentially sensitive cross-origin resources. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.17% at the 7th percentile reflects very low current exploitation probability; Chromium's own team rated the severity as Low despite the NVD's Medium (6.5) CVSS assignment.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the Related-Website-Sets feature, enabling a remote attacker to read sensitive cross-origin data by delivering a crafted HTML page to a victim. The CVSS 6.5 score with High confidentiality impact reflects meaningful exposure potential, though Google internally rated this as Low severity and EPSS sits at 0.17% (7th percentile), suggesting limited real-world exploitation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Cross-origin data leakage in Google Chrome's Passwords component prior to version 150.0.7871.47 enables remote attackers to exfiltrate credential-related or other sensitive cross-origin data by directing victims to a crafted HTML page. The root cause (CWE-693, Protection Mechanism Failure) represents a breakdown in the policy enforcement layer governing cross-origin access in the Passwords subsystem - a bypass of the isolation guarantees Chrome's same-origin model is meant to provide. No public exploit has been identified at time of analysis; EPSS of 0.17% (7th percentile) and the absence of a CISA KEV listing place real-world exploitation probability very low, and Chromium's own team rated the severity as Low despite the NVD CVSS 6.5 Medium score.
Cross-origin data leakage in Google Chrome's StorageAccessAPI (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to read storage or cookie data belonging to other origins by delivering a crafted HTML page. This is a chained attack - the StorageAccessAPI policy bypass is the second stage of a multi-step compromise, not a standalone entry point. EPSS is very low (0.17%, 7th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
Cross-origin credential data leakage in Google Chrome's built-in Passwords feature (all versions prior to 150.0.7871.47) can be triggered remotely via a crafted HTML page requiring only user interaction. The flaw is rooted in an inappropriate implementation in Chrome's password management subsystem (CWE-522 - Insufficiently Protected Credentials), allowing a remote attacker to read data across origin boundaries that should be strictly isolated. No public exploit code is identified and EPSS stands at 0.17% (7th percentile), indicating limited exploitation pressure at time of analysis; however, Chrome's ubiquitous deployment makes the aggregate exposure significant.
Cross-origin data leakage in Google Chrome's SVG implementation prior to version 150.0.7871.47 allows a remote attacker to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw exploits improper SVG handling that bypasses same-origin policy protections, exposing potentially sensitive session data or authenticated content from third-party origins. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS stands at 0.17% (7th percentile), indicating low observed exploitation probability at time of analysis.
Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) signals low near-term exploitation probability despite the CVSS High confidentiality impact - consistent with Chromium's own 'Medium' severity designation and the inherent timing-sensitivity of race condition attacks.
UI spoofing in Google Chrome's Paint rendering component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent browser interface elements through a specially crafted HTML page, with the victim's visit being the sole prerequisite. The CVSS vector confirms high integrity impact (I:H) with no confidentiality or availability exposure, consistent with CWE-451 misrepresentation of critical UI information rather than code execution. No public exploit has been identified and EPSS sits at the 7th percentile (0.17%), indicating very low near-term exploitation probability; a vendor patch is confirmed available in the Chrome stable channel.
UI spoofing in Google Chrome's Geolocation implementation allows an attacker who has already compromised the renderer process to present misleading geolocation-related interface elements to the user via a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47. The integrity impact is rated High (CVSS I:H) because the spoofed UI can deceive users into granting or believing geolocation permissions under false pretenses; no public exploit or CISA KEV listing exists, and the 0.17% EPSS score (7th percentile) reflects low observed exploitation probability.
Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
UI spoofing in Google Chrome for Windows (prior to 150.0.7871.47) is enabled by insufficient input validation in the DataTransfer subsystem when the renderer process has already been compromised. A remote attacker who controls a compromised renderer can deliver a crafted HTML page that manipulates visual UI elements, potentially deceiving users into approving malicious permissions, revealing credentials, or performing unintended actions. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.17% at the 7th percentile reflects minimal observed exploitation probability; however, exploitation as a second-stage payload in a renderer RCE chain remains a realistic concern for high-value targets.
Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
Insufficient policy enforcement in Chrome's DevTools component allows a crafted malicious extension to read potentially sensitive data from process memory. Affected versions are all Google Chrome releases prior to 150.0.7871.47 on desktop platforms. An attacker must first persuade a victim to install the malicious extension, after which the extension can silently extract in-memory data - including session tokens, credentials, or page content resident in the Chrome process - without triggering further user interaction. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
IBM Db2 versions 11.5.0-11.5.9 and 12.1.0-12.1.4 expose sensitive information through internal monitoring and event tables to authenticated low-privilege local users, a consequence of CWE-538 where sensitive data is inserted into storage locations accessible beyond the intended trust boundary. The CVSS vector confirms local-only attack surface (AV:L) with low-privilege authentication (PR:L) and high confidentiality impact, making this most relevant to insider threat scenarios or post-compromise lateral movement in multi-tenant Db2 environments. No public exploit code exists and the vulnerability is not listed in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Cross-origin data leakage in Google Chrome's Storage component prior to version 150.0.7871.47 enables remote attackers to read data belonging to a different origin by exploiting a race condition triggered via a crafted HTML page. The Chromium security team internally rated this as Low severity - a notable contrast to the CVSS 6.5 score reflecting High confidentiality impact - suggesting the practical exploitation window or data exposure scope is constrained in real-world conditions. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) confirms negligible observed exploitation activity.
Server-Side Request Forgery in IBM Langflow OSS 1.0.0 through 1.9.3 allows a low-privileged authenticated user to coerce the server into making attacker-controlled internal requests by abusing the URL data-source component, where a Time-of-Check/Time-of-Use race condition lets a hostname resolve to a safe address during validation and a private/internal address at fetch time (classic DNS rebinding). Exploitation is rated CVSS 7.1 with a scope change, reflecting that the server can be made to reach internal services beyond its own trust boundary; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.
Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. No public exploit or CISA KEV listing is identified at time of analysis, and Google has released a patch in the stable channel.
Path traversal in Adobe ColdFusion 2025.9 and 2023.20 (and earlier) allows unauthenticated remote attackers to bypass path restrictions and gain limited read and write access to files and directories outside the intended web root. The vulnerability is classified as a security feature bypass under CWE-22, exploitable over the network without user interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low-complexity, zero-authentication attack surface makes it attractive for opportunistic actors targeting ColdFusion deployments.
Stored cross-site scripting in IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 allows authenticated low-privileged users to inject persistent JavaScript into the Web UI, which then executes within the browser sessions of other authenticated users visiting the affected page. The CVSS scope change (S:C) confirms the payload crosses the security boundary from the attacker's session into victims' sessions, enabling credential harvesting within trusted contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored and persistent nature of the injection elevates operational impact beyond what the 6.4 base score alone conveys.
Use-after-free in the SSSD PAM responder crashes the authentication daemon when a local attacker manipulates YubiKey or smartcard contents during an authentication attempt on Red Hat Enterprise Linux 6 through 10. The primary realized impact is a denial of service - the PAM responder crash disrupts all authentication - but the underlying memory corruption also presents a difficult-to-exploit privilege escalation path. No public exploit code exists at time of analysis, and the CVSS vector (AV:L/AC:H/PR:H) reflects a tightly constrained local attack requiring high privileges and significant complexity, limiting realistic blast radius to insider-threat and physical-access scenarios.
Stored cross-site scripting in GitHub Enterprise Server's Q&A Discussion feature allows an authenticated attacker to execute arbitrary JavaScript in any visiting user's browser by embedding a crafted payload into a Discussion title. The AnsweredQuestionStructuredDataComponent unsafely injects user-controlled titles into a server-rendered <script type="application/ld+json"> block, enabling script-context breakout; the attacker then leverages JSONP callback support in the GHES REST API to load arbitrary JavaScript and bypass the Content Security Policy entirely. No public exploit or CISA KEV listing exists at time of analysis, but the CSP bypass mechanism substantially elevates practical impact beyond typical stored XSS, enabling full session hijacking of any user who views the malicious Discussion.
Remote code execution risk in c3p0 versions prior to 0.14.0 arises from the library serving as an essential 'sink' in Java deserialization gadget chains. c3p0's DataSource and ConnectionPoolDataSource objects conform to JavaBean's getXXX() naming convention, causing commons-beanutils and similar libraries to invoke JDBC connection methods as though they were safe property accessors during deserialization - triggering arbitrary JDBC driver execution under attacker control. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 vector scores this at 6.3, largely due to the partial attack requirements (AT:P), though real-world impact when prerequisites are met can substantially exceed that rating.
Memory exhaustion via denial of service in ImageMagick before 7.1.2-19 allows remote attackers to trigger a persistent memory leak in the PNG encoder by supplying crafted MNG image input that induces an encoder failure condition. Affected deployments include any service that accepts user-supplied images and processes them through ImageMagick's MNG write path. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack surface in image-processing pipelines makes this a realistic DoS risk against unpatched instances.
Nonce reuse in ImageMagick's AES-CTR cipher implementation exposes encrypted image plaintext to recovery attacks. The PasskeyEncipherImage method in ImageMagick before 7.1.2-22 reuses nonces when performing AES in Counter mode, violating the fundamental security requirement that a nonce be used exactly once per key. A network-accessible attacker who can collect multiple ciphertexts produced with the same passkey and nonce can XOR the outputs to cancel the shared keystream and partially or fully recover encrypted image content. No active exploitation has been identified (not in CISA KEV), and no public exploit code is known at time of analysis.
Stored/reflected cross-site scripting in the administrative console of IBM WebSphere Application Server 9.0 and 8.5 lets an adjacent-network attacker inject malicious script that executes in an administrator's browser session. Because the CVSS scope is changed and impact is rated high, a successful injection could let the attacker hijack the privileged admin session and pivot to broader server compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome before 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by serving a crafted HTML page to a victim user. The flaw stems from insufficient input validation in Chrome's HTML handling (CWE-20), and its Scope:Changed CVSS metric confirms the core danger: injected scripts escape the attacker-controlled origin and execute in the context of other web origins, undermining the browser's same-origin policy. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS stands at 0.18% (8th percentile), consistent with the vendor's own 'Low' Chromium severity classification despite a NVD CVSS score of 6.1.
Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.
Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.
Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)
Stored cross-site scripting in SYSGUARD 6001 (versions 2.0.2 through before 6.1.4.0) by Eksagate Electronic Engineering and Computer Industry Trade Inc. permits remote unauthenticated attackers to inject persistent malicious scripts into the product's web interface, which execute in the browsers of any user who subsequently views the affected page. The vendor has confirmed the product is end-of-life and unsupported, meaning no patch will ever be issued, leaving all in-scope deployments permanently vulnerable. No public exploit code or CISA KEV listing exists at time of analysis.
Path traversal in Vibe-Trading before version 0.1.10 allows low-privileged authenticated network attackers to write arbitrary Markdown files outside the application's intended memory root directory. The `remember` tool fails to sanitize the `memory_type` parameter before constructing filesystem paths, enabling traversal sequences to escape the memory root and land files at attacker-controlled locations on the server. No public exploit or CISA KEV listing has been identified, but the high integrity impact and low attack complexity make patching urgent for any internet-exposed deployment.
Unauthorized source code disclosure in GitHub Enterprise Server exposes private repository contents to any authenticated user on the instance, regardless of their actual repository permissions. The Copilot pull request description diff summary endpoint accepted cross-repository comparison ranges and rendered the resulting diff without verifying the requesting user held read access to the target repository - a missing authorization flaw (CWE-862) allowing lateral access to arbitrary private repositories. No active exploitation has been confirmed (not in CISA KEV), the issue was responsibly disclosed via GitHub's Bug Bounty program, and patches are available across four release branches.