Relative path traversal in Apache Tika's ISA-Tab parser (ISArchiveParser) enables arbitrary local file read against the Tika process. Specifically, the 'Study Assay File Name' field within an ISA-Tab investigation file is processed without adequate path sanitization, allowing traversal outside the intended dataset directory and causing the contents of any file readable by the Tika process to be emitted in the extracted text output. Affected deployments span Apache Tika 1.8 through 3.3.1 and the 4.0.0-alpha-1 preview release, all of which include the vulnerable tika-parser-scientific-module. No public exploit or CISA KEV listing was identified at time of analysis, but the vulnerability was independently reported by two researchers with proposed patches, indicating the issue is reproducible and well-understood.
Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Use-after-free in the GPU process on macOS enables sandbox escape in Google Chrome versions prior to 151.0.7922.72, but only when an attacker has already achieved renderer process compromise. This is a second-stage exploit primitive - it extends an existing renderer compromise across the sandbox boundary into the GPU process, potentially allowing arbitrary code execution outside Chrome's sandbox on macOS. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; however, sandbox escapes are a critical capability for attackers chaining browser exploit kits.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).
Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in IBM Db2 federated server (versions 12.1.0 through 12.1.4) can be triggered by executing non-fenced federated queries, causing the database engine to exhaust resources and become unresponsive. The root cause is CWE-400 (Uncontrolled Resource Consumption) within the in-process federated wrapper execution path. No public exploit has been identified at time of analysis, and IBM has released a patch via their support portal.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Insecure file permissions in ansible-collection-redhat-leapp expose PostgreSQL backup archives to local non-root users on managed RHEL 9 and RHEL 10 nodes. When the `leapp_old_postgresql_data` remediation option is invoked with elevated privileges, the resulting backup archive is written with world-readable or group-readable permissions (CWE-732), allowing any local non-root user on that managed node to extract the full contents of the archived PostgreSQL data. No public exploit has been identified at time of analysis, and exploitation requires local authenticated access to the managed node.
XML External Entity injection in IBM DataPower Gateway 10.5.0, 10.6.0, and 10.6CD allows a privileged authenticated user who can submit XML data to the gateway to either exfiltrate sensitive information from the underlying system or trigger memory exhaustion through recursive or large entity expansion. The vulnerability exists in the gateway's XML processing pipeline, a core function of this API/ESB platform. No public exploit code has been identified at time of analysis, and the vendor has released a patch documented in IBM Security Advisory 7278748.
Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 allows a remote unauthenticated attacker to inject arbitrary scripts or HTML that can escape the browser's same-origin policy by delivering a crafted HTML page to an unsuspecting victim. All Chrome installations below 151.0.7922.72 across supported platforms are affected, with partial confidentiality and integrity impact. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' confirm low current exploitation probability, though UXSS primitives carry disproportionate value for credential and session theft.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.
Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.
Stack exhaustion in PHP's phar archive handler allows an attacker to crash the PHP process by supplying a crafted archive containing circular symbolic links, triggering unbounded recursion that depletes the native C stack. Affected versions span PHP 8.2.x before 8.2.33, 8.3.x before 8.3.33, 8.4.x before 8.4.24, and 8.5.x before 8.5.9 across all platforms. Exploitation requires a PHP process to actively parse the malicious archive (UI:A/AV:L); no public exploit has been identified and exploitation likelihood is rated unlikely (E:U in the provided CVSS 4.0 vector), making this a moderate-priority patch for most deployments - with heightened urgency for applications that process user-supplied phar archives.
Cross-site scripting in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0-6.2.2.0_1 enables any authenticated low-privilege user to inject persistent JavaScript into the Web UI, which executes within the browser session of other authenticated users who load the affected page. The changed scope (S:C in CVSS) reflects that the injected script runs in the victim's browser context rather than the originating user's, enabling credential harvesting or session token theft within the trusted application session. No public exploit code or CISA KEV listing exists at time of analysis; IBM has issued a patch.
Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.
Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.
Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.
Path traversal in the Performance Co-Pilot (PCP) pmproxy logger servlet on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 permits unauthenticated remote attackers to create arbitrary files and directories on the host filesystem by supplying a crafted hostname value in requests to the service. The primitive is write-only - no file contents can be read - but an attacker can abuse it to corrupt directory structures or exhaust disk space, leading to denial of service. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.
Out-of-bounds heap read in GoAccess prior to version 1.11 allows a remote unauthenticated attacker to read approximately 4 KB beyond a heap allocation and conditionally crash the analyzer by embedding a crafted User-Agent string into any web server access log that GoAccess subsequently processes. The defect resides in the parse_ios() function (src/opesys.c), where an attacker-controlled keyword-to-OS offset value is incorrectly passed as both the source pointer offset and the copy length to memmove(), violating the intended semantics and enabling the out-of-bounds read. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in version 1.11.
Improper authorization in Apache Superset's chart update REST API allows any authenticated user holding chart-update permissions to associate charts with dashboards they do not own, effectively modifying those dashboards without authorization. All Superset versions from 0.0.0 up to (but not including) 6.0.0 are affected. The root cause is that UpdateChartCommand accepted arbitrary dashboard IDs from the request body without verifying the caller held write permissions on those target dashboards. No public exploit or CISA KEV listing has been identified at time of analysis.
Regular Expression Denial of Service in Apache Superset's SQL parser (sql_parse.py) allows authenticated attackers to exhaust CPU resources on Superset worker processes by submitting crafted inputs containing pathological character sequences to SQL-processing endpoints. Versions 1.5.0 through 5.0.0 are affected via a vulnerable SQL_REGEX pattern that exhibits catastrophic backtracking under adversarial input. No public exploit code or active exploitation has been identified at time of analysis; the authentication prerequisite meaningfully limits opportunistic attack surface.
Unrestricted file upload in Phoenix Contact CHARX SEC series EV charging controllers (SEC-3000, SEC-3050, SEC-3100, SEC-3150 running firmware 1.0.0-1.9.0) allows a low-privileged remote attacker holding 'operator' credentials to push arbitrary files through the REST API endpoint designated for firmware updates. Successful exploitation results in persistent storage of attacker-controlled content on the device filesystem and, through repeated or oversized uploads, potential resource exhaustion leading to Denial-of-Service. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch to firmware 1.9.1 is available per CERT VDE advisory VDE-2026-008.
Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.
Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Server-side request forgery in MaxKB versions 2.0.0 through 2.10.4-lts allows authenticated workspace users to proxy HTTP requests through the application server to internal infrastructure, loopback addresses, link-local networks, and cloud instance metadata endpoints such as the AWS IMDSv1 service. The vulnerable code paths in both template workflow handlers and tool update functions pass caller-supplied download_url and download_callback_url values directly to requests.get protected only by a weak startsWith prefix check, which is insufficient to block hostname-confusion or open-redirect bypasses. No public exploit has been identified at time of analysis, and the upstream fix on the v2 branch has not yet been packaged into a published release.
Samba's internal DNS server inserts unauthenticated TKEY registration requests into the TKEY name cache before rejecting them, allowing a remote unauthenticated attacker to exhaust the cache by flooding it with arbitrary TKEY names. Eviction of legitimate cache entries blocks TSIG-authenticated DNS query processing, producing a targeted denial of service against Active Directory environments relying on Samba's built-in DNS backend. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available from both Samba upstream and Red Hat.
Use-after-free in the Bluetooth component of Google Chrome on Android prior to 151.0.7922.72 enables a sandbox escape for remote attackers who have already achieved renderer process compromise. Exploitation requires delivering a crafted HTML page to a victim user and successfully triggering a memory corruption condition in the Bluetooth subsystem, allowing code execution outside the renderer sandbox. No public exploit code has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low observed exploitation probability; no CISA KEV listing is present.