Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.
Heap corruption via a use-after-free in Google Chrome for iOS (versions prior to 151.0.7922.72) lets a remote attacker potentially corrupt memory when a victim opens a crafted HTML page, with the CVSS 8.8 vector modeling full confidentiality, integrity, and availability loss. Google reported it internally and Chromium rated the security severity as Low; there is no public exploit identified at time of analysis, EPSS is low at 0.21% (11th percentile), and SSVC records exploitation status as none.
Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.
Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.
Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.
Memory-corruption remote code execution in Google Chrome's Dawn WebGPU graphics component affects all Desktop builds prior to 151.0.7922.72, where a crafted HTML page triggers a use-after-free (CWE-416) that lets a remote attacker run arbitrary code - though confined inside the renderer sandbox, which is why Chromium rated it Low despite the CVSS 8.8. Exploitation requires only that a victim load a malicious page (UI:R), with no authentication. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Remote code execution in Google Chrome on macOS prior to 151.0.7922.72 stems from an inappropriate implementation in the Safe Browsing component, where a remote attacker can trigger arbitrary code execution by luring a victim into opening or downloading a malicious file. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) requires no privileges but does require user interaction, and Google has shipped a fixed Stable channel build. Despite the 8.8 CVSS, Chromium rated the underlying issue Low severity, EPSS is only 0.20% (10th percentile), and there is no public exploit identified at time of analysis.
Out-of-bounds memory read in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) lets a remote attacker disclose heap memory when a victim opens a crafted HTML page. The flaw is a CWE-122 heap buffer overflow that Chromium itself rated Low severity, with no public exploit identified at time of analysis and an EPSS probability of 0.19% (9th percentile). CISA's SSVC assessment records no observed exploitation and marks the issue as not automatable, though technical impact is rated total.
Remote code execution in Google Chrome's PDFium component (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code - confined to the renderer sandbox - when a victim opens a maliciously crafted PDF. The flaw is a CWE-416 use-after-free reported by Google's own Chrome team and fixed in the July 2026 Stable channel update; Chromium rated its intrinsic severity Low because execution is contained within the sandbox, though NVD's CVSS scores it 8.8. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Out-of-bounds memory access in Google Chrome's Frame component affects all Desktop builds prior to 151.0.7922.72, letting a remote attacker read memory outside intended bounds when a victim opens a crafted HTML page. Chromium rated the underlying flaw Low severity, yet NVD scores it 8.8 (High) and tags flag potential RCE; there is no public exploit identified at time of analysis and EPSS is a low 0.18% (8th percentile). A vendor patch is available and the issue is not listed in CISA KEV.
Heap corruption in Google Chrome's Views UI framework on Linux affects all versions prior to 151.0.7922.72, where a remote attacker can leverage a use-after-free by luring a victim to a crafted HTML page. Because exploitation requires the user to visit malicious content (UI:R), it is not fully automatable, and there is no public exploit identified at time of analysis; EPSS estimates only a 0.18% exploitation probability (8th percentile) and SSVC records exploitation status as none. Chromium rated the underlying issue Medium severity, though the CVSS base score is 8.8 due to high confidentiality, integrity, and availability impact if successfully exploited.
Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.
Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.
Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. A publicly available proof-of-concept exists, raising the realistic threat above the CVSS 4.8 medium score.
Privilege escalation in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets an attacker who convinces a user to install a malicious extension escape the normal extension privilege boundary via a crafted Chrome Extension. Rooted in insufficient validation of untrusted input (CWE-20), the flaw carries a CVSS 8.8 rating reflecting high confidentiality, integrity, and availability impact once the extension is installed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome's ubiquity makes patch urgency high.
Arbitrary code execution within the renderer sandbox in Google Chrome's V8 JavaScript engine affects all desktop versions prior to 151.0.7922.72, triggered when a victim installs a crafted malicious Chrome extension that exploits a use-after-free memory-corruption bug. Google fixed this in the July 2026 Stable channel update, and no public exploit identified at time of analysis; EPSS is low at 0.13% (3rd percentile), consistent with Chromium's own 'Low' security-severity rating despite the CVSS base score of 8.8.
Privilege escalation in Google Chrome's DevTools component (all desktop builds prior to 151.0.7922.72) lets a malicious browser extension bypass DevTools policy enforcement to gain capabilities beyond its declared permissions. Exploitation is not remote-in-a-vacuum: an attacker must first convince a victim to install a crafted extension, after which the flaw escalates that extension's effective privileges within the browser. Google fixed the issue in the stable channel and rated the Chromium security severity as Low; there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site request forgery via JSON Hijacking affects Apache JSPWiki through version 2.12.3, letting a remote attacker who lures an authenticated user to a malicious page read sensitive JSON responses and force state-changing wiki actions in the victim's session. The flaw (CWE-352) is fixed in 2.12.4 and carries a vendor CVSS of 8.8, though exploitation requires user interaction; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Confidential Active Directory attribute disclosure in Samba's Active Directory Domain Controller allows an authenticated low-privilege domain user to read protected directory attributes by abusing how LDAP Compare requests are handled. Because Samba fails to validate user-supplied attribute names (LDAP filter injection, CWE-90) and runs the resulting internal search in a trusted context, normal ACL enforcement is bypassed; in gMSA-enabled deployments this permits extraction of msKds-RootKeyData and offline derivation of Group Managed Service Account passwords, which can escalate to full domain compromise. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but a vendor patch is available.
Authentication bypass in Gladinet CentreStack before 17.2 lets unauthenticated remote attackers read, write, and delete arbitrary account settings by hitting API endpoints that lack authorization checks (CWE-306). Because a static shared encryption key is used to generate valid encrypted EntAcctId values, an attacker can forge identifiers for any user GUID - including the system-wide cluster settings account - to enumerate hosted tenant domains and administrator identities. There is no public exploit identified at time of analysis, but the flaw was surfaced by VulnCheck and requires no authentication.
Privilege escalation via OS command injection affects Eaton's Tripp Lite series PADM firmware (versions 0 through 20), where a low-privileged authenticated user can abuse a session management interface that improperly validates input to gain unrestricted device access. The flaw (CWE-78) carries a CVSS 8.8 and, because the affected PADM 20 line has reached end-of-life, there is no forthcoming firmware patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial of service in the aws-smithy-json Rust runtime crate (versions before 0.62.7) lets remote unauthenticated attackers abort a process via stack exhaustion. Because the smithy-rs code generator wires this crate's deserializer into every generated struct, any smithy-rs generated server that parses JSON is exposed, and a single small HTTP request carrying deeply nested JSON triggers uncontrolled recursion in the unknown-key skip path. No public exploit was identified at time of analysis and the flaw is not in CISA KEV, but the trigger is trivial and a vendor patch is available.
Privilege escalation in the Serendipity (s9y) PHP blogging platform before 2.6.1 lets an authenticated Editor take over an Administrator account by exploiting an authentication context confusion (CWE-304): password checking and session loading resolve the user independently rather than binding to a single record. By registering a username that collides with an Administrator's, the Editor logs in with their own password yet has the Administrator's account loaded into their session, inheriting full admin rights. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 4.0 base score of 8.7 reflects high confidentiality, integrity, and availability impact.
Denial-of-service in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 up to but not including 1.9.1) allows an unauthenticated network attacker to reboot the charging controller by sending a crafted Modbus TCP command to the CharxModbusServer. The attack requires no credentials or user interaction and, per the CVSS 4.0 vector, produces high availability impact with no confidentiality or integrity effect. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity makes reliable disruption of charging service straightforward once the Modbus port is reachable.
Denial of service in GoAccess before version 1.11 allows an unauthenticated remote client to crash the built-in real-time WebSocket server by sending a crafted frame whose 64-bit extended payload length is truncated into a signed 32-bit field before the maximum-frame-size guard runs. The truncation lets the length check be bypassed, triggering an approximately 18-exabyte memory allocation request that fails and terminates the process. No public exploit identified at time of analysis, but the upstream fix commit and GitHub Security Advisory GHSA-5gm5-pvh2-wg46 confirm the root cause and remediation.
Denial of service (and potentially remote code execution) affects the File Explorer component of ASUSTOR's ADM operating system across ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81, where a stack-based buffer overflow (CWE-121) lets an authenticated network attacker crash the underlying CGI process by supplying oversized decoded input. Only DoS is vendor-confirmed; the advisory notes further impact may be possible depending on runtime protections, and the vendor-assigned CVSS 4.0 of 8.7 assumes full confidentiality/integrity/availability compromise. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Unauthenticated OS user-account creation in Gladinet CentreStack before 17.3 lets remote attackers abuse an insecure deserialization path in GSNamespace.dll to add arbitrary local Windows accounts. By posting a crafted base64-encoded XML StorageConfigure value to the exposed jsonimportuserbyupn/jsonimportuserbyupnex/japiimportuserbyupn endpoints, an attacker (no credentials, per CVSS PR:N) drives InternalImportAdUserByUPN() to call NetUserAdd with attacker-chosen credentials and to create arbitrary server directories. No public exploit identified at time of analysis and it is not in CISA KEV, but the same product family has a prior history of actively exploited flaws, so weight this accordingly.
BFCache in Google Chrome prior to 151.0.7922.72 contains insufficient input validation that enables a renderer-compromised attacker to escape Chrome's sandbox and execute code in the higher-privileged browser process via a crafted HTML page. The Scope:Changed metric in the CVSS vector (8.7) confirms the escape crosses the renderer-to-browser process boundary, yielding high confidentiality and integrity impact. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile) and SSVC rates exploitation as none and not automatable, consistent with the chained, technically demanding nature of this attack.
Information disclosure and host-process Denial-of-Service affects VMware ESX, Workstation, and Fusion via an out-of-bounds read (CWE-125) reachable by an actor holding VM deployment privileges. On ESX the flaw can crash or leak memory from the host VMX process (a guest-to-host scope crossing), while on Workstation and Fusion the impact is limited to information disclosure. Reported by VMware/Broadcom with no public exploit identified at time of analysis and no CISA KEV listing.
SQL injection leading to remote code execution in Gladinet CentreStack before 17.4 lets authenticated users inject arbitrary SQL through the x-glad-filter HTTP header handled by the jsondir API endpoint. Because the injected query runs on the PostgreSQL backend, attackers chain lo_from_bytea() and lo_export() to write arbitrary files onto the server filesystem, converting a database flaw into full code execution. Reported by VulnCheck; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-band file exfiltration in Gladinet CentreStack before 17.4 lets unauthenticated remote attackers read arbitrary server files by abusing an XML External Entity (XXE) flaw in the SharePoint StorageConfig handler. By pointing the storage configuration at a malicious URL, an attacker forces the server to parse attacker-controlled XML with external DTD references and leak sensitive files such as Web.config, exposing database credentials and cryptographic key material. Reported by VulnCheck; no public exploit identified at time of analysis, and the CVSS 4.0 base score is 8.7 (High).
Sensitive data disclosure in Adobe Campaign Classic (ACC) allows a remote, unauthenticated attacker to read arbitrary files from the underlying host by exploiting an SQL injection flaw (CWE-89) that reaches file-system read primitives. Because the CVSS scope is changed and no user interaction is required, a single crafted request against an exposed ACC instance can leak sensitive memory and file contents (CVSS 8.6). There is no public exploit identified at time of analysis, but the network vector and low attack complexity make this a high-priority patch.
Memory disclosure and denial-of-service in ASUSTOR ADM (the NAS operating system) arises from an externally-controlled format string in the Notification OAuth settings, where administrator-supplied notification configuration values are passed into an unsafe format function. An authenticated administrator can submit crafted format specifiers to leak process memory or crash the affected notification component, affecting ADM 4.1.0-4.3.3.RUN1 and 5.0.0-5.1.3.RI81. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was self-reported by ASUSTOR's own security team.
Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.
Cross-site WebSocket hijacking in MeshCentral 1.1.21 lets unauthenticated remote attackers steal the server sessionKey and forge session cookies for any user, including administrators, ultimately gaining full remote control of every device managed by the instance. The flaw stems from an origin-validation bypass that only manifests on deployments using self-signed certificates, and it requires an authenticated admin to be lured into visiting attacker-controlled content (CVSS 4.0 8.6, UI:A). A vendor fix exists (PR #7882 / commit f04c9f4); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Authentication bypass in Eaton's Tripp Lite series PADM power-distribution management firmware (all versions through 20) lets an unauthenticated remote attacker gain privileged user access to the device. The flaw is rooted in improper input validation in the authentication component and is tagged as SQL injection (CWE-89), meaning a crafted login input can subvert the auth check itself. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the network-reachable, no-authentication attack profile combined with the product now being end-of-life makes this a serious exposure for anyone still running affected units.
Remote code execution in IBM WebSphere Application Server 9.0 and 8.5 allows an authenticated attacker to run arbitrary code by delivering a malicious serialized Java object through the SOAP/JMX connector, which the server deserializes unsafely (CWE-502). An attacker with low-level credentials who can reach the management connector can achieve full compromise of the application server process. IBM has released a fix; there is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Cross-tenant data compromise in Clastix Kamaji (Hosted Control Plane Manager for Kubernetes) before 26.7.4-edge lets one tenant read, modify, or destroy another tenant's control-plane state. Kamaji's defaulting webhook derived each TenantControlPlane's datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization that replaced dashes with underscores, so two tenants whose names normalize to the same string (e.g. 'a-b' vs 'a_b') were assigned identical datastore identifiers and silently shared backing storage. No public exploit identified at time of analysis and it is not in CISA KEV, but the root cause is confirmed by the vendor advisory (GHSA-4f3f-65vx-r34f) and the fixing commit, which now uses the immutable resource UID.
Local privilege escalation in Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to 1.9.1) allows a low-privileged local user to execute arbitrary commands as root through a vulnerable init-script for user-applications, yielding full system compromise. Reported by CERT@VDE and classified as OS command injection (CWE-78), the flaw carries a CVSS 4.0 base score of 8.5 (local vector, low privileges required). A vendor patch (1.9.1) is available; no public exploit identified at time of analysis.
Privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 up to but excluding 1.9.1) lets a low-privileged local user inject and run arbitrary OS commands as root through the device's system configuration handling, yielding full compromise of the charging controller. The flaw is a CWE-78 OS command injection reported by CERT@VDE (advisory VDE-2026-008), and a vendor patch is available in version 1.9.1. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Local privilege escalation in the Phoenix Contact CHARX SEC EV charging controllers (SEC-3000/3050/3100/3150, firmware 1.0.0 through 1.9.0) lets the low-privileged local account 'charx-web' inject and run arbitrary OS commands as root via the udhcpc DHCP client, yielding full device takeover. The flaw is a CWE-78 OS command injection reported by CERT@VDE, and a vendor patch (1.9.1) is available. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Local privilege escalation in Phoenix Contact CHARX SEC-3000/3050/3100/3150 EV charging controllers (firmware 1.0.0 through versions before 1.9.1) lets a low-privileged local user inject OS commands through a network-configuration script and gain root, yielding full device compromise. The flaw is a classic CWE-78 command injection reachable by any authenticated local account (CVSS 4.0 8.5). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Local privilege escalation in Phoenix Contact CHARX SEC electric-vehicle charging controllers (SEC-3000/3050/3100/3150, versions 1.0.0 through 1.9.0) lets a low-privileged local user inject OS commands via the user-application init-script and execute them as root, yielding full device compromise. The flaw was reported by CERT@VDE and is fixed in firmware 1.9.1; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV. EPSS data was not provided, so widespread automated exploitation cannot be confirmed.
Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.
Local OS-level privilege escalation in Google Chrome on Linux before 151.0.7922.72 stems from an inappropriate implementation in the Chromoting (Chrome Remote Desktop) component, letting a local attacker leverage malicious network traffic to gain elevated OS privileges. Rated CVSS 8.4 (Chromium severity Medium), the flaw carries total technical impact but no public exploit identified at time of analysis and a low EPSS of 0.11% (2nd percentile), indicating minimal current exploitation pressure. A vendor patch is available and no active exploitation has been reported.
OS memory integrity compromise and hypervisor denial of service in IBM PowerVM Hypervisor (firmware FW950, FW1060, and FW1110 families) allows a low-privileged actor inside a logical partition to issue a carefully crafted hypervisor call that crashes the PowerVM hypervisor or corrupts OS memory. Because the flaw crosses the partition-to-hypervisor trust boundary (CVSS scope change), a single guest partition can impact the integrity and availability of the shared virtualization layer serving other partitions. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; IBM, the reporter, has released a fix.
Server-side request forgery in Kanboard 1.2.52 and earlier lets authenticated users pivot into internal networks by encoding target IP addresses in hexadecimal notation, which slips past the application's SSRF allow-list check. Because the isPrivateURL() filter in app/Core/Http/Client.php relies on FILTER_VALIDATE_IP - which rejects non-dotted-decimal formats - a hex-encoded address like 0x7f000001 is deemed 'not a private IP' and forwarded to cURL, which happily resolves and connects to it. Publicly available exploit code exists (a proof-of-concept gist), though there is no public exploit identified as being used in active attacks; EPSS was not provided.
Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.
Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.
Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox through crafted input to the GPU component. This is a second-stage vulnerability (CWE-20, improper input validation) that Google rates High severity and CVSS 8.3 with a scope change; it is chained after an initial renderer bug rather than exploited alone. No public exploit has been identified at time of analysis, EPSS is low (0.29%, 21st percentile), and CISA SSVC records exploitation as none, though technical impact is rated total.