Origin header validation bypass in PraisonAI's MCP HTTP Stream transport allows a malicious webpage to invoke unauthenticated MCP tool calls against a locally-running server by exploiting a Python `startswith()` prefix match that accepts `http://localhost.evil.example` as a trusted localhost origin. Affected are all pip/praisonai installations prior to version 4.6.58 running the MCP HTTP Stream server under the CLI-default configuration (no API key). A functional proof-of-concept is included in the GitHub security advisory demonstrating local file read via `praisonai.files.create` and arbitrary state writes via `praisonai.todo.add`; no public exploit identified at time of analysis beyond this researcher-provided PoC.
Server-Side Request Forgery in PraisonAI before version 4.6.58 allows unauthenticated remote attackers to force the application server to make HTTP requests to internal network resources, including cloud metadata endpoints (169.254.169.254), loopback services, and RFC 1918 hosts. Two independent bypass paths exist in the Jobs API webhook_url validator: a DNS rebinding path exploiting the TOCTOU gap between validation and request dispatch, and a fail-open condition where socket.gaierror exceptions are silently swallowed, accepting unresolvable domains with no validation at all. A detailed proof-of-concept including curl commands is published in the GHSA advisory; no CISA KEV listing was present at time of analysis.
Unbounded recursive referrer traversal in ORAS CLI versions through 1.3.2 allows a malicious OCI registry to trigger client-side denial of service by returning a cyclic referrer graph. Because neither `fetchAllReferrers` in the discover path nor `RecursiveFindReferrers` in the backup/restore graph logic tracked visited descriptors, a minimal two-node cycle (A→B→A) is sufficient to exhaust heap memory and CPU on the connecting client. No public exploit has been identified at time of analysis, though the fix commit and its accompanying regression tests make the attack pattern trivially reproducible. A patched release, version 1.3.3, is available.
Memory exhaustion in PraisonAI's MCP HTTP Stream server allows remote unauthenticated attackers to crash the service by flooding the initialize endpoint with requests. Each initialize call unconditionally appends a new dictionary to self._sessions with no eviction: the cleanup routine _cleanup_sessions is defined but has zero call sites in versions prior to 4.6.58, and the configured TTL is stored but never enforced. No public exploit is identified at time of analysis, but the attack requires only standard HTTP tooling against default deployments where no API key is configured.
Unauthorized filesystem mutation in praisonaiagents allows an LLM-controlled agent to rewrite arbitrary on-disk source files by invoking ast_grep_rewrite with dry_run=False, bypassing the @require_approval authorization gate uniformly enforced on every sibling mutation tool in the framework. All praisonaiagents releases prior to 1.6.58 are affected; the vulnerable function is registered as a top-level tool and exposed through the code_intelligence built-in profile. Exploitability is confirmed by a proof-of-concept in GHSA advisory GHSA-cfxv-8fw8-rwpv, and a secondary defect causes the function to return 'No changes made' to the caller even when files were modified, silently concealing the write.
Stack overflow denial of service in github.com/graphql-go/graphql (through v0.8.1) crashes any Go server process embedding the library when an attacker submits a specifically crafted GraphQL request containing a deeply nested scalar value of a mismatched type. The `coerceString` and `coerceBool` functions in `scalars.go` violate the GraphQL specification by accepting type-mismatched scalar input instead of returning a request error, and under specific deep-nesting conditions exhaust Go's call stack and trigger an unrecoverable fatal error that immediately terminates the host process. A publicly available proof-of-concept exists via the Openwall security list; however, no active exploitation is confirmed in CISA KEV, and the CVSS 4.0 vector (AV:L, AT:P) combined with the description's explicit caveat that this is not triggered by typical web JSON traffic indicates exploitation requires a non-standard input path.
Remote command injection in TOTOLINK N600R firmware 4.3.0cu.7647_B20210106 allows unauthenticated network attackers to execute arbitrary OS commands by supplying shell metacharacters in the `ntp_server` parameter to the `getCurrentTime` handler at `/cgi-bin/cstecgi.cgi`. A public proof-of-concept demonstrating popen-based injection is available on GitHub, confirmed by the CVSS 4.0 E:P exploit maturity indicator, meaning exploitation requires minimal attacker skill. No vendor-released patch has been identified in available intelligence, leaving internet-exposed devices unmitigated.
SCTP state cookie forgery in mediasoup (npm 3.20.0-3.20.5, Rust crate 0.22.0-0.22.4) permits an on-path attacker to establish unauthorized SCTP associations and inject DataChannel messages as a trusted peer, violating RFC 9260 Section 5.1.3. The root cause is that cookie validation relies entirely on two hardcoded magic constants ('msworker' and 0xAD81) rather than a per-instance HMAC secret - all remaining cookie fields are attacker-controlled, and COOKIE-ECHO packets bypass verification-tag and CRC32c checks by design. No public exploit has been identified at time of analysis; real-world risk is bounded by the narrow attack surface: only PlainTransport and PipeTransport with SCTP enabled and without DTLS/SRTP are vulnerable, while the far more common WebRtcTransport path is explicitly unaffected.
Path traversal in dekdee's adobe-xd-mcp 1.0.0 exposes the server filesystem to remote unauthenticated attackers via unsanitized `outputFile` and `outputDir` parameters in the `file-access-from-request` endpoint of `src/parsers/xd-parser.ts`. A public proof-of-concept exploit is available through the project's GitHub issue tracker, and no patch has been released - the vendor has not responded to the disclosure. With a CVSS 4.0 score of 6.9, public exploit code (E:P), and no mitigating authentication requirement, any network-exposed instance is immediately at risk.
Prototype pollution in the `@cleverbrush/deep` package (versions ≤ 4.4.0) allows a remote attacker to corrupt `Object.prototype` by supplying crafted JSON containing reserved JavaScript keys (`__proto__`, `constructor`, `prototype`) to the `deepExtend()` function without any privilege requirement. Any Node.js application that passes externally controlled input through `deepExtend()` is at risk of property injection affecting every plain object in the runtime, potentially enabling authentication bypass or logic manipulation downstream. A public exploit exists (GitHub issue #213); the vulnerability is not listed in CISA KEV, so widespread active exploitation is not confirmed at time of analysis.
Unrestricted file upload in the Reachy Mini daemon (pip/reachy-mini prior to 1.8.2) permits any unauthenticated network-reachable attacker to write arbitrary files to the robot's filesystem at /tmp/reachy_mini_sounds/<filename>. The daemon's /api/media/sounds/upload endpoint applies no authentication, no extension filtering, no content validation, and no size cap, and is bound to 0.0.0.0 with permissive CORS by default, making every network interface the robot touches an attack surface. The GHSA advisory documents this as step 1 of a three-step compromise chain that, when combined with separately reported Bluetooth authentication bypass and directory traversal vulnerabilities, enables full unauthenticated root access on the robot OS; a public proof-of-concept curl command is embedded in the advisory. No CISA KEV listing identified at time of analysis.
Stored cross-site scripting in Ekushey Project Manager CRM allows a malicious or compromised administrator to inject arbitrary HTML and script into the application's login page, which then executes silently in the browser of every unauthenticated visitor who loads that page - including users about to submit their credentials. The vulnerability persists until the system name setting is corrected, and the payload runs within the CRM's own origin, co-located with the credential input fields. A public proof-of-concept exists on GitHub (LindHunt/CVE-2026-26211); no CISA KEV listing or vendor patch has been identified at time of analysis.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
OS command injection in NVIDIA OpenShell for Linux's sandbox exec handler allows a low-privileged, network-accessible attacker to inject and execute arbitrary OS commands outside the intended sandbox boundary. All versions are affected per CPE data (cpe:2.3:a:nvidia:openshell:*:*:*:*:*:*:*:*), with confirmed potential impact spanning code execution, information disclosure, and data tampering. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Local file inclusion in Winter CMS before 1.2.13 allows authenticated backend users holding the cms.manage_assets permission to exfiltrate arbitrary server-readable files - including .env - by embedding =include or =require path-traversal directives in theme JavaScript assets. The critical escalation is that the resulting combined asset output is served unauthenticated via the public combine/{file} route, meaning a single privileged write operation exposes APP_KEY and database credentials to any unauthenticated visitor. This is the JavaScript-importer counterpart of two prior Winter CMS LFI bugs (GHSA-58fp-mcx6-7qf9, CVE-2023-52085) in the same asset combiner pipeline. No public exploit identified at time of analysis; vendor-released patch available in 1.2.13.
Remote denial-of-service in vLLM before 0.27.0 allows unauthenticated network attackers to activate the DeepStream GPU video-decode backend per-request, initialize the process-wide GPU decode pool, and submit video content that bypasses pixel-limit enforcement, causing partial availability loss for concurrent inference requests. The root cause is vLLM's failure to classify DeepStream as a GPU backend subject to resource controls combined with an omitted pixel-limit check in the DeepStream decode path (CWE-400). No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Argument injection in Fdawgs node-poppler affects all ten PDF-processing wrapper functions (pdfToText, pdfToCairo, pdfToPpm, and others) in src/index.js across versions up to 9.1.2 and 10.0.1, allowing a remote attacker who can supply a hyphen-prefixed file_path value to inject arbitrary CLI options into the underlying poppler binary invocations. The CVSS 4.0 score of 6.9 reflects network-reachable exploitation with no authentication required at the library level, though real-world exploitability depends on whether the application exposes file_path selection to external input. No public exploit has been identified and no CISA KEV listing exists; a fix is available via upstream GitHub commit db6e3f79d3beb20601be7e59669c39811ae3c330.
Server-side request forgery in Adminer before 5.5.0 allows unauthenticated remote attackers to probe arbitrary internal hosts and ports by injecting PDO DSN keys into the login form's server parameter. The root cause is an incomplete port-validation routine that only inspects leading numeric characters, failing to reject non-numeric port values; a crafted server string such as 'host=internal.host port=6379' bypasses the privileged-port restriction entirely. No public exploit code or CISA KEV listing has been identified at time of analysis, but the pre-authentication nature and low attack complexity make this an attractive reconnaissance primitive against Adminer deployments exposed to untrusted networks.
Unauthenticated credential exposure in rclone before 1.75.0 allows remote attackers to retrieve backend storage secrets via the pprof debug endpoint, bypassing the main handler's fail-closed authentication entirely. The root cause is architectural: rclone registers Go's net/http/pprof handler on its own separate router route rather than nesting it within the authenticated main handler, so GET /debug/pprof/cmdline returns the full process argv - including cloud backend credentials - to any unauthenticated caller. No CISA KEV listing or confirmed public exploit code exists at time of analysis, but exploitation requires no authentication, no special tooling, and no user interaction, making any network-exposed RC instance immediately vulnerable to credential theft.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count field of any post by repeatedly calling PUT /api/echo/like/:id without credentials or rate limiting. The endpoint is explicitly registered on the public router group, bypassing all JWT authentication middleware, and the service layer performs no identity check or per-user binding before executing the database increment. A proof-of-concept is publicly documented in GHSA advisory GHSA-rgj7-vg8v-j4wr; no active exploitation is confirmed via CISA KEV.
Path traversal in rclone's serve s3 command (versions before 1.74.4) allows unauthenticated remote attackers to both read and overwrite files at the serve root directory by embedding dot-dot sequences in S3 object keys. Go's path.Join() in the S3 backend normalizes traversal sequences that the S3 protocol treats as opaque identifiers, so a request like GET /bucket/../root-secret.txt resolves outside the intended bucket scope to a root-level file. A public proof-of-concept is available; no active exploitation has been confirmed in CISA KEV, but the unauthenticated default configuration and low attack complexity make exposed instances high-priority for patching.
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.6 by issuing repeated PUT /api/echo/like/:id requests with no authentication, rate limiting, or deduplication. Each request triggers a database write and four-key cache invalidation, enabling both persistent metric corruption and amplified load against the database and cache layers. A proof-of-concept is publicly available in the GHSA advisory; no CISA KEV listing exists at time of analysis.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-listing API endpoints, due to a missing `json:"-"` serialization tag on the Comment model's Email field. Any attacker with HTTP access to an Ech0 instance can enumerate every guest commenter email stored in the database by calling `/api/comments` or `/api/comments/public` without credentials. A working proof-of-concept script is published in the GHSA advisory; no public exploit has been confirmed as actively exploited (CISA KEV listing absent).
Rocket.Chat's unauthenticated DDP method sendForgotPasswordEmail lacks a rate-limiting rule, enabling any network caller to flood a target email address with password reset messages from the deployment's own mail sender and to enumerate account types at scale. The method is reachable both via the Meteor DDP protocol and the unauthenticated HTTP route POST /api/v1/method.callAnon/sendForgotPasswordEmail, requiring no credentials. A side-channel in the method's response - returning false only when the target belongs to an OAuth-authenticated account with Accounts_AllowPasswordChangeForOAuthUsers disabled - allows an attacker to distinguish account authentication types, confirming information disclosure beyond simple email abuse. No public exploit or KEV listing is identified at time of analysis.
Server-side request forgery in the Grav API plugin before version 1.0.16 allows an attacker who controls authoritative DNS for a configured webhook hostname to reach private internal network resources from the Grav server. The flaw exploits a TOCTOU race (CWE-367) between hostname validation and HTTP delivery: validation resolves the hostname to a legitimate public address, but a DNS rebind before delivery redirects the actual request to an RFC1918 address. No public exploit has been identified at time of analysis and the vulnerability has not been confirmed in CISA KEV.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Symlink following in LACT (Linux AMDGPU Control Tool) versions through 0.10.0 allows a local low-privileged user to redirect privileged file operations to attacker-chosen paths via a crafted UNIX symbolic link, resulting in local denial-of-service. Reported by SUSE and tracked in their Bugzilla (bsc#1276481), the flaw is rooted in CWE-61 and is confined to systems with multi-user local access where LACT is installed. No public exploit code has been identified and the issue does not appear in the CISA KEV catalog.
NULL pointer dereference in OpenEXR 3.4.0-3.4.12 causes a deterministic crash in the OpenEXRCore C API function `exr_attr_set_bytes()` when a caller passes a positive `hint_length` alongside a NULL `type_hint` pointer, enabling reliable denial of service against any application that processes EXR content via this API. The flaw is confined to availability impact with no confidentiality or integrity exposure, and the CVSS 4.0 local attack vector limits remote exploitation to indirect paths such as network-facing EXR parsing pipelines. No public exploit code or active exploitation has been identified; a vendor-released patch is available in version 3.4.13.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Insufficient session expiration in Apache Tomcat allows an authenticated attacker to maintain an active WebSocket connection after the underlying HTTP session has been invalidated, violating the Jakarta WebSocket specification's requirement that WebSocket sessions close when their parent HTTP session ends. Affected are all supported branches from 9.0.0.M1 through 9.0.120, 10.1.0-M1 through 10.1.57, and 11.0.0-M1 through 11.0.24, plus EOL branches 7.0.43-7.0.109 and 8.5.0-8.5.100. No public exploit or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.28%, 19th percentile) reflects limited real-world exploitation probability.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Out-of-bounds write in Zephyr RTOS's ext2 filesystem driver enables supervisor-mode memory corruption when a device mounts a crafted ext2 image from a physical storage medium such as an SD card. The driver's superblock validation function omits bounds-checking the s_log_block_size field, allowing an attacker-controlled value to produce an inflated block size that silently misconfigures the kernel memory slab allocator beyond its static backing buffer, with impact ranging from denial of service to potential code execution in kernel mode. No confirmed active exploitation or public POC is identified at time of analysis; a vendor patch is available as upstream commit f270f4bd0e59585da31e1fbaa79c5abf73f1364b.
Local File Inclusion in the Events Manager WordPress plugin (all versions through 7.3.7.4) allows an administrator-level attacker to store a malicious PHP file traversal path via the em_options_save function, which is then executed without any further authentication on every admin_init hook invocation - including unauthenticated admin-ajax.php requests. The two-phase attack converts a high-privilege write primitive into a persistent, unauthenticated code execution trigger that survives account remediation until the stored option is manually purged. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the OpenEXR HTJ2K decoder (versions 3.4.0-3.4.12) crashes any application that opens a crafted EXR file containing a malformed PLEN (payload length) header field. The decoder advances a raw pointer into the compressed data buffer by the attacker-supplied header size without first verifying it fits within the buffer, passing the resulting out-of-bounds offset to the OpenJPH memory-input path and causing a process crash. No active exploitation has been identified and no public proof-of-concept exists; vendor-released patch v3.4.13 resolves the flaw.
Second-order SQL injection in the Events Manager WordPress plugin (all versions through 7.4.0) allows authenticated contributors to extract sensitive data from the WordPress database by exploiting unsafe meta key concatenation in the event and location duplication flow. An attacker with contributor-level access plants SQL metacharacters in a custom event or location meta key via the standard WordPress add-meta interface; WordPress stores these verbatim in wp_postmeta, and when the duplicate action is subsequently invoked, the plugin reads the stored key via get_post_meta() and concatenates it unsafely into an INSERT SQL query. No public exploit has been identified at time of analysis, but Wordfence has published the advisory and the vulnerable code paths in em-event.php and em-location.php are exposed via Trac source references, significantly lowering the barrier to exploit construction.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Resource exhaustion via crafted SASL UNBIND in 389 Directory Server (389-ds-base) allows a remote authenticated attacker to stall connections and deny LDAP service to legitimate users. Affected deployments span Red Hat Directory Server 11, 12, and 13, plus 389-ds-base as packaged across RHEL 6 through 10. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 6.5 rating (AV:N/AC:L/PR:L) indicates low-complexity network exploitation requiring only a low-privilege LDAP bind - a realistic bar in any environment with shared directory users.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
URL extraction bypass in GOVCERT-LU eml_parser prior to version 3.0.2 allows a remote sender to craft phishing emails containing HTML-entity-encoded URLs that evade the library's URL extraction entirely. Security gateways and SOC pipelines relying on eml_parser to produce IOC lists will silently omit these obfuscated links, preventing submission to threat-intelligence feeds, URL reputation services, and sandboxes. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the regression test added in the fix commit provides a clear reproduction template.