Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. No public exploit code exists and EPSS stands at 0.11% (1st percentile), indicating very low near-term exploitation likelihood despite the high confidentiality impact of the exposed data.
Cross-workspace domain deletion in TypeBot prior to 3.18.0 allows any authenticated non-guest workspace member to remove custom domains belonging to other workspaces, rendering their chatbots unavailable. The `handleDeleteCustomDomain` API handler validates the caller's membership in a client-supplied workspaceId but forwards the client-supplied domain name to the shared Vercel project API without confirming that domain is owned by the authorized workspace - a classic IDOR flaw (CWE-639). No public exploit code and no CISA KEV listing exist at time of analysis, but the attack requires only valid workspace membership on the target deployment.
Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.
Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in galaxy_ng, the Ansible Galaxy server plugin for Pulp, allows authenticated users holding namespace management permissions to redirect a background worker process into probing arbitrary internal network addresses, including loopback interfaces and cloud instance metadata endpoints (e.g., 169.254.169.254). The dual-impact vulnerability enables both internal network reconnaissance (enumerating reachable IPs and reading service responses) and a denial-of-service condition against background workers due to the absence of an HTTP client timeout. No public exploit has been identified at time of analysis, and no confirmed KEV listing exists; however, the scope-changing CVSS vector (S:C) reflects that impact crosses trust boundaries from the application into adjacent internal infrastructure.
Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.
Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.
Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.
Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.
Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.
Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.
Stored Cross-Site Scripting in the tagDiv Composer WordPress plugin (all versions through 5.4.5) allows authenticated attackers with Contributor-level access to persist arbitrary JavaScript in WordPress post content that executes in the browsers of any user who views the affected page. The exploit abuses a base64-encoding bypass in the vc_raw_html shortcode: WordPress's save-time wp_kses_post() sanitizer never sees the dangerous tags because they are encoded as innocuous base64 text, and the vc_raw_html::render() method decodes and emits the content unescaped at render time. No public exploit is identified at time of analysis, but the technique (base64-bypass of wp_kses_post) is a well-understood class in the WordPress ecosystem and the barrier to exploitation for authenticated users is low.
Path traversal in the liketrek TREK Public Journey Photo Proxy controller allows remote attackers - without authentication - to read files outside the intended directory on self-hosted instances running version 3.0.22 or earlier. The affected endpoint (`server/src/nest/journey/journey-public.controller.ts`) fails to adequately sanitize path inputs, exposing server-side files to limited confidentiality disclosure. No public exploit has been identified and the CVE is not listed in the CISA KEV catalog; a vendor-released patch is available in v3.1.0.
Unauthorized event disclosure in the TYPO3 "Event Management and Registration" extension allows unauthenticated remote users to view hidden or time-restricted events by supplying a demand-override query parameter that the extension fails to validate against its own enable-field restrictions. The vulnerability (CWE-862, Missing Authorization) is exploitable against any deployment where the `disableOverrideDemand` plugin setting is not explicitly activated - making non-hardened installs vulnerable by default. No public exploit code has been identified at time of analysis, and CVSS 4.0 scores this at 6.3 Medium with low confidentiality impact and no integrity or availability consequence.
Improper authentication in liketrek TREK up to version 3.0.22 allows a remote unauthenticated attacker to bypass the OIDC login flow by exploiting flawed user-lookup logic in the `findOrCreateUser` function of `server/src/services/oidcService.ts`. Successful exploitation - rated high attack complexity - could allow an attacker to authenticate as an arbitrary user without valid credentials. No public exploit or CISA KEV listing exists; however, the vendor's v3.1.0 release notes describe this as a 'critical authentication bypass' among 18 privately-reported vulnerabilities, and updating is strongly recommended for all self-hosted instances.
Unrestricted Solr query syntax passthrough in the TYPO3 EXT:solr enterprise search extension exposes indexed data to remote unauthenticated attackers via blind injection techniques. By crafting queries that exploit Solr's native field selectors, wildcards, and range operators, an attacker can enumerate schema field names and systematically extract stored values without triggering obvious errors. No public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.3 reflects high attack complexity (AC:H/AT:P) that limits opportunistic mass exploitation.
Incorrect authorization in liketrek TREK's Journey Photo Proxy (all versions through 3.0.22) enables remote unauthenticated attackers to bypass share token validation in the `validateShareTokenForAsset` function, potentially exposing journey photos without a valid share token. The CVSS 4.0 score of 6.3 reflects high attack complexity that constrains practical exploitation despite requiring no authentication or user interaction. No public exploit code exists and this vulnerability is absent from the CISA KEV catalog; vendor-released patch v3.1.0 is available and strongly recommended for all self-hosted instances.
Filter injection in the EXT:solr (Apache Solr for TYPO3 - Enterprise Search) extension enables unauthenticated visitors to bypass per-site document isolation on shared Solr cores, exposing public search-indexed content belonging to adjacent TYPO3 site installations. The flaw exists because user-supplied additionalFilters request parameters can pre-register a named siteHash filter that the query builder then refuses to overwrite, undermining the multi-tenancy boundary the extension relies upon for site separation. No public exploit code has been identified at time of analysis, and exploitation is gated on a specific shared-core deployment pattern; no active exploitation is confirmed.
Timing oracle in Kimai's TokenAuthenticator (all 2.x versions before 2.54.0) allows unauthenticated network attackers to enumerate valid usernames by measuring a consistent ~25ms response time differential - argon2id password hashing executes only when a matched user record exists, leaking username validity despite identical HTTP 403 response bodies. No authentication, API token, or session cookie is required to exploit this flaw against default Kimai deployments. A fully functional proof-of-concept Python script is publicly available in the GitHub Security Advisory (GHSA-jrc6-fmhw-fpq2), making this a low-barrier reconnaissance primitive for follow-on credential attacks; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Frontend detail-view document lookup in the Apache Solr for TYPO3 Enterprise Search extension bypasses both the siteHash isolation filter and frontend user access controls, allowing retrieval of Solr-indexed documents outside normal authorization constraints. An unauthenticated visitor who obtains or guesses a valid Solr document ID can access content restricted to specific sites or authenticated frontend users by querying the detail-view endpoint directly, circumventing the access controls enforced on the regular search path. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS 4.0 score of 6.3 with AC:H and AT:P reflects that exploitation depends on obtaining valid document IDs.
Timing side-channel in Grav CMS before 2.0.16 allows remote attackers to weaken CSRF protection by recovering valid nonce values through statistical analysis of server response latency. The `Utils::verifyNonce()` function uses PHP's non-constant-time `===` operator instead of `hash_equals()`, enabling byte-by-byte nonce reconstruction via repeated probing requests. No public exploit is identified at time of analysis, but the CWE-208 vulnerability class is well-documented in security literature and the technique is reproducible with standard tooling.
Integer underflow (CWE-191) in Adobe's Content Credentials Rust SDK and C2PA Tool crashes the application when processing a specially crafted C2PA manifest, producing a denial-of-service condition. Both the c2pa_tool and content_credentials_rust_sdk components are confirmed affected per Adobe advisory APSB26-110. No public exploit code or active exploitation has been identified; impact is limited entirely to application availability with no confidentiality or integrity consequences.
Integer underflow in Adobe's Content Credentials Rust SDK and c2pa_tool allows a local attacker to crash the application via a crafted C2PA manifest, causing a denial-of-service condition. Both the standalone CLI tool (c2pa_tool) and the Rust SDK library (content_credentials_rust_sdk) are affected per CPE data. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the absence of user interaction requirement lowers the bar for automated or scripted triggering.
Infinite-loop denial of service in OpenEXR versions prior to 3.2.10, 3.3.12, and 3.4.13 allows an attacker to permanently hang any process that parses a crafted EXR image by triggering an integer overflow in the sample-count helper roundListSizeUp(). When UINT_MAX is passed as a sample-count value, 32-bit unsigned left-shift arithmetic wraps the accumulator to zero, producing a loop condition that never terminates. The vulnerability is reachable through public OpenEXRUtil APIs, making it exploitable wherever applications accept externally-supplied EXR files. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.
Stored XSS in GazellePW's forum reward comment system allows network-accessible attackers to inject persistent JavaScript payloads into the `data-tooltip` attribute of forum thread views, which Tooltipster then renders as live HTML in victims' browsers. The vulnerable endpoint is `/forums.php?action=ajax_get_jf` (parameter `c`), confirmed at commit 86c4bedf727691b5a97af42a4864869d18446449 of the Mosasauroidea repository. A publicly referenced write-up claims this can be chained for complete GazellePW database compromise, though that escalation path has not been independently verified or confirmed by CISA KEV.
Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. No public exploit code or CISA KEV listing was identified at time of analysis; exploitation requires tricking a victim into clicking a crafted link.
Stack buffer overflow in Zephyr RTOS's virtio PCI driver (drivers/virtio/virtio_pci.c) allows a malicious virtio device to corrupt the kernel stack with up to ~228 bytes of device-controlled data, or trigger a near-unbounded write via unsigned underflow, during boot-time device probe. All Zephyr versions are potentially affected (CPE: cpe:2.3:a:zephyrproject:zephyr:*:*:*:*:*:*:*:*) when compiled with CONFIG_ASSERT disabled, which is the production default. Exploitable scenarios are limited to bare-metal systems with untrusted physical or passthrough virtio PCIe devices, or confidential computing deployments where the Zephyr guest must be defended against a potentially malicious hypervisor. No public exploit identified at time of analysis; upstream patch is available at commit d98dacee.
Stored XSS in the Drupal Media Folders contributed module (versions 0.0.0 through 1.0.8) allows network-accessible injection of persistent malicious scripts that execute in the browsers of users who subsequently view affected media folder pages. The CVSS scope change (S:C) confirms the payload crosses the application security boundary into the victim's browser session, enabling session hijacking or privilege escalation against authenticated users including administrators. No active exploitation has been confirmed - no CISA KEV listing, no public exploit code, and an EPSS of 0.15% (4th percentile) - and a vendor patch is available via Drupal security advisory SA-contrib-2026-080.
Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-082.
Heap out-of-bounds write in OpenEXR's DeepImage API affects all versions prior to 3.2.10, 3.3.12, and 3.4.13, exploitable by processing a crafted deep image EXR file. A coordinate axis confusion bug in `Imf_4_0::SampleCountChannel::set()` uses `dataWindow.min.x` instead of `dataWindow.min.y` when computing a target Y coordinate, causing memory writes before the allocated `_numSamples` heap buffer when `min.x ≠ min.y`. No public exploit identified at time of analysis; SUSE Linux Enterprise distributions have received vendor-released patches confirming active remediation.
Credential exposure in NVIDIA NemoClaw allows a local low-privileged user, upon triggering user interaction, to access insufficiently protected credential material stored or accessible within the application's runtime context. The CVSS 5.6 Medium score reflects the constrained local attack vector (AV:L), but the high confidentiality impact (C:H) indicates that successfully harvested credentials could enable meaningful lateral movement or downstream access beyond the initial system. No public exploit code has been identified and no CISA KEV listing exists at time of analysis.
Path traversal in the TYPO3 Mask extension allows authenticated backend users with Mask module access to create or delete arbitrary .html files outside the configured template directory. The flaw stems from the extension's failure to validate client-supplied template element keys before using them to construct filesystem paths for saving and deleting Mask template files. No public exploit code or CISA KEV listing has been identified at time of analysis, but the integrity impact is concrete - an attacker can overwrite or remove .html files anywhere the TYPO3 web process has write access.
Unauthorized database field disclosure in the TYPO3 "Modules" extension allows any authenticated low-privileged backend user to read arbitrary database field values - including backend and frontend user password hashes - by supplying user-controlled table, field, and record parameters to an unprotected AJAX inline editing endpoint. The authorization check protecting which fields a given user may view or modify is entirely absent from this endpoint, meaning any backend session holder with module access can query sensitive records regardless of their configured permissions. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, but the attack requires only a valid TYPO3 backend login, making it a meaningful insider privilege-escalation risk in multi-user installations.
Rclone before v1.75.0 panics in the WebDAV TUS creation handler when a transport failure returns a nil HTTP response, because `getTusLocationOrRetry` dereferences `resp.StatusCode` before checking the accompanying error - crashing the process if it runs as a long-lived VFS mount or multi-workload goroutine without a recovery boundary. An attacker who controls or compromises the configured WebDAV endpoint can trigger the crash by resetting the TCP connection before an HTTP response is returned, halting all unrelated work in the process. No public exploit code and no confirmed active exploitation have been identified at time of analysis.
Self-service privilege escalation in the TYPO3 femanager (Frontend User Manager) extension allows any authenticated frontend user to assign themselves to arbitrary frontend usergroups via the profile edit plugin when operating under its default field configuration. The root cause is CWE-862 (Missing Authorization): the extension does not validate whether the requesting user is permitted to join the target group before processing the self-update. No public exploit has been identified at time of analysis, but the exploit path is straightforward for any logged-in frontend user on an affected TYPO3 installation. The CVSS 4.0 score of 6.0 reflects the prerequisite of an authenticated session and a specific configuration context.
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege local access requirement substantially constrains the realistic attacker population.
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentication passwords, bearer tokens, or session cookies transmitted in cleartext after a same-host HTTPS-to-HTTP redirect. All rclone versions through v1.74.0-240 are affected when the WebDAV backend is configured with Basic credentials or cookie-based authentication. No public exploit code has been released, but a proof-of-concept was demonstrated and documented in the GHSA advisory as part of responsible disclosure.
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during same-host HTTPS-to-HTTP redirect downgrades, or SSE-C customer-provided encryption keys during cross-origin S3 redirects. The S3 redirect callback in s3.go correctly strips X-Amz-Security-Token on host changes but omits IBM IAM Authorization headers and SSE-C key headers from its denylist, exploiting a gap in Go's built-in redirect sanitization that does not treat scheme downgrades as a credential boundary. A proof-of-concept is documented in GHSA-8mxv-9xhp-86h4; no public exploit tool has been independently identified, and the vulnerability is not listed in CISA KEV at time of analysis.
NULL pointer dereference in the Zephyr RTOS OCPP 1.6 client allows a malicious or compromised OCPP central system - or a man-in-the-middle on an unencrypted ws:// connection - to remotely crash the OCPP reader thread of an EV charge point by returning a malformed CALLRESULT uid field. Impact is availability-only and platform-conditional: on MMU/MPU-equipped or CONFIG_NULL_POINTER_EXCEPTION_DETECTION-enabled Zephyr targets, the fault invokes the fatal handler and produces a remote denial of service; on bare-metal targets where address 0 is readable, the call returns 0 and is benign. No public exploit is identified at time of analysis, and the vendor-supplied patch at the referenced commits is known to be incomplete - a second unguarded strtok_r/atoi pair in the same function path remains exploitable via a uid containing one token but no second hyphen-delimited segment.
Unbounded memory growth in OpenSSL's Certificate Management Protocol (CMP) implementation enables unauthenticated remote attackers to exhaust server memory by repeatedly sending rejected CMP messages containing large extraCerts lists. Affected are OpenSSL 3.0.x before 3.0.22, 3.4.x before 3.4.7, 3.5.x before 3.5.8, 3.6.x before 3.6.4, and 4.0.x before 4.0.2 - but only when the CMP server shares a single long-lived OSSL_CMP_CTX across requests. Vendor patches are available; SSVC classifies exploitation as 'none' and no public exploit code has been identified at time of analysis.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Consent bypass in Red Hat Build of Keycloak's keycloak-services component allows an authenticated attacker holding valid client credentials and a trusted identity provider assertion to obtain OAuth2 access tokens for user accounts at consent-gated clients without the user's knowledge or approval. The JWT Bearer authorization grant flow (RFC 7523) omits the consent validation step that is correctly enforced in other grant types - classified as CWE-862 (Missing Authorization). No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the high confidentiality impact and network-accessible token endpoint warrant prompt remediation in any Keycloak deployment leveraging federated JWT Bearer grants.
Path traversal in SKYSEA Client View and SKYMEC IT Manager enables a locally-authenticated Windows user to execute arbitrary code on remote Windows systems running the same software via UDP communication channels. This is an incomplete-fix bypass of CVE-2024-41726, reported by JPCERT/CC, meaning the original remediation failed to neutralize all traversal variants. No public exploit has been identified at time of analysis, but the subsequent-system impact is maximal (SC:H/SI:H/SA:H per CVSS 4.0), indicating full lateral compromise potential within enterprise environments deploying these management agents.
Lateral code execution via path traversal in SKYSEA Client View and SKYMEC IT Manager allows a low-privileged user authenticated to one Windows host running the software to execute arbitrary code on other Windows hosts where the product is installed, provided those targets are reachable via UDP. The vulnerability (CWE-22) is a bypass of the incomplete patch for CVE-2024-41726, meaning prior remediation efforts are insufficient. No public exploit code or CISA KEV listing has been identified at time of analysis, but the RCE-class impact on subsequent systems - reflected in CVSS 4.0 SC:H/SI:H/SA:H - makes this a meaningful lateral movement risk in enterprise environments running SKY Co. products.