OS command injection in zackees/transcribe-anything (versions up to 4.1.0) allows remote attackers to execute arbitrary system commands by supplying a crafted URL argument to the `ytdlp_download` function in `src/transcribe_anything/ytldp_download.py`. The CVSS 4.0 score is 2.9 - low - primarily because attack complexity is rated High, meaning exploitation requires specific conditions to align rather than trivial one-shot delivery. A publicly available proof-of-concept exploit exists via GitHub issue #137, and the vendor has not responded to the coordinated disclosure, leaving no patch available at time of analysis.
OS command injection in FishCodeTech Muteki up to version 0.2.5 enables remote low-privileged attackers to execute arbitrary operating system commands through unsanitized input handled by the Default Local Worker Backend component, specifically via the application's .claude/settings.json configuration file. Publicly available exploit code (POC) exists, referenced from a dedicated exploit report repository, raising the practical exploitability despite the product's limited deployment footprint. The project maintainer closed the issue without a patch, announcing that Muteki will be refactored and shut down, making this effectively an unpatched, end-of-life vulnerability with no vendor remediation path. No public exploit identified at time of analysis as confirmed active exploitation by CISA KEV.
SQL injection in itsourcecode Sales and Inventory System 1.0 exposes the /pages/cust_del.php endpoint to database manipulation via an unsanitized ID parameter. Authenticated remote attackers holding low-privilege accounts can craft malicious SQL to read, modify, or delete customer and inventory records. A publicly available proof-of-concept exploit exists on GitHub, though the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited impact.
Path traversal in peerigon unzip-crx and unzip-crx-3 (versions up to 0.2.0) enables a local, low-privileged attacker to write extracted archive files outside the intended destination directory by supplying a crafted path argument to the unzip() function. A publicly available proof-of-concept exploit exists via the GitHub issue tracker, and no vendor patch has been released as the project has not responded to the disclosure. The integrity impact is limited to arbitrary file placement on the local filesystem within the privileges of the invoking process.
HCL Hive exposes sensitive host environment information through a network-accessible information disclosure flaw, enabling unauthenticated remote attackers - under high attack complexity conditions - to collect reconnaissance data about the underlying system. The CVSS 3.7 (Low) score reflects both the constrained confidentiality impact and the high exploitation complexity. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery in JFrog Artifactory's External Dependency feature allows a low-privileged authenticated user to trigger outbound HTTP requests from the Artifactory server to remote CocoaPods repositories under specific high-complexity conditions. The CVSS scope change (S:C) indicates the forged requests escape the Artifactory application boundary, creating potential for internal network probing from the server's network position. No public exploit code exists and no active exploitation has been confirmed; no KEV listing is present at time of analysis.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Insufficient permissions restrictions in iOS and iPadOS (all versions prior to 26.5) allow a malicious locally-installed app to enumerate other applications installed on the device. The flaw, rooted in improper privilege management (CWE-269), exposes app inventory data that Apple's sandbox model is designed to protect. No public exploit identified at time of analysis, EPSS is extremely low at 0.09%, and SSVC exploitation status is confirmed none - placing this squarely as a low-urgency privacy concern rather than an active threat.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape process-level sandboxing constraints via a crafted HTML page. The vulnerability stems from improper input validation in Chrome's Navigation subsystem (CWE-20), and exploitation requires both a prior renderer compromise and user interaction. With a CVSS score of 3.1 (Low), EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, this is a low-urgency chained escalation risk rather than a primary attack vector - but it is meaningful in advanced threat scenarios where a renderer exploit already exists.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already achieved renderer process compromise to make unauthorized cross-origin network requests via a crafted HTML page. The incorrect authorization check (CWE-863) in Chrome's Network component fails to enforce origin boundaries when the renderer is compromised, exposing limited confidentiality data from foreign origins. No public exploit has been identified, EPSS probability stands at a low 0.23%, and the vulnerability is not listed in CISA KEV - consistent with the high attack complexity imposed by the renderer-compromise prerequisite.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Cookie-path scoping manipulation in Adminer 4.6.0-5.5.0 results from an incomplete fix for a prior X-Forwarded-Prefix header injection (GHSA-8478-xrj3-h9c2). The validation guard in bootstrap.inc.php blocks double-slash prefixes (//evil.com) but accepts backslash variants (/\evil.com); because browsers normalize backslash to forward slash, the malformed prefix survives as a network-path reference into cookie_path(), corrupting the Set-Cookie Path attribute. Exploitation depends on a misconfigured or absent reverse proxy that permits clients to supply the X-Forwarded-Prefix header, and no public exploit has been identified at time of analysis.
Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.
Reflected XSS in AshAuthentication's confirmation and magic link interaction pages allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious GET URL. Versions 4.8.0 through 4.14.1 and 5.0.0-rc.0 through 5.0.0-rc.12 of this Elixir framework authentication library embed user-supplied request parameters verbatim into hidden HTML form inputs using unescaped EEx template expressions, and since the vulnerable accept handlers are served over GET, simply loading the crafted link is sufficient - no form submission or prior session is required. No public exploit code has been independently identified at time of analysis, though the attack is trivially constructable from the public advisory and commit diff alone.
Unbounded memory allocation in CPython's zipfile module allows a crafted archive to exhaust process memory during decompression of bzip2, LZMA, or Zstandard members. The ZipExtFile._read1() method lacked the max_length output bound that the DEFLATE code path already enforced, permitting a small compressed member with an attacker-controlled declared size to expand into unlimited memory per read call. No public exploit is identified at time of analysis; exploitation requires user interaction (opening the archive), and the CVSS 4.0 base score of 2.1 reflects the low, availability-only impact.
Port forwarding in GitHub CLI versions 2.28.0 through 2.97.0 binds its local TCP listener to all network interfaces (0.0.0.0) rather than loopback only, exposing forwarded Codespace services to any adjacent host that can route to the user's machine while `gh codespace ports forward` is active. Developers using this command on shared or untrusted networks - corporate Wi-Fi, conference networks, co-working LAN segments - may unintentionally expose Codespace services that were intended to remain private. The vulnerability is fixed in v2.98.0 per advisory GHSA-vfhh-p7hm-pxfh; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Kimai's Twig invoice template sandbox fails to block the getApiToken() and getPlainApiToken() User methods, allowing admins with template creation permissions to exfiltrate hashed API tokens from any user who generates an invoice using that template. Affected are OnPremise deployments of Kimai before 2.53.0 where invoice template upload is enabled and admins hold the manage_invoice_template permission. No public exploit is independently confirmed, but the GHSA advisory includes complete proof-of-concept reproduction steps; the CVSS 4.0 score of 2.0 reflects the high prerequisite access level and limited confidentiality impact. Note: the 'RCE' tag present in source intelligence appears to be a mis-tag - the vulnerability is information disclosure, not remote code execution.
Privilege escalation in rclone before 1.74.4 allows an attacker who controls a source remote to plant a setuid binary on the destination filesystem when the victim uses the --metadata flag during a copy or sync operation. The local backend passes source-supplied mode, uid, and gid metadata verbatim to os.Chmod and os.Chown without masking ModeSetuid or ModeSetgid bits, enabling an attacker to store a crafted binary with mode=40000755 and uid=0 on a remote they control. If rclone runs as root - common in automated backup/restore workflows - any local user on the destination system can execute the planted binary to gain root access. A proof-of-concept is documented in the upstream advisory; no confirmed active exploitation (CISA KEV) is recorded at time of analysis.