Address bar spoofing in Google Chrome prior to version 152.0.7977.75 allows remote attackers to visually deceive users by manipulating the browser's fullscreen UI state through a crafted HTML page, causing the displayed origin to misrepresent the actual site being visited. The vulnerability (CWE-451) carries no confidentiality or availability impact - the risk is exclusively to integrity through phishing enablement, consistent with Google's own 'Low' severity designation. No public exploit code has been identified, and exploitation probability is negligible at EPSS 0.16% (6th percentile).
Plaintext token storage in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier exposes authentication tokens to any Jenkins user holding Item/Extended Read permission or to anyone with direct access to the Jenkins controller filesystem. Tokens written to job config.xml files are readable without decryption, potentially allowing lower-privileged users to impersonate legitimate remote-trigger callers and invoke builds on downstream Jenkins instances. No public exploit has been identified; SSVC assessment confirms no active exploitation and a non-automatable attack path.
Observable response discrepancy in Kibana's Osquery feature enables cross-space scheduled query ID enumeration by authenticated low-privileged users. An attacker holding Osquery live-query privileges can determine whether a scheduled query identifier exists in a Kibana space they are not authorized to access by observing distinguishably different API responses. Vendor-released patch is version 9.4.4 per ESA-2026-161; no public exploit or CISA KEV listing is identified at time of analysis.
Missing authorization in Jenkins' CLI build command allows authenticated low-privileged users to cancel builds they did not initiate. When invoking the `build` CLI command with the `-s` flag (wait-for-completion mode), Jenkins 2.579 and earlier and LTS 2.568.2 and earlier skip the required `Item/Cancel` permission check, enabling any user holding only `Item/Build` permission to abort in-flight builds owned by other users. No public exploit code has been identified at time of analysis, and this issue is not listed in the CISA KEV catalog.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
The Drupal contributed module 'Disable Login Page' fails to fully suppress access to Drupal's login interface, allowing its security control to be bypassed via an alternate path or channel (CWE-288). Affected versions span 0.0.0 through 1.1.4 (exclusive), targeting Drupal sites that rely on this module to hide their login page - typically to enforce SSO or obscure attack surface. The vendor-assessed CVSS vector (PR:H, S:C, C:L) indicates scope change into Drupal core's login component, with low confidentiality exposure and no patch-related active exploitation identified; EPSS at 0.19% (9th percentile) reflects negligible current threat activity.
CVE-2026-80220 is attributed to Ubuntu but carries no description, CVSS score, CWE classification, or technical details in the available intelligence data. Without a vulnerability description or affected component, no characterization of attacker capability, impact type, or affected user population is possible. Security teams should monitor Ubuntu Security Notices directly at ubuntu.com/security/notices for authoritative details as they become available.
CVE-2026-16658 is attributed to Ubuntu (vendor source) but carries no available description, CVSS score, CWE classification, or reference data at time of analysis. The affected component, attack vector, and impact are entirely unknown from the provided intelligence. No meaningful characterization of attacker capability or defender exposure can be made without additional disclosure from Canonical or NVD.