Hardcoded or algorithmically derivable Wi-Fi credentials in the Softish C6 Ear Camera (firmware 1.3.1_Code 132) and companion EarVision Android application (1.3.1) allow an adjacent-network attacker to reconstruct the device's access-point password without authentication. Once the attacker connects to the camera's private Wi-Fi network, the live video stream, device management interfaces, status pages, and the firmware-update endpoint become fully accessible. The vulnerability was disclosed via CISA ICS-CERT advisory VA-26-251-01 and carries a CVSS 4.0 score of 8.7 reflecting high impact across confidentiality, integrity, and availability within the vulnerable system.
Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.
Out-of-bounds memory access in zstd-jni versions 1.3.3-1 through 1.5.7-13 enables unauthenticated network-accessible attackers to crash the JVM by supplying crafted sample-size arrays to the Zstd.trainFromBufferDirect dictionary-training API. The native C implementation (jni_zdict.c) failed to sum caller-supplied sample lengths against the DirectBuffer's actual capacity before iterating, allowing the native code to walk past the buffer allocation boundary and trigger a hard JVM termination. A patched release (v1.5.7-14) is available; no public exploit has been identified at time of analysis.
Regular expression denial of service in GitPython before 3.1.60 allows unauthenticated remote attackers to exhaust server CPU resources by supplying a crafted commit with a malformed author or committer field. The vulnerable regex Actor.name_email_regex exhibits quadratic backtracking when processing an unterminated angle bracket in the author string, stalling affected processes for over two minutes per commit access. Any application that reads attacker-influenced git repositories using GitPython is exposed; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Read-only mode bypass in SiYuan ≤ 3.8.1 allows an authenticated administrator to submit arbitrary SQL against the blocks database via POST /api/search/fullTextSearchBlock (method=2), circumventing the workspace's --readonly=true protection that correctly blocks the dedicated /api/query/sql endpoint. The prior fix for CVE-2026-32767 added an admin-role gate but omitted the model.CheckReadonly and CheckReadonlyStatementInBox calls, leaving the SQL code path unguarded. Vendor-released patch available in v3.8.2; no public exploit identified at time of analysis.
Arbitrary PHP file upload in the Rara One Click Demo Import WordPress plugin (versions before 1.3.5) grants authenticated administrators a path to full remote code execution by deliberately bypassing WordPress core's file type validation. The plugin's `process_uploaded_files()` function passes a false override value to `wp_handle_upload()`, disabling MIME and extension checks across all three upload parameters, allowing a PHP webshell to be written to the publicly accessible `wp-content/uploads/` directory and triggered via HTTP. Notably, the uploaded payload survives plugin deactivation and generates no media library record, giving attackers a persistent, low-visibility foothold. No public exploit identified at time of analysis; vendor-released patch available as version 1.3.5.
Snipe-IT before 8.7.0 fails to apply the CheckUserIsActivated middleware to the API middleware group, allowing deactivated accounts to retain full REST API access through their existing Laravel Passport personal access tokens. Any deactivated user whose token has not been explicitly revoked can continue reading and writing assets, users, and licenses at their prior permission level, bypassing the offboarding control that correctly blocks web sessions. The most critical escalation path lets a deactivated account previously holding users.edit permission PATCH its own activation flag via /api/v1/users/{id} to permanently re-enable itself. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 8.7.0.
Account takeover in Snipe-IT before 8.7.0 allows low-privileged identity-provider users to hijack arbitrary Snipe-IT accounts by registering IdP usernames that are case or Unicode accent variants of existing victim usernames. The vulnerability exploits MySQL's default utf8mb4_unicode_ci collation, which conflates these variants during database lookups, enabling an attacker to be matched to a different user's record across all federated authentication paths - SAML, LDAP, and OAuth. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.
SQL injection in the RelatedProduct block of Mageplaza Blog for Magento 2 (versions through 4.3.2) exposes the full e-commerce database to unauthenticated remote attackers via the unsanitized `id` GET parameter at the `/mpblog/post/view` endpoint. Successful exploitation allows arbitrary SQL command execution, giving attackers read access to the Magento database - including customer PII, order history, session tokens, and hashed admin credentials. A public PoC is referenced via a GitHub gist; no confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated remote availability disruption in Huawei HarmonyOS 6.1.0 allows network-accessible attackers to exploit missing permission controls in the event notification module, causing high-severity service outages that propagate beyond the vulnerable component via a scope change. The vulnerability is rooted in CWE-264 (Permissions, Privileges, and Access Controls) and carries a CVSS 3.1 base score of 8.6 with no privilege or user-interaction requirements. Huawei issued remediation guidance in its September 2026 security bulletin covering smartphones, Vision devices, wearables, and laptops; no public exploit code has been identified at time of analysis.
Sandbox-escape remote code execution in Google Chrome's Views UI framework prior to 153.0.8010.36 allows a local attacker to execute arbitrary code outside the browser sandbox by inducing a specific UI interaction that triggers a use-after-free condition. The CVSS scope change (S:C) confirms the vulnerability crosses the renderer sandbox boundary into the broader OS context, with full confidentiality, integrity, and availability impact. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS of 0.20% (10th percentile) reflects low automated exploitation probability, though sandbox escapes are high-value for privilege escalation chains.
Argument injection in bestzip's nativeZip function (versions 2.2.6 and 3.0.2) allows attackers who control the destination path or source file entries to inject arbitrary flags into the underlying Info-ZIP binary, achieving command execution at the Node.js process privilege level. Two distinct injection vectors exist: passing a flag-like string such as `-n` as the destination consumes the `--` argument separator, allowing source entries like `--unzip-command` to be interpreted as zip binary flags that trigger shell execution during archive validation. Patched versions 2.2.7 and 3.0.3 apply `path.resolve()` to normalize the destination before constructing the argument list. No public exploit is identified at time of analysis and the CVE is not in CISA KEV.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Server-Side Request Forgery in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior enables a privileged authenticated attacker to send crafted, unvalidated parameters to a server endpoint, causing the platform to make unauthorized outbound or internal requests. The resulting impact spans unauthorized command execution and disclosure of server-side data - a unusually severe outcome for SSRF, likely achieved by pivoting through the SSRF to reach privileged internal services. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Remote code execution is possible in Schneider Electric EcoStruxure IT Data Center Expert (formerly StruxureWare Data Center Expert) versions 9.1.2 and prior via an argument injection flaw (CWE-88) in backup configuration parameter handling. An attacker holding a privileged account can supply crafted arguments that are passed unsanitized to an underlying backup command, resulting in arbitrary OS-level code execution on the server. No public exploit code or active exploitation has been identified at time of analysis, but the network-reachable attack vector and full CIA impact make this a meaningful risk for any organization operating this data center infrastructure management platform.
Path traversal in Tanium Comply allows authenticated low-privileged network users to read files outside the module's intended directory scope, resulting in high confidentiality impact and scope change to the broader host system. The CVSS vector (S:C, C:H) indicates the traversal can reach resources beyond the Comply component itself, potentially exposing sensitive configuration, credentials, or endpoint compliance data accessible to the Tanium platform. No public exploit code or CISA KEV listing has been identified at time of analysis.
Path traversal in Tanium Comply exposes all authenticated low-privilege users to a scope-changing arbitrary file write against the underlying host. The CVSS vector (AV:N/AC:L/PR:L/S:C/I:H) confirms the vulnerability is network-reachable without administrative credentials and breaks containment boundaries beyond the Comply module itself. Tanium addressed the issue under advisory TAN-2026-043; no public exploit code or CISA KEV listing is currently identified.
Unauthenticated firmware injection in Softish EarVision Android Application 1.3.1 paired with the C6 Ear Camera 1.3.1_Code 132 allows an adjacent attacker to deliver arbitrary, unsigned firmware to the physical ear camera device. By spoofing the C6 Ear Camera's wireless identity and eliciting a single user confirmation, the attacker triggers the application to transmit firmware over an update channel that performs neither endpoint authentication nor cryptographic signature verification (CWE-306). No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; however, the adjacent-network vector and minimal social engineering threshold make exploitation realistic in clinical or close-proximity consumer settings.
Local privilege escalation in ESET AV Remover (standalone) enables a low-privileged local user to attain SYSTEM-level control by sending specially crafted RPC messages to the tool's privileged service component. The root cause is CWE-269 (Improper Privilege Management): the RPC handler fails to enforce access controls commensurate with the operations it exposes, allowing an unprivileged caller to invoke functionality that executes at a higher privilege level. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis.
Cross-tenant IDOR in identrail's GitHub App connection-completion endpoint allows any authenticated tenant to hijack another customer's GitHub App installation and read their organization's private repositories. The flaw exists at POST /v1/workspaces/:workspace_id/projects/:project_id/github/connect/complete, where the client-supplied installation_id is accepted and persisted with no ownership verification-despite the co-located state token being rigorously bound to {TenantID, WorkspaceID, ProjectID}. Fixed in v1.0.2; no public exploit code or CISA KEV listing identified at time of analysis.
Privilege escalation in Snipe-IT before 8.7.0 allows any authenticated user to register OAuth clients with attacker-controlled redirect URIs by directly accessing Laravel Passport's client management routes, which are not properly gated to administrative users. An attacker with any valid account can then social-engineer an administrator into approving a crafted OAuth consent screen, capturing the resulting authorization code and exchanging it for a bearer token inheriting full admin API permissions. The compounding risk is a token lifetime of up to 40 years, meaning harvested tokens remain valid far beyond typical credential rotation cycles without explicit revocation. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Path traversal in SiYuan's flashcard deck management API allows an authenticated administrator to delete arbitrary `.deck` and `.cards` files anywhere on the host filesystem. The `/api/riff/removeRiffDeck` endpoint accepts a `deckID` parameter without sanitizing traversal sequences, so a malicious or compromised admin account can reference files outside the designated workspace directory. The CVSS 4.0 score of 8.4 (PR:H) reflects that exploitation requires administrative credentials, but the subsequent-system integrity and availability impacts (SI:H/SA:H) confirm that damage extends beyond the SiYuan workspace itself. No public exploit code or active exploitation has been identified at time of analysis.
Server-side request forgery and arbitrary file read in Snipe-IT before 8.7.0 allow any authenticated user to exfiltrate sensitive server files - including the Laravel `.env` file containing `APP_KEY` - by injecting markdown image syntax into checkout acceptance note fields. The injected syntax survives HTML escaping, is expanded by the CommonMark parser, and subsequently resolved by the laravel-mail-auto-embed library via `file_get_contents()` (local paths) or `curl` (remote URLs) when email notifications are generated. Vendor-released patch is available in version 8.7.0; no public exploit has been identified at time of analysis, but compromise of `APP_KEY` can facilitate escalation to remote code execution via Laravel cookie/session decryption.
Arbitrary file read and SSRF in Snipe-IT before 8.7.0 allow low-privileged users to exfiltrate sensitive server files - including .env credential files - via unsanitized EULA text fields. An attacker with category-edit permissions injects markdown image syntax or raw HTML img tags referencing local file paths or remote URLs; the mail auto-embed library resolves these references server-side during checkout confirmation email generation and returns the resolved content as email attachments. No public exploit has been identified at time of analysis, and a vendor patch is available at 8.7.0.
A stack buffer overflow in GPAC's NHNT demuxer (nhntdmx_process() in src/filters/dmx_nhnt.c) allows an attacker to execute arbitrary code when the affected build processes a crafted NHNT media file, because an unbounded strcpy/strcat writes a file-supplied media string into a fixed-size stack buffer. The flaw is rated 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and affects GPAC at commit c2dee3aff638cd96f9617ac5b17dc2868cd90ef3; it is fixed upstream in commit fac50e6a12ac27ffabdd5d3080b51afcc44ad8d6, which replaces the unsafe calls with gf_strlcpy/gf_strlcat. Exploitation likelihood appears limited: EPSS is only 0.18% (7th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis.
Heap-based memory corruption in GPAC's DVB-MPE/DSM-CC transport-stream parser lets an attacker who supplies a crafted MPEG-2 TS file trigger out-of-bounds reads and writes that can be turned into arbitrary code execution in the context of the parsing process. The flaw lives in src/media_tools/dvb_mpe.c in descriptorTime_slice_fec_identifier(), gf_m2ts_ipdatagram_reader() and the DSM-CC section/descriptor loops, and is fixed by commit 0e4093392e1f847c90d20e031e893cd942fef938. No public exploit code or in-the-wild exploitation is known, EPSS is a low 0.16% (5th percentile), and the vendor-supplied CVSS of 8.4 assumes local access with no privileges or user interaction.
Device impersonation via unauthenticated camera spoofing in Softish's EarVision ecosystem exposes Android app users to man-in-the-middle attacks on adjacent networks. The C6 Ear Camera and its companion EarVision Android app (both at version 1.3.1) lack proper device authentication, allowing an adjacent network attacker to emulate the camera, intercept and manipulate device status responses, observe application traffic, and potentially trigger firmware-update behavior on the camera. Reported by CISA ICS-CERT; no public exploit code or KEV listing identified at time of analysis.
Improper input validation in Samsung's DualDAR kernel driver enables a local privileged attacker to escalate privileges and execute arbitrary code at root level on affected Samsung Mobile Devices. DualDAR (Dual Data At Rest) is a Samsung Knox encryption subsystem implemented as a kernel-space driver across Android 14 through 17; a flaw in its input handling allows a caller with existing elevated privileges to corrupt driver state and reach kernel execution context. The patch ships in SMR Sep-2026 Release 1. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in SiYuan's search asset preview feature allows authenticated workspace members to inject and execute arbitrary JavaScript in other users' browser sessions. All SiYuan releases before v3.8.2 are affected; the flaw stems from unescaped asset content passed directly to innerHTML during search preview rendering. Successful exploitation grants the attacker authenticated API access within the SiYuan origin, enabling workspace data exfiltration and content manipulation on behalf of the victim.
Stored cross-site scripting in SiYuan's Search Assets result list (all versions before 3.8.2) allows low-privilege authenticated attackers to plant JavaScript payloads inside asset filenames that execute in any user's browser session when that user performs an asset search. The CVSS 4.0 score of 8.4 (PR:L/UI:A) reflects the requirement for a valid account and victim interaction, but successful exploitation grants the attacker same-origin API access and full application state manipulation under the victim's identity. No active exploitation has been confirmed and no public POC is identified at time of analysis.
Stored XSS in SiYuan note-taking application before v3.8.2 allows an authenticated attacker to achieve same-origin JavaScript execution in a victim's browser session. Notebook template paths are persisted to storage and later reflected into HTML input value attributes without attribute-context encoding, enabling an attacker who can write a template path to inject JavaScript that executes when any user opens the affected notebook's configuration panel. Successful exploitation permits same-origin API requests and full application state manipulation, including access to notes, attachments, and configuration secrets. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Sandbox escape in Google Chrome's FileSystem component prior to 153.0.8010.36 stems from missing authorization checks (CWE-862), allowing arbitrary code execution outside the renderer sandbox. The attack is multi-stage: an attacker must first compromise the renderer process via a separate exploit, then serve a crafted HTML page using social engineering to trigger the authorization gap and escape the sandbox. No active exploitation is confirmed (not in CISA KEV; EPSS 0.34% at 27th percentile; SSVC exploitation: none), and the renderer pre-compromise requirement substantially limits real-world attack surface.
Use-after-free in Chrome's WebPackaging component enables full sandbox escape to arbitrary code execution for attackers who have already established a foothold in the renderer process. All Chrome desktop releases prior to 153.0.8010.36 are affected. No public exploit code has been identified and EPSS is low (0.34%), but the scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms that successful exploitation fully escapes Chrome's multi-process sandbox, translating a renderer compromise into OS-level code execution.
Sandbox escape via incorrect authorization in the WebView component of Google Chrome on Android (prior to 153.0.8010.36) allows a network-based attacker to execute arbitrary code outside the Chrome renderer sandbox. Exploitation is a two-stage process: the attacker must first compromise the renderer process, then leverage the CWE-863 authorization flaw in WebView to break out of the sandbox via a crafted HTML page. No public exploit or KEV listing has been identified at time of analysis; EPSS is low at 0.30%, consistent with the complexity barrier of requiring a prior renderer compromise.
FileAPI improper input validation in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code on the underlying host system. The flaw, tracked in Chromium issue 532957878, was addressed in the September 2026 stable channel release. With an EPSS of 0.30% and no confirmed active exploitation, this functions as a second-stage sandbox-escape primitive rather than a standalone remote attack.
Chrome's Extensions subsystem prior to 153.0.8010.36 fails to correctly enforce security policies when inputs originate from a compromised renderer process (CWE-807), enabling a two-stage sandbox escape that results in arbitrary code execution outside the Chrome sandbox on the host OS. Exploitation chains a prior renderer compromise with social engineering to bypass Extensions-mediated policy decisions. No public exploit code exists and EPSS is low (0.30%, 22nd percentile), consistent with Chromium's internal 'Medium' severity rating despite the CVSS 8.3 score - reflecting the substantial pre-condition barrier.
Sandbox escape via improper input validation in Chrome's SiteIsolation component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox. Affected versions are all Chrome releases prior to 153.0.8010.36. Exploitation requires chaining this flaw with a separate renderer compromise - an attacker must first gain control of the renderer (typically via another renderer-targeted vulnerability), then use this SiteIsolation validation flaw to break out of the sandbox and execute code in a more privileged process context. No public exploit code or active exploitation has been identified at time of analysis.
Sandbox-escape code execution in Google Chrome's Printing subsystem (all versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via a crafted HTML page, leveraging a use-after-free in the print handling path. This is a secondary exploit in a multi-stage chain: renderer compromise is a hard prerequisite, not something this bug alone provides. No public exploit code has been identified and CISA KEV does not list this vulnerability as actively exploited.
Use-after-free in Google Chrome's Core component on Windows prior to 153.0.8010.36 enables a renderer-compromised attacker to escape the browser sandbox and execute arbitrary code on the host OS. The vulnerability is platform-specific to Windows and functions as the second stage of a chained exploit: an attacker must first achieve renderer-level compromise before triggering this UAF to pivot into the privileged browser process. No public exploit code or active exploitation has been identified at time of analysis; vendor patch 153.0.8010.36 is available.
Sandbox escape via improper initialization (CWE-665) in Google Chrome's Views UI framework on Windows, prior to version 153.0.8010.36, can lead to arbitrary code execution outside the browser sandbox. The attack is chained: an adversary must first compromise the renderer process through a separate vulnerability, then leverage social engineering to trigger the Views initialization flaw, elevating from renderer-level code execution to full host OS access. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the multi-step prerequisite bar, though the C:H/I:H/A:H impact profile warrants prompt patching.
Use-after-free in Chrome's ANGLE graphics layer on Windows enables sandbox escape and arbitrary code execution when a renderer process has already been compromised. Affected versions are all Chrome releases prior to 153.0.8010.36 on Windows; exploitation requires an attacker to first compromise the renderer and then deliver a crafted HTML page triggering the ANGLE memory corruption. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.28% (20th percentile) reflects low observed exploitation probability.
Sandbox escape via incorrect authorization in the Views component of Google Chrome on Windows (versions prior to 153.0.8010.36) enables arbitrary code execution outside the browser sandbox. Exploitation requires an attacker to first compromise the renderer process and then leverage social engineering to induce user interaction with a crafted HTML page. No public exploit or KEV listing exists at time of analysis; Chromium's own severity rating of Medium contrasts with the CVSS 8.3 score, reflecting the difficult two-stage attack chain.
DevTools injection (CWE-74) in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to escape the Chromium sandbox and execute arbitrary code on the host system via a crafted HTML page. Chromium rated this 'High' severity; the CVSS 3.1 score of 8.3 (AC:H/S:C) accurately reflects the elevated complexity imposed by the prerequisite renderer compromise and the full scope-change impact. No public exploit code has been identified and CISA has not listed this in the KEV catalog; EPSS at 0.25% (16th percentile) confirms low current exploitation probability.
Sandbox escape via confused deputy in Chrome's DataTransfer component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox by directing the victim to a crafted HTML page. Fixed in Chrome 153.0.8010.36, this is classified 'Medium' severity by the Chromium team despite the CVSS 8.3 score with full scope change (S:C, C:H/I:H/A:H), reflecting that renderer pre-compromise is required. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS is 0.25% (16th percentile).
Sandbox escape in Google Chrome on Windows (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. The flaw resides in the Storage component's incorrect reference resolution (CWE-706), making this a second-stage exploit that chains with a separate renderer compromise to achieve full sandbox breakout. No public exploit has been identified at time of analysis, and the fix is available in the stable channel release 153.0.8010.36.
Privilege elevation in Chrome's WebUI component prior to version 153.0.8010.36 enables sandbox escape and arbitrary code execution outside the browser sandbox when the renderer process has already been compromised. This is a second-stage, chained exploit: an attacker must first achieve renderer-level code execution (e.g., via a separate renderer bug) and then leverage this WebUI flaw (CWE-250 - execution with unnecessary privileges) to break out of the sandbox. No public exploit code has been identified and no CISA KEV listing exists; SSVC rates automatable exploitation as 'no', consistent with the multi-step chain requirement.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction layer, enables sandbox escape and potential remote code execution on the host system for Chrome versions prior to 153.0.8010.36. This is a staged, second-phase exploit: an attacker must first compromise the renderer process through a separate vulnerability before leveraging this ANGLE flaw to break out of Chrome's sandbox via a crafted HTML page. No public exploit has been identified and no CISA KEV listing exists; EPSS at 0.21% (12th percentile) reflects minimal observed exploitation activity at time of analysis.
SQL injection in Tanium Comply (CWE-89) allows a network-accessible, unauthenticated attacker - contingent on user interaction and high attack complexity - to execute arbitrary SQL against the backend database, with a scope change that extends impact beyond the Comply application itself to C:H/I:H/A:H. Tanium addressed this in advisory TAN-2026-042. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.
Tenant boundary violation in Snipe-IT ≤ 8.6.3 allows an authenticated low-privileged API user to create or relocate user accounts into company scopes outside their authorization. The REST API handlers Api\UsersController::store() and ::update() commit the user record to the database before filtering submitted company_id and company_ids[] values against the actor's permitted companies via Company::getIdsForCurrentUser(), making the post-hoc authorization check unable to undo the database write. On instances with null_company_is_floater=1 configured, the resulting misaligned account is persisted as a cross-company 'floater,' gaining visibility across all tenant boundaries. No public exploit has been identified at time of analysis, but the exploitation mechanics are described in sufficient detail in the GHSA advisory to reproduce without additional tooling.
Use-after-free in Chrome's Cast (Chromecast streaming) component allows an adjacent unauthenticated attacker to potentially escape the browser sandbox and execute arbitrary code by delivering crafted network traffic over a local or Wi-Fi network. All Chrome desktop versions prior to 153.0.8010.36 are affected, with Chromium rating this Critical due to the full-CIA, scope-changed impact. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (6th percentile) indicates minimal observed exploitation activity despite the high severity classification.