Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds write in libsavscmn.so, a shared library component of Samsung One UI, enables local attackers holding low-level user privileges to execute arbitrary code on affected devices. All Samsung devices running One UI prior to version 8.5 are in scope, with the fix delivered in the September 2026 One UI 8.5 security update as documented in Samsung Mobile's bulletin. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Improper export of Android application components in Samsung Bixby Touch prior to version 4.3.01.17 allows any co-installed application on the same device to access sensitive information without requiring special Android permissions. The vulnerability stems from one or more app components being declared exported in the application manifest without enforcing appropriate permission checks, giving locally present adversarial apps direct access to data the Bixby Touch service handles. Samsung Mobile has released a patched version (4.3.01.17) via its monthly security bulletin; no public exploit or active exploitation has been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Out-of-bounds write in libsthmbc.so affects Samsung Mobile devices running One UI prior to version 8.5, allowing local low-privilege attackers to corrupt memory beyond allocated buffer boundaries. The CVSS 4.0 vector assigns high confidentiality impact (VC:H), indicating the write primitive can be leveraged to read or expose sensitive adjacent memory content. No public exploit has been identified at time of analysis, and Samsung has shipped a fix in the One UI 8.5 security update.
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026.
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
Path traversal in Samsung's GalaxyDiagnostics component on Samsung Mobile Devices allows a physical attacker to access files with system-level privilege, affecting Android versions 14 through 17 prior to the SMR Sep-2026 Release 1 patch. The CVSS 4.0 vector (AV:P/VC:H/VI:H) confirms both high confidentiality and integrity impact but constrains exploitation to physical presence at the device. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.
Command injection in Dell PowerScale OneFS allows a local attacker with admin-level privileges to escalate to root, achieving full system compromise across confidentiality, integrity, and availability. Affected versions span three distinct release trains: 9.5.0.0-9.7.1.0, 9.8.0.0-9.10.1.0, and 9.11.0.0-9.14.0.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the attack requires pre-existing local administrative access, substantially limiting the attack surface to insider threats or post-compromise scenarios.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Path traversal in Tanium Data Service 4.2 prior to build 4.2.345 allows a highly privileged, remote-authenticated attacker to read, write, or otherwise manipulate files outside the application's intended directory scope. Tanium addressed this in their security advisory TAN-2026-044 with a patch to build 4.2.345. No public exploit or active exploitation has been identified at time of analysis.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Web origin policy bypass in Google Chrome's Network component prior to 153.0.8010.36 allows remote attackers to violate cross-origin resource isolation by socially engineering victims into interacting with a crafted Chrome extension. The Same-Origin Policy (SOP) is a foundational browser security boundary; its bypass enables unauthorized cross-origin writes (I:H), potentially allowing attackers to tamper with resources on other origins. No public exploit code exists and EPSS is low (0.29%), though Chromium's own severity rating is 'High.'
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Actor component of Google Chrome before 153.0.8010.36 allows remote attackers to read sensitive browser information by inducing a victim to visit a crafted HTML page. The flaw (CWE-862) reflects a failure to enforce access control checks in an internal Chromium IPC/actor abstraction, exposing confidential data without requiring credentials. With CVSS 6.5 (Medium), EPSS at 0.28% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a real but lower-priority information disclosure fixed in the September 2026 stable channel update.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.
Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in Chrome's FileAPI implementation allows remote attackers to bypass system-level file access restrictions, resulting in high-integrity impact against the vulnerable system. Exploitation requires social engineering - a user must visit a crafted HTML page - making it a targeted rather than opportunistic threat. No public exploit code or active exploitation has been identified; the Chromium team assigned a 'Medium' severity rating consistent with the CVSS 6.5 score, and a patch is available in Chrome 153.0.8010.36.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Privilege escalation in the HPE Aruba ClearPass OnGuard agent enables an authenticated network-accessible attacker with low privileges to elevate to root on the affected deployment. The CVSS vector (AV:N/AC:L/PR:L/UI:N) confirms low-complexity network exploitation requiring no user interaction, making it straightforward to weaponize for any attacker who holds even a basic account on the system. No public exploit code or CISA KEV listing has been identified at time of analysis; HPE has published advisory hpesbnw05130en_us, which presumably details affected versions and remediation.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Relative path traversal (CWE-23) in Dell Secure Connect Gateway 5.0 allows unauthenticated remote attackers to access the underlying filesystem of the appliance or application deployment without credentials. Both form factors - the dedicated Appliance (prior to 5.36.00.16) and the software Application (prior to 5.36.00.00) - are affected. Successful exploitation yields limited file read access (C:L) and high-impact file write capability to arbitrary filesystem locations (I:H), creating conditions for persistent configuration tampering or malicious file placement on a security-adjacent platform. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote low-privileged attacker to extract sensitive data and potentially inject scripts into the application. Affecting both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00), the flaw requires only valid low-privilege credentials and standard network access with no user interaction. Dell has released patched versions and no public exploit code has been identified at time of analysis.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Divide-by-zero in GPAC v26.07.0's DASH client crashes the process when parsing a crafted MPD SegmentTimeline containing a zero-duration segment entry, enabling a remote attacker to cause a Denial of Service against any application using GPAC to process MPEG-DASH content. The affected function gf_dash_get_timeline_duration divides by ent->duration without guarding against zero; the upstream fix commit (2fd5a06a) is confirmed available but a tagged patched release has not been independently verified. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a crafted JMAP blob ID. By issuing a JMAP blob download request using the internal format H<emailid>-<index> with an index value that exceeds the length of the blob_headers array, an attacker triggers an out-of-bounds read (CWE-125) and receives whatever heap memory follows the array in the server's response. The CVSS 3.1 score of 3.1 (Low) reflects the authentication requirement, high attack complexity, and limited confidentiality impact; no public exploit has been identified at time of analysis.