Use-after-free in Chrome's Receiver component allows an adjacent, unauthenticated attacker to execute arbitrary code outside the renderer sandbox via crafted network traffic, affecting all Chrome versions prior to 153.0.8010.36. The scope change in the CVSS vector confirms this is a full sandbox escape - successful exploitation yields OS-level code execution on the victim machine without requiring any user interaction. No public exploit has been identified at time of analysis, and EPSS at 0.13% (3rd percentile) indicates low observed exploitation activity.
Path traversal in @openhop/server (npm, versions ≤0.3.5) allows unauthenticated remote attackers to read or permanently delete arbitrary `.yaml` files accessible to the OpenHop process outside its configured flow data directory. The root cause is that `FlowStore.filePath()` passes caller-supplied HTTP route parameters directly to Node.js `path.join()` without any sanitization or allowlist validation, and Fastify's underlying `find-my-way` router URL-decodes the parameter before it reaches application code, enabling `..%2F`-encoded directory traversal. A fully functional PoC is publicly available with Docker-based reproduction steps; no KEV listing at time of analysis. Docker deployments expose the server on all interfaces by default, enabling direct network exploitation without user interaction.
Server-side request forgery in Snipe-IT before 8.7.0 allows an authenticated low-privileged attacker to pivot the application server against internal network resources, cloud metadata endpoints, or arbitrary external targets. The vulnerability stems from TCPDF's writeHTML() processing unsanitized img tag injection through the employee_num field in the asset acceptance PDF generator. Exploitation is deferred until a victim user signs an asset acceptance form, at which point the server makes an outbound HTTP(S) request to the attacker-controlled URL embedded in the rendered PDF. A proof-of-concept exists per SSVC data; no active exploitation has been confirmed in CISA KEV.
Heap buffer overflow in OpenIDC/cjose versions prior to 0.6.2.5 allows a remote unauthenticated attacker to corrupt process heap memory by submitting a crafted JWE token with an oversized `encrypted_key` segment targeting the AES Key Wrap decryption path. The `cjose_jwe_import()` and `cjose_jwe_decrypt()` functions are pre-authentication entry points that accept fully attacker-controlled input, making every application that decrypts AES-KW JWEs with this library directly reachable. Impact ranges from a reliable denial of service (process crash) to potential memory-corruption-based code execution depending on heap layout and allocator behavior. No public exploit has been identified at time of analysis, but the patch commit confirms the exact boundary condition and includes a regression test demonstrating the overflow trigger.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows remote unauthenticated attackers to exploit TLS/certificate handling weaknesses, leading to unauthorized access and high-availability impact. Both the Appliance (Virtual Edition) builds prior to 5.36.00.16 and Application builds prior to 5.36.00.00 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated network vector and CVSS 8.2 score make this a priority patching item for environments running Dell infrastructure monitoring.
Arbitrary code execution at firmware privilege level is possible in InsydeH2O UEFI firmware code developed specifically for HP-branded systems, exploitable by a local attacker with high OS-level privileges. The root cause is an unvalidated memory boundary (CWE-20), consistent with an SMM (System Management Mode) handler that fails to verify caller-supplied buffer boundaries, allowing memory corruption that escapes the OS privilege boundary into firmware-controlled memory. The scope-changed CVSS vector (S:C, C:H/I:H/A:H) confirms the impact extends beyond the calling OS context, characteristic of SMRAM-targeting vulnerabilities. No public exploit code or CISA KEV listing has been identified at time of analysis.
Secure Boot bypass in InsydeH2O UEFI firmware allows a locally-privileged attacker to leverage the embedded UEFI Shell to execute shell commands or startup scripts that circumvent Secure Boot integrity enforcement, enabling pre-OS code execution outside the chain of trust. The vulnerability affects InsydeH2O across all tracked versions per the CPE wildcard, with remediation details deferred to OEM-specific advisories referenced in Insyde SA-2026004. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope change to C:H/I:H/A:H reflects the catastrophic trust boundary violation once exploited.
Authentication bypass in the Next-Cart Store to WooCommerce Migration WordPress plugin (all versions ≤ 3.9.8) allows unauthenticated remote attackers to reach privileged migration endpoints and achieve full site takeover via arbitrary SQL execution and arbitrary file deletion. The root cause is a double design flaw: the `/wp-json/next_cart/v1/migration` REST route is registered with `permission_callback` set to `__return_true` (granting unrestricted access to all callers), and the token check falls back to the hardcoded literal `__token__` via `get_option('nextcart_token', '__token__')` whenever the database option has never been written. Once past the token check, attackers pass attacker-controlled SQL directly to `$wpdb->query()` and `$wpdb->get_results()` - enabling administrator account creation - and pass an attacker-controlled path to `unlink()`, enabling arbitrary file deletion. No public exploit or CISA KEV listing has been identified at time of analysis, though source code confirming the flaw is publicly visible in the WordPress plugin SVN repository.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a locally authenticated low-privilege attacker to execute arbitrary operating system commands, resulting in full confidentiality, integrity, and availability compromise of the affected system. Both the Appliance deployment form (virtual/hardware) and the Application package are affected, with fix versions 5.36.00.16 and 5.36.00.00 respectively confirmed by Dell advisory DSA-2026-382. No public exploit code and no CISA KEV active-exploitation listing are identified at time of analysis.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) variants - enables a locally authenticated low-privileged attacker to execute arbitrary operating system commands, yielding full compromise of confidentiality, integrity, and availability of the affected host. Dell confirmed the issue in advisory DSA-2026-382 and released patches for both deployment forms. No public exploit code or active exploitation has been identified at time of analysis; SSVC rates exploitation as none and the attack as non-automatable.
Site isolation bypass in Google Chrome's ServiceWorker implementation allows a remote attacker who has already compromised the renderer process to escape cross-origin protections via a crafted HTML page. All Chrome versions prior to 153.0.8010.36 are affected. This is a chained exploit step: an attacker must first achieve renderer code execution (via a separate vulnerability), then leverage this incorrect authorization flaw to break site isolation and access data from other origins. No public exploit or CISA KEV listing exists at time of analysis.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Authentication bypass in Siam Ordering (siam-server) 1.0.0 lets remote attackers log in as any user, merchant, or administrator by supplying a hardcoded master verification code that ships with the server. The flaw is rooted in a hardcoded credential (CWE-259) rather than a memory-safety or logic error, so every deployment of version 1.0.0 that exposes the verification endpoint is potentially affected, with full confidentiality, integrity, and availability impact once a session is obtained. No public exploit code has been identified and the EPSS score is low (0.24%, 16th percentile), but the issue is trivially severe if the code value is known or recoverable, and no vendor-released patch was identified in the available data.
Improper access controls (CWE-862, Missing Authorization) in Tanium Comply allow an authenticated low-privileged user to perform unauthorized actions, producing high integrity and availability impact across the platform. Tanium disclosed this vulnerability via advisory TAN-2026-041; the CVSS 8.1 score reflects network-reachable exploitation requiring only a valid low-privilege account with no user interaction. No public exploit code or active exploitation has been identified at time of analysis.
Improper access controls in Tanium Comply allow an authenticated low-privilege user to perform unauthorized operations with high integrity and availability impact over the network. Exploiting this CWE-863 (Incorrect Authorization) flaw, an attacker with minimal authenticated access can bypass authorization enforcement within the Comply module, potentially altering compliance posture data or disrupting compliance workflows. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed.
Sandbox escape in Google Chrome's Extensions component (versions prior to 153.0.8010.36) permits an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox via crafted network traffic. The missing authorization check (CWE-862) in the Extensions subsystem fails to enforce inter-process privilege boundaries, converting a renderer-level foothold into host-level code execution. No public exploit or active exploitation has been identified; EPSS sits at 0.19%, though SSVC rates the technical impact as 'total' given successful exploitation fully bypasses Chrome's sandbox isolation.
Site isolation authorization bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The flaw (CWE-862, Missing Authorization) resides in the SiteIsolation component, which enforces process-level separation between web origins; with that enforcement missing, a controlled renderer can access data belonging to other sites. No public exploit has been identified and EPSS sits at 0.18%, consistent with this vulnerability's role as a second-stage link in a chained browser attack rather than a standalone entry point.
Site isolation bypass in Google Chrome's Network component prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to read and modify cross-origin data by exploiting incorrect authorization checks. The vulnerability requires a user to visit a crafted HTML page, making it a second-stage component in a renderer-compromise exploit chain. No public exploit code and no CISA KEV listing are associated with this CVE; EPSS is 0.18% (7th percentile), consistent with no observed widespread exploitation at time of analysis.
Use-after-free in Chrome's Views UI framework enables local attackers to escape the browser sandbox and execute arbitrary code at browser-process privilege level. The vulnerability affects all Google Chrome desktop versions prior to 153.0.8010.36. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects low near-term exploitation probability.
Uncontrolled search path element in Chrome's Windows CredentialProvider component (CWE-427) enables a local attacker to execute arbitrary code outside the browser sandbox on Windows systems running Chrome prior to 153.0.8010.36. The flaw is a DLL or executable search-order hijacking issue: Chrome's CredentialProvider resolves a dependency by searching an attacker-controllable path, allowing a malicious local program to intercept and execute in place of a legitimate component, with the result escaping Chrome's sandbox entirely. No public exploit code or CISA KEV listing has been identified at time of analysis.
Site isolation bypass in Google Chrome's FileSystem component allows a remote attacker who has already achieved renderer process compromise to escape cross-origin boundaries via a crafted PDF file. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. The vulnerability (CWE-863, Incorrect Authorization) enables the attacker to read or modify data belonging to other origins, undermining Chrome's core sandboxing guarantee. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.16%, consistent with the SSVC 'Exploitation: none' rating.
Sandbox escape via incorrect authorization in the Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the browser's sandbox using a crafted local program. Affected versions are all Google Chrome releases prior to 153.0.8010.36 on Windows. The Chromium team rates internal severity as 'Low' - notably lower than the CVSS 8.1 score - suggesting that while the impact is high if exploited, real-world attack complexity limits practical risk. No public exploit or active exploitation has been identified at time of analysis.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows allows a local unprivileged attacker to execute arbitrary code outside the Chrome renderer sandbox by exploiting a race condition. All Chrome for Windows releases prior to 153.0.8010.36 are affected. No public exploit has been identified at time of analysis; EPSS places exploitation probability at the 3rd percentile, though SSVC rates technical impact as 'total,' reflecting full system compromise potential if the race condition is successfully won.
Use-after-free in Google Chrome's DevTools component prior to 153.0.8010.36 enables a local attacker to escape the browser sandbox and execute arbitrary code at the host OS level via a crafted local program. Chromium's own severity rating is 'Medium', reflecting the local access prerequisite, while the CVSS 8.1 score captures the high-impact sandbox-escape outcome once exploitation succeeds. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the EPSS score (0.12%, 2nd percentile) confirms low observed exploitation probability.
Sandbox-escape via race condition in Google Chrome's Updater component on Windows allows a local, unprivileged attacker to execute arbitrary code outside the Chrome sandbox. Affected versions are all Chrome releases for Windows prior to 153.0.8010.36, fixed in the September 2026 stable channel update. No public exploit has been identified and EPSS sits at 0.10% (1st percentile), but successful exploitation yields full C:H/I:H/A:H impact beyond the sandbox boundary. Chromium's own rating of 'Medium' reflects the high attack complexity imposed by the race condition timing requirement.
Sandbox-escape code execution via a race condition in the Google Chrome Updater component on Windows allows a local attacker to execute arbitrary code outside the Chrome sandbox. Affected builds are all Chrome versions prior to 153.0.8010.36 on Windows. The Chrome Updater's elevated-privilege execution context makes winning the race condition particularly impactful, as successful exploitation bypasses sandbox containment entirely.
Remote code execution via unsafe Python pickle deserialization in the community.general Ansible collection's memcached fact cache plugin gives unauthenticated network-adjacent attackers full control of the Ansible controller. Despite documenting JSON as its storage format, the plugin delegates serialization entirely to python-memcached, which transparently pickles Python objects on write and unpickles them on read - a format that executes arbitrary Python code during deserialization. Because memcached has no native authentication and Ansible fact cache keys are derived from predictable hostnames, any attacker who can write to the target memcached instance can inject a malicious payload that executes when the controller next reads cached facts. No public exploit or CISA KEV entry has been identified at time of analysis.
Integer overflow leading to heap buffer overflow in GPAC's JPEG 2000 decoder filter allows arbitrary code execution when a user opens a crafted media file. The vulnerable computation in j2kdec_process() multiplies width, height, and component count without overflow checking, producing a truncated out_size that causes an undersized buffer allocation followed by an out-of-bounds write. SSVC exploitation status is 'poc' (proof-of-concept exists), though EPSS is low at 0.18%, indicating no widespread in-the-wild exploitation at time of analysis.
Remote code execution in functype-mcp-server 1.4.3 and earlier allows any MCP client - including an LLM agent manipulated via prompt injection - to execute arbitrary JavaScript in the server process by invoking the `set_functype_version` tool with a `file:`, `git+`, or URL package-alias as the version string. The server interpolates the unsanitized input directly into a `pnpm add` specifier, installs the attacker-controlled package as the `functype` alias, then immediately dynamic-imports `functype/cli` from the poisoned location, running module-level attacker code with full MCP server process privileges. A fully automated Docker-based proof-of-concept confirming end-to-end RCE is documented in GHSA-wcjj-9m6g-2fr2; no public exploitation has been confirmed (not in CISA KEV), and a patched version 1.4.4 is available.
Arbitrary code execution in Joker (the Clojure/ClojureScript linter) before v1.8.2 allows an attacker who controls files within a repository to execute arbitrary Clojure code on any developer or CI runner that lints that repository. The linter's directory-walking behavior automatically located and executed project-local `.jokerd/linter.*` files before processing any source file, treating attacker-controlled repository content as trusted configuration. Because editor integrations and CI pipelines commonly invoke `joker --lint` automatically on checked-out code, this creates a reliable developer-toolchain attack surface. No public exploit or CISA KEV listing has been identified; vendor-confirmed fix is available in v1.8.2.
Unauthenticated server-side request forgery in GeoNetwork OpenSource lets any anonymous user force the server to issue arbitrary outbound HTTP GET requests through the SLD tooling endpoint POST /api/tools/ogc/sld. Because the caller-supplied WMS server URL is fetched without validation and the response body is returned and stored when it is XML, the SSRF is non-blind — attackers can read back internal XML resources such as configuration files, bypass authorization boundaries, and map the internal network from an anonymous position. Patched versions 4.4.12 and 4.2.17 are available; there is no public exploit code identified at time of analysis and no confirmed active exploitation (not in CISA KEV).
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application deployment forms - enables a locally authenticated low-privileged user to inject and execute arbitrary operating system commands. Affected are Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with full confidentiality, integrity, and availability impact on the underlying host. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as currently none with non-automatable attack delivery.
Path traversal in Fortra GoAnywhere MFT versions prior to 7.10.2 allows authenticated Web Users to escape their sandboxed home directory and read arbitrary files from the server filesystem. Exploitation requires a Web User account provisioned with both Secure Folders and Secure Mail permissions - a role combination common in production deployments of this enterprise MFT platform. The CVSS scope-changed vector (S:C, C:H) correctly reflects that successful traversal breaks the intended sandbox boundary, exposing files outside the attacker's authorized directory tree. No public exploit code or CISA KEV listing is identified at time of analysis.
DNS rebinding SSRF in Open WebUI versions 0.9.6 through 0.11.0 allows authenticated users who control authoritative DNS to bypass hostname validation in SafePlaywrightURLLoader and reach internal services or cloud metadata endpoints. The flaw exists because Python validates the resolved hostname at check time, then the Playwright browser independently re-resolves the same hostname at use time - enabling an attacker to serve a public IP during validation and a private or link-local IP for the actual fetch. The issue is fixed in v0.11.1 by routing all fetches through the SSRF-safe requests session, eliminating the second resolution. No public exploit code or CISA KEV listing is present.
Server-side request forgery in Tanium Enforce allows authenticated low-privileged users to cause the Enforce server to issue arbitrary HTTP requests to internal network resources outside the application's normal authorization boundary. The CVSS scope change (S:C) and high confidentiality impact (C:H) reflect that a successful attack can expose internal services, cloud metadata endpoints, or backend infrastructure inaccessible to the attacker directly. Tanium disclosed and addressed this issue in advisory TAN-2026-036; no public exploit code or active exploitation has been identified at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows an unauthenticated network-positioned attacker to conduct man-in-the-middle attacks against both the Appliance (prior to 5.36.00.16) and Application (prior to 5.36.00.00) deployment forms, intercepting and potentially tampering with encrypted remote-support communications to achieve unauthorized access. Dell confirmed the vulnerability under advisory DSA-2026-382 with a CVSS 7.7 (High) rating; the AC:H metric reflects the MITM positioning prerequisite, which is the primary exploitation barrier. No public exploit code has been identified at time of analysis.
Privilege escalation in the Portworx Operator on Red Hat OpenShift (OCP) allows a low-privileged, namespace-scoped user to cause the operator to assign cluster-wide permissions beyond what the user was authorized to hold. The flaw (CWE-266, Incorrect Privilege Assignment) is constrained to the initial provisioning phase of a Portworx storage cluster, meaning the exploitation window is finite but deliberate timing by an insider or a compromised account could reliably hit it. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the CVSS 4.0 score of 7.7 reflects high confidentiality, integrity, and availability impact when the specific provisioning condition is met.
Local File Inclusion in the Eventin Event Calendar WordPress plugin (all versions through 4.1.22) allows authenticated attackers with custom-level WordPress access to include and execute arbitrary PHP files by supplying a crafted path via the unsanitized `event_layout` parameter in the plugin's event template and REST API endpoints. Successful code execution requires the attacker to first place a PHP file on the server - a two-stage exploit chain reflected in the CVSS AC:H rating. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported this with direct source code line references, indicating the attack surface is well-documented.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 enables a low-privileged authenticated remote attacker to inject arbitrary OS commands and escalate to full system control, achieving complete confidentiality, integrity, and availability compromise. Both the SCG 5.0 Appliance (fixed in 5.36.00.16) and SCG 5.0 Application (fixed in 5.36.00.00) variants are affected. No public exploit identified at time of analysis, and the high attack complexity (AC:H) suggests a specific condition or non-trivial technique is required beyond simple credential possession.
Local File Inclusion in the Eventin WordPress event management plugin (versions ≤4.1.22) allows authenticated contributors to include and execute arbitrary PHP files on the server via the unsanitized 'event_layout' parameter, achieving full remote code execution. The etn_manage_event capability is assigned to WordPress Contributors by default, meaning any registered Contributor can set the malicious parameter value through the REST API without any site-specific configuration change. Exploitation requires a PHP file to already be present on the server, reflected in the AC:H CVSS rating; no public exploit or CISA KEV listing has been identified at time of analysis.
Unauthenticated information disclosure in the Magefan Blog GraphQL extension for Magento 2 (magefan/module-blog-graph-ql, versions through 2.2.1) exposes blog commenter email addresses alongside internal customer and admin identifiers via a simple POST request to the /graphql endpoint. The blogComments GraphQL query resolver fails to enforce authorization checks on sensitive fields, allowing any remote unauthenticated actor to enumerate user data from affected Magento stores. No active exploitation is confirmed in CISA KEV, but SSVC rates the attack as automatable, and a researcher gist publicly documenting the issue is included in the references.
Unauthenticated remote denial-of-service in HPE Aruba ClearPass Policy Manager (CPPM) allows a network attacker to crash or degrade the web-based management interface without any credentials. Exploitation causes instability and sustained performance degradation on the CPPM server, potentially disrupting network access control policy enforcement across the environment. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated address deletion in Mageplaza GDPR for Magento 2 (versions through 4.2.9) allows any remote attacker to destroy saved customer addresses across an entire store via sequential GET requests. The Address Delete controller inherits from Magento 2's legacy base `Action` class rather than `AbstractAccount`, meaning no session authentication, address ownership check, or CSRF form-key validation is applied. A public proof-of-concept gist exists; no actively exploited (CISA KEV) status has been confirmed, but the trivial iteration attack vector makes this readily weaponizable against any merchant running the affected module.
Remote denial of service in the utcp OCaml TCP userspace library before version 0.0.6 is possible via crafted out-of-order TCP segment sequences that expose a flaw in the segment reassembly logic. Unauthenticated network attackers can exploit this against any service built on the affected library, causing complete availability loss. No public exploit code or active exploitation has been identified at time of analysis.
Authentication bypass in SSSD's OIDC/IdP provider allows an authenticated IdP user whose subject identifier is a strict lexical prefix of a target user's identifier to impersonate that target user on SSSD-protected Linux systems. The root cause is `eval_access_token_buf()` passing the attacker-controlled identifier's length to `strncmp()`, reducing an identity equality check to a prefix test. All Red Hat Enterprise Linux releases (6-10) and OpenShift Container Platform 4 are affected when SSSD is configured to use an OIDC-based identity provider; no public exploit has been identified at time of analysis.
Uncontrolled stack consumption in eprosima Fast DDS allows any unauthenticated participant in the same DDS domain to remotely crash target Fast DDS processes with a single crafted network message. The DDSSQLFilter component recursively parses the filterExpression field of SEDP DATA submessages during endpoint discovery; a sufficiently deeply nested expression drives unbounded recursion that exhausts the stack and terminates the target process. Vendor-released patches are available across all maintained branches; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in the Extensions subsystem of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive browser information by delivering a crafted Chrome extension that bypasses access control checks. The vulnerability is classified CWE-862 (Missing Authorization), meaning the runtime fails to enforce proper permission boundaries between extension capabilities and protected browser data. No public exploit code or active exploitation has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' reflects practical exploitation barriers not fully captured by the NVD CVSS 7.5 High rating.
SJRC F11 / SJ-GPS-PRO drones running firmware build 2019-09-17 expose an inetd service that spawns the helper binary /app/sh_for_telnet, giving anyone who can reach that port unauthenticated access to a shell and thus to sensitive data stored on the device (CWE-200). The flaw is remotely triggerable with no credentials or user interaction (CVSS 7.5, AV:N/PR:N/UI:N), but impact is limited to confidentiality — integrity and availability are unaffected. It is not listed in CISA KEV, EPSS is only 0.21% (11th percentile), and while a public GitHub advisory/repository documents the issue, no confirmed exploit code or in-the-wild activity was identified at time of analysis.
Incorrect authorization in Google Chrome's Permissions subsystem before version 153.0.8010.36 enables remote attackers to exfiltrate sensitive browser information through a crafted Chrome extension that requires social engineering to install. The flaw (CWE-863) causes Chrome's permission brokering layer to incorrectly authorize an extension's access to protected browser data, resulting in high-confidence confidentiality impact with no integrity or availability consequence. No public exploit has been identified and EPSS sits at 0.18%, consistent with the social-engineering prerequisite that constrains mass opportunistic exploitation.
Server-Side Request Forgery in Dell Secure Connect Gateway (SCG) 5.0 enables unauthenticated remote attackers to cause denial of service against both the Application and Appliance (Virtual Edition) deployment forms. The CVSS vector confirms fully unauthenticated network exploitation with no user interaction, targeting availability exclusively - confidentiality and integrity are unaffected. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile, and the CISA SSVC assessment lists exploitation status as none.