Improper access control in Samsung's Collection app on Android allows local unprivileged attackers to read sensitive information stored by the application. Affected versions are Collection prior to 1.0.1.14 on Android 15 and prior to 2.0.02.7 on Android 16. The flaw is limited to local access (AV:L) but requires no privileges, suggesting an exported Android component - such as a Content Provider, Activity, or Service - is reachable by any co-resident app without proper permission enforcement. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Out-of-bounds read (CWE-125) in the HarmonyOS graphics module affects version 6.1.0 across multiple device categories including smartphones, wearables, and laptops. A local attacker without special privileges can trigger the flaw to cause partial availability loss, limited information disclosure, or a crash of the graphics subsystem. No public exploit code or active exploitation has been identified at time of analysis, and Huawei has released a security bulletin addressing the issue.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, network-positioned attacker to intercept TLS-protected communications via a man-in-the-middle attack, bypassing the TLS protection mechanism and exposing high-confidentiality data. Both the Appliance form factor (versions prior to 5.36.00.16) and the Application form factor (versions prior to 5.36.00.00) are affected. No public exploit or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Race condition in Dell Secure Connect Gateway (SCG) 5.0 allows unauthenticated remote attackers to trigger denial of service against both the Appliance and Application deployment variants by exploiting improper synchronization of shared resources under concurrent access (CWE-567). Affected versions are Appliance prior to 5.36.00.16 and Application prior to 5.36.00.00, with fixes detailed in Dell advisory DSA-2026-382. Notably, the vendor-supplied CVSS 3.1 vector records C:L/A:N, which conflicts with the stated denial-of-service impact - a likely metadata error, as availability impact is the primary concern here. No public exploit code or active exploitation has been confirmed at time of analysis.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 enables a network-positioned unauthenticated attacker to intercept encrypted communications via a man-in-the-middle attack, bypassing TLS-based trust mechanisms. Both the appliance form factor (versions prior to 5.36.00.16) and the virtual/application form factor (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 5.9 Medium rating reflects the high attack complexity imposed by the MITM positioning requirement.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 permits a local, low-privileged attacker to execute arbitrary OS commands on the affected host, potentially exposing sensitive configuration data and credentials stored on the appliance. Both physical Appliance deployments (prior to 5.36.00.16) and software Application deployments (prior to 5.36.00.00) are affected, as confirmed in Dell advisory DSA-2026-382. No public exploit code or active exploitation has been identified; Dell has released corrective patches for both form factors.
Read-only enforcement bypass in Amazon awslabs mysql-mcp-server (versions ≤ 1.0.21) enables context-dependent actors - including AI models or users interacting via the Model Context Protocol - to reach file-read and file-write SQL execution paths that the mutable SQL detector is designed to gate. The detector relies on a regex engine that does not treat SQL inline comments as whitespace, allowing crafted queries containing comment tokens to pass the allowlist check while MySQL parses and executes the full underlying write or file-access statement. No public exploit has been identified at time of analysis; AWS has released a fix in version 1.0.23.
Exploitation of a TOCTOU race condition in Dell Secure Connect Gateway (SCG) 5.0 - both the Appliance and Application variants - allows a remote unauthenticated attacker to cause denial of service, with marginal confidentiality and integrity impact as reflected in the CVSS vector (C:L/I:L/A:L). The High Attack Complexity rating (AC:H) indicates reliable exploitation requires precise timing to win the race between the check and use operations. No public exploit code or CISA KEV listing has been identified, placing this in the category of a vendor-disclosed race condition with moderate real-world exploitability.
JWT signature verification bypass in Dell Secure Connect Gateway 5.0 enables remote unauthenticated attackers to forge or tamper with cryptographically signed tokens, bypassing the product's authentication protection mechanisms. Both the Appliance variant (versions prior to 5.36.00.16) and Application variant (versions prior to 5.36.00.00) are affected. No public exploit code or active exploitation has been identified at time of analysis; Dell has released patches under advisory DSA-2026-382.
Improper certificate validation in Dell Secure Connect Gateway (SCG) 5.0 allows a remote, unauthenticated attacker in a network-adjacent MITM position to bypass TLS protection mechanisms, potentially intercepting and altering communications between the SCG appliance or application and remote endpoints. Both deployment forms are affected - the physical/virtual appliance (versions prior to 5.36.00.16) and the software application (versions prior to 5.36.00.00). No public exploit or KEV listing exists; this is a medium-severity finding under CVSS 5.6 with high attack complexity reflecting the MITM positioning requirement.
Stack-based buffer overflow in Samsung's PROCA (Process Authenticator) TrustZone trustlet allows a local privileged attacker to write out-of-bounds memory, resulting in high-confidentiality impact against affected Samsung Mobile Devices running Android 14 through 17. The flaw is patched in SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified; the CVSS 4.0 score of 5.6 reflects the significant exploitation barriers - local access, high privileges, high complexity, and specific prerequisite conditions all required simultaneously.
Command injection in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application variants - permits unauthenticated remote attackers to perform script injection via network-accessible interfaces. The vulnerability is classified under CWE-77 (Improper Neutralization of Special Elements in a Command), though Dell's own CVSS scoring constrains the impact to limited confidentiality exposure (C:L, I:N, A:N), suggesting the injected scripts are not fully executed as OS-level commands but rather reflected or partially evaluated. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing authentication on the AJAX `addCategory` endpoint in Rizwan17's PHP inventory-management-system allows any unauthenticated remote attacker to invoke category management operations by manipulating the `userid` argument in `includes/process.php`. The CWE-287 root cause means the authentication gate is simply absent rather than bypassable through a logic flaw. A public exploit has been released, the maintainer has not responded to the responsible-disclosure issue, and no patch exists at time of analysis.
SQL injection in Rizwan17's inventory-management-system PHP application exposes the update_record() function in includes/manage.php to unauthenticated remote exploitation via unsanitized parameters (update_category, cid, update_brand, update_product). Exploit code is publicly available per the CVSS 4.0 E:P modifier and a VulDB submission, though the project is a small hobby-tier GitHub application with negligible production footprint. The maintainer was notified via a GitHub issue but has not responded, and no patch exists.
Missing authorization in Google Chrome's TrustedWebActivities (TWA) component on Android prior to version 153.0.8010.36 allows a local attacker to obtain sensitive information through a co-installed malicious application. The vulnerability stems from CWE-862 (Missing Authorization), where the TWA implementation fails to enforce adequate access controls between co-installed apps and Chrome's protected data. No public exploit code has been identified and the EPSS score places this at the 5th percentile, but the confidentiality impact is rated high given Chrome's potential access to session data, credentials, and browsing context.
Sensitive data written to log files in Dell Secure Connect Gateway (SCG) 5.0 is readable by low-privileged local users, resulting in high-confidence confidentiality exposure. Affected products are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00, with a vendor-released patch available under advisory DSA-2026-382. No public exploit code exists and no active exploitation has been identified at time of analysis.
Permission control bypass in HarmonyOS 6.1.0's app lock module allows a local low-privileged user to circumvent locking protections and read content belonging to locked applications. The flaw is rooted in CWE-264, indicating improper enforcement of permission restrictions within the module. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the C:H CVSS impact signal indicates full confidentiality exposure to locked app data once exploited locally.
Denial of service in Wings3D v.2.4.1 allows a local attacker to crash the application by convincing a user to open a specially crafted Wavefront OBJ file. The vulnerability is availability-only, with no confidentiality or integrity impact, and requires user interaction to trigger. No public exploit code or active exploitation has been identified at time of analysis.
Denial-of-service via unvalidated kernel pointer in the Thesycon DPC Latency Checker Windows driver (dpc.sys) through version 1.4.0 allows any local unprivileged user to crash the host system. The driver's IOCTL handler at code 0x81772008 accepts a user-supplied pointer, dereferences it without validation, and passes the resulting value to the kernel API ExSetTimerResolution - causing an arbitrary kernel memory access that triggers an immediate BSOD. No public exploitation in the wild or CISA KEV listing has been identified, but a public researcher writeup with supporting materials exists on GitHub.
Path traversal in LF Edge eKuiper's plugin installation endpoint (POST /plugins/*) allows high-privileged management API users to delete arbitrary files and directories on the host by embedding traversal sequences such as `../../` in the plugin `name` parameter. Affected versions are all eKuiper releases prior to 2.4.1 (Go module github.com/lf-edge/ekuiper/v2). A proof-of-concept is published in the GitHub security advisory GHSA-c23q-fw86-9h5x, demonstrating deletion of arbitrary host paths via `os.RemoveAll`; the advisory explicitly confirms exploitation is bounded to file deletion only - no code execution, file creation, or data exfiltration is achievable.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
OS command injection in Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to inject and execute scripts, resulting in high confidentiality impact. Affected are SCG 5.0 Appliance versions prior to 5.36.00.16 and SCG 5.0 Application versions prior to 5.36.00.00. No public exploit code has been identified at time of analysis, and there is no CISA KEV listing.
Sensitive information exposure in Dell Secure Connect Gateway (SCG) 5.0 - both Appliance and Application deployment variants - results from debugging code retained in production builds that exposes confidential data to locally authenticated low-privileged users. The flaw covers Appliance versions prior to 5.36.00.16 and Application versions prior to 5.36.00.00, with patches available under Dell Security Advisory DSA-2026-382. No public exploit code or active exploitation has been identified at time of analysis.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
Safebrowsing in Google Chrome prior to 153.0.8010.36 contains improper state validation (CWE-754) that allows a remote, unauthenticated attacker to bypass system access restrictions enforced by the Safe Browsing subsystem via a specially crafted HTML page. The bypass yields partial confidentiality and integrity impact (C:L/I:L) but no availability impact, consistent with circumventing protective filtering rather than achieving code execution. No active exploitation has been confirmed - EPSS is 0.24% (15th percentile) and the CVE is absent from CISA KEV - and Chromium's own severity assessment of 'Medium' aligns with the CVSS 5.4 score.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 expose a CWE-377 insecure temporary file flaw that a low-privileged remote attacker can exploit to cause denial of service and tamper with data. The vulnerability stems from unsafe temporary file handling - likely predictable naming or insecure permissions - enabling race-condition or symlink attacks against the storage platform. No public exploit or CISA KEV listing has been identified; Dell has released patches in the 9.13.1.1 and 9.15.0.0 branches.
UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. This is a phishing-class attack vector: by hijacking the fullscreen rendering to simulate trusted UI (OS dialogs, address bar, lock icons, or other sites), an attacker can deceive users into performing unsafe actions or disclosing credentials. No public exploit has been identified and EPSS is 0.22%, reflecting low near-term exploitation probability.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
Authorization bypass in Eventin - Event Calendar plugin for WordPress (all versions ≤4.1.17) allows authenticated subscriber-level users to fully manage notification flow automation workflows restricted to administrators. Exploitation requires only a low-privilege WordPress account, enabling unauthorized read, create, update, clone, and delete operations on event automation configurations. No public exploit or KEV listing identified; vendor-released patch 4.1.18 resolves the flaw.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper access controls in Tanium Comply (CWE-862, Missing Authorization) allow authenticated low-privileged users to perform unauthorized actions affecting the integrity and availability of the compliance module. Three active release branches are affected - 2.32.x, 2.35.x, and 2.37.x - with vendor-issued patches available for each. No active exploitation has been identified and no public proof-of-concept exists at time of analysis.
Improper access controls in Tanium Comply allow authenticated low-privileged users to perform unauthorized actions affecting integrity and availability via CWE-639 (Authorization Bypass Through User-Controlled Key). Affected versions span three active release branches: 2.32, 2.35, and 2.37, each with specific fixed builds. Tanium has released patched versions and no active exploitation or public exploit code has been identified at time of analysis.
Tanium Comply contains an improper access control vulnerability (CWE-639, Authorization Bypass Through User-Controlled Key) that allows authenticated low-privileged users to perform unauthorized integrity-affecting or availability-impacting actions against compliance data by manipulating user-controlled object references. Affected branches span three minor release lines (2.32, 2.35, 2.37) with fixed versions available. No public exploit code and no CISA KEV listing are present at time of analysis, consistent with the medium CVSS score of 5.4. The vendor (Tanium) self-reported and released patches across all affected branches.
Incorrect authorization in Chrome's Isolated component (all versions prior to 153.0.8010.36) enables remote attackers to spoof UI elements by directing users to a crafted HTML page. The flaw stems from CWE-863 authorization failures within Chrome's isolation architecture, allowing cross-boundary deception without requiring attacker authentication. No public exploit exists and EPSS is 0.17% (6th percentile), placing this firmly in the routine-patching tier despite the network-accessible attack vector.
Incorrect authorization in Chrome's Loader component allows a remote attacker to bypass system access restrictions with limited confidentiality and integrity impact. Affected versions are all Chrome releases prior to 153.0.8010.36, and exploitation requires user interaction via a crafted HTML page combined with social engineering. No public exploit or active exploitation (CISA KEV) has been identified; the EPSS score of 0.17% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a low-priority issue relative to the broader Chrome vulnerability landscape.
Stored XSS in money-pos 1.0 allows a low-privileged attacker with product-creation access to inject malicious JavaScript into order log entries via an unsanitized goodsName parameter during return processing. The payload persists server-side and executes in the browser of any administrator who views the order logs, because the Vue.js frontend renders the log description through v-html without sanitization. No public exploit code has been identified at time of analysis, and EPSS at 0.16% signals negligible automated exploitation probability.
UI spoofing in Google Chrome's Passwords component on Android (prior to 153.0.8010.36) enables a remote attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. The CVSS 5.4 (Medium) rating contrasts with Chromium's own 'Low' severity classification, a common divergence for UI-redressing issues. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS of 0.16% (6th percentile) confirms negligible near-term exploitation probability.
Bluetooth Classic L2CAP channel state confusion in Zephyr RTOS (versions 1.6.0 through pre-4.4.2) enables an adjacent unauthenticated peer to inject data PDUs into half-open L2CAP channels before configuration or security handshaking completes, forcing processing on stale or uninitialized channel fields. In the worst case, reused channel objects expose dangling _sdu reassembly buffer pointers, creating a memory-safety condition that causes channel and link teardown (denial of service) alongside unintended delivery of attacker-controlled data to upper-layer protocol handlers. No public exploit has been identified and the flaw is absent from CISA KEV; a vendor-released fix is available via Zephyr commit 2738ee9, targeting release 4.4.2.
SQL injection in Dell Secure Connect Gateway (SCG) 5.0 allows a remote attacker holding low-privilege credentials to execute unauthorized SQL commands against the product's backend database. Both the Appliance variant (prior to 5.36.00.16) and the Application variant (prior to 5.36.00.00) are affected, with confirmed limited confidentiality and integrity impact but no availability consequence. No active exploitation or public proof-of-concept has been identified at time of analysis; Dell has released patched versions under advisory DSA-2026-382.
Stored cross-site scripting in the announcement preview component of REBUILD 4.4.3 allows an authenticated user who can author announcement content to run arbitrary JavaScript in the browsers of anyone who views the affected announcement — potentially including the dashboard, activity feed, or login page depending on the announcement's visibility settings. The server correctly HTML-escapes the announcement body, but the client-side preview code reverses those escapes via jQuery's html().text() chain and then re-injects the decoded string into the DOM, defeating the server-side defense. No public exploit code has been identified and the vulnerability is not in CISA KEV; EPSS is very low at 0.15% (4th percentile), indicating limited expected mass exploitation.
Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.