Path traversal in the key provider component of Red Hat Build of Keycloak allows a realm administrator to probe arbitrary filesystem paths by supplying crafted keystore parameters, revealing the existence and readability of server-side files. The vulnerability exists because a prior fix for path probing was incomplete, leaving a residual bypass in the keycloak-services library - the core engine shared by both Red Hat Build of Keycloak and Red Hat Single Sign-On 7. No public exploit code has been identified at time of analysis, and exploitation requires realm administrator credentials, materially limiting opportunistic attack surface.
SQL injection in the Mail Mint WordPress email marketing plugin (versions up to and including 1.31.0) allows authenticated attackers holding administrator-level access to extract sensitive records from the WordPress database via the REST API 'status' parameter. The root cause is a well-known $wpdb->prepare() misuse: the attacker-controlled $contact_filter_query fragment is concatenated into the SQL format string before prepare() is called, so prepare()'s placeholder sanitization never processes the injected content. REST API bodies parsed from php://input further bypass WordPress's automatic wp_magic_quotes() escaping, allowing raw double-quote characters to reach the SQL sink unescaped. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
Second-order SQL injection in the WP Crowdfunding WordPress plugin by Themeum (versions ≤2.2.1) enables authenticated shop managers to exfiltrate arbitrary database contents. The attack is split across two phases: the attacker writes a malicious payload once to the `wpneo_reward` post meta via the WooCommerce REST API, and the unsanitized value is then injected into a live SQL query on every subsequent public page view that renders the campaign rewards sidebar - making the extraction persistent and silent. No public exploit or KEV listing is identified at time of analysis, but the high confidentiality impact (C:H) and persistent execution model elevate practical risk beyond the CVSS 4.9 base score.
Cross-site scripting in OpenText Documentum Webtop versions prior to 16.7.1 allows an authenticated attacker to inject malicious scripts into the application that execute in a victim user's browser upon interaction with attacker-controlled content. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both a valid account and active victim engagement, constraining the realistic attack surface to insider threats or compromised accounts. No public exploit code or active exploitation has been identified at time of analysis.
Address bar spoofing in Google Chrome's CustomTabs feature on Android (prior to 153.0.8010.36) allows a remote attacker to display a falsified URL by leveraging a co-installed application on the victim's device. The flaw, rooted in CWE-451 (User Interface Misrepresentation of Critical Information), enables phishing attacks where users are deceived into believing they are visiting a trusted origin while interacting with attacker-controlled content. Chromium rates this 'Low' severity; EPSS is 0.16% (6th percentile), no public exploits are identified, and no active exploitation is confirmed.
Address bar spoofing in Google Chrome for Android (all versions before 153.0.8010.36) exploits incorrect certificate authorization logic (CWE-863), allowing a remote attacker who can deliver crafted network traffic - such as via a man-in-the-middle position - to cause the browser to display a false origin in the address bar. The primary risk is phishing: users who trust the spoofed address bar may submit credentials or sensitive data to an attacker-controlled endpoint. Chromium's own team rated this Low severity, consistent with its CVSS 4.8 score and AC:H rating; no public exploit code and no active exploitation have been identified, and the EPSS score of 0.12% (2nd percentile) confirms very low real-world exploitation probability at time of analysis.
Improper authorization in the ProxyHandler component of Samsung Android devices allows a locally-executing, low-privileged attacker to read proxy configuration without proper access controls. Devices running Android 14 through 17 are affected and patched in the SMR September 2026 release cycle. No public exploit code exists and no active exploitation has been identified; the CVSS 4.0 score of 4.8 accurately reflects the constrained local-only attack surface.
Out-of-bounds write in Samsung's libcodec2secevrcdec.so codec library exposes Samsung Mobile Devices running Android 14 through 17 to local memory corruption by low-privileged attackers. The flaw resides in a proprietary secure EVR codec decoder and was addressed in Samsung's SMR Sep-2026 Release 1. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds write in the Samsung-proprietary libsaviextractor.so library allows a local low-privileged attacker to corrupt memory on affected Samsung devices running Android 14 through 17. Exploitation requires code execution on the device with at minimum a standard user account, limiting the attack surface to malicious apps or post-compromise scenarios. Samsung has addressed the issue in SMR Sep-2026 Release 1; no public exploit or active exploitation has been identified at time of analysis.
Samsung Mobile Visual Voicemail for Android prior to version 20.1.00.05 improperly exports application components, allowing a co-installed malicious app on the same device to trigger outgoing calls without holding the required Android CALL_PHONE permission. The CVSS 4.0 score of 4.8 (AV:L/PR:L) accurately reflects the local-only, low-privilege attack surface. Samsung has released a patched build (20.1.00.05) in its September 2026 mobile security bulletin, and no public exploit code has been identified at time of analysis.
Permission control bypass in the Huawei HarmonyOS and EMUI Settings module allows an attacker with physical access to a device to read confidential data from a protected scope beyond the Settings component. The vulnerability affects HarmonyOS versions 4.0.0 through 4.3.3 and EMUI versions 14.0.0 through 16.0.0, as confirmed by Huawei PSIRT via the September 2026 security bulletin. The CVSS scope-change indicator (S:C) signals that successfully exploiting the flaw grants access to confidential resources outside the Settings module itself, though integrity and availability are unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored XSS in the decidim-elections Ruby gem (versions before 0.32.0) allows a process-scoped admin or election editor with question-management rights to persist arbitrary JavaScript in election question body fields, which subsequently executes in the browsers of all public visitors and voters accessing affected election pages. The root cause is the `question_title` helper in `application_helper.rb` returning `question.body` marked `.html_safe` without any sanitization boundary, bypassing Rails' automatic HTML escaping. No public exploit code and no active exploitation (CISA KEV) have been identified; the issue was discovered through a formal security audit commissioned by the Decidim Association.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer on Windows (prior to 153.0.8010.36) can expose limited memory content outside the Chrome sandbox to a remote attacker via a crafted HTML page. The vulnerability is platform-specific to Windows and requires user interaction to trigger, carrying a Chromium-assigned severity of Low and a CVSS score of 4.7. No public exploit or active exploitation has been identified; EPSS at 0.16% (6th percentile) confirms very low real-world exploitation probability, making this a routine patch priority rather than an emergency.
Insufficient entropy in the PRNG used by Dell Secure Connect Gateway (SCG) 5.0 allows a local low-privileged attacker to predict pseudo-random values - session tokens, authentication nonces, or cryptographic keys - generated by the system, ultimately enabling elevation of privileges. Both the virtual Appliance form factor (prior to 5.36.00.16) and the Application form factor (prior to 5.36.00.00) are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality-only CVSS vector (C:H/I:N) conflicts with the description's claimed elevation-of-privileges outcome, which warrants independent verification.
Improper authentication in Samsung's ActivityTaskManagerService allows local privileged attackers on affected Android devices to launch arbitrary activities, bypassing intended access controls. The flaw affects Samsung Mobile Devices running Android 14 through 17 and is addressed in the SMR Sep-2026 Release 1 patch. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 score of 4.6 reflects the constrained local-privileged attack surface.
LDAP injection in Dell Secure Connect Gateway 5.0 (both Appliance and Application variants) allows attackers to inject malicious LDAP query elements, leading to script injection against the underlying directory service. The CPE data confirms two distinct deployment forms are affected: the virtual Appliance (fixed at 5.36.00.16) and the Application (fixed at 5.36.00.00), both covered under Dell advisory DSA-2026-382. Critically, the description characterizes the attacker as unauthenticated, but the provided CVSS vector specifies PR:H - a direct contradiction that must be clarified with Dell before this vulnerability is triaged or deprioritized.
Hard-coded credentials embedded in Dell Secure Connect Gateway 5.0 (both Appliance and Application deployment forms) allow a remote attacker who discovers those credentials to authenticate without legitimate access and retrieve sensitive information. Dell advisory DSA-2026-382 confirms patches for both variants: Appliance fixed at 5.36.00.16 and Application at 5.36.00.00. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Hard-coded cryptographic key exposure in Dell Secure Connect Gateway (SCG) 5.0 enables remote information disclosure by allowing an attacker who extracts the embedded key to decrypt protected communications or data stores. Both the Appliance (versions prior to 5.36.00.16) and Application (versions prior to 5.36.00.00) variants of SCG 5.0 are affected per Dell advisory DSA-2026-382. No public exploit code has been identified at time of analysis, and the vendor has released patches.
Unauthorized remote access to Dell Secure Connect Gateway 5.0 is enabled by a hard-coded cryptographic key embedded in both the Appliance and Application editions. An attacker who extracts this key - through binary analysis of the software - can leverage it to gain unauthorized access to protected resources, bypassing the confidentiality controls the cryptographic layer is intended to enforce. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, but a vendor patch has been issued under Dell DSA-2026-382.
Incorrect authorization in Cyrus IMAP's JMAP snooze feature allows an authenticated low-privileged user to bypass destination-mailbox ACL checks, inserting mail into another user's inbox or any mailbox whose ID is known - even when the attacker holds no insert permissions on that target mailbox. Affected versions are prior to 3.12.4, 3.10.4, and 3.8.8. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Remote code execution via subscriber-level authorization bypass in the Checkout Custom Fields Builder for WooCommerce WordPress plugin (all versions ≤1.1.5) allows any authenticated subscriber to install an arbitrary attacker-hosted PHP plugin and achieve full server compromise. The plugin registers AJAX endpoints for plugin installation and activation without enforcing WordPress capability checks, and the required nonce is emitted directly into all admin pages visible to subscribers when WooCommerce is inactive - making the exploit trivially accessible to any registered user. No public exploit code has been identified, but the low authentication barrier and clear exploit path represent a critical risk on multi-user WordPress sites.
SQL injection in PbootCMS versions 3.2.0 through 3.2.5 lets any authenticated backend user inject crafted parameters into the User/mod interface to rewrite arbitrary fields — including password hashes and role assignments — of other accounts, resulting in full account takeover. The flaw requires only a low-privileged login (CVSS PR:L) and no victim interaction, so a single compromised or low-privilege account can be escalated into administrative control of the CMS. Exploitation is easy (AC:L) but real-world urgency is tempered: no CISA KEV listing, an EPSS score of just 0.32% (25th percentile), and a public GitHub repository tied to the CVE identifier that suggests exploit code may be circulating.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Missing authorization in Google Chrome's Browser component (prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions via a crafted HTML page. The CWE-862 root cause - an absent authorization check rather than a broken one - means the Browser component fails to enforce expected access control boundaries when processing certain HTML content. Chromium rated this 'Medium' severity, consistent with the CVSS 4.3 score reflecting limited integrity-only impact and a requirement for user interaction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Cross-origin data disclosure in Google Chrome's WebGL subsystem (all versions prior to 153.0.8010.36) enables remote attackers to read residual GPU memory belonging to other origins by serving a crafted HTML page to an unpatched user. The root cause is CWE-908 (use of uninitialized resource): Chrome's WebGL implementation exposed GPU-side buffers to JavaScript before zeroing them, allowing fragments of prior rendering operations from cross-origin contexts to be read back. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.29%, consistent with the Medium Chromium severity rating and the limited, read-only impact.
Authorization bypass in the Eventin event management plugin for WordPress (all versions ≤ 4.1.22) enables attackers to fraudulently claim paid tickets, mark unprocessed orders as completed, deplete ticket inventory, and trigger confirmation emails - all without making payment. While the formal CVSS vector assigns PR:L (subscriber-level access), the CVE description explicitly confirms a fully unauthenticated exploitation path: the wp_rest nonce is emitted on every frontend page, and the order creation endpoint issues an order_access_token to any caller possessing that nonce, granting anonymous users the credential material to invoke the privileged update_booking_status branch. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch changeset is referenced in the WordPress plugin repository.
Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.
Authorization bypass in WP Recipe Maker for WordPress (all versions ≤10.8.0) allows authenticated contributors to manipulate admin-authored recipe content without authorization. Specifically, any contributor-level user can unpublish any admin recipe by overwriting its post_status to draft or pending, and - when the plugin's recipe_use_author setting is configured as 'parent' - can additionally claim ownership of that recipe by substituting their own user ID into post_author. The vulnerability stems from missing authorization checks in the recipe-save code path. No public exploit has been identified and the CVE is not listed in CISA KEV.
Web origin policy bypass in Google Chrome's Loader component (versions prior to 153.0.8010.36) lets a remote attacker circumvent same-origin protections by serving a crafted HTML page, potentially reading cross-origin resources the attacker should not have access to. The CVSS score of 4.3 and Chromium's own 'Medium' severity rating are consistent, reflecting a confidentiality-only impact with no integrity or availability consequence and no sandbox escape. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS places exploitation probability at 0.26% (18th percentile), indicating low real-world exploitation likelihood.
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. No active exploitation has been confirmed and EPSS remains low at 0.26%, indicating this is currently a theoretical risk addressed by the September 2026 stable channel update.
Input data manipulation is possible in the Yordam Informatics Library Reservation System before v22.2 due to a missing authentication check on a critical function (CWE-306), reachable over the network by low-privileged authenticated users. The flaw enables integrity violations - altering reservation records or system data - without requiring elevated privileges or user interaction. Reported by TR-CERT; no public exploit code or active exploitation has been identified at time of analysis.
LocalNetworkAccess missing authorization in Google Chrome before 153.0.8010.36 allows a renderer-compromised attacker to bypass Chrome's Private Network Access (PNA) restrictions via a crafted HTML page, enabling unauthorized requests to private network resources. This is a chained second-stage capability (CWE-862): the attacker must already control the renderer process before this bypass is reachable. No public exploits have been identified and EPSS sits at 0.25% (16th percentile), consistent with the significant chained-attack prerequisite; Chromium's own 'Medium' severity rating aligns with the CVSS 4.3 score.
Authenticated subscriber-level users on WordPress sites running the Awesome Support plugin through version 6.3.9 can invoke the unguarded wpas_do_mr_deny_user() function to permanently set the mr_user_denied flag on any account in the moderated registration queue-including administrator accounts-without holding the edit_users capability. The attack also dispatches a denial notification email to the victim, enabling targeted harassment or lockout of admin registrations. No public exploit or KEV listing has been identified at time of analysis; Wordfence is the reporting source.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Cross-origin data disclosure in Google Chrome's Extensions subsystem before version 153.0.8010.36 allows a remote attacker to obtain data from origins other than those the victim is currently browsing, contingent on successfully social-engineering the victim into installing a crafted malicious extension. The Chromium security team rated this Medium severity, consistent with the CVSS 4.3 score, and the EPSS probability of 0.23% confirms minimal current exploitation interest. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.
Incorrect authorization in Chrome's Web Workers component enables remote unauthenticated attackers to bypass the browser's same-origin policy (web origin isolation) by inducing a victim to visit a crafted HTML page. All Google Chrome desktop versions prior to 153.0.8010.36 are affected. The impact is confined to partial cross-origin data read (C:L), with no integrity or availability consequences; no public exploit code and no active exploitation have been identified at time of analysis.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate private mailboxes belonging to other users and read shared mailbox annotation values. By crafting conditional Sieve filter scripts using `fileinto` branches and observing delivery outcomes during LMTP processing, an attacker can infer the existence of otherwise inaccessible mailboxes or annotation content through a side-channel. No public exploit exists and the vulnerability is not listed in CISA KEV; the EPSS risk is commensurately low, reflecting a medium-severity information disclosure limited to authenticated insiders.
Incorrect authorization in Chrome's Paint rendering component (versions prior to 153.0.8010.36) allows a remote attacker to read cross-origin data by directing a user to a crafted HTML page. The flaw (CWE-863) bypasses same-origin policy enforcement within the Paint subsystem, exposing rendered or pixel-level data from other origins to the attacking script. No public exploit has been identified and EPSS is low (0.22%), though Chromium's own 'High' severity rating substantially exceeds the NVD-assigned CVSS 4.3, signaling that the vendor considers the cross-origin data exposure more consequential than the base score reflects.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Out-of-bounds read in the mirage-crypto-ec OCaml cryptographic library (versions before 2.3.0) allows low-privileged network attackers to crash or disrupt services that parse compressed elliptic curve public keys. The flaw arises from insufficient bounds checking during compressed EC point deserialization, classified under CWE-125. No public exploit has been identified at time of analysis; a vendor-released patch is available in version 2.3.0.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Unauthorized token deletion in the Reviso Exporter for WooCommerce WordPress plugin (≤1.2.3) allows any authenticated subscriber-level user to permanently delete the plugin's stored Reviso Agreement Grant Token via an unprotected AJAX action, severing the WooCommerce-to-Reviso accounting service integration. The vulnerability stems from the `disconnect_callback()` function registered to `wp_ajax_wcefr-disconnect` performing no capability check and no nonce verification, meaning any logged-in WordPress user - including those with the lowest default role - can trigger it. No public exploit code is identified at time of analysis, and a vendor-released patch exists as of version 1.2.4.
Improper access control (CWE-863) in Tanium Server allows authenticated low-privilege users to impact platform availability without the required authorization. Affecting three active version branches (7.7.3, 7.8.2, and 7.8.4), the flaw was self-reported and patched by Tanium under advisory TAN-2026-031. No public exploit code or active exploitation has been identified at time of analysis.