Snipe-IT through version 8.6.4 exposes protected component inventory data to any authenticated user holding only the assets.view permission via a missing authorization check on the GET /api/v1/hardware/<asset-id>/assigned/components REST API endpoint. The components.view permission is incorrectly applied only to the available_actions.view flag in the API response rather than to the underlying component data, allowing enumeration of component IDs, names, assigned quantities, and notes that the permission model is designed to restrict. Vendor-released patch 8.7.0 resolves the issue; no public exploit code or active exploitation has been identified at time of analysis.
Missing authorization on the POST /hardware/history endpoint in Snipe-IT before 8.7.0 allows any authenticated user to reassign arbitrary assets and inject fabricated entries into audit logs. By submitting a crafted CSV payload, a low-privileged attacker can silently transfer assets across organizational boundaries and corrupt the audit trail, undermining inventory accountability and chain-of-custody integrity. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though exploitation is trivially automatable for any authenticated account.
License key exposure in Snipe-IT before 8.7.0 allows any authenticated low-privilege user to bypass the viewKeys authorization gate and retrieve all product license keys stored in the system. Two distinct exploitation paths exist: bulk extraction via the CSV export endpoint and a key-validation oracle via observable API response discrepancies, making CWE-204 an accurate root-cause classification for the latter. No public exploit code or CISA KEV listing exists at time of analysis; the patch is available in version 8.7.0.
Server-side request forgery in Lara Dashboard 0.9.2-1.3.1 allows any authenticated content editor to proxy arbitrary HTTP requests through the application server via the markdown fetch API endpoint, with the server returning response bodies verbatim to the caller. The POST /api/admin/builder/markdown/fetch endpoint validated only URL format (not destination host), enabling requests to internal services and cloud metadata endpoints such as AWS IMDSv1 at 169.254.169.254, which can yield IAM role temporary credentials. No public exploit identified at time of analysis; vendor-released patch is available in v1.3.2.
Siyuan note-taking application before v3.8.2 leaks private block content to authenticated readers through two export/preview API endpoints that skip publish-access validation when resolving embedded block references. Any user holding reader-level credentials can craft requests to /api/export/preview or /api/lute/copyStdMarkdown referencing public documents whose embed queries target private, hidden, or publish-disabled blocks, receiving their full rendered content. No public exploit code or CISA KEV listing has been identified, but exploitation requires only reader authentication and standard HTTP tooling.
Permanent image data destruction in Snipe-IT ≤8.6.3 results from unchecked return values on Laravel storage operations in ImageUploadRequest::handleImages(). When any authenticated user submits an image upload while the configured storage backend (S3, local filesystem, NFS) experiences a transient failure, the silently-returned false from Storage::put() is ignored - the prior image is deleted, and the database record is updated to reference a file that was never written. A symmetric defect in deleteExistingImage() compounds the problem by nulling the model's image field even when Storage::delete() fails, orphaning files on disk. The condition affects all image-carrying models routed through this handler and produces unrecoverable data loss requiring manual reconciliation. No public exploit has been identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows attackers to trigger silent data corruption or JVM crashes by closing a Zstandard dictionary after it has been associated with a stream or context. The library's locking design released the dictionary's shared lock immediately after the load call, leaving the stream holding a native pointer to freed memory; subsequent read or write operations on that stream then access freed native heap, producing undefined behavior at the JVM/native boundary. No public exploit has been identified at time of analysis, and a patched release (v1.5.7-14) is available with two upstream commits.
Certificate hostname validation failure in Dell Secure Connect Gateway (SCG) 5.0 enables an unauthenticated remote attacker positioned as a network man-in-the-middle to present a valid TLS certificate for a different host, defeating the connection's trust model and gaining unauthorized access to intercepted communications. Both the Appliance variant (prior to 5.36.00.16) and Application variant (prior to 5.36.00.00) are confirmed affected per Dell DSA-2026-382. No public exploit or CISA KEV listing has been identified at time of analysis; the AC:H CVSS metric reflects the non-trivial network positioning prerequisite.
OS command injection in Tanium Enforce enables a local attacker to execute arbitrary operating system commands at the privilege level of the Enforce agent process. The flaw (CWE-78) requires user interaction and specific exploitation preconditions, reflected in a CVSS 7.0 score despite full C:H/I:H/A:H impact ratings. Tanium self-disclosed the issue via advisory TAN-2026-022; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Use-after-free in zstd-jni versions 1.3.8-4 through 1.5.7-13 allows callers to invoke setDict, setLongMax, setLevel, and setRefMultipleDDicts on already-closed stream objects, writing through freed native (JNI) pointers into arbitrary JVM memory. The root cause is missing closed-state validation in stream classes such as BaseZstdBufferDecompressingStreamNoFinalizer and ZstdInputStreamNoFinalizer, meaning the JNI layer operates on native context structures that have already been released. Exploitation can corrupt unrelated heap objects or terminate the JVM process entirely. No public exploit code or CISA KEV listing is identified at time of analysis.
Unauthenticated information disclosure in AlchemyCMS affects all 7.x versions before 7.4.16 and all 8.x versions before 8.3.6 via the GET /api/nodes REST endpoint, which returned the full navigation node dataset without any authorization check. Any network-reachable attacker could enumerate restricted page names, internal URL paths, and cross-site navigation structures across all languages. No public exploit identified at time of analysis, but the attack requires only a single unauthenticated HTTP request, making automated scanning trivial.
Relative path traversal in Ragic Enterprise Cloud Database enables privileged remote attackers to read arbitrary files from the underlying server filesystem. Exploitation requires high-privilege authenticated access (PR:H per the CVSS 4.0 vector AV:N/AC:L/AT:N/PR:H), meaning an attacker must first hold or compromise an elevated account within the platform before leveraging the traversal to exfiltrate sensitive system files. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis; the vulnerability was disclosed via TWCERT advisories.
Snipe-IT before version 8.7.0 permanently destroys its database when a superuser uploads a corrupted or invalid ZIP archive to the backup restore endpoint, because the wipe operation executes before input validation occurs. The root cause is a validate-after-act ordering flaw (CWE-460): the restore workflow irreversibly clears the database first, then attempts to parse the archive - leaving no rollback path on failure. Exploitation requires superuser privileges and deliberate file upload (CVSS 4.0 PR:H/UI:P), but the consequence is total, unrecoverable data loss for the affected Snipe-IT instance.
Information disclosure in Siyuan note-taking software before v3.8.2 allows unauthenticated publish-mode readers to probe the existence and quantity of private or unpublished content via the full-text search API. The POST /api/search/fullTextSearchBlock endpoint correctly withholds actual block content from hidden documents but leaks unfiltered match counts - the number of matching blocks and pages - enabling attackers to use the search API as an oracle to systematically map the structure of private content without ever seeing it. No public exploit code has been identified at time of analysis, and the vendor has released a patch in v3.8.2.
Null pointer dereference in mrubyc through 4.0.0 allows an attacker who can supply untrusted .mrb bytecode to crash any application embedding the VM. The op_enter() handler in src/vm.c fails to validate execution context before dereferencing, and OP_ENTER instructions placed at the top level of a crafted bytecode file - where no call frame exists - trigger the dereference and terminate the embedding application. No public exploit or active exploitation has been identified at time of analysis, and real-world risk is bounded by the requirement to feed attacker-controlled bytecode to the target application.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle parsing library affects Samsung Mobile Devices running Android 14 through 17, exploitable by a local attacker who induces the device owner to open or play media containing a maliciously crafted subtitle track. The flaw carries a high integrity impact rating consistent with a memory-corruption primitive capable of enabling code execution within the media processing context, patched in the SMR Sep-2026 Release 1 monthly security update. No public exploit code or active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Samsung's libsubextractor.so subtitle processing library allows local attackers to corrupt memory by exploiting improper input validation when removing style tags from subtitle content. Affected devices run Android 14 through 17 and are fixed in SMR Sep-2026 Release 1, disclosed through Samsung's monthly security bulletin. No public exploit identified at time of analysis, though the integrity impact is rated high (VI:H in CVSS 4.0), suggesting realistic potential for privilege escalation or code execution if chained with further exploitation.
Out-of-bounds write in libsavscmn.so, a shared library component of Samsung One UI, enables local attackers holding low-level user privileges to execute arbitrary code on affected devices. All Samsung devices running One UI prior to version 8.5 are in scope, with the fix delivered in the September 2026 One UI 8.5 security update as documented in Samsung Mobile's bulletin. No public exploit code or active exploitation has been identified at the time of analysis, and the vulnerability is not listed in CISA's KEV catalog.
Improper export of Android application components in Samsung Bixby Touch prior to version 4.3.01.17 allows any co-installed application on the same device to access sensitive information without requiring special Android permissions. The vulnerability stems from one or more app components being declared exported in the application manifest without enforcing appropriate permission checks, giving locally present adversarial apps direct access to data the Bixby Touch service handles. Samsung Mobile has released a patched version (4.3.01.17) via its monthly security bulletin; no public exploit or active exploitation has been identified at time of analysis.
Improper access control in Samsung SystemUI prior to SMR Sep-2026 Release 1 permits any locally-executing attacker without elevated privileges to launch arbitrary Android activities on affected devices. Samsung Mobile Devices running Android 14 through 17 are affected, with the fix delivered in the September 2026 Monthly Security Release. No public exploit code or active exploitation has been identified at time of analysis.
Improper access control in Samsung's Link to Windows Android application allows a local attacker to establish an unauthorized connection with a paired Windows PC, silently bypassing the user-consent step required for pairing. Affected Samsung Mobile Devices run Android 14 through 17 with the Link to Windows app prior to SMR Sep-2026 Release 1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the local attack vector substantially constrains real-world exposure to physical or on-device access scenarios.
Out-of-bounds write in libsthmbc.so affects Samsung Mobile devices running One UI prior to version 8.5, allowing local low-privilege attackers to corrupt memory beyond allocated buffer boundaries. The CVSS 4.0 vector assigns high confidentiality impact (VC:H), indicating the write primitive can be leveraged to read or expose sensitive adjacent memory content. No public exploit has been identified at time of analysis, and Samsung has shipped a fix in the One UI 8.5 security update.
Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows a local low-privileged attacker to corrupt memory beyond allocated buffer boundaries, resulting in high confidentiality impact and minor integrity and availability effects. The CVSS 4.0 vector (AV:L/PR:L/UI:N/VC:H) confirms local access with low privileges is sufficient, with no user interaction required after the attacker establishes presence. No public exploit or active exploitation has been identified at time of analysis; Samsung Mobile released a patch in September 2026.
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.
IP-based geo-restriction bypass in IP2Location Country Blocker for WordPress (all versions before 2.45.0) allows unauthenticated remote attackers to access restricted pages, links, or entire sites by forging the X-Real-IP HTTP header with an allowlisted IP address. The plugin resolves the client's country from this user-controlled header without validating it against the actual TCP connection source, making any IP-based access control rule trivially defeatable. No public exploit or active exploitation has been confirmed, but SSVC classifies the attack as automatable with partial technical impact.
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
Path traversal in Samsung's GalaxyDiagnostics component on Samsung Mobile Devices allows a physical attacker to access files with system-level privilege, affecting Android versions 14 through 17 prior to the SMR Sep-2026 Release 1 patch. The CVSS 4.0 vector (AV:P/VC:H/VI:H) confirms both high confidentiality and integrity impact but constrains exploitation to physical presence at the device. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unconditional TLS certificate validation disabling in the OCAPI modules (ocapi_command, ocapi_info) of the community.general Ansible collection exposes HTTP Basic-Auth credentials to interception and permits response tampering against any managed OCAPI storage or enclosure device. Because the shared request helper disables certificate validation on every call with no parameter to re-enable it, a network-adjacent attacker performing a MITM attack can present any certificate, silently capture credentials, and inject falsified device responses back to the Ansible controller. Red Hat bundles the affected collection in Ceph Storage 5 and 9 and OpenStack Platform 17.1 and 18.0; no public exploit has been identified at time of analysis.
Command injection in Dell PowerScale OneFS allows a local attacker with admin-level privileges to escalate to root, achieving full system compromise across confidentiality, integrity, and availability. Affected versions span three distinct release trains: 9.5.0.0-9.7.1.0, 9.8.0.0-9.10.1.0, and 9.11.0.0-9.14.0.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; the attack requires pre-existing local administrative access, substantially limiting the attack surface to insider threats or post-compromise scenarios.
PHP Object Injection in the Ninja Forms WordPress plugin (all versions through 3.14.6) allows authenticated administrators to inject arbitrary PHP objects during the form import process via unsafe deserialization in WPN_Helper::build_nf_cache(). The vulnerability itself carries no inherent impact - exploitation requires a separate POP (Property Oriented Programming) chain supplied by another co-installed plugin or theme. When a POP chain is present, the impact escalates to arbitrary file deletion, sensitive data retrieval, or remote code execution, depending on what the chain enables. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Path traversal in Tanium Data Service 4.2 prior to build 4.2.345 allows a highly privileged, remote-authenticated attacker to read, write, or otherwise manipulate files outside the application's intended directory scope. Tanium addressed this in their security advisory TAN-2026-044 with a patch to build 4.2.345. No public exploit or active exploitation has been identified at time of analysis.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Web origin policy bypass in Google Chrome's Network component prior to 153.0.8010.36 allows remote attackers to violate cross-origin resource isolation by socially engineering victims into interacting with a crafted Chrome extension. The Same-Origin Policy (SOP) is a foundational browser security boundary; its bypass enables unauthorized cross-origin writes (I:H), potentially allowing attackers to tamper with resources on other origins. No public exploit code exists and EPSS is low (0.29%), though Chromium's own severity rating is 'High.'
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Actor component of Google Chrome before 153.0.8010.36 allows remote attackers to read sensitive browser information by inducing a victim to visit a crafted HTML page. The flaw (CWE-862) reflects a failure to enforce access control checks in an internal Chromium IPC/actor abstraction, exposing confidential data without requiring credentials. With CVSS 6.5 (Medium), EPSS at 0.28% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a real but lower-priority information disclosure fixed in the September 2026 stable channel update.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.