Server-side template injection in web.py 0.76 allows an attacker who can write to the application's template source directory to achieve arbitrary Python code and OS command execution on the server, but only when the application precompiles those templates and later renders them through the precompiled template loader; that specific deployment pattern is what defeats the template engine's built-in sandbox. The flaw is a genuine RCE-class issue (CWE-94) at CVSS 8.5, yet it is gated by real prerequisites: the CVSS vector indicates authenticated access (PR:L) and high attack complexity (AC:H), because the attacker must first obtain write access to the template directory and the application must use the precompiled code path rather than direct sandboxed rendering. It is not a remote-unauthenticated exploit against stock configurations, and no public exploit identified at time of analysis; exploitation is not confirmed actively exploited (CISA KEV) and no KEV entry is present in the source data.
Unauthenticated remote attackers can connect to the /log WebSocket endpoint in Klever-Go and either read live node logs or apply an arbitrary logger profile process-wide, for example setting *:NONE to mute normal slot logs or *:TRACE to flood them. The flaw is a management-plane information exposure (CWE-200) with additional integrity and availability effects, and publicly available exploit code exists because the advisory includes a proof-of-concept reproduction; no CISA KEV active exploitation is indicated. Exploitation requires the REST API to be network-reachable, so nodes that keep the API bound to localhost or an admin-only interface are not remotely exposed, and the vendor-released fix is version 1.7.20.
Authenticated Joomla backend users of any privilege level can bypass EasyStore's ACL checks and edit arbitrary records in versions 1.0.0 through 3.0.0. The allowEdit() method in ApiController.php is hardcoded to return true, defeating Joomla's component- and asset-level permission model (CWE-284). The vendor rates this high severity (CVSS 8.6), though our independent assessment confirms the attack requires an existing backend account and is not exploitable by unauthenticated visitors; no public exploit identified at time of analysis.
Missing authorization in Formie's IntegrationsController::actionFormSettings control panel action lets any authenticated user (no integration permission required) override outbound host properties such as apiUrl on an already-configured integration, causing the server to send stored API keys or OAuth tokens to an attacker-controlled or internal host and return the remote response in the JSON body. This is a non-blind SSRF combined with credential exfiltration affecting verbb/formie versions before 2.2.23 (Craft 4) and 3.0.0 through 3.1.30 (Craft 5); patched releases are 2.2.23 and 3.1.31. Authentication with any level of access is required, so exposure is greatest on sites permitting low-privileged or front-end/member authentication (including public self-registration), and a CRM, email-marketing, or webhook integration must already be configured with stored credentials for exfiltration to be meaningful; no public exploit code was identified at time of analysis, and the flaw is an incomplete remediation of GHSA-cvpc-hccg-wmw4, whose 3.1.28 permission gate omitted this action.
Missing object-level authorization in the JobTemplate copy endpoint (CopyAPIView) of AWX and Red Hat Ansible Automation Platform 2 lets an authenticated user duplicate a JobTemplate they are not permitted to read, disclosing the template's configuration - playbook reference, associated credentials, inventory and extra variables - that RBAC was intended to protect. The root cause is CWE-862 (Missing Authorization): the copy view's GET path enforces a read check on the source object, but the POST path that performs the copy only validates add and copy-related permissions, none of which imply read access on the source template. Per the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N; vendor score 8.5), exploitation requires an authenticated account already holding inventory.use_role, project.use_role, execution_environment.read_role and credentials.use_role, so this is an insider/multi-tenant privilege-boundary flaw rather than unauthenticated remote compromise; no public exploit code was identified at time of analysis.
SQL injection in the WP EasyCart plugin for WordPress (versions up to and including 5.9.4) allows authenticated attackers with Contributor-level access or higher to execute arbitrary SQL queries, potentially leading to the disclosure of sensitive data from the WordPress database. Exploitation is remote, requires low-privilege authentication (PR:L), and no user interaction; the confidentiality impact is high, with low integrity and availability impacts. No public exploit code has been identified at the time of analysis, and the vulnerability is not known to be actively exploited.
SQL injection in the Mollie Forms WordPress plugin (versions up to and including 2.11.0) lets a remote attacker who holds an authenticated Contributor-level account on the target site inject arbitrary SQL through plugin-supplied input, potentially exposing sensitive data stored in the WordPress database. The issue is network-reachable with low attack complexity and requires no user interaction, but exploitation is gated by the need to first obtain Contributor credentials, so sites that disable open registration or tightly control Contributor accounts are substantially less exposed. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and no vendor-released fixed version is stated in the available data. Reported by Patchstack and tracked as EUVD-2026-85467; the independent assessment rates the impact as high confidentiality with limited integrity and availability effects under an unchanged-scope vector.
SQL injection in the Live Copy Paste for Elementor WordPress plugin (bdthemes, versions up to and including 1.5.10) allows an authenticated attacker holding at least Contributor-level credentials to inject arbitrary SQL through a network-reachable plugin endpoint, resulting in high-impact confidentiality exposure (database contents, including user and configuration data) and a limited availability effect. No public exploit code has been identified at time of analysis and the flaw is not listed as confirmed actively exploited (CISA KEV); EPSS data was not provided. The vendor-published vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L, 8.5) is treated in our independent assessment as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L, with the same base 8.5 and the same Contributor-authentication prerequisite, so real-world exposure is concentrated on multi-author sites that permit Contributor registration or low-privileged content workflows.
Arbitrary file upload in Microweber Administration Panel allows an authenticated high-privileged administrator to upload unrestricted files, including executable server-side scripts, resulting in remote code execution and complete system compromise. The vulnerable upload forms are administrative features and require prior administrator-level access, so exploitation is not unauthenticated. There is no public exploit identified at time of analysis; the reported EICAR test-file demonstration underscores the missing validation but is not equivalent to active exploitation.
Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.
A missing-authorization flaw (CWE-862) in Google Chrome desktop builds prior to 154.0.8037.57 can be triggered by an unauthenticated local attacker with no user interaction, and the assessed CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.4) rates confidentiality, integrity and availability impact as high, consistent with the 'Authentication Bypass' tagging applied by the reporting vendor. The local attack vector and absence of a user-interaction requirement mean the attacker must already have some form of local execution context on the target host, which sharply constrains mass remote exploitation; no public exploit code has been identified at time of analysis and EPSS is low at 0.24% (13th percentile). Exploitation is limited to unpatched builds and is fully mitigated by the vendor-released fix in Chrome 154.0.8037.57, so this should be handled as a moderate-priority patch rather than an emergency, though the 8.4 score and high CIA impact still warrant prompt update cycles.
Authentication bypass in Google Chrome prior to 154.0.8037.57 allows an attacker with local access to the machine to slip past an authorization check in a browser component, yielding high confidentiality, integrity, and availability impact. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) means no privileges and no user interaction are needed once local access exists, so the realistic prerequisite is the ability to execute or otherwise interact with the vulnerable Chrome component on the host rather than reaching it over the network; a purely remote, unauthenticated web-based attack is not supported by the available data. Exploitation signals are currently weak and non-urgent: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, while the vendor has shipped a fixed build. Note that the affected feature or component is not named in the available data because no vendor description was published, so the exact local precondition should be confirmed against the Chrome release advisory.
Google Chrome desktop builds earlier than 154.0.8037.57 are affected by an improper input validation flaw (CWE-20) rated CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), in which an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can potentially achieve high confidentiality, integrity and availability impact that crosses a browser security boundary. Although the public tagging labels this issue as information disclosure, the assessed vector indicates broader high impact across all three CIA dimensions combined with a scope change (S:C), consistent with escaping the Chrome renderer sandbox. Exploitation is constrained by mandatory user interaction and high attack complexity, no public exploit has been identified at time of analysis, and Google has already shipped the fix in the stable channel, so auto-updating installations are remediated on restart.
Use-after-free in Google Chrome desktop versions prior to the September 2026 stable channel update allows remote attackers to cause information disclosure and memory corruption when a victim loads attacker-controlled web content. Exploitation requires user interaction (UI:R) and a high-complexity timing or heap-state precondition (AC:H), but no authentication (PR:N); the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, yielding a base score of 8.3. A vendor patch is available in the September 2026 stable channel update, and no public exploit code or active exploitation has been identified in the provided intelligence.
An authorization-bypass flaw in Google Chrome desktop builds prior to 154.0.8037.57 lets remote attackers escape a security boundary by having the victim load crafted web content in the browser. Successful exploitation crosses a sandbox boundary (S:C) and can compromise confidentiality, integrity and availability of the affected system, but the CVSS vector (AC:H, UI:R) means the attacker must satisfy specific timing or memory-state conditions and the user must actively visit or interact with the malicious page. No confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and a vendor patch is available, so prioritization should reflect a high-severity but hard-to-trigger client-side issue rather than an imminent mass-exploitation event.
Use-after-free memory corruption in Google Chrome before 154.0.8037.57 allows a remote, unauthenticated attacker to potentially escape the browser's renderer sandbox by persuading a victim to visit attacker-controlled web content. Exploitation requires mandatory user interaction (UI:R) and a high-complexity precondition such as precise heap grooming or a timing race (AC:H), and no public exploit has been identified at time of analysis. Google has issued a vendor-released patch in version 154.0.8037.57 that removes the vulnerable code path.
Improper input validation in Google Chrome before 154.0.8037.57 can be triggered when a victim loads attacker-controlled web content, yielding a scope-changed impact rated high for confidentiality, integrity, and availability (CVSS 8.3). Exploitation is network-reachable without credentials (PR:N) but demands victim interaction (UI:R) plus non-trivial preconditions such as specific memory state, heap grooming, or timing windows (AC:H), and the affected component is undisclosed because chromium issue 517730821 is access-restricted. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in the Chrome stable channel at 154.0.8037.57.
Use-after-free in Google Chrome before 154.0.8037.57 can be triggered when a victim visits attacker-controlled web content, potentially allowing a remote unauthenticated attacker to corrupt memory and escape the renderer sandbox to execute code or disclose information. The vendor-assigned CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction and high attack complexity. Vendor-released patch: 154.0.8037.57; no public exploit was identified at time of analysis.
Use-after-free memory corruption in Google Chrome desktop (Stable channel below 154.0.8037.57) allows remote attackers to corrupt browser memory and reach code-execution-class impact when a victim browses an attacker-controlled page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and carries high attack complexity (AC:H) because reliable reuse of the freed object depends on heap grooming or an allocation/timing race; the S:C scope change with C:H/I:H/A:H indicates the compromise can extend beyond the browser's original security context toward a sandbox escape. CVSS 3.1 base score is 8.3 (HIGH); no public exploit code was identified at time of analysis, and a vendor fix is available as Chrome 154.0.8037.57.
Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows remote attackers to achieve high-integrity and high-confidentiality impact against a victim who loads attacker-controlled web content and performs some interaction with it, but exploitation is not trivially repeatable: with AC:H it depends on winning a race or reliably grooming heap layout rather than a single deterministic trigger. The flaw is reachable without authentication (PR:N) and the vector's scope change (S:C) indicates the assessed impact crosses a component boundary, yet no public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this should be treated as a high-priority patching item rather than a confirmed in-the-wild threat. A vendor patch is available.
Ubuntu Linux is the only product attributable to CVE-2026-95319, and the sole intelligence signal available is a vendor:ubuntu report with no accompanying advisory text, version range, or affected component. No description, CVSS score, CVSS vector, CWE classification, CPE string, EPSS score, KEV status, or reference link was supplied, so the vulnerability class, attack vector, privilege requirements, and impact cannot be characterized. No public exploit code has been identified at time of analysis, but this reflects absent data rather than a confirmed absence of exploitation, and the entry must be treated as unassessable until the upstream NVD or Ubuntu security advisory is retrieved.
Improper output encoding in Google Chrome before the 154.0.8037.57 stable release allows a remote attacker to break out of the intended data context when a victim opens or interacts with an attacker-controlled web page, resulting in cross-boundary confidentiality and integrity impact according to the assessed CVSS vector (S:C/C:H/I:H/A:H). No authentication or pre-existing privileges are required (PR:N), but exploitation demands user interaction (UI:R) and non-trivial attacker-controlled preconditions (AC:H), which materially limits reliable, high-volume exploitation; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Google has shipped a vendor patch, so upgrading the browser is a direct and effective fix rather than a mitigation-only situation.
Google Chrome versions prior to 154.0.8037.57 contain an incorrectly-resolved name or reference flaw (CWE-706) that remote, unauthenticated attackers can trigger by convincing a user to load attacker-controlled web content; the issue is rated CVSS 3.1 8.3 High with scope change (S:C) and high confidentiality, integrity and availability impact. Exploitation is gated by mandatory user interaction (UI:R) and high attack complexity (AC:H), requiring non-trivial prerequisites such as specific timing, memory grooming or a race condition, and no public exploit code has been identified at time of analysis. Google has already shipped a stable-channel fix in Chrome 154.0.8037.57, so patched or auto-updated browsers are not exposed.
Improper input validation in Google Chrome before 154.0.8037.57 allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact with a scope change, though exploitation requires the victim to visit attacker-controlled web content and overcome high attack complexity. The flaw, tracked as CVE-2026-95341 with a CVSS 8.3 base score, affects default installations of Chrome on all platforms and could permit renderer-level code execution or sandbox escape; no public exploit identified at time of analysis. Vendor-released patch 154.0.8037.57 addresses the issue.
Every desktop application generated by Pake inherits two upstream template defaults that together hand native IPC functionality to untrusted web content, allowing scripts served from any HTTPS origin to invoke the application's own native commands, including download_file. The root cause is a wildcard Tauri capability ("remote": { "urls": ["https://*.*"] } in src-tauri/capabilities/default.json) paired with "withGlobalTauri": true in src-tauri/tauri.conf.json, which places window.__TAURI__.core.invoke() within reach of ordinary page JavaScript; because Tauri's access control list only validates plugin: commands and not commands registered by the application itself via generate_handler!, no permission entry is required to call them. Exploitation is unauthenticated per the assessed vector (PR:N) but requires user interaction (UI:R) - the victim must run the generated app and attacker-controlled JavaScript must execute inside it, whether directly or through third-party analytics, advertising, or a compromised CDN loaded by the wrapped site. Chained with the path traversal tracked separately as CVE-2026-82635, this escalates to arbitrary file write and persistent code execution; no public exploit identified at time of analysis, and the issue is fixed in Pake V3.17.0.
Unauthenticated remote attackers can read other customers' order records - including billing addresses, customer details, and purchased downloadable files - on Isotope eCommerce installations through 2.9.10 that accept guest orders, because order identifiers are generated from PHP's time-seeded uniqid() function and the guest order-details module performs no ownership verification. Exploitation requires guessing a valid uid value, which is why the flaw carries high attack complexity rather than being trivially scriptable, but no authentication or user interaction is needed. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV); the practical exposure is a bounded but genuine confidentiality risk confined to shops exposing guest checkout.
Memory-exhaustion denial of service in RabbitMQ's Web-MQTT plugin (rabbitmq_web_mqtt) lets an unauthenticated remote attacker crash a broker node by sending a single WebSocket frame that is highly compressed and inflates to gigabytes in memory. Affected are RabbitMQ server releases prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0 whenever the Web-MQTT plugin is enabled and its listener (TCP 15675/15676) is network-reachable; the attacker only needs to negotiate RFC 7692 permessage-deflate during the upgrade and then send a zlib bomb, since decompression happens in the connection process before any MQTT CONNECT credentials are evaluated. No public exploit code was identified at time of analysis, exploitation requires the non-default plugin to be enabled, and the impact is availability-only (C:N/I:N/A:H) against the affected node. Vendor-released fixes are available in 3.13.15, 4.0.20, 4.1.11, 4.2.6 and 4.3.0.
Unauthenticated remote attackers can crash any RabbitMQ node with the AMQP 1.0 listener enabled by sending a single ~19-byte frame to TCP port 5672, causing the Erlang VM to exhaust heap memory and terminate, which takes down all tenants and protocols on that node. The flaw is an unbounded-allocation bug (CWE-770) in the AMQP 1.0 framing code that is reached before authentication completes, so no credentials or user interaction are required; only network reachability to the broker's AMQP 1.0 port is needed. Affected releases are RabbitMQ prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, which contain the vendor-released fix; no public exploit code has been identified at time of analysis, and the issue is scored high severity (CVSS 8.2 v4.0 / assessed CVSS 3.1 7.5) with availability-only impact.
Unauthenticated attackers can overwrite or hijack other users' in-progress multi-page or save-for-later submissions in the Craft CMS Formie plugin by enumerating sequential submission IDs against the anonymous formie/submissions/submit endpoint, which trusted a client-supplied submissionId with no session binding, ownership check, or edit-token validation (CWE-639, CVSS 3.1 base 8.2, vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N, so no authentication or user interaction is required). Affected installations are Formie 3.0.0 through 3.1.30 on Craft 5 and all versions before 2.2.23 on Craft 4; completed submissions are unaffected because the vulnerable code path only loads records with isIncomplete=true, meaning exposure requires the site to actually use multi-page forms or save-for-later. Exploitation status: no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; vendor-released patches exist (3.1.31 for Craft 5, 2.2.23 for Craft 4).
Unauthenticated remote attackers can manipulate SQL database queries in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift, giving them a high-integrity impact with limited confidentiality and availability effects on affected payments-processing deployments. The flaw is a boolean-based blind SQL injection rooted in improper neutralization of special elements in a boolean expression (CWE-74), exploitable over the network with low complexity and no authentication or user interaction per the assessed CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (base 8.2). No public exploit code has been identified and there is no confirmation of active exploitation; IBM has published a vendor advisory containing patch guidance, but affected version ranges are expressed as a wildcard CPE, so defenders must match their specific build against IBM's advisory to determine exposure.
Unauthenticated attackers can spoof the client IP address that the divi-dash WordPress plugin (versions before 1.0.7) relies on for rate limiting and banning, allowing them to bypass throttling, ban arbitrary addresses of their choosing, and grow a stored WordPress option without bound until the site suffers denial of service. The flaw is rated CVSS 3.1 base 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H), with the score driven almost entirely by the high availability impact from unbounded wp_options growth and the loss of effective rate limiting. Neither CISA KEV nor any public exploit code was identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
Unauthenticated attackers can permanently lock any user account - including an administrator's - out of WordPress sites running WP Recipe Maker versions 9.8.0 through 10.8.1. The plugin exposes a REST route that performs no authorization check and imposes no size limit on the data it writes, so an anonymous request can push unlimited content into a target user's metadata until that account can no longer load. Exploitation requires only that a vulnerable plugin version be installed on a default configuration; no credentials or user interaction are needed, and no public exploit code has been identified at time of analysis. The result is a denial-of-service lockout with possible limited integrity impact from metadata tampering, not a privilege escalation or data disclosure.
Incorrect permission assignment in the cPanel CalDAV/CardDAV service (CCS Calendar and Contacts) allows an authenticated low-privilege cPanel account on a multi-tenant or shared-hosting server to read calendar and contact data belonging to other hosting accounts. Exploitation requires an existing local foothold with a valid cPanel login on the same server (CVSS 4.0 AV:L/PR:L) and produces a confidentiality-only impact with a scope change, since the data exposed belongs to separate accounts rather than the attacker's own; integrity and availability are unaffected. There is no public exploit identified at time of analysis and the issue is a local permission-assignment defect rather than a remotely reachable flaw, so single-tenant deployments with only one account have no 'other accounts' to disclose and are effectively not exposed.
Unauthenticated PII harvesting in the JoomShaper Easy Store extension for Joomla (versions 1.0.0 through 3.0.0) allows anyone to retrieve guest checkout records by submitting an email address to the checkout.searchGuestUser endpoint, which returns full name, phone number, street address, city, postal code and country directly from the #__easystore_guests table with no authentication, session validation or ownership check. Attackers can script the endpoint against purchased or scraped email lists to enumerate guest customers and compile sensitive personal data at scale, with no user interaction required. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (no CISA KEV listing), but the attack is trivially reachable; yield depends on email-list quality and on whether a given site has actually used guest checkout, since only matching guest emails return data.
Unauthenticated remote attackers can stall job dispatch for every tenant on Red Hat Ansible Automation Platform 2 by repeatedly calling four debug scheduler views that are routed in production builds because their URL include is not gated on the debug setting. Each call lets any network-reachable client acquire the cluster-wide scheduler advisory lock, and since the legitimate scheduler takes that same lock without waiting, genuine scheduler runs are skipped, job dispatch is delayed or halted, and controller web workers are consumed. The debug root view also discloses the list of debug endpoints to unauthenticated callers, and no public exploit code has been identified at time of analysis.
CVE-2026-92709 cannot be characterized at this time: the record carries no description, no CVSS score or vector, no CWE mapping, and no CPE data, so the affected component, attack vector, and impact are all undetermined. The sole usable metadata is that the record was reported by vendor:ubuntu, which suggests the vulnerable code lives in an Ubuntu-maintained package but does not establish which package, which release, or under what configuration it could be triggered. Exploitation status is unconfirmed: there is no CISA KEV listing for this identifier and no public exploit code identified at time of analysis, and risk cannot be meaningfully assessed from the available data until the Ubuntu security tracker/USN entry and the NVD description are retrieved.
Missing authorization enforcement in Google Chrome builds earlier than 154.0.8037.57 (classified CWE-862 and tagged as an authentication bypass) lets an attacker defeat an access-control decision in the browser, with the impact scored as high confidentiality and high integrity loss (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). The flaw is network-delivered and requires no authentication or prior privileges, but exploitation is not silent: the victim must navigate to or render attacker-controlled web content (UI:R), which keeps the practical attack path dependent on user browsing behavior rather than on a remotely reachable service. Google has shipped the fix in Chrome 154.0.8037.57 and the issue is tracked as ENISA EUVD-2026-89222 / Chromium issue 540265100; no public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation.
Authentication bypass and sensitive-information disclosure in IBM Financial Transaction Manager (FTM) for Red Hat OpenShift stem from a hard-coded cryptographic key (CWE-321) embedded in the product, scoring 8.1 (High) with the vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Because the key is embedded and therefore shared across deployments, an unauthenticated attacker who is positioned on the same adjacent network as an affected OpenShift deployment can bypass authentication and read or tamper with sensitive financial-transaction data, with no user interaction required; the assessment notes this is not confirmed as directly reachable from the public internet despite the description's 'remote attacker' phrasing. A vendor patch is available, and no public exploit code has been identified at time of analysis.
Incorrect authorization handling (CWE-863) in Google Chrome before 154.0.8037.57 allows remote, unauthenticated attackers to bypass intended authorization checks by convincing a user to load attacker-controlled web content, resulting in high confidentiality and integrity impact with no availability impact (CVSS 3.1 base 8.1, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Because exploitation hinges on the UI:R component, it is not a fully drive-by condition - the victim must visit a malicious or compromised page while running an unpatched build, and the requirement for that user action is the main limiting factor. Exploitation status at time of analysis is that no public exploit code has been identified, and CISA KEV does not list this CVE; EPSS is low at 0.22% (12th percentile), suggesting limited observed exploitation pressure despite the high base score. Vendor-released patch: 154.0.8037.57.
Authenticated users holding only a Subscriber-level account can abuse the field-management AJAX action in the WC Fields Factory WordPress plugin before 4.1.11 to create, modify, or delete arbitrary post meta on any post - including WooCommerce products they do not own - and to rewrite stored pricing rules so that a product checks out at a reduced price. The root cause is a missing authorization check (CWE-862) on a field-management endpoint, rated CVSS 8.1 by NVD (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N; our assessment reaches the same 8.1 base score but caps confidentiality at Low: C:L/I:H/A:N), and no public exploit code or CISA KEV listing was identified at time of analysis. Exploitation requires only that the site runs a vulnerable version of the plugin alongside WooCommerce and that the attacker can obtain a basic account, which is trivially satisfied where WooCommerce customer self-registration is enabled.
Man-in-the-middle attackers occupying the network path of Foxit PDF Editor and Foxit PDF Reader software-update traffic can bypass TLS certificate validation and update package integrity checks, allowing a forged update to be accepted and executed with system privileges. Exploitation is materially constrained: the client must both be intercepted and perform an update check/download in that window, which is why the CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H vector scores AC:H, and no authentication (PR:N) or user interaction (UI:N) is required. Affected builds are Foxit PDF Editor 2026.2 and earlier, 14.0.7 and earlier, and 13.2.6 and earlier, plus Foxit PDF Reader 2026.2 and earlier; no public exploit code and no confirmed active exploitation (not in CISA KEV) have been identified at time of analysis, EPSS is low at 0.13% (3rd percentile), and CISA's SSVC rates the technical impact as total while noting exploitation and automability as none/no.
Cross-site request forgery in PublishPress Capabilities 2.50.1 and earlier lets an attacker lure a logged-in, sufficiently privileged WordPress user into silently submitting role- and capability-modification requests, producing unauthorized permission changes with high integrity impact. The published CVSS 8.1 reflects PR:N/UI:R, but the independent assessment scores the same flaw as C:N/I:H/A:N, giving a materially lower effective severity: exploitation is not self-driven, it requires an authenticated administrative victim to interact with attacker-controlled content during an active session. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and the issue should be treated as moderate priority despite the headline score.
Configuration tampering in ZohoCorp ManageEngine Applications Manager 182000 and below lets an authenticated low-privileged user modify the application's server-wide proxy settings, an operation that should be restricted to administrators. Because proxy settings govern outbound traffic from the monitoring server - including connections to monitored hosts and external services - a non-admin can redirect or intercept that traffic and expose sensitive configuration data; the independent assessment rates integrity impact lower (I:L) than the vendor's CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 8.1 HIGH) while agreeing on high confidentiality impact. Exploitation requires a valid low-privileged account and network reachability to the management interface; it is not pre-authentication. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Privilege escalation in Zoho ManageEngine OpManager and Firewall Analyzer 12.8.710 and earlier allows an authenticated low-privilege user to gain Administrator privileges by importing a crafted Report Profile. The issue is network-reachable with low attack complexity and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, base 8.1 High), but the attacker must already hold working low-privilege credentials on the target instance and no non-default configuration is needed. No public exploit identified at time of analysis.
Google Chrome desktop stable-channel builds are affected by CVE-2026-95333, a flaw whose description, CVSS vector, and CWE classification were all absent from the available intelligence, leaving only a vendor patch flag and a single Chrome Releases stable-channel advisory reference as substantive signals. Because no exploitation, authentication, or impact data is present, the effect on confidentiality, integrity, or availability cannot be characterized from this input, and no public exploit code was identified at time of analysis. The most notable finding is an internal metadata conflict: the record is attributed to vendor:ubuntu while the sole reference is Google's Chrome desktop advisory, so the actually affected package (Google Chrome versus Ubuntu's Chromium/Chrome packaging) should be confirmed directly against the linked Chrome Releases post before remediation is scoped.
Race condition in Google Chrome's stable channel allows a remote, unauthenticated attacker who persuades a user to interact with crafted content to win a time-of-check/time-of-use window and affect data beyond the vulnerable component's security scope. The CVSS 3.1 base score of 8.0 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) reflects high confidentiality and integrity impact with no availability impact, tempered by high attack complexity; no public exploit code or CISA KEV entry was identified at time of analysis. The flaw is addressed in the 154.0.8037.57 stable channel update, and while the vendor feed tags it Information Disclosure, the scoring indicates a broader boundary-crossing defect, so this is best treated as a moderately high-priority browser issue with partly inferred impact.
Information disclosure in Google Chrome desktop builds earlier than 154.0.8037.57 lets an attacker who shares a local network segment with the victim trigger a flaw that the assessed CVSS scores as high impact across confidentiality, integrity, and availability (CVSS 8.0, AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no authentication or elevated privileges (PR:N), but must be positioned on the same adjacent L2 segment as the target (AV:A) and must get the victim to load attacker-influenced content (UI:R) - a combination that substantially constrains mass or opportunistic exploitation. An official fix is already available on the stable channel and no public exploit code has been identified at time of analysis, so risk here is driven primarily by Chrome's ubiquity and by unpatched client exposure rather than by observed exploitation activity.
Security policy bypass in Forcepoint Security Engine (NGFW) versions 7.1.0 through 7.1.13, 7.3.0 through 7.3.1, 7.3.3, 7.4.0 through 7.4.1, and 7.5.0 allows unauthenticated network attackers to defeat the enforcement policy the appliance is supposed to apply to traffic passing through it. Because the appliance itself is not the target, impact falls on downstream systems that the NGFW is meant to protect - an attacker who exploits the flaw can make traffic the policy should block appear permitted, with high integrity impact on those subsequent systems (scope-changed). The CVSS 4.0 base score is 7.9 (AV:N/AC:L/AT:N/PR:N/UI:N with subsequent-system impact H/H/H) and the issue is tagged as an authentication bypass; no CISA KEV entry is present and no public exploit code has been identified at time of analysis, though no EPSS data was supplied for this CVE. Exploitation is limited primarily by deployment context rather than access difficulty - the target must actually be enforcing a policy the bypass can negate.
Improper bounds checking in IBM Concert 1.0.0 through 3.0.0 lets a local, authenticated user supply overlong input that overflows a buffer and achieves arbitrary code execution under the privileges of the affected process, matching the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. IBM's own advisory scores the issue 9.8 with a network/unauthenticated vector (AV:N/AC:L/PR:N/UI:N), but the vendor description explicitly states a 'local user' is required, so realistic exposure is confined to systems where an attacker already has a local account - a foothold-to-full-compromise escalation rather than a pre-authentication remote RCE. No public exploit code or confirmed active exploitation was identified at time of analysis, and IBM has published an advisory with a vendor-supplied fix.