Missing authorization in Devolutions Server's gateway network scan token API lets any authenticated low-privileged account mint a network scan token and drive the gateway to discover internal hosts and probe ports, handing an attacker reconnaissance-grade visibility into the internal network from a single valid login. The flaw affects Devolutions Server 2026.3.5.0 and earlier and is fixed in 2026.3.7.0, which the vendor now ships; at a CVSS of 5.0 the issue is rated moderate because confidentiality is the only impacted property, with no code execution, data tampering, or availability loss. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates it neither exploited nor automatable.
Denial of service in HPE Networking Instant On firmware version 3.4.1.0 and earlier lets a remote attacker who already holds an authenticated administrative session (PR:H) disrupt the device's API service, rated CVSS 3.1 4.9 with availability impact High and no confidentiality or integrity impact. The disruption is transient - the affected service restarts and resumes normal operation without manual intervention - so the practical consequence is a brief loss of management/API availability rather than a persistent outage, and the requirement for admin-level credentials sharply limits who can trigger it. There is no CISA KEV listing and no public exploit identified at time of analysis, so this should be treated as a low-priority hardening item rather than an urgent patching driver.
Memory corruption in the network-facing interface of HPE Networking Instant On firmware (version 3.4.1.0 and earlier) allows an unauthenticated remote attacker to disrupt the affected service and retrieve a limited amount of information from the component. The flaw scores CVSS 3.1 4.8 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L, so the limiting factor is high attack complexity - reliable triggering depends on specific memory state or precisely crafted input rather than a simple repeatable request - and the realistic impact is service outage plus limited disclosure, with no integrity impact and no confirmed path to code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and exploitation additionally requires network reachability to the affected interface.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Uninitialized resource handling in ANGLE, the GPU translation layer bundled with Google Chrome on Windows, lets a remote attacker who gets a victim to load a crafted HTML page trigger a memory read that crosses the browser's sandbox boundary, although the leak is limited to low-severity confidentiality impact (CVSS 4.7, C:L, S:C with no integrity or availability effect). Only Chrome builds on Windows prior to 154.0.8037.92 are affected; the attack is unauthenticated per the CVSS vector but requires user interaction (UI:R) - the victim must open or be redirected to attacker-controlled content that exercises the WebGL/GPU-accelerated path. No public exploit code identified at time of analysis, no confirmed active exploitation (CISA KEV), and Google has already published a fixed build, so the practical risk is low.
An out-of-bounds read in Chrome's WebGL implementation allows a remote attacker to disclose a limited amount of memory beyond the renderer/sandbox boundary in Google Chrome builds prior to 154.0.8037.92. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled HTML that exercises the WebGL rendering path (UI:R), and the confirmed impact is limited to a partial information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical value to an attacker is low because the quantity and controllability of the leaked data are constrained and unpredictable. Chromium rated the issue High severity, and Google has published a stable-channel fix, but the assessed CVSS of 4.7 keeps this in low-priority territory relative to memory-corruption bugs that grant code execution.
Cross-origin information disclosure in Mozilla Firefox's panning and zooming component lets attacker-controlled web content defeat the browser's site-isolation boundary and leak a limited amount of data from another origin. The issue affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires the victim to load a malicious page (UI:R) with no authentication or special privileges (PR:N); impact is confined to confidentiality (C:L) with no integrity or availability effect. There is no public exploit identified at time of analysis and no CISA KEV listing, and the EPSS score of 0.16% (4th percentile) indicates very low predicted exploitation activity, making this a defense-in-depth fix rather than an urgent threat.
Denial of service in Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 occurs when a local user opens a maliciously crafted Microsoft Network Monitor (netmon) capture file, triggering an unbounded loop in the file parser. Exploitation requires user interaction (opening the file) and high complexity, resulting in a crash or hang of the application; there is no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis.
Denial of service in the Wireshark CSN.1 protocol dissector (versions 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18) stems from a heap-based buffer overflow (CWE-122) that crashes the application when it parses malformed CSN.1-encoded data. Exploitation is local and requires user interaction: the target must open an attacker-supplied capture file, and the assessed vector CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H indicates high attack complexity with a non-deterministic trigger and availability-only impact, with no confidentiality or integrity loss and no confirmed remote path. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; at CVSS 4.7 the practical outcome is a recoverable crash rather than code execution, making this a low-priority availability bug.
Uninitialized memory handling in Firefox's Audio/Video (media playback) component can crash the browser or leak small amounts of stale process memory when a victim loads attacker-controlled media content on an unpatched build. The issue is reachable by unauthenticated attackers (CVSS PR:N) but requires user interaction (UI:R) to render the malicious content, and the underlying uninitialized-memory read is non-deterministic, so reliable weaponization is unlikely and the realistic outcome is a crash or incidental minor memory exposure rather than targeted data theft. No public exploit code has been identified at time of analysis, and this is a genuinely low-priority issue despite Firefox's ubiquity; vendor patches are available in Firefox 157 and in the ESR branches 153.4, 140.17, and 115.42.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Information disclosure in Mozilla Firefox's Networking: JAR component allows remote, unauthenticated attackers to leak a limited amount of data when a victim loads attacker-controlled web content in an unpatched browser, with no integrity or availability impact. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; per the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (base 4.3), the practical limiter is the required user interaction and the low value/volume of the exposed information. No public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was supplied, so this is a low-severity client-side disclosure rather than an active-threat priority.
Uninitialized memory reads in the WebGPU component of Mozilla Firefox before 157 (and ESR before 153.4) can cause availability impacts such as browser crashes when a remote attacker convinces a user to load crafted content that exercises WebGPU. Exploitation requires user interaction (UI:R) and the WebGPU code path to be reachable, and the vendor-assigned CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) limits impact to low availability with no confirmed confidentiality or integrity effect. No public exploit has been identified at time of analysis; the issue is considered low priority and was fixed in Firefox 157 and Firefox ESR 153.4 per Mozilla advisories mfsa2026-100 and mfsa2026-97.
Uninitialized memory handling in Firefox's WebGPU implementation (Graphics: WebGPU component) lets a remote attacker crash or destabilize the browser process when a victim loads a crafted page that exercises WebGPU rendering or compute paths, affecting Firefox versions prior to 157. Per Mozilla's assessed CVSS 3.1 vector (4.3, AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), the impact is availability-only, requires user interaction, and requires no authentication; no public exploit code and no confirmed active exploitation were identified at time of analysis. The flaw is fixed in Firefox 157 via advisory MFSA2026-97 (Bugzilla 2057833), and pre-157 installations remain vulnerable until updated.
Uninitialized memory handling in Mozilla Firefox's WebGPU graphics component can crash the browser process, giving a remote attacker a low-impact denial-of-service condition against users running builds prior to Firefox 157. Exploitation requires the victim to actively browse attacker-controlled web content and for that content to drive the vulnerable WebGPU rendering path, so no authentication is required (PR:N) but user interaction is (UI:R); the vendor vector rates impact as availability-only (A:L) with no integrity or confidentiality effect. There is no confirmed active exploitation (CISA KEV does not list this CVE) and no public exploit code identified at time of analysis; the issue is considered a genuinely low-priority defect despite Mozilla Firefox being a ubiquitous target.
Uninitialized memory in Google Chrome's WebGPU implementation, in builds prior to 154.0.8037.92, can be read back by a remote attacker as cross-origin data when a victim loads a crafted HTML page. The flaw is unauthenticated and remote (CVSS:3.1/AV:N/AC:L/PR:N) but demands that the victim visit the attacker-controlled page (UI:R) and that WebGPU is reachable on the target platform; the outcome is a limited information disclosure with no code execution, no write primitive, and no availability impact, which is why the CVSS 3.1 base score is only 4.3 despite Chromium's internal 'High' severity label. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuinely low real-world priority even given Chrome's ubiquity.
Address-bar spoofing in Google Chrome for Android versions prior to 154.0.8037.92 lets a remote attacker misrepresent the Omnibox (URL bar) to a victim who opens a crafted HTML page, according to Google's own Chromium severity rating of High. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) confirms this is an unauthenticated, network-reachable attack that hinges entirely on user interaction, with only a low-integrity impact on the browser UI and no confidentiality or availability loss, and the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) places it at low real-world priority. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limitation is that the attacker must first lure the target to a malicious page, and only the Android build is affected - desktop and iOS Chrome users are out of scope.
Uninitialized-memory handling in Skia, Chrome's 2D graphics rendering library, allows a remote attacker to leak cross-origin data when a victim loads a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation is bounded by the mandatory user interaction (UI:R) - the target must open or render attacker-controlled content - and by the impact, which is limited to a partial confidentiality breach (C:L) with no integrity or availability effect, no code execution, and no authentication requirement (PR:N) on default builds. Google rates the underlying Chromium issue as High severity, though the assessed CVSS of 4.3 reflects the narrow cross-origin information-disclosure outcome; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA SSVC scoring aligns (Exploitation: none, Automatable: no, Technical Impact: partial). A vendor patch is available in Chrome 154.0.8037.92.
Information disclosure in the Networking component of Mozilla Firefox can leak limited data to attacker-controlled content, but only after the victim loads a malicious page in a vulnerable build. The flaw affects Firefox versions prior to 157 and the ESR branches prior to 153.4 and 140.17, and can be triggered remotely without authentication (AV:N/AC:L/PR:N) because it requires only that the user interact with attacker-supplied web content (UI:R); impact is confined to low confidentiality loss with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the resulting 4.3 CVSS score, combined with the mandatory user-interaction precondition, makes this a genuinely low-priority issue despite affecting a ubiquitous browser.
Query injection in the Airflow Google provider allows an attacker who can write to a source GCS bucket to steer which Google Drive file or folder is resolved during wildcard gcs_to_gdrive transfers, potentially redirecting uploads into an attacker-named folder or causing a download to return an attacker-placed file. This affects deployments running apache-airflow-providers-google before 22.6.0 that pass externally-sourced names to the Drive hook; the assessed vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, which indicates low privileges are required-specifically the ability to create or name objects in the source bucket-while no Airflow authentication or user interaction is needed. No public exploit code has been identified at time of analysis, there is no CISA KEV entry, no EPSS score was provided, and Apache rates the issue as low severity.
An out-of-bounds write in U-Boot's Android boot method (boot/bootmeth_android.c) lets someone with physical access to a device boot from crafted media whose boot image header declares a size larger than the containing partition, causing U-Boot to write past its load buffer into bootloader memory before 2026.10-rc3. Only devices that actually use the Android bootmeth and do NOT have Android Verified Boot (AVB) enabled are exposed, since AVB rejects the tampered image; authentication requirements are not confirmed from available data, but the assessed vector is CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H and there is no public exploit identified at time of analysis, nor any CISA KEV listing. The practical risk is low-priority: exploitation is gated on physical possession of the device plus an unprotected boot chain, and impact is limited to integrity and availability of the bootloader rather than confidentiality or a remote attack path.
Incorrect authorization in Grafana's library panel update path allows an authenticated user who holds edit permission on one folder to move a library panel into a different folder where they have only view permission, because the update flow never re-checks create permission on the destination folder. The bug is network-reachable at low complexity with low privileges (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) and produces only a low integrity impact: no destination-folder data is exposed and existing content there cannot be changed or deleted. No public exploit code has been identified at time of analysis, and the issue requires a multi-folder RBAC configuration where a user's rights differ across folders.
KitchenAsty versions through 0.3.0 expose an object-level authorization flaw in the reservations API: the authenticated endpoint GET /api/reservations/:id returns whatever reservation record matches the caller-supplied identifier without ever comparing reservation.customerId to the authenticated principal, allowing any logged-in low-privilege customer to read other customers' reservation data. Because the authenticate middleware is enforced, an anonymous attacker cannot reach the handler, which is the main constraint on exploitation; the impact per request is a read-only disclosure of a single reservation record and the assessed severity is correspondingly low (CVSS 3.1 base 4.3, PR:L). No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis, though the attack requires only a valid account plus enumeration of sequential or guessable reservation identifiers.
Cryptographic weakness in the Russh SSH library before 0.63.0 lets a malicious remote SSH peer send an all-zero 32-byte X25519 public key during the hybrid ML-KEM-768 + X25519 key exchange, zeroing the classical half of the combined shared secret so the handshake is protected by ML-KEM-768 alone. Any deployment negotiating the mlkem768x25519 kex method is affected, and the flaw is reachable without authentication or user interaction because it triggers inside the key exchange itself (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). The practical confidentiality impact is latent rather than immediate: no public exploit has been identified at time of analysis, and the exchange is only recoverable if ML-KEM-768 is independently weakened, so the real consequence today is the loss of the hybrid's classical fallback safety net.
Devolutions Server versions prior to 2026.3.7.0 contain an improper rule enforcement flaw in the PAM Active Directory provider that allows an authenticated user with PAM edit permissions to bypass Devolutions Gateway host rulesets, potentially exposing restricted hosts to unauthorized access. This low-severity (CVSS 4.3) authorization-scoping weakness requires specific configuration-the PAM AD provider and a Gateway host ruleset-and no public exploit or active exploitation has been identified at time of analysis. The primary impact is a limited confidentiality breach.
Improper authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user to copy or move workflow definitions across project boundaries through the batch-copy and batch-move endpoints, which omit the project-level permission check. Exploitation requires a valid account on the instance with access to at least one project but without the required permissions on the targeted projects, and the effect is limited to low confidentiality and integrity impact (cross-project workflow manipulation) with no availability or code-execution impact; there is no public exploit identified at time of analysis and no confirmed active exploitation. Because the flaw matters mainly in multi-tenant or shared deployments with untrusted tenants, the aggregate signals place it at LOW-to-MEDIUM priority, but organizations relying on DolphinScheduler project isolation as a security boundary should patch promptly.
Incorrect authorization in Apache DolphinScheduler before 3.4.3 allows an authenticated user who holds only read permission on a project to modify workflow instances inside that same project by sending a request to the PUT /projects/{projectCode}/workflow-instances/{id} endpoint, which fails to enforce the write permission the operation requires. The flaw is assessed as CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, meaning remote, authenticated, low-complexity exploitation with a limited integrity impact and no confidentiality or availability impact; the attacker must already possess valid credentials and read access to the target project, so exposure is largely limited to insiders or compromised low-privilege accounts. There is no public exploit code identified at time of analysis and the issue is not listed in CISA KEV, so it should be treated as a genuine but low-severity authorization bug rather than an urgent, actively exploited threat; upgrading to 3.4.3 fully remediates.
Improper authorization in Apache DolphinScheduler's sub-workflow task handling allows an authenticated user who lacks access to a given project to reference and execute a workflow owned by that project, bypassing project-level access controls. Only deployments using project boundaries as a security boundary (multi-tenant or multi-team instances) are meaningfully exposed, and exploitation requires a low-privileged authenticated account able to create workflows and sub-workflow tasks (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L); no victim interaction is required. Impact is bounded to unauthorized execution of workflow tasks and exposure of data or resources reachable by the target workflow, and no public exploit code has been identified at time of analysis.
Open redirect in the HPE OneView management web interface allows a remote, unauthenticated attacker to craft a URL that, once clicked by a victim, sends that victim's browser to an arbitrary attacker-chosen destination. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) and does not compromise the OneView server itself; the practical risk is phishing and credential-theft staging that borrows the trust of a legitimate OneView hostname. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the overall risk is assessed as low, with the user-interaction prerequisite the primary limiting factor.
Information disclosure in the underlying operating system of HPE Networking Instant On 3.4.1.0 and earlier allows an authenticated, high-privileged local attacker to read sensitive data from the device, which could then be leveraged to reach further network services supported by the platform - but only when unspecified preconditions outside the attacker's control are satisfied. Per the CVSS vector (AV:L/AC:H/PR:H/UI:N), exploitation requires local presence on the device, pre-existing administrative privileges, and a high-complexity conjunction of runtime conditions, with no user interaction; the resulting confidentiality impact is rated High while integrity and availability are unaffected (CVSS 4.1). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is low because the issue is confined to post-compromise scenarios on already-privileged local access.
An out-of-bounds write in the printf builtin of the dash shell allows a local user to corrupt one or two bytes past a four-byte reservation when a crafted Unicode \u or \U escape expanding to a five- or six-byte token is processed, including via 'dash -c' with the escape passed as a positional argument to printf or 'echo %b'. The flaw affects dash as shipped in Red Hat Enterprise Linux 6 (CPE cpe:2.3:a:red_hat:red_hat_enterprise_linux_6) and is rated CVSS 4.0 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). No public exploit code was identified at time of analysis, and the bounded write stays within the caller's own shell process, so it provides no inherent privilege escalation.
Local privilege escalation in LXC can occur when lxc-copy updates a cloned container's hostname in host context and follows a symlink planted in the source container's root filesystem. An attacker who already controls files in a container can position the symlink, and a host administrator must then run lxc-copy against that container, causing a root-privileged write to an attacker-chosen path and potentially compromising the host. The assessed vector is CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H, and no public exploit or active exploitation is identified in the available data.
Ubuntu is the only vendor identified for CVE-2026-96544, but the intelligence feed supplies no description, CWE, CVSS score, or CVSS vector, so the affected component, the vulnerable version range, and the resulting impact are all unconfirmed. The identifier comes from a vendor advisory channel (vendor:ubuntu), which indicates the flaw is most likely tracked against one or more Ubuntu source packages rather than a third-party upstream product, but the specific package and release cannot be determined from the data at hand. No public exploit code and no confirmed active exploitation are indicated by the supplied intelligence, and because no CVE record, Ubuntu Security Notice, or patch reference was included, no meaningful severity or risk rating can be assigned until the authoritative record is retrieved.
Ubuntu Linux is the only product context available for CVE-2026-88841, and the record is effectively a placeholder: the supplied intelligence contains no description, no affected package or component name, no CVSS score or vector, no CWE mapping, no CPE identifiers, and no references beyond the originating vendor tracker (vendor:ubuntu). Because of this, the concrete impact, attack vector, authentication requirements, and platform prerequisites cannot be stated, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the available data; the only defensible action at this point is to obtain the Ubuntu CVE tracker entry and the referenced upstream advisory before making any defensive or prioritization decision.
Risk cannot be meaningfully assessed from the available data for CVE-2026-96543, which is currently known only through the vendor:ubuntu security feed with no description, no CWE, no CVSS score or vector, and no identified affected package. Because the affected product or feature, the protocol involved, and the configuration prerequisites are all absent, it is not possible to determine who is affected or what an attacker could achieve. No public exploit identified at time of analysis, and no patch version data was supplied, so the corresponding Ubuntu Security Notice (USN) must be reviewed manually to establish exploitation prerequisites and impact.
No impact assessment is possible for CVE-2026-95622 from the intelligence available at this time: the record supplies no description, no CVSS score or vector, no CWE classification, and no CPE identifiers, and the only attribution is a 'vendor:ubuntu' reporter tag. Consequently the vulnerable component, the affected Ubuntu package and release, and the privileges an attacker would require remain unknown, and no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal are present to suggest real-world activity. The identifier should be treated as unverified and non-actionable until NVD/MITRE publishes the CVE record and the Ubuntu security team issues a corresponding USN or tracker entry.