Command injection in the Ziroom ZHOME A0101 smart-home hub (firmware 1.0.1.0) allows an attacker with high-privilege authenticated access to the management API to execute arbitrary OS commands via the conloglevel and log_size arguments of the set_syslog function exposed at /api/ZRnetwork/set_syslog. The flaw is network-reachable and needs no user interaction, and publicly available exploit code exists (a GitHub write-up), so the practical risk is elevated wherever the device API is exposed or admin credentials are weak or default - the PR:H requirement is the main limiting factor, and the vendor was contacted early but did not respond. No CISA KEV entry confirms active exploitation, and EPSS data was not provided.
Authenticated command injection in Ziroom ZHOME A0101 firmware 1.0.1.0 lets a privileged user execute arbitrary operating-system commands on the device by supplying shell metacharacters in the hostname or zonename argument of the /api/ZRFirmware/set_time_zone API endpoint. The endpoint is network-reachable and needs no user interaction (CVSS 4.0 base 8.5), but the vector carries PR:H, so an attacker must already hold a high-privileged authenticated session before the injection can be triggered - this is a post-authentication command execution issue, not an unauthenticated one. Publicly available exploit code exists (a PoC write-up on GitHub referenced by VulDB), the vendor was contacted early and did not respond, and no vendor-released patch has been identified at time of analysis.
Stored cross-site scripting in GitLab CE/EE lets an authenticated user who can create or modify a merge request embed crafted content in a path component that the merge request diff viewer fails to sanitize, so arbitrary JavaScript executes in the browser session of any other user who views that diff. All versions from 13.11 up to the fixed releases 19.2.7, 19.3.3 and 19.4.1 are affected; the CVSS 3.1 base score is 8.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N), reflecting network reachability, low privileges required, mandatory victim interaction, and a scope change because the attacker compromises a different user's session rather than their own. Publicly available exploit code exists - the issue was disclosed through GitLab's HackerOne program - but there is no evidence of confirmed active exploitation (CISA KEV) at time of analysis.
A stack-based buffer overflow in the FAST FAC1203R router firmware (version 20200116_2.0.4) is reachable through the MmtAtePrase parser inside the _tWlanTask function, letting an attacker on the same LAN or WiFi segment send crafted input that corrupts the stack and can lead to full compromise of the device (assessed CVSS:3.1 base 8.8, AV:A/AC:L/PR:N/UI:N/C:H/I:H/A:H). No authentication or user interaction is required once the attacker has local network adjacency, so the realistic exposure is confined to attackers who can join or reach the local network rather than the general internet. Publicly available exploit code exists and a proof-of-concept repository has been published, but there is no indication of confirmed active exploitation (CISA KEV) at time of analysis, and the vendor did not respond to disclosure, so no vendor patch is currently identified.
Cross-origin requests from attacker-controlled web pages can invoke the mcp-chrome-bridge native-server HTTP API (all versions through 1.0.31) running on the victim's host, allowing script execution, page-content reading, and screenshot capture through the browser automation tools the bridge exposes. The root cause is an origin validation error (CWE-346) that lets cross-origin browser traffic reach endpoints that should be restricted, yielding a CVSS 4.0 score of 8.6 and an independent 3.1 assessment of AV:N/AC:L/PR:N/UI:R/C:H/I:H/A:N. Exploitation requires no authentication but is interaction-gated: the bridge must be installed and running on the victim's machine and the victim must visit or be redirected to a malicious page in a local browser. No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV.
Untrusted git configuration includes reachable through simple-git before 4.0.0 let an attacker execute arbitrary commands with the privileges of the Node.js process. The default blockUnsafeOperationsPlugin failed to classify include.path inside customArgs passed to git.clone(), and the initial remediation also missed includeIf.<condition>.path, so a loaded config file could set an executable option such as core.sshCommand that Git runs during the clone. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:H/PR:N/UI:N, base 8.1) but requires both attacker-influenced customArgs reaching git.clone() and an attacker-controlled file already readable by the Node.js process; no public exploit was identified at time of analysis and the issue is fixed in simple-git 4.0.0.
Authentication bypass in self-hosted Bitwarden Server versions 2025.6.0 through 2026.5.0 backed by Microsoft SQL Server allows a user with a provisionable SSO identity to obtain a victim-scoped access token. The stored procedure User_ReadBySsoUserOrganizationIdExternalId declares its @ExternalId parameter as NVARCHAR(50) while the column it queries stores NVARCHAR(300), so an identity-provider ExternalId whose value begins with a victim organization member's full 50-character identifier is silently truncated and matches that member's record during SSO login. Exploitation requires organization SSO login enabled on a SQL Server deployment plus knowledge or control of an IdP identifier sharing the victim's 50-character prefix (CVSS vector shows PR:L), making the attack targeted rather than broadly opportunistic; publicly available exploit code exists but there is no CISA KEV confirmation of active exploitation. The flaw is fixed in Bitwarden Server 2026.5.0, and despite the supplied 'Information Disclosure' tag its actual outcome is account takeover (CWE-303).
virtualenv versions prior to 21.7.12 cache and seed pip/setuptools wheels without verifying their bytes, so an attacker who controls the wheel delivery path can substitute a different wheel under the requested distribution, version, and filename and have it injected into every environment virtualenv subsequently creates. The flaw is exploitable unauthenticated but requires an active man-in-the-middle position, a compromised index, or a stale/poisoned mirror, and requires a user to actually create or seed a virtual environment. No public exploit code was identified at time of analysis, and the digest check is intentionally skipped whenever PIP_INDEX_URL, PIP_EXTRA_INDEX_URL, or PIP_INDEX points at a custom index - meaning custom-index users remain unverified even after upgrading.
Improper privilege management in RaspAP WebGUI through 3.5.5 lets an authenticated low-privilege web-UI user escalate to root by manipulating how the plugin installer writes sudo configuration entries through PluginInstaller::addSudoers (src/RaspAP/Plugins/PluginInstaller.php). Exploitation is remote and unauthenticated attempts are not possible - the attacker must already hold a valid RaspAP panel session (CVSS 4.0 PR:L, independently assessed as CVSS 3.1 AV:N/AC:L/PR:L/UI:N, C:H/I:H/A:H) - but no user interaction or unusual complexity is required beyond that. Publicly available exploit code exists (a GitHub gist demonstration was published alongside the VulDB entry), and the vendor was contacted but did not respond, so no vendor-released patch has been identified at time of analysis; this is a genuine high-impact issue but not an emergency, with exposure concentrated on panels reachable from untrusted networks or protected only by default credentials.
Privilege escalation in FastAdmin (versions 1.6.1.20250430 and 1.6.5.20260602) lets an attacker who already holds an authenticated administrator session manipulate the Database Management component via application/database.php so that code runs with privileges beyond those intended, resulting in full compromise of confidentiality, integrity, and availability of the affected instance. Exploitation is network-reachable but heavily gated: the assessed vector (CVSS:3.1/AV:N/AC:L/PR:H/UI:R, score 7.1) requires high privileges and user interaction, so an unauthenticated attacker against a default install cannot trigger it directly. Publicly available exploit code exists and is referenced in a public GitHub issue, though there is no KEV confirmation of active exploitation; the EPSS-style exploit maturity flag in the CVSS 4.0 vector (E:P) reinforces that a working proof of concept is circulating.
Missing authorization checks in mall4j through 4.0 let any authenticated low-privilege account read the entire customer address book via the admin-side GET endpoints /user/addr/page and /user/addr/info in UserAddrController, exposing names, phone numbers and postal addresses. Exploitation requires only a valid, low-privileged login (PR:L) reachable over the network with no user interaction and no special configuration, and publicly available exploit code exists in a GitHub proof-of-concept repository. The flaw is a data-exposure issue (confidentiality only, no write or availability impact), and no vendor-released patch was identified at time of analysis.
Time-based blind SQL injection in ClipBucket v5 (through 5.5.3-#197) allows an authenticated administrator who holds the video_moderation permission to inject arbitrary SQL through the videoid parameter of the admin video edit function, enabling extraction and partial modification of database contents. Exploitation requires a valid high-privilege admin session with that specific permission, so anonymous or low-privilege users cannot trigger it; once such an account is authenticated, no user interaction or non-default configuration is needed. Publicly available exploit code exists (a published two-blind-SQLi write-up), and an upstream fix is available as a commit that casts videoid to an integer; the issue is a real but modest-priority finding given the authentication prerequisite.
Time-based blind SQL injection in ClipBucket v5 (all builds through 5.5.3-#197) allows an authenticated administrator holding the basic_settings permission to inject arbitrary SQL through the language_id parameter of the language update function, enabling extraction or modification of database contents. The flaw is reachable over the network with no user interaction, but the high-privilege prerequisite is the primary limiting factor: neither unauthenticated nor low-privilege users can trigger it, and builds patched after upstream commit ecbdf2d5 are not affected. Publicly available exploit code exists (a published HackMD write-up demonstrating the blind SQLi), though there is no confirmed active exploitation (no CISA KEV listing); EPSS-style urgency is moderate given the admin-level access required.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat lets an authenticated, high-privilege operator inject SQL through the 'reportType' parameter of the product summary report in the balancing reports section, with data recovered indirectly by measuring database response delays rather than returned in the response. The issue is remotely reachable with no user interaction but is gated behind a privileged session (vendor CVSS:4.0 base 8.5; independent assessment CVSS:3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L), so confidentiality is the primary exposure while integrity and availability impacts remain limited. Exploitation status: no public exploit identified at time of analysis, and the vendor addresses it by upgrading to TMS7 v7.8; taken together this is a genuine but access-gated data-confidentiality issue in a niche OT deployment rather than an internet-wide emergency.
Time-based blind SQL injection in Toptech Systems TMS7 and TopHat terminal management software lets an authenticated high-privilege user inject SQL through the 'screenID' parameter of the electronic transaction queue viewer in the manual transactions section, using response-time delays to infer database contents. Exploitation requires an existing high-privilege (PR:H) session on the affected web interface, so anonymous and low-privilege users are excluded, and the blind, inference-based technique makes data extraction slow rather than directly returned. No public exploit code has been identified at time of analysis and the issue is remediated in TMS7 version 7.8, so despite the vendor's CVSS 4.0 score of 8.5 the practical operational priority for most terminal operators is moderate.
Time-based blind SQL injection in the home-page search function of Toptech Systems' TMS7 terminal management application lets an attacker who already holds a high-privileged session inject SQL through the 'pattern' query parameter and infer database contents from response timing. The vendor addressed the flaw in TMS7 version 7.8, so unpatched pre-7.8 deployments are the exposed population; TOPHAT is also listed in the affected CPE set. The issue requires authenticated high-privileged access (CVSS PR:H) and the product has a limited OT footprint, so this is a real but access-gated concern rather than an internet-scale emergency, and no public exploit identified at time of analysis.
Time-based blind SQL injection in the 'search' parameter of the view-audit-logs feature (utilities section) of Toptech Systems' TMS7 and TopHat terminal-automation platforms, confirmed affecting version 7.6.3, lets an attacker with an authenticated high-privilege session force the backend database to leak data through conditional response delays. Exploitation is access-gated rather than open: the independent assessment (CVSS 3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L) aligns with the vendor's v4.0 vector (PR:H) in requiring a privileged, authenticated foothold, and the flaws sit in OT/terminal-management deployments that are normally segmented rather than internet-facing. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has shipped a fix in TMS7 v7.8.
Time-based blind SQL injection in the business allocation search feature of Toptech Systems TMS7 and TopHat 7.6.3 and earlier lets a high-privilege authenticated attacker inject SQL through the supplier_no parameter and infer database contents by measuring conditional query delays. The vendor fixed the issue in TMS7 v7.8, documented in CISA ICS advisory ICSA-26-272-02 and tracked as EUVD-2026-89428, and no public exploit code or confirmed active exploitation was identified at time of analysis. Because exploitation requires a privileged authenticated session against the business allocation search endpoint, the issue is access-gated rather than broadly reachable, although the assessed confidentiality and availability impacts on the database are high.
Lantronix G520 Series firmware (2.6.0.4R6 stable, covering G526, G526RP, G527 and G528) can be induced to treat forged software packages as authentic, because the boot-time 'stock done' routine disables OPKG signature verification before restoring optional packages from a writable, unsigned feed, and because the production private key whose public counterpart is trusted by both stable and beta builds ships inside the publicly distributed Lantronix SDK. An attacker who can deliver a malicious package onto the device's update/feed path and get it processed can execute arbitrary code with root privileges at install time, although the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R) shows this is gated by attack requirements and passive user interaction rather than a one-shot unauthenticated remote compromise. No public exploit code, PoC, or confirmed in-the-wild exploitation was identified at the time of analysis, but the combination of an exposed trust anchor and a signature-verification bypass makes this a genuine high-impact integrity flaw rather than an inflated score.
Update metadata fetched over plain HTTP by Lantronix G520 series devices (reported against firmware 2.6.0.4R6 stable, covering G526, G526RP, G527 and G528 models) can be tampered with so that a stored value is later served by the management interface as JSON and rendered as raw HTML by the update-information web page, allowing attacker-controlled script to run in an authenticated administrator's browser. Because the same authenticated origin also exposes an interface that executes system-level commands with root privileges, an attacker who can inject metadata can escalate from script execution to arbitrary code execution in the device's administrative context. The vendor-assigned CVSS 4.0 base score is 7.7, but the attack is not opportunistic: it requires an on-path/adversary-in-the-middle position against the unencrypted update channel (AT:P) and an administrator who opens the affected page (UI:P), and no public exploit code or confirmed active exploitation was identified at time of analysis - the issue was reported through CISA's ICS coordination process (ICSA-26-272-01).
Session fixation (CWE-384) in Toptech Systems TMS7 and TopHat terminal management platforms allows an attacker to seed a chosen session identifier into a victim's browser/client and then reuse that same identifier after the victim logs in, effectively hijacking the authenticated session and gaining the victim's privileges on the fuel-terminal management application. The reported severity is CVSS 7.5 (CVSS v4.0), and the independent assessment rates confidentiality and integrity impact as high with high attack complexity, because success requires both successful session-ID seeding and the victim subsequently authenticating with that identifier. No public exploit code has been identified and the flaw is not listed as confirmed actively exploited (CISA KEV) at time of analysis, though ICS-CERT has published an advisory (ICSA-26-272-02) indicating OT/ICS relevance.
Unauthenticated path traversal in Balbooa Forms (a Joomla extension) before 2.4.3.4 allows remote attackers to exfiltrate local files readable by the Joomla process via crafted upload-field JSON during public form submission. The flaw requires that the target form has both the 'auto reply' and 'attach uploaded files' options enabled, limiting exploitability but still posing high risk given the CVSS 4.0 score of 8.9 and no authentication or user interaction required. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed via CISA KEV.
Unbounded memory allocation in urllib3 (1.10.3 through 2.7.x) lets a malicious or machine-in-the-middle HTTP server exhaust the memory of a Python client process by streaming an unterminated chunk-size line in a 'Transfer-Encoding: chunked' response. Only clients that consume the response through the streaming path (HTTPResponse.stream() or HTTPResponse.read_chunked()) are affected; the non-streaming .read() path was already bounded to http.client._MAXLINE. Exploitation is unauthenticated (CVSS:4.0 vector PR:N, assessed CVSS:3.1 PR:N) but requires the client to reach an attacker-controlled or intercepted endpoint, so SSRF-prone, proxy, crawler, and webhook-fetching services are the realistic exposure; impact is denial of service only (C:N/I:N/A:H, no RCE), and no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in Joomla CMS versions 4.0.0-5.4.8 and 6.0.0-6.1.3 allows an authenticated, high-privileged attacker to make the server issue requests to arbitrary URLs via improperly validated URLs in various core extensions. Exploitation requires a backend or administrator account and is not achievable by anonymous users; high attack complexity means a single reliable request is insufficient. No public exploit code or active exploitation has been identified at time of analysis.
Command injection in IBM Guardium Data Protection 12.2 lets an authenticated attacker who can influence security policy alert text execute arbitrary operating system commands with root privileges through the SNMP alert notification functionality. Exploitation is gated behind valid credentials with policy-authoring capability and requires that the deployment actually uses SNMP alerting, so this is a privileged-insider or compromised-account risk rather than an opportunistic remote attack; no public exploit code was identified at time of analysis and CISA SSVC records no known exploitation. IBM has published a vendor patch, and the EPSS score is low (0.67%, ~50th percentile), consistent with a credible high-impact issue that is not an emergency.
IBM DataStage on Cloud Pak for Data 5.4.0.0 contains a path traversal flaw in its archive extraction routine that lets a remote attacker with a valid authenticated account write files outside the intended destination directory and ultimately execute arbitrary code with the privileges of the affected service (CVSS 3.1 base 8.8, AV:N/AC:L/PR:L/UI:N/C:H/I:H/A:H). The root cause is CWE-22 improper limitation of a pathname to a restricted directory, commonly known as an archive 'zip-slip' condition, where crafted entries in an uploaded archive escape the extraction root. Authentication is mandatory, so this is not an unauthenticated flaw; no public exploit code and no confirmed active exploitation were identified at time of analysis, and the realistic risk is concentrated in enterprise Cloud Pak for Data deployments where the attacker already holds platform credentials or a foothold.
Wireshark 4.6.0 through 4.6.8 and 4.4.0 through 4.4.18 can be crashed by processing attacker-controlled SPDY protocol data, an availability-only denial-of-service condition that our independent assessment scores as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L. The signals conflict and, on balance, point to a LOWER real-world priority than the headline 8.8 suggests: exploitation requires the victim to open a crafted capture file or live-capture crafted SPDY traffic, publicly available exploit code exists, EPSS is only 0.45% (37th percentile), and there is no confirmed active exploitation (CISA KEV). Unauthenticated attackers can trigger the crash, but user interaction is mandatory and the impact is limited to terminating the Wireshark process, not code execution or data compromise.
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.
Memory corruption in U-Boot's IP fragment reassembly code (net/net.c) allows remote, unauthenticated attackers on the boot network to crash the bootloader and corrupt adjacent memory while a device is performing a netboot. Only builds compiled with CONFIG_IP_DEFRAG are affected - an opt-in, frequently disabled compile option - so deployments without it are not vulnerable, and exploitation requires delivering a crafted IP fragment with a non-zero offset and the More-Fragments flag onto the boot path during the narrow netboot window. The CVSS 4.0 base score is 8.8 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H), an availability-dominant flaw with only limited integrity impact and no confidentiality loss, and no public exploit has been identified at time of analysis (no CISA KEV listing).
Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.
Memory corruption in U-Boot’s NFS READLINK handling can crash the bootloader on devices booting over NFS. A malicious or man-in-the-middle NFS server can return a crafted symlink length that triggers a signed-to-unsigned conversion error (CWE-195) and out-of-bounds access in nfs_readlink_reply(), affecting U-Boot versions before 2026.10-rc5; the vendor CVSS 4.0 base score is 8.8. Exploitation requires the device to be actively performing an NFS netboot and reaching the attacker-controlled server, so idle or non-NFS-boot devices are unaffected, and no public exploit code or CISA KEV active exploitation is identified at time of analysis.
Use-after-free in the DOM: Core & HTML engine of Mozilla Firefox allows memory corruption that can be driven by attacker-controlled web content, potentially yielding code execution or memory disclosure inside the browser's content process. Affected are Firefox releases before 157 and the ESR branches before 153.4, 140.17, and 115.42; exploitation only requires that the victim load a malicious or compromised page (UI:R) with no authentication and no non-default settings, since the DOM Core/HTML code path is always active. Mozilla has published fixed versions and no public exploit was identified at time of analysis, and the achievable impact is bounded by Firefox's content-process sandbox unless chained with a separate escape.
Use-after-free in Mozilla Firefox's XSLT engine lets a remote, unauthenticated attacker corrupt memory by getting a victim to render attacker-controlled content that performs an XSL transformation, with the assessed CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflecting high confidentiality, integrity, and availability impact. The flaw affects Firefox builds before 157 and ESR builds before 153.4, 140.17, and 115.42, and is remediated in those releases. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing); the main practical barrier is the mandatory user interaction, since the victim must visit or render the malicious content for the XSLT path to execute.
Use-after-free in Mozilla Firefox's Graphics: Canvas2D rendering component allows a remote, unauthenticated attacker to corrupt browser memory and potentially achieve arbitrary code execution when a victim loads crafted web content in an unpatched build. Exploitation hinges on user interaction - the victim must open a malicious or compromised page that exercises the Canvas2D path - and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects high confidentiality, integrity, and availability impact confined to the browser process by the renderer sandbox. No public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (CISA KEV), making this a serious client-side bug rather than an emergency; vendor-released fixes are Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42.
Memory corruption in Mozilla Firefox's DOM: Core & HTML component allows unauthenticated remote attackers to trigger a use-after-free when a victim loads attacker-controlled web content, potentially leading to arbitrary code execution, information disclosure, or crashes. Affected versions include Firefox before 157 and Firefox ESR before 153.4, 140.17, and 115.42; the flaw is patched in those fixed releases. Exploitation requires user interaction in default browsing and must contend with Firefox sandboxing and heap-hardening mitigations; no public exploit identified at time of analysis (no CISA KEV confirmation).
A use-after-free in Firefox's Layout: Text and Fonts component lets remote attackers corrupt memory by enticing a victim to open crafted web content, potentially leading to code execution within the browser's content process. Unauthenticated network attackers can trigger it with low complexity, but the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8 High) confirms a successful attack requires user interaction and no privilege is needed beforehand. Affected builds are those prior to Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; there is no CISA KEV entry and no public exploit identified at time of analysis, though the memory-corruption class makes weaponization plausible.
A use-after-free flaw in Firefox's DOM Core & HTML component (CWE-416) can corrupt browser memory when a victim loads attacker-controlled web content, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). All supported release channels are affected below the fixed builds - Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42 - and the flaw is exploitable by unauthenticated remote attackers only if the user actively visits or is induced to load a malicious page (UI:R), with no server-side exposure. No public exploit code and no confirmed active exploitation were identified at time of analysis; impact ranges from information disclosure and memory corruption to a potentially exploitable crash or code execution, though reliable exploitation requires winning the heap reallocation race and defeating browser sandbox mitigations, placing it in the normal severity band for this bug class rather than an emergency.
A use-after-free in Mozilla Firefox's XSLT (XML stylesheet transformation) engine can be triggered when a victim loads attacker-controlled content that exercises stylesheet processing, allowing memory corruption that jeopardizes confidentiality, integrity, and availability of the browser session. The flaw affects Firefox builds prior to 157, ESR 153.4, ESR 140.17, and ESR 115.42, and requires no privileges (PR:N) but does require user interaction (UI:R) - the target must open a malicious page or XML document, with no zero-click or server-side path indicated by the available data. Mozilla has released fixed versions across all supported release and ESR channels; no public exploit code was identified at time of analysis.
Use-after-free in the Graphics: Canvas2D component of Mozilla Firefox allows remote, unauthenticated attackers to corrupt browser memory when a victim renders attacker-controlled web content - a malicious page, ad, or iframe provides the required user interaction (UI:R). Successful exploitation can expose or modify memory (high C/I/A impact per the 8.8 CVSS), causing crashes and potentially arbitrary code execution inside the content/renderer process, although turning the primitive into reliable code execution also requires defeating Firefox's site isolation, sandbox, and ASLR hardening, which keeps practical difficulty above the raw score. Only unpatched builds are affected; Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42 carry the fix, and no public exploit code or active exploitation was identified at the time of analysis.
Use-after-free in Mozilla Firefox's DOM: Core & HTML implementation lets remote attackers corrupt browser memory and potentially achieve arbitrary code execution when a victim loads attacker-controlled web content in an unpatched build. The flaw carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), meaning exploitation is network-reachable and low-complexity and requires no authentication, but does depend on user interaction - the victim must open a malicious or compromised page. Every supported channel is affected prior to the fixed releases (Firefox 157, Firefox ESR 153.4, ESR 140.17, and ESR 115.42); there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV), though successful heap grooming of the freed DOM object can escalate beyond a crash within the constraints of Firefox's sandbox and mitigations.
Use-after-free in Mozilla Firefox's IndexedDB storage implementation allows a remote, unauthenticated attacker to execute arbitrary code with the victim's privileges by convincing them to load attacker-controlled web content that exercises the IndexedDB API. CVSS 3.1 scores it 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality, integrity, and availability impact, with the only meaningful barrier being the required user interaction - no authentication or non-default configuration is needed. Mozilla fixed the flaw in Firefox 157, Firefox ESR 153.4, Firefox ESR 140.17, and Firefox ESR 115.42; no public exploit code or confirmed active exploitation was identified at time of analysis, but given Firefox's enormous install base and the browser-context code execution primitive, this warrants priority patching rather than emergency escalation.
Mozilla Firefox builds prior to version 157, along with the ESR branches prior to 153.4, 140.17, and 115.42, contain a use-after-free in the Networking: Cache component that lets a remote attacker corrupt memory by persuading a victim to render attacker-controlled web content. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) is the classic browser drive-by profile: no authentication is required, complexity is low, but exploitation depends on the user navigating to or loading a malicious page that reaches the specific cache code path, and the content-process sandbox limits how far a single use-after-free can be pushed toward full system compromise. The flaw is patched in Firefox 157 and Firefox ESR 153.4, ESR 140.17, and ESR 115.42; no CISA KEV listing and no public exploit code were identified at time of analysis, so this is a patch-now, high-severity memory-safety bug rather than a confirmed actively exploited one.
Use-after-free (CWE-416) in Mozilla Firefox's Widget component allows remote attackers to potentially execute arbitrary code when a victim renders attacker-controlled web content in unpatched versions (before Firefox 157, Firefox ESR 153.4, ESR 140.17, or ESR 115.42). Successful exploitation requires reliable heap manipulation and depends on the user opening malicious content (UI:R), but can achieve high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.
Memory corruption in the U-Boot bootloader's NFS client lets a malicious or man-in-the-middle NFS server overflow the packet buffer in nfs_read_reply(), crashing the bootloader or corrupting memory before control is handed to the kernel. Affected are U-Boot builds prior to 2026.10-rc5 that perform NFS netboot (CPE cpe:2.3:a:u-boot:u-boot:*); the flaw is reachable by an unauthenticated network attacker (CVSS vector PR:N), though per our assessment the practical outcome is a boot-time denial of service with limited integrity impact rather than confirmed code execution, since the device must be actively NFS-booting and the attacker must control or intercept the NFS server on the boot network. A vendor patch exists (commit 0bbf0985, fixed in 2026.10-rc5) and no public exploit code was identified at time of analysis.
A use-after-free in Mozilla Firefox's WebAssembly component allows remote attackers to potentially execute arbitrary code by enticing a victim to visit a malicious web page. The vulnerability affects Firefox versions before 157, Firefox ESR before 153.4, and Firefox ESR before 140.17; no authentication or non-default configuration is required, but exploitation requires user interaction (UI:R). No public exploit code or active exploitation has been identified at time of analysis, and browser process sandboxing limits the impact.
Use-after-free in Mozilla Firefox's DOM: Core & HTML component (CWE-416) lets remote attackers achieve full confidentiality and integrity impact against unpatched Firefox builds when a victim simply loads attacker-controlled web content, matching the CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Affected are Firefox versions prior to 157, Firefox ESR prior to 153.4, and Firefox ESR prior to 140.17; exploitation needs no authentication or non-default configuration, and the mandatory browsing/user interaction is the primary limiting factor. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (no CISA KEV listing), but Mozilla has shipped fixed builds, so prioritization should focus on unpatched endpoints in browser-exposed or high-value user populations.
Use-after-free in Mozilla Firefox's JavaScript WebAssembly component lets remote attackers corrupt memory and potentially achieve code execution or disclose sensitive data when a user loads attacker-controlled web content containing a malicious WebAssembly payload. The flaw affects default Firefox configurations up to Firefox 157 and the ESR branches-Firefox ESR 153.4 and Firefox ESR 140.17 are the first fixed releases-and requires no authentication, only that the victim browse a crafted page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, making this a genuine but not top-tier priority; exploitation is client-side and requires user interaction, and because scope is unchanged the initial impact is confined to the content process unless chained with a separate sandbox-escape bug.
Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.
Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.