Information disclosure in IBM Langflow OSS versions 1.0.0 through 1.12.2 allows a remote authenticated attacker with only low-level privileges to obtain sensitive information, because authorization checks are not properly enforced on certain resources. The assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) confirms network reachability and low attack complexity but also that a valid account is a prerequisite, so unauthenticated external attackers cannot exploit it directly; there is no integrity or availability impact. At time of analysis there is no public exploit identified, and the primary risk is for multi-tenant or publicly registrable Langflow deployments where obtaining a low-privileged account is trivial. IBM has published a vendor advisory covering this issue.
Low-privileged authenticated users of IBM Langflow OSS 1.0.0 through 1.12.2 can retrieve credentials that the platform fails to protect adequately, exposing stored secrets such as integration keys and API tokens to any account holder on the instance. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N, base 7.7 High) confirms a network-reachable flaw requiring only low privileges and no user interaction, with a scope change and high confidentiality impact but no integrity or availability effect. Exploitation requires a valid authenticated session, which rules out anonymous internet attacks; no public exploit has been identified at time of analysis and IBM has published fixes via its support advisory, so the highest residual risk sits in multi-user or multi-tenant deployments where low-trust accounts coexist with high-value stored credentials.
Unauthenticated IDOR in the Wappointment appointment-booking plugin for WordPress (all versions through 2.7.7) allows remote attackers to access and tamper with appointment records they do not own by supplying or enumerating object identifiers that the plugin fails to authorize. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, base 6.5) confirms no authentication, privileges, or user interaction are needed, so any network-reachable WordPress site running the plugin at or below 2.7.7 is exposed; impact is bounded to partial confidentiality and integrity loss with no availability impact. No public exploit code and no CISA KEV listing were identified at time of analysis, and no EPSS score was provided, making this a moderate-priority issue rather than an emergency - though unauthenticated Internet exposure and the ease of identifier enumeration keep it worth prompt attention.
Unauthenticated settings modification in the TrueBooker appointment-booking WordPress plugin (versions 1.2.9 and earlier) lets remote attackers alter plugin configuration without logging in, rated CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N, meaning no privileges, no user interaction, and low attack complexity are required against default installs. The flaw is a CWE-862 missing authorization condition that affects integrity (limited) and availability (limited) but not confidentiality, so the practical outcome is tampered or degraded booking/settings behaviour rather than data theft or code execution. Exposure is bounded by deployment scope - only WordPress sites running this specific ThemeTechMount plugin at a vulnerable version are at risk - and no public exploit code or confirmed active exploitation was identified at time of analysis; as of the Patchstack report (EUVD-2026-93042) no fixed version had been published.
Sensitive-value disclosure in the @backstage/plugin-scaffolder-backend package prior to 4.1.0 lets an authenticated user who can create and read scaffolder tasks observe secret values in task logs and error messages. Exposure is conditional: it requires a deployment using the scaffolder permission framework with restrictive action permissions that actually deny an action, plus an affected template that passes a task secret, an environment secret, or a secret-derived 'each' key as input to that denied action. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV); risk is moderate and highly configuration-dependent because default deployments without action-level denials and templates that do not route secrets through denied actions are unaffected.
Improper preservation of access restrictions in Backstage's @backstage/backend-defaults package lets an authenticated holder of a restricted external service credential (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L, rated 7.6) escalate privileges by routing requests through plugin-to-plugin delegation: the credential's permission-name or permission-attribute limits (for example action:read) are dropped when a plugin request token is minted on the credential's behalf, so a read-only principal can perform write operations on plugins it should only be able to read. Only deployments that both use @backstage/backend-defaults and configure external service credentials with accessRestrictions are exposed, and exploitation is scoped to plugins reachable through the delegation path. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV); fixed releases are @backstage/backend-defaults 0.16.1 and 0.17.8.
Uninitialized memory disclosure in Google Chrome's Video component (all versions prior to 155.0.8059.39) lets a remote attacker read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) with no authentication (PR:N), and the resulting leak is confined to the sandboxed renderer, so it would realistically need to be chained with a separate sandbox-escape to reach host data. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile); vendor-released patch 155.0.8059.39 resolves the issue, and CISA SSVC rates exploitation as 'none' with partial technical impact.
Inconsistent credential enforcement in the @backstage/plugin-proxy-backend package (versions 0.5.0 through 0.6.17) lets unauthenticated callers reach nested proxy upstreams that were explicitly configured to require credentials. When an operator defines an overlapping parent proxy path with credentials set to 'dangerously-allow-unauthenticated' and a nested child path under it with credentials set to 'require', the permissive parent exemption is applied to requests matched by the nested route, so the request is forwarded to the protected upstream and may be sent with static upstream credentials configured for that proxy. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) marks this as unauthenticated but high-complexity because exploitation depends on a specific overlapping proxy configuration rather than default settings; no public exploit code has been identified and the issue is not confirmed actively exploited (no CISA KEV listing).
Stored cross-site scripting in the Front End PM WordPress plugin (versions 11.4.6 and earlier) lets an attacker holding a low-privileged Subscriber account inject script payloads through plugin input such as private messages or profile fields, which then execute in the browser of a higher-privileged user who views the content. The flaw is rated CVSS 6.5 (medium, AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L), meaning the attacker must be authenticated and the victim must actively open the tainted content, so exposure is concentrated on sites that permit open or self-service user registration. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited; Patchstack published the finding and no vendor fix version is confirmed in the available data.
Log-file information disclosure in Dell Container Storage Modules (CSM) versions prior to 1.18.0 allows a low-privileged but authenticated remote user to obtain sensitive data that the components write into their own log files (CWE-532). The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N (6.5) confirms confidentiality-only impact with no integrity or availability effect, and exploitation presupposes that the attacker already holds a valid account plus read access to the generated logs, making this a moderate rather than a top-tier priority. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper input validation in Google Chrome's Viz display/compositor component lets an attacker who has already compromised the renderer process bypass system access restrictions by enticing a victim to load a crafted HTML page, producing a high-integrity impact with no confidentiality or availability loss, and consistent with a sandbox defense-in-depth bypass rather than standalone code execution. The flaw affects Chrome builds prior to 155.0.8059.39 and was rated Chromium security severity Medium; it is not a remotely triggerable, unauthenticated compromise of a fully patched browser on its own, because the renderer must be pre-compromised first. There is no public exploit code identified at time of analysis, no CISA KEV listing, and the EPSS score is low at 0.22% (12th percentile), so this is a medium-severity patch-cycle item rather than an emergency one.
Social engineering plus a crafted Chrome extension can let an unauthenticated remote attacker bypass the web origin policy in Google Chrome versions prior to 155.0.8059.39 by exploiting a missing authorization check in DevTools, resulting in high integrity/origin-isolation impact without confidentiality or availability loss. The attack is not a drive-by against a default browser: it requires the victim to install the malicious extension (UI:R). No public exploit was identified at time of analysis, EPSS is low at 0.22% (11th percentile), and a vendor patch is available in 155.0.8059.39.
Web origin policy bypass in Google Chrome on iOS prior to 155.0.8059.39 allows remote attackers to cross origin boundaries and alter content the browser should treat as belonging to a different site, after a victim is persuaded through social engineering to load crafted network traffic (CVSS 6.5, C:N/I:H/A:N). No authentication is required (PR:N), but the mandatory user interaction (UI:R) keeps the attack non-automatable under CISA's SSVC assessment, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation is further constrained by a low EPSS score of 0.21% (11th percentile) and by integrity-only impact that exposes no confidential data and causes no denial of service, which is why this is rated a genuine Medium-severity issue rather than a high-priority emergency.
Backstage's catalog backend (the @backstage/plugin-catalog-backend package) prior to 3.9.1 enforces its allowedLocationTypes restriction inconsistently, letting a disallowed location type be processed when it is inherited from the parent/origin location rather than declared directly. An authenticated user who can register or influence a Location entity in a deployment that has configured an allowedLocationTypes list can therefore trigger the backend to resolve a location type it was supposed to reject, potentially reading files on the backend host. This is a low-severity issue: it requires non-default configuration plus authenticated access and a specific inheritance edge case, and no public exploit code has been identified at time of analysis; the fix is in @backstage/plugin-catalog-backend 3.9.1 (Backstage release v1.54.6).
Stored/reflected cross-site scripting in WC Fields Factory 4.1.12 and earlier allows authenticated subscriber-level attackers to inject script that executes when a higher-privileged user views the affected field content. The plugin is a WooCommerce add-on for WordPress, and successful exploitation can lead to session theft, administrative actions performed in the victim's browser, or content manipulation, though the requirement for a subscriber account and victim interaction substantially narrows practical risk. CVSS 6.5; no public exploit identified at time of analysis, and no CISA KEV status is reported.
Authenticated subscriber-level cross-site scripting (XSS) in the Ohio Extra WordPress plugin up to version 3.6.8 allows attackers with a subscriber account or higher to inject arbitrary JavaScript that executes in the browser of a higher-privileged user who views the injected content. The independent assessment rates this as a moderate-risk issue (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) with no availability impact, requiring victim interaction and confined to browser-context script execution rather than server compromise. No public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV).
Unauthenticated broken access control in the WP Event Solution (Eventin) WordPress plugin, versions 4.1.25 and earlier, allows any remote, network-reachable attacker to reach functionality that should require authorization, with the realistic outcome bounded to low-severity exposure or manipulation of event-related data rather than full site compromise. The flaw carries a vendor-style CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:N/UI:N), and our independent reassessment scopes the impact to low confidentiality only, with no authentication, user interaction, or non-default configuration required. There is no CISA KEV listing, so this is not confirmed actively exploited, and no public exploit code has been identified at time of analysis; the only public reporting is the Patchstack advisory, and the specific vulnerable endpoint is not disclosed, which limits operators' ability to target blocking rules precisely.
Insecure direct object reference in the Faktur Pro for WooCommerce WordPress plugin (all versions up to and including 3.2.1) allows an authenticated WooCommerce customer to read other customers' invoice and order data by substituting a different user's object identifier in a request that fails to enforce per-user ownership checks. The flaw is rated CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N): exploitation is remote and low-complexity but requires a legitimate low-privileged customer account, and the confirmed impact is limited to confidentiality (high) with no integrity or availability effect. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical risk is further bounded by the plugin's niche deployment and the authentication precondition - anonymous visitors cannot trigger it.
An information disclosure flaw in the Omnibox component of Google Chrome for Android lets a remote attacker leak sensitive data through crafted network traffic, provided the victim first performs an attacker-influenced interaction (a social-engineering lure). Only Chrome on Android builds earlier than 155.0.8059.39 are affected; desktop and iOS Chrome are out of scope per the vendor advisory, and the impact is limited to confidentiality with no integrity or availability effect. Google rates the Chromium severity as Medium, EPSS is low at 0.20 percent (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, though a vendor fix is available and should be applied through normal update channels.
Incorrect authorization in the Passwords component of Google Chrome on iOS lets a remote, unauthenticated attacker bypass web origin policy if a victim opens an attacker-controlled crafted HTML page (CVE-2026-106381, CWE-863). The flaw is confined to the iOS build of Chrome and to versions prior to 155.0.8059.39, which Google has addressed with a vendor-released patch; the assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N, 6.5, Chromium severity Medium) scores high only for integrity impact, so the exposure is unauthorized cross-origin action or modification rather than confirmed credential disclosure. No public exploit code, proof-of-concept, or confirmed active exploitation was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); the primary practical barrier is the required user interaction - driving a victim on iOS to load the malicious page.
Missing authorization in Chrome's Animation component (CWE-862) affects Google Chrome versions prior to 155.0.8059.39 and lets a remote, unauthenticated attacker bypass web origin policy when a victim loads a crafted HTML page. The attack is not passive: exploitation requires the user to navigate to attacker-controlled content (UI:R), but no credentials or non-default browser settings are needed, and success is bounded to an integrity impact (C:N/I:H/A:N) on the browser session rather than code execution or data theft. No public exploit code was identified and there is no confirmed active exploitation (no CISA KEV listing); EPSS is 0.20% (9th percentile), and a vendor patch is available, making this a moderate-priority, patch-and-move-on issue.
Google Chrome versions before 155.0.8059.39 contain a missing authorization check in the browser's SignIn component that a crafted, attacker-supplied Chrome extension can abuse to read sensitive sign-in information, making this primarily an information-disclosure issue rather than a full system compromise. Exploitation is not drive-by: it requires the victim to be socially engineered into installing the malicious extension (UI:R), and the attacker needs no prior privileges or credentials on the target (PR:N). No public exploit code or evidence of active exploitation was identified at time of analysis, and while the published CVSS score is 6.5, the independent assessment rates the realistic confidentiality impact as low, making this a moderate-but-not-urgent issue; unauthenticated remote attackers are the relevant threat model, but only where a user can be convinced to install an untrusted extension.
Memory disclosure in Google Chrome versions prior to 155.0.8059.39 lets a remote, unauthenticated attacker read contents of process memory inside the renderer sandbox by convincing a victim to open a crafted HTML page that exercises the WebAudio API. Exploitation is bounded by the required user interaction (CVSS UI:R) and does not escape the Chrome sandbox, so there is no integrity or availability impact, only confidentiality loss (C:H) scored at CVSS 6.5. Publicly available exploit code exists per the SSVC assessment, but the issue is not confirmed as actively exploited (not in CISA KEV) and EPSS is low at 0.19% (8th percentile), making this a moderate-priority patching item rather than an emergency.
Availability degradation in OpenSSH before 10.6 occurs because sshd and ssh fail to enforce the maximum packet length while decompressing highly compressed SSH data, allowing a peer on a connection with negotiated SSH compression to trigger excessive resource consumption. Exploitation requires compression (zlib or zlib@openssh.com) to be negotiated-often not the case on modern OpenSSH servers where compression is disabled or delayed until after authentication-and an active malicious or compromised SSH peer; the independent assessment scores this as remote, network-reachable, unauthenticated with low availability impact and no confidentiality or integrity impact. No public exploit identified at time of analysis.
Missing authorization checks in Google Chrome's Federated Credential Management (FedCM) API allow an unauthenticated remote attacker to bypass web origin policy by luring a victim to a crafted HTML page, with the primary impact being integrity (C:N/I:H/A:N) rather than confidentiality or availability. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires the user to navigate to attacker-controlled content (UI:R), which is why CISA's SSVC framework rates the issue as not automatable and not currently exploited. There is no public exploit code and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), so this is a medium-severity, moderate-priority issue best handled through routine Chrome auto-update cycles rather than emergency patching.
Incorrect authorization in Google Chrome's PermissionElement before 155.0.8059.39 allows an unauthenticated remote attacker to bypass web origin policy by enticing a victim to load a crafted HTML page, as reflected in CVSS 6.5 (CWE-863); independent assessment rates confidentiality and integrity impact as limited and notes the bypass does not by itself enable code execution. Exploitation requires user interaction (UI:R), no public exploit code is identified at time of analysis, and EPSS is only 0.19% (8th percentile), so this is a low-to-moderate priority. No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected.
An origin-policy bypass in Google Chrome's Contextual Tasks feature allows an attacker who has already compromised a renderer process to reach a privileged page through a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39. The flaw is a confused deputy (CWE-441) and is integrity-only, with no confidentiality or availability impact; it is not a standalone remote exploit because it must be chained behind a separate renderer compromise, and it also requires the victim to load attacker-controlled HTML (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Risk signals are uniformly low: no public exploit identified at time of analysis, EPSS 0.19 percent (8th percentile), CISA SSVC exploitation 'none' and automatable 'no', and a vendor patch already available. This is a genuinely moderate issue, not a critical one, and real-world urgency is low.
Bypassing Site Isolation in Google Chrome versions prior to 155.0.8059.39 allows an attacker who has already compromised a renderer process to cross site boundaries and access data or resources that should be isolated, using a crafted HTML page. The flaw is a missing authorization check (CWE-862) in the SiteIsolation component and was rated Medium by Chromium; its CVSS is 6.5 (AV:N/AC:L/PR:N/UI:R/C:N/I:H/A:N) per the vendor, while independent assessment treats it as a second-stage, chained issue that requires a prior renderer compromise and therefore a hard AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N posture. EPSS is low at 0.19% (8th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and Google has released a patched build.
Origin policy bypass in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote, unauthenticated attacker to break the browser's cross-origin protections and reach content that should have remained isolated, provided the victim opens an attacker-crafted HTML page (CVSS 3.1 UI:R - user interaction is the limiting precondition, and the assessed impact is to confidentiality). Exploitation is confined to the iOS build of Chrome and requires luring a user to a malicious page; it is not a server-side, wormable, or self-propagating flaw, and no public exploit code has been identified at time of analysis. Risk is moderate rather than urgent: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, the vulnerability is not known to be actively exploited, and Google has shipped a vendor fix in Chrome 155.0.8059.39.
Cloud Foundry UAA versions 4.5.0 through 79.6.0 can be induced to skip the OAuth authorization-code exchange at its external OIDC login callback and instead accept a caller-supplied id_token, when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that same zone's own /oauth/token endpoint (a non-default 'self-UAA' configuration). An attacker who already holds any valid UAA JWT for themselves - including a low-scope access token (uaa.user only) or an ID token minted for an unrelated client such as cf - plus a valid browser login state for the target zone, can present that token as the callback's id_token and be authenticated into a mapped local 'shadow' account without the token's true audience or user_id being verified. This is not a pre-authentication bug and does not by itself grant privileges beyond those of the mapped shadow account, so real impact depends entirely on that account's group memberships (which may include administrative scopes such as clients.write); no public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided in the available intelligence.
Information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker leak sensitive information out of the browser through a crafted HTML page that the victim must load, exploiting the browser's Animation rendering path. The attack is limited by its user-interaction requirement (UI:R) and by the fact that impact is confidentiality-only - no data modification, no denial of service - which is reflected in the 6.5 CVSS score and the Medium Chromium severity rating. There is no public exploit identified at time of analysis and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood, but a vendor patch is available so the fix is straightforward to apply.
Improper input validation in Google Chrome's Extensions component before 155.0.8059.39 lets a crafted, attacker-controlled extension cross the web origin policy boundary and act within a privileged browser page (for example chrome:// or other WebUI surfaces), with the impact confined to integrity (C:N/I:H/A:N) per the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Exploitation is neither remote-automatic nor silent: the attacker must first convince the victim to install and run the malicious extension through social engineering, which is why Google rated it Low on the Chromium severity scale despite the 6.5 base score. EPSS sits at only 0.18 percent (7th percentile) and no public exploit has been identified at time of analysis, so this is a genuine but lower-tier priority; a vendor patch is available in Chrome 155.0.8059.39 and Chrome's auto-update channel rapidly closes the exposure window.
Web origin policy bypass in Google Chrome for iOS versions prior to 155.0.8059.39 lets an attacker subvert same-origin protections when a hostile companion app is installed on the same device, corrupting the trust boundary between web content and native app data. Exploitation is not drive-by: per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) it requires a vulnerable build, a malicious co-installed iOS app as the exploitation vector, and social engineering to obtain user interaction, so impact is confined to integrity (I:H) with no confidentiality or availability loss. No public exploit has been identified at time of analysis, EPSS is very low at 0.18% (7th percentile), and CISA SSVC rates exploitation as none and the issue as not automatable, making this a targeted, low real-world priority despite the 6.5 Medium base score; a vendor patch is available.
Incorrect authorization in Google Chrome's FontAccess implementation lets an attacker who has already compromised the renderer process bypass system access restrictions by getting the victim to load a crafted HTML page. Desktop Chrome builds prior to 155.0.8059.39 are affected; the flaw is a second-stage restriction/sandbox bypass rather than an entry point, since a separate renderer compromise and user interaction are both prerequisites. No public exploit has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.18% (7th percentile), consistent with an independent assessment that this is a genuine but secondary-chain issue rather than a standalone high-priority threat.
Incorrect authorization in Google Chrome's Network component lets a remote attacker who has already compromised the renderer process bypass system access restrictions by having the victim load a crafted HTML page, with all desktop builds prior to 155.0.8059.39 affected. The flaw is reachable without authentication (AV:N/PR:N) but requires user interaction (UI:R) and, critically, a pre-existing renderer compromise, which is why our assessment raises attack complexity to AC:H and treats this as a second-stage bypass rather than an initial-access vector. Impact is confined to integrity (C:N/I:H/A:N) with no direct data disclosure or denial of service; no public exploit code has been identified at time of analysis, Chrome is not on CISA KEV, and EPSS is only 0.18% (7th percentile), so real-world risk is moderate rather than urgent despite the 6.5 vendor base score.
Incorrect authorization logic in Google Chrome's GetUserMedia (media capture) implementation affects builds prior to 155.0.8059.39, allowing an attacker who has ALREADY compromised the browser's renderer process to use a crafted HTML page to bypass system access restrictions. The renderer-compromise precondition is the dominant limiting factor: despite the vendor vector carrying PR:N, this is best modeled as an authenticated/privileged post-compromise primitive (independent reassessment: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) that is only useful as a chain link after a separate renderer exploit, with integrity-only impact and no direct confidentiality or availability loss. Note that no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none) and EPSS is low at 0.18% (7th percentile); a vendor patch is available, making this a genuine medium-risk defense-in-depth issue rather than a top-priority emergency.
Site isolation bypass in Google Chrome versions prior to 155.0.8059.39 allows an attacker who has already compromised a Chrome renderer process to escape Chrome's site-isolation security boundary by having the victim load a crafted HTML page, undermining the process-level compartmentalization that keeps data from different sites apart. The root cause is a missing authorization check (CWE-862) in Chrome's Network component, and Google rates the flaw Chromium security severity Medium; the CVSS vector is AV:N/AC:L/PR:N/UI:R with no confidentiality or availability impact but high integrity impact, while our independent assessment raises attack complexity to AC:H because the renderer-compromise precondition is substantial and the attack is not a standalone remote-unauthenticated path. Vendor-released patch: 155.0.8059.39, distributed through the Chrome stable channel; EPSS is 0.18% (7th percentile), SSVC records exploitation as 'none', and no public exploit identified at time of analysis, so this is a moderate, deprioritizable risk best handled in a normal patch cycle rather than an emergency response.
A missing authorization check in Chrome's network component lets crafted network traffic defeat the browser's web origin policy in Google Chrome desktop builds prior to 155.0.8059.39, which can be exploited by a remote, unauthenticated attacker only after the victim is socially engineered into loading attacker-controlled content (CVSS UI:R). The impact is integrity-only with unchanged scope (C:N/I:H/A:N, S:U): cross-origin boundaries can be crossed, but the flaw does not by itself provide code execution, credential theft, or availability loss, and Google assigns it a Chromium severity of Low. EPSS is 0.17% (6th percentile) and no public exploit identified at time of analysis; the vendor fix ships in Chrome 155.0.8059.39, so this is a moderate-score but low-priority issue.
Origin-policy bypass in Google Chrome's Omnibox affects all builds prior to 155.0.8059.39, allowing a remote attacker who delivers crafted network traffic to manipulate the address-bar component into acting on its behalf and violating web origin boundaries. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), no authentication or prior privileges are required, but the victim must interact with attacker-influenced content, and the resulting impact is confined to integrity - origin-policy enforcement - with no confidentiality or availability effect and no scope change. Google has released a fix in the 155.0.8059.39 stable channel update, there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is very low at 0.17% (6th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no, technical impact: partial, making this a moderate-priority patch-and-move-on item rather than an emergency.
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Incorrect authorization in Google Chrome's USB handling (CWE-863) allows a malicious, attacker-controlled Chrome extension to bypass system access restrictions on USB devices in Chrome versions prior to 155.0.8059.39. Exploitation is not a remote drive-by: it requires the victim to be socially engineered into installing and running the crafted extension, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (6.5, Medium) - unauthenticated over the network, but gated by mandatory user interaction, with integrity/access-restriction impact only and no confidentiality or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.17% (6th percentile). A vendor patch is available in Chrome 155.0.8059.39.
Google Chrome before 155.0.8059.39 contains an improper input validation flaw in its SignIn component, allowing a remote unauthenticated attacker to bypass system access restrictions by socially engineering a victim into installing a crafted extension. Exploitation requires user interaction (UI:R) and results in a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N); the EPSS score is 0.17% and no public exploit identified at time of analysis. Vendor patches are available, and CISA SSVC indicates low exploitation and automation potential.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Repository migration in Gitea through 28.0.0 can be driven into an unbounded paginated download loop that consumes server memory until exhaustion, denying service to other users. The flaw is reachable by an authenticated user holding repository-migration rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) who directs a migration at a source server they control and that reports max_response_items as 0, which Gitea treats as the loop's termination condition. Exploitation is not known to be active - no public exploit code identified at time of analysis - and EPSS is low at 0.17% (5th percentile), making this a genuine but moderate-priority availability issue; a vendor-released patch exists in Gitea 28.1.0.
Authorization bypass in the Permissions subsystem of Google Chrome allows a remote, unauthenticated attacker to reach restricted system functionality by delivering crafted network traffic to any browser version prior to 155.0.8059.39, with default configurations affected and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Impact is bounded to limited confidentiality and integrity with no availability loss, Chromium rates the issue Medium, and no public exploit identified at time of analysis; EPSS is 0.17% (5th percentile). Google shipped the stable-channel fix in 155.0.8059.39.
Algorithmic complexity denial-of-service in Gitea 1.27.3 and earlier allows an authenticated user with permission to create issues or post comments to stall a server process by submitting a crafted ~1 MB body containing many Markdown links, keeping a CPU core busy for minutes while holding a database transaction open. The flaw is a quadratic rescan of preceding text for close/reopen keywords such as "closes" or "fixes" performed once per link (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5). It is authentication-gated and no public exploit code has been identified at time of analysis; EPSS is low at 0.16% (4th percentile) and CISA SSVC records Exploitation: none.
Authenticated denial of service in Microsoft UFO prior to 3.0.9: a caller holding a valid API key can indefinitely block the /api/task_result/{task_name} endpoint by requesting a task name that maps to an existing session, causing the server to re-acquire the same non-reentrant lock twice (CWE-833 deadlock). In the vendor's default single-process configuration the hung request stalls the event-loop thread, taking down other HTTP endpoints, WebSocket connections, and dependent background interactions, while unknown or unmapped task names never reach the nested call and are harmless. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates this purely as an availability impact requiring low privileges; no confirmed active exploitation and no public exploit code were identified at time of analysis, and multi-process or multi-worker deployments limit the blast radius to the affected worker.
Improper input validation in Backstage's @backstage/plugin-proxy-backend before 0.6.17 allows an authenticated user to craft a request URL containing path traversal sequences that the proxy forwards to a path outside the configured base path on an already-configured upstream target server. The flaw is bounded: the attacker must already hold an authenticated Backstage session (CVSS vector PR:L, unless an endpoint is deliberately configured with 'dangerously-allow-unauthenticated'), and only hosts that are already registered as proxy endpoints can be reached, so the escape is a redirect within an already-trusted target rather than a route to arbitrary internal systems. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is addressed by vendor-released fixes in @backstage/plugin-proxy-backend 0.6.17 and Backstage release v1.54.6.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
Authenticated device registration in Microsoft UFO versions prior to 3.0.9 can be abused to make the server open WebSocket connections to internal hosts, because pinned-address enforcement is applied only to the initial destination while the underlying websockets client still follows HTTP redirects. An attacker with valid credentials who can supply a device server_url that passes Galaxy's URL validation can then have that endpoint return a 301/302/303/307/308 redirect to an internal address, causing a cross-origin TCP connection and WebSocket upgrade handshake to be sent before peer-IP validation runs. The impact is limited to the internal connection and handshake request - no arbitrary HTTP methods, response-body disclosure, completed AIP session, or cloud metadata access - and this is a medium-severity (CVSS 6.4) SSRF whose real-world priority is modest rather than urgent; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).