Authenticated users who are permitted to submit a Django model formset can delete database rows outside that formset's limiting queryset - without holding any permission on the targeted object - by forging management-form POST data when the affected model's primary key is editable through the form. The flaw is an authorization bypass through a user-controlled key (CWE-639) in django.forms.models.BaseModelFormSet.save_existing_objects(), rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with integrity-only impact; it affects Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, while models using the default AutoField/BigAutoField primary key are not affected. No public exploit code identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); this is a genuinely moderate-severity authorization flaw and the signals are internally consistent.
Brute-force attacks against the Pusula Expert Mail authentication surface can succeed because the product does not adequately control the frequency of repeated login attempts, a CWE-799 anti-automation weakness rated CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw is remotely reachable with no authentication, no privileges, and no user interaction, meaning default-configuration instances that expose a webmail or login endpoint are affected; impact is limited to confidentiality, so a successful attack only yields whatever credentials are weak or guessable. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue was reported by TR-CERT; feasibility drops sharply where a WAF, IP rate limiting, external MFA, or network segmentation sits in front of the login endpoint.
Open redirect in the PingGateway Fragment Filter lets unauthenticated remote attackers craft a link that causes the gateway to send a victim to an attacker-controlled destination, with the CVSS 4.0 vector (UI:A) requiring the victim to actively interact with that link; the vendor-assigned base score is 5.1 (medium). Only deployments running PingGateway 7.1.0 and later, 2023.2.0 through 2024.11.1, or 2025.3.0 through 2025.11.1 and actually using the Fragment Filter feature are affected, while builds 2024.11.2, 2025.11.2, and 2026.3.0 or later are fixed. No public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing), and the combination of mandatory user interaction with low confidentiality/integrity impact keeps practical risk moderate.
Incorrect authorization in Google Chrome for Android prior to 155.0.8059.39 allows a locally co-installed malicious application to obtain sensitive information from the browser through a social-engineering precondition. Exploitation is confined to the same Android device: a local attacker (the assessed vector requires no privileges, PR:N) must persuade the victim to install or run a hostile app alongside Chrome, and the high attack complexity (AC:H) reflects that non-trivial co-installation and user-interaction dependency; impact is limited to confidentiality, with no integrity or availability loss. There is no public exploit code and no confirmed active exploitation at time of analysis - CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial - and Google has released a vendor patch, so this is a low-to-moderate priority defect rather than an urgent one.
Local information disclosure in Google Chrome on Android versions prior to 155.0.8059.39 allows a co-installed malicious app to access sensitive information without user interaction or authentication, though exploitation requires high attack complexity and the pre-existence of an attacker-controlled app on the same device. This moderate-severity issue (CVSS 5.1) has no public exploit identified at time of analysis, and vendor patch 155.0.8059.39 is available.
Server-side request forgery (SSRF) in Arista CloudVision Portal allows an authenticated user with high privileges to manipulate the OIDC bearer token configuration and direct requests to arbitrary destinations. Affected versions include 2023.3.0 before 2025.3.0, 2025.3.0 through 2025.3.3, 2026.1.0 through 2026.1.2, and 2026.2.0. Exploitation requires pre-existing elevated access, limiting impact to subsequent-system confidentiality; no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in Arista CloudVision Portal arises from insufficient validation of OIDC SSO provider configuration, allowing a user holding the specific high-privilege right to view and modify that configuration to direct CVP-originated requests to arbitrary destinations. The practical impact is limited rather than systemic: the CVSS 4.0 base of 5.1 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) both reflect that the attacker must already be a highly privileged CVP administrator with network reach to the management interface, and that the consequence is a low-confidentiality information-disclosure primitive rather than code execution or service disruption. There is no public exploit identified at time of analysis and no confirmed active exploitation (SSVC: Exploitation=none, Automatable=no); a vendor patch is available via Arista security advisory 0186, and the main residual risk is abuse or takeover of an already-privileged administrative account.
Stored cross-site scripting in the Formwork PHP content management system (versions up to and including 2.3.12) lets an authenticated user who can submit HTML content inject a script-bearing 'formaction' URI that survives the built-in DomSanitizer. The payload does not fire on its own: a second user must view and activate the injected form control (UI:P/UI:R) for the script to execute, which is why this is rated medium severity (CVSS 4.0 base 5.1; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The flaw is fixed in Formwork 2.3.13, and no public exploit code has been identified at time of analysis.
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Information disclosure in the Backstage Kubernetes backend plugin (@backstage/plugin-kubernetes-backend) before 0.21.10 allows an authenticated catalog contributor who can create or modify kubernetes-cluster Resource entities to steer cluster discovery into an unsupported authentication mode, causing the backend to answer Kubernetes API requests using its own local in-cluster service-account identity rather than a catalog-supplied credential. The disclosure is bounded strictly by what that pod service account is already permitted to read via RBAC, and the leaked credential is used only against the local in-cluster API endpoint and is never transmitted to the catalog-supplied endpoint; exploitation requires a non-default catalog cluster discovery deployment, the relevant endpoint permissions, and over-privileged pod RBAC, which is why the assessed severity is low. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in 0.21.10 (shipped in the Backstage release v1.54.6).
Content injection in Backstage's cloud storage URL readers (the @backstage/backend-defaults package before 0.17.8) allows an attacker who holds write access to a configured AWS S3 bucket, AWS CodeCommit repository, or Azure Blob Storage container to craft object names containing path traversal segments so that an ingested object can collide with a protected file in the reader's output directory, overwriting or injecting content in certain deployment configurations. The issue is a CWE-22 improper-limitation-of-pathname flaw with an integrity-only impact, scored CVSS 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N), meaning exploitation demands high privileges (bucket write access) and a non-trivial collision condition, while confidentiality and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in @backstage/backend-defaults 0.17.8 (Backstage v1.54.6).
Secret-derived values used during Scaffolder template iteration in Backstage can leak into task logs, exposing configured scaffolder.defaultEnvironment.secrets to anyone who can read those logs. Affected deployments run the @backstage/plugin-scaffolder-backend package prior to version 4.1.0, and exploitation requires a privileged, authenticated template author (PR:H in the CVSS vector) plus a deployment that has populated sensitive values in scaffolder.defaultEnvironment.secrets. The flaw only manifests when secret-derived values pass through a transforming Nunjucks filter inside an 'each' loop, since untransformed secrets were already redacted; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Realistic risk is moderate given the layered prerequisites, though the confidentiality impact for exposed credentials is high.
Gitea versions through 28.0.0 allow repository administrators to create new push mirrors through the API even when the site administrator has enabled the [mirror] DISABLE_NEW_PUSH restriction that the web UI honors. This is an authenticated, repository-admin-only authorization bypass (CVSS PR:H) that only crosses the intended security boundary on instances where that restriction is configured; on default configurations push mirrors are permitted, so the API behavior is not a violation. EPSS is 0.16% (5th percentile), no public exploit identified at time of analysis, and no CISA KEV activity is reported; the vendor fixed the issue in 28.1.0. The independent assessment rates this as a genuinely low-priority issue with assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Information disclosure in Bludit CMS 3.22.0 can be triggered through the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints, enabling an authenticated attacker with admin-area access to read sensitive data. The issue is a CWE-200 exposure flaw with a moderate CVSS score, and the authoritative assessment limits its practical severity because exploitation requires an authenticated session and has a confidentiality-only impact. No public exploit code or active exploitation is identified in the available data.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Incorrect authorization in the Extensions component of Google Chrome prior to 155.0.8059.39 allows a crafted extension to spoof browser UI elements after it has been installed, giving a remote attacker a means of deceiving the user about what the browser is actually showing or requesting. Successful exploitation requires social engineering to convince the victim to install an untrusted extension (the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, Chromium severity Medium), so impact is limited to deceptive UI and low-level integrity loss rather than code execution or direct credential compromise, and unauthenticated remote attackers are the relevant threat model with user interaction as the practical gate. No public exploit code and no confirmed active exploitation were identified at time of analysis; environments that restrict extension installation through enterprise policy are largely protected, making this a genuinely low-to-moderate priority issue despite being network-reachable.
Information disclosure in Google Chrome on Android before 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to read memory outside the GPU sandbox by serving a crafted HTML page. The flaw (CWE-908, use of an uninitialized resource in the GPU path) is a chain-dependent bug rather than a standalone entry point: it requires a separate renderer compromise plus victim interaction to load malicious content, and the impact stops at memory disclosure with no code execution, integrity, or availability loss. No public exploit has been identified at time of analysis, EPSS is low at 0.24 percent (13th percentile), and Google has released a fix in Chrome 155.0.8059.39 at Chromium severity Medium.
Memory disclosure in Google Chrome on Android before 155.0.8059.39 lets a remote attacker who persuades a victim to open a crafted HTML page read uninitialized GPU memory that lies outside the browser sandbox, exposing data the page should never be able to observe. The bug is rated CVSS 3.1 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) - unauthenticated remote triggering is possible but requires the victim to actively load the malicious page, only confidentiality is partially affected, and there is no integrity or availability impact, so this is an information-leak primitive rather than a code-execution path. Risk is currently low: EPSS is 0.24% (13th percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list it, but the disclosure crosses the sandbox boundary, which is why Google assigned Medium severity and the vector shows a scope change.
Uninitialized memory handling in ANGLE, the graphics translation layer Chrome uses for WebGL and hardware-accelerated rendering on Windows, allows a remote attacker to read memory outside the browser sandbox by getting a victim to load a crafted HTML page. Only Chrome on Windows running builds earlier than 155.0.8059.39 is affected; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, meaning the attack is remote and unauthenticated but requires user interaction, and the outcome is read-only out-of-sandbox memory disclosure with no integrity or availability impact. The issue is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified, and EPSS is 0.24% (13th percentile), indicating low near-term exploitation likelihood; a vendor patch is available.
Information disclosure in Google Chrome on Windows lets remote attackers read memory outside the browser sandbox by convincing a user to open a crafted HTML page that exercises the ANGLE graphics translation layer. The affected builds are Chrome versions prior to 155.0.8059.39 on Windows; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) confirms no authentication is required but that a victim must interact with the malicious page, and the Scope:Changed rating reflects that the read crosses the intended sandbox boundary even though there is no integrity or availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.24% (13th percentile), consistent with a moderate-priority defect that is patched by the vendor.
Uninitialized memory handling in ANGLE, Chrome's graphics translation layer on Windows, allows a remote attacker to read memory outside the browser sandbox when a user opens a crafted HTML page in Chrome builds prior to 155.0.8059.39. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R) - the victim must navigate to attacker-controlled content that reaches the WebGL/graphics rendering path - and the impact is confidentiality-only, with no write or code-execution primitive. No public exploit identified at time of analysis, EPSS is low at 0.23% (12th percentile), and vendor-released patches are available, making this a moderate-priority patch-and-update item rather than an emergency.
Uninitialized-memory handling in Dawn, Chrome's WebGPU backend, allows unauthenticated remote attackers to read memory outside the browser sandbox on macOS when a victim loads a crafted HTML page in Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction - the victim must navigate to attacker-controlled content that exercises the WebGPU path - and the impact is bounded to information disclosure, with no code execution, data modification, or denial of service. EPSS is 0.23% (12th percentile) and no public exploit has been identified at time of analysis, so despite the 'High' Chromium triage label this is a moderate-priority issue; Google has shipped a fixed build.
Information disclosure in Google Chrome for Android versions prior to 155.0.8059.39 lets a remote attacker read a limited amount of GPU process memory outside the browser sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the malicious page) and yields only a partial read of uninitialized memory - no code execution, data modification, or denial of service - which is why Google rates it Chromium severity Low and our assessment scores it CVSS 4.7. There is no confirmed active exploitation and no public exploit identified at time of analysis, and exploitation likelihood is low (EPSS 0.19%, 8th percentile); a vendor patch is available in Chrome 155.0.8059.39 and later.
Out-of-sandbox memory disclosure affects Google Chrome on Android builds prior to 155.0.8059.39, where an uninitialized resource in Dawn, Chrome's WebGPU implementation, can be triggered by a crafted HTML page to leak memory contents. Exploitation is constrained: it requires the victim to open attacker-influenced content that exercises WebGPU (user interaction is mandatory, UI:R) and yields only a LOW-confidentiality read with no integrity or availability impact, giving a CVSS 3.1 base score of 4.7 and EPSS of just 0.19% (8th percentile). No public exploit code has been identified at time of analysis, this CVE is not on CISA KEV, and a vendor patch is available in Chrome 155.0.8059.39.
Memory disclosure outside the GPU boundary in Google Chrome on Android (versions prior to 155.0.8059.39) allows an attacker who has already compromised the Chrome renderer process to read uninitialized GPU-related memory via a crafted HTML page, providing a second-stage sandbox information-leak primitive. The flaw is not remotely exploitable in isolation: it requires a separate, prior renderer compromise plus user interaction (navigating to attacker-controlled HTML), and it yields only low-severity reads with no integrity or availability impact (CVSS 4.7, CWE-908; the independent assessment raises attack complexity to High to reflect the renderer-compromise prerequisite). No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.19% (8th percentile), reinforcing that near-term exploitation risk is low. The vendor has released a fix in Chrome 155.0.8059.39.
An uninitialized resource flaw in the Video component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to craft an HTML page that reads memory outside the sandbox, leaking limited information. The vulnerability requires both a pre-existing renderer compromise and user interaction (victim must load attacker-controlled content), and no public exploit has been identified at time of analysis; EPSS is low at 0.19% (8th percentile). Our independent assessment rates this as a moderate-but-not-urgent issue - its practical value is primarily as a sandbox-escape/info-leak primitive within a larger exploit chain rather than a standalone attack, and a vendor patch is available.
An uninitialized-resource flaw in Chrome's ANGLE graphics abstraction layer on Windows allows a remote attacker who persuades a victim to render a crafted HTML page to read memory that should not be reachable from the renderer, potentially crossing the browser's sandbox boundary. The vulnerability affects Google Chrome on Windows prior to 155.0.8059.39, requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N) but does require user interaction, and is scored 4.7 with scope change because the leaked data can originate outside the sandboxed renderer. There is no public exploit code identified at time of analysis, EPSS is low at 0.19% (8th percentile), and a vendor patch is available.
Out-of-bounds memory reads in Google Chrome's ANGLE graphics layer (the WebGL/OpenGL ES translation backend) affect all versions prior to 155.0.8059.39, letting a remote attacker leak memory located outside the browser sandbox when a victim loads a crafted HTML page. The impact is disclosure-only: the changed-scope score (S:C) reflects a sandbox boundary crossing, but there is no integrity or availability effect, and per the assessed vector the attack still requires victim user interaction (UI:R) even though no authentication is needed (PR:N). No public exploit code has been identified at time of analysis, EPSS is low at 0.18% (6th percentile), and a vendor patch is available in Chrome 155.0.8059.39.
Out-of-bounds memory read in Google Chrome's Printing component on Windows (all versions prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to read memory outside the sandbox when a victim is socially engineered into loading a crafted HTML page. The flaw is rated Chromium security severity Medium and carries a CVSS v3.1 base score of 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), reflecting a scope-changing confidentiality-only leak with no integrity or availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (6th percentile), and a vendor patch is available.
Out-of-sandbox memory disclosure in Google Chrome (desktop) versions prior to 155.0.8059.39 stems from a race condition (CWE-367) in the CacheStorage component, which an attacker can drive through a crafted HTML page to read memory beyond the renderer sandbox. The dominant limiting factor is that exploitation requires the attacker to have already compromised the renderer process - this flaw alone does not provide initial access and functions as a chain component rather than a primary entry point, and the victim must also load attacker-controlled content to trigger the timing-dependent race. Impact is confidentiality-only (memory read; no integrity or availability effect), the vendor has released a fixed build, EPSS is very low at 0.14% (3rd percentile), and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Handlebars (the handlebars.js npm package) versions 4.0.0 through 4.7.9 emit static template text into precompiled JavaScript without escaping sequences such as '</script>' or '<!--', so an application that precompiles attacker-controlled template text and inlines the generated source inside a <script> element can have that element terminated early and followed attacker markup parsed and executed - a cross-site scripting condition (CWE-116). Exploitation is narrow rather than universal: it requires the non-default pattern of running Handlebars.precompile() on untrusted template text and embedding the output directly in an inline script, plus a victim loading the resulting page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, 4.7); ordinary server-side rendering and precompiled templates served as external JavaScript files are explicitly unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the required user interaction and unusual integration keep practical risk below a typical network XSS. The issue is fixed in Handlebars 4.7.10.
Information disclosure in Google Chrome for iOS before 155.0.8059.39 allows an attacker with hands-on physical access to the device to obtain sensitive information through the browser's Mobile component. The flaw scores CVSS 3.1 base 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a high confidentiality impact that is heavily offset by the requirement for physical possession of the device; authentication or user interaction beyond having the unlocked device is not required per the assessed vector. No public exploit code has been identified at time of analysis, and Google rates the Chromium security severity as Low, so this is a low real-world priority despite the moderate score.
Missing authorization in the CredentialProvider component of Google Chrome on Windows (versions prior to 155.0.8059.39) lets an attacker with direct physical access to the machine read sensitive credential data. The vulnerability is strictly local and physical - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - so it cannot be triggered over a network, cannot be automated (SSVC Automatable=no), and carries no integrity or availability impact, only confidentiality. CISA's SSVC assessment rates exploitation as none and no public exploit code or in-the-wild activity has been identified at time of analysis, keeping overall risk genuinely low and confined to shared, kiosk, loaner, or lost/stolen Windows devices.
Authentication and access-control bypass in Google Chrome on Android before version 155.0.8059.39 lets a malicious app already installed on the same device act as a confused deputy, driving Chrome's UI into a privileged page and circumventing system access restrictions. The flaw is local-only (AV:L) and requires the attacker to first get their app onto the victim's device via sideloading or a trojanized application, after which no further interaction with Chrome is needed (UI:N); impact is limited to partial confidentiality and integrity loss with no availability impact (CVSS 4.4). There is confirmed vendor patching but no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is negligible (0.11%, 1st percentile), ranking this as a low-to-moderate, local-only issue rather than an urgent priority.
A logic error in the Android kernel hardware-crypto driver routine kdn_set_sysregs_prot (hwcrypto-kdn.c) causes an information disclosure, but only for an attacker who already executes code with System-level privileges directly on the affected Pixel/Tensor device. The CVSS base score is 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting a local-only, high-privilege, confidentiality-only impact with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV (SSVC: Exploitation none). In practice this is a genuine-but-low-priority weakness that hardens an already-compromised or highly privileged execution context rather than a remotely reachable or pre-auth escalation path.
A missing permission check in the is_pd_allowed function of Android's gem_msg.c kernel source (CWE-862, Missing Authorization) allows an attacker who already holds System execution privileges to bypass an authorization decision and read otherwise-protected information. Impact is limited to local information disclosure - confidentiality-only (C:H) with no integrity or availability effect - and exploitation requires a local foothold running as System (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.4); no user interaction is needed. There is no public exploit identified at time of analysis, exploitation is assessed as non-automatable (SSVC Exploitation: none), and this is a low-priority, post-compromise authorization gap behind an already-high trust boundary rather than an initial-access bug. Google Devices reported the flaw and a fix is referenced through the Android/Pixel October 2026 security bulletin.
Denial of service in Elasticsearch stems from catastrophic backtracking in the ES|QL CHUNK function, which accepts user-supplied regular expressions as text-splitting separators without validating their computational complexity or bounding their execution time. An authenticated attacker who holds read access to any text-based index and can invoke CHUNK through ES|QL can submit a crafted pattern that drives exponential regex blowup, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node, though the cluster does not crash. CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a bounded availability-only impact, no public exploit code was identified at time of analysis, and patched releases are available as Elasticsearch 8.19.22, 9.4.8, and 9.5.5 per Elastic security update ESA-2026-189.
Authenticated users of Twisted-based IMAP4 servers (Twisted 25.5.0 and earlier running the twisted.mail.imap4 server component) can stall the entire service by supplying a crafted LIST or LSUB mailbox pattern whose regex metacharacters survive wildcardToRegexp() and reach re.compile(), triggering catastrophic backtracking. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, base 4.3) confirms this is a network-reachable availability issue that requires valid credentials and has no impact on confidentiality or integrity. Because Twisted's cooperative single-threaded reactor performs the match inline, a single expensive match suspends all server input and output for its duration; no public exploit code has been identified at time of analysis, and this is a genuine but modest-priority issue rather than a top-tier emergency.
Gitea through 1.27.3 grants the named recipient of a private-repository transfer temporary read collaborator access so they can review the repository, but rejecting or cancelling that transfer never revokes the collaboration, leaving the recipient with persistent read access to the private repository's code, issues, pull requests and wiki, including the ability to clone it, without any notification to the repository owner. Exploitation requires the repository owner to initiate a transfer of a private repository to a specific authenticated Gitea user who lacks prior access, and the affected party is that designated recipient rather than an arbitrary user; it is not attacker-initiated against default configurations. Severity is moderate (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; published base score 4.3) with no public exploit identified at time of analysis and a low EPSS of 0.27% (17th percentile). Vendor-released patch: Gitea 28.0.0.
An origin-policy bypass in Chrome's DeviceBoundSessionCredentials component allows remote attackers to make the browser act as a confused deputy for an untrusted site via a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39 (Chromium security severity: Low, CVSS 4.3). Exploitation is network-reachable and requires no attacker authentication (PR:N), but it depends entirely on the victim navigating to an attacker-controlled page (UI:R) and is limited to an integrity impact on web origin rules (C:N/I:L/A:N). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (13th percentile), which is consistent with the low-priority assessment of this defect.
Cross-origin information disclosure in Google Chrome's Payments component (all platforms, versions prior to 155.0.8059.39) allows an unauthenticated remote attacker to obtain limited cross-origin data by luring a victim to a crafted HTML page; exploitation requires the victim to actively visit or load the attacker's content (CVSS vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base score 4.3). There is no integrity or availability impact and no scope change - the leak is confined to read-only disclosure of payment-related cross-origin data in the victim's browser session. The issue is not in CISA KEV and no public exploit code has been identified at time of analysis, and CISA's SSVC assessment scores exploitation as none and automatable as no, indicating a low-to-moderate practical risk rather than an urgent, wormable threat; a vendor patch is available in Chrome 155.0.8059.39.
Information disclosure in Google Chrome versions prior to 155.0.8059.39 allows a remote, unauthenticated attacker who convinces a victim to open a crafted HTML page to read data belonging to other origins, bypassing the browser's same-origin boundary. Exploitation requires user interaction (UI:R) but no privileges, and default Chrome installations are exposed because the vulnerable Media code path is standard browser functionality; the impact is confidentiality-only, consistent with a CVSS base score of 4.3. No public exploit code has been identified at time of analysis and CISA's SSVC records no known exploitation, so the practical risk is concentrated in unpatched endpoints rather than active attacks; Google has shipped a fixed build.
Missing authorization checks in Google Chrome's Google Lens component let a remote attacker read cross-origin data when a victim loads a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39. The practical hurdle is steep: the attacker must already hold a compromised renderer process (a separate sandbox-bypass prerequisite not reflected in the PR:N metric), and the victim must be induced into loading the malicious page, which confines real-world risk to low-sensitivity information disclosure. No public exploit has been identified at time of analysis, CISA's SSVC assessment rates exploitation as 'none' with automation judged not feasible, and the technical impact is partial - making this a low-priority issue despite Chromium's 'Medium' severity label.
Cross-origin data leakage in Google Chrome before 155.0.8059.39 stems from incorrect reference resolution in the browser's Core component, allowing a remote attacker to read data belonging to another origin through a crafted HTML page. Exploitation is not silent: it requires the victim to visit an attacker-controlled or compromised page (UI:R), typically reached via phishing or a malicious link, and no privileges are needed on the target (PR:N). The impact is limited to confidentiality (C:L) with no memory corruption, code execution, integrity, or availability effect, and no public exploit has been identified at time of analysis - this is a genuinely low-priority issue despite being network-reachable.
Missing authorization in Kibana's Metrics Experience feature lets an authenticated user who holds only Elasticsearch index-level read privileges - but no corresponding Kibana feature privilege - pull back index-derived metric data that a correctly protected sibling API would have blocked. Exploitation requires valid credentials (CVSS PR:L, remote, no user interaction) and is confined to information disclosure (C:L), giving a modest CVSS 3.1 base score of 4.3. Kibana installations running 9.4.0 or later are not affected, and no public exploit code or active exploitation has been identified at time of analysis.
Cross-origin information disclosure in Google Chrome's Glic integrated AI assistant component allows a remote attacker to leak data from other origins by convincing a victim to open a crafted HTML page; the flaw is an incomplete-cleanup bug (CWE-459) affecting Chrome builds prior to 155.0.8059.39. The attack is remote but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3), and impact is limited to low-sensitivity read access with no integrity or availability effect, so the practical risk is low. There is no public exploit identified at time of analysis, CISA SSVC records no known exploitation and marks the issue as not automatable, and the vendor has already shipped a fix in the stable channel.
Inconsistent property-permission matching in the @backstage/plugin-catalog-backend package (Backstage releases prior to the fix) allows an authenticated user to receive catalog entity data that policy authors intended to restrict, because value-based catalog permission conditions evaluate keys and values inconsistently. Exposure is limited to deployments that use these value-based property conditions as a confidentiality boundary; installations without such value-based restrictions are not affected, and no public exploit has been identified at time of analysis. The issue is rated CVSS 4.3 (low severity, information disclosure only) and is fixed in @backstage/plugin-catalog-backend 3.9.1, shipped with Backstage release v1.54.6.