Availability degradation in OpenSSH before 10.6 occurs because sshd and ssh fail to enforce the maximum packet length while decompressing highly compressed SSH data, allowing a peer on a connection with negotiated SSH compression to trigger excessive resource consumption. Exploitation requires compression (zlib or zlib@openssh.com) to be negotiated-often not the case on modern OpenSSH servers where compression is disabled or delayed until after authentication-and an active malicious or compromised SSH peer; the independent assessment scores this as remote, network-reachable, unauthenticated with low availability impact and no confidentiality or integrity impact. No public exploit identified at time of analysis.
Missing authorization checks in Google Chrome's Federated Credential Management (FedCM) API allow an unauthenticated remote attacker to bypass web origin policy by luring a victim to a crafted HTML page, with the primary impact being integrity (C:N/I:H/A:N) rather than confidentiality or availability. All Chrome builds prior to 155.0.8059.39 are affected, and exploitation requires the user to navigate to attacker-controlled content (UI:R), which is why CISA's SSVC framework rates the issue as not automatable and not currently exploited. There is no public exploit code and no CISA KEV listing, and the EPSS score is very low at 0.19% (8th percentile), so this is a medium-severity, moderate-priority issue best handled through routine Chrome auto-update cycles rather than emergency patching.
Incorrect authorization in Google Chrome's PermissionElement before 155.0.8059.39 allows an unauthenticated remote attacker to bypass web origin policy by enticing a victim to load a crafted HTML page, as reflected in CVSS 6.5 (CWE-863); independent assessment rates confidentiality and integrity impact as limited and notes the bypass does not by itself enable code execution. Exploitation requires user interaction (UI:R), no public exploit code is identified at time of analysis, and EPSS is only 0.19% (8th percentile), so this is a low-to-moderate priority. No authentication or prior privileges are needed (PR:N), and default Chrome configurations are affected.
An origin-policy bypass in Google Chrome's Contextual Tasks feature allows an attacker who has already compromised a renderer process to reach a privileged page through a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39. The flaw is a confused deputy (CWE-441) and is integrity-only, with no confidentiality or availability impact; it is not a standalone remote exploit because it must be chained behind a separate renderer compromise, and it also requires the victim to load attacker-controlled HTML (CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N). Risk signals are uniformly low: no public exploit identified at time of analysis, EPSS 0.19 percent (8th percentile), CISA SSVC exploitation 'none' and automatable 'no', and a vendor patch already available. This is a genuinely moderate issue, not a critical one, and real-world urgency is low.
Bypassing Site Isolation in Google Chrome versions prior to 155.0.8059.39 allows an attacker who has already compromised a renderer process to cross site boundaries and access data or resources that should be isolated, using a crafted HTML page. The flaw is a missing authorization check (CWE-862) in the SiteIsolation component and was rated Medium by Chromium; its CVSS is 6.5 (AV:N/AC:L/PR:N/UI:R/C:N/I:H/A:N) per the vendor, while independent assessment treats it as a second-stage, chained issue that requires a prior renderer compromise and therefore a hard AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N posture. EPSS is low at 0.19% (8th percentile), no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and Google has released a patched build.
Origin policy bypass in Google Chrome on iOS prior to version 155.0.8059.39 allows a remote, unauthenticated attacker to break the browser's cross-origin protections and reach content that should have remained isolated, provided the victim opens an attacker-crafted HTML page (CVSS 3.1 UI:R - user interaction is the limiting precondition, and the assessed impact is to confidentiality). Exploitation is confined to the iOS build of Chrome and requires luring a user to a malicious page; it is not a server-side, wormable, or self-propagating flaw, and no public exploit code has been identified at time of analysis. Risk is moderate rather than urgent: EPSS is 0.18% (7th percentile), there is no CISA KEV listing, the vulnerability is not known to be actively exploited, and Google has shipped a vendor fix in Chrome 155.0.8059.39.
Cloud Foundry UAA versions 4.5.0 through 79.6.0 can be induced to skip the OAuth authorization-code exchange at its external OIDC login callback and instead accept a caller-supplied id_token, when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that same zone's own /oauth/token endpoint (a non-default 'self-UAA' configuration). An attacker who already holds any valid UAA JWT for themselves - including a low-scope access token (uaa.user only) or an ID token minted for an unrelated client such as cf - plus a valid browser login state for the target zone, can present that token as the callback's id_token and be authenticated into a mapped local 'shadow' account without the token's true audience or user_id being verified. This is not a pre-authentication bug and does not by itself grant privileges beyond those of the mapped shadow account, so real impact depends entirely on that account's group memberships (which may include administrative scopes such as clients.write); no public exploit code was identified at time of analysis, the issue is not listed in CISA KEV, and no EPSS score was provided in the available intelligence.
Information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker leak sensitive information out of the browser through a crafted HTML page that the victim must load, exploiting the browser's Animation rendering path. The attack is limited by its user-interaction requirement (UI:R) and by the fact that impact is confidentiality-only - no data modification, no denial of service - which is reflected in the 6.5 CVSS score and the Medium Chromium severity rating. There is no public exploit identified at time of analysis and EPSS is 0.18% (7th percentile), indicating low near-term exploitation likelihood, but a vendor patch is available so the fix is straightforward to apply.
Improper input validation in Google Chrome's Extensions component before 155.0.8059.39 lets a crafted, attacker-controlled extension cross the web origin policy boundary and act within a privileged browser page (for example chrome:// or other WebUI surfaces), with the impact confined to integrity (C:N/I:H/A:N) per the assessed CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. Exploitation is neither remote-automatic nor silent: the attacker must first convince the victim to install and run the malicious extension through social engineering, which is why Google rated it Low on the Chromium severity scale despite the 6.5 base score. EPSS sits at only 0.18 percent (7th percentile) and no public exploit has been identified at time of analysis, so this is a genuine but lower-tier priority; a vendor patch is available in Chrome 155.0.8059.39 and Chrome's auto-update channel rapidly closes the exposure window.
Web origin policy bypass in Google Chrome for iOS versions prior to 155.0.8059.39 lets an attacker subvert same-origin protections when a hostile companion app is installed on the same device, corrupting the trust boundary between web content and native app data. Exploitation is not drive-by: per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) it requires a vulnerable build, a malicious co-installed iOS app as the exploitation vector, and social engineering to obtain user interaction, so impact is confined to integrity (I:H) with no confidentiality or availability loss. No public exploit has been identified at time of analysis, EPSS is very low at 0.18% (7th percentile), and CISA SSVC rates exploitation as none and the issue as not automatable, making this a targeted, low real-world priority despite the 6.5 Medium base score; a vendor patch is available.
Incorrect authorization in Google Chrome's FontAccess implementation lets an attacker who has already compromised the renderer process bypass system access restrictions by getting the victim to load a crafted HTML page. Desktop Chrome builds prior to 155.0.8059.39 are affected; the flaw is a second-stage restriction/sandbox bypass rather than an entry point, since a separate renderer compromise and user interaction are both prerequisites. No public exploit has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.18% (7th percentile), consistent with an independent assessment that this is a genuine but secondary-chain issue rather than a standalone high-priority threat.
Incorrect authorization in Google Chrome's Network component lets a remote attacker who has already compromised the renderer process bypass system access restrictions by having the victim load a crafted HTML page, with all desktop builds prior to 155.0.8059.39 affected. The flaw is reachable without authentication (AV:N/PR:N) but requires user interaction (UI:R) and, critically, a pre-existing renderer compromise, which is why our assessment raises attack complexity to AC:H and treats this as a second-stage bypass rather than an initial-access vector. Impact is confined to integrity (C:N/I:H/A:N) with no direct data disclosure or denial of service; no public exploit code has been identified at time of analysis, Chrome is not on CISA KEV, and EPSS is only 0.18% (7th percentile), so real-world risk is moderate rather than urgent despite the 6.5 vendor base score.
Incorrect authorization logic in Google Chrome's GetUserMedia (media capture) implementation affects builds prior to 155.0.8059.39, allowing an attacker who has ALREADY compromised the browser's renderer process to use a crafted HTML page to bypass system access restrictions. The renderer-compromise precondition is the dominant limiting factor: despite the vendor vector carrying PR:N, this is best modeled as an authenticated/privileged post-compromise primitive (independent reassessment: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N) that is only useful as a chain link after a separate renderer exploit, with integrity-only impact and no direct confidentiality or availability loss. Note that no public exploit code has been identified at time of analysis (CISA SSVC exploitation: none) and EPSS is low at 0.18% (7th percentile); a vendor patch is available, making this a genuine medium-risk defense-in-depth issue rather than a top-priority emergency.
Site isolation bypass in Google Chrome versions prior to 155.0.8059.39 allows an attacker who has already compromised a Chrome renderer process to escape Chrome's site-isolation security boundary by having the victim load a crafted HTML page, undermining the process-level compartmentalization that keeps data from different sites apart. The root cause is a missing authorization check (CWE-862) in Chrome's Network component, and Google rates the flaw Chromium security severity Medium; the CVSS vector is AV:N/AC:L/PR:N/UI:R with no confidentiality or availability impact but high integrity impact, while our independent assessment raises attack complexity to AC:H because the renderer-compromise precondition is substantial and the attack is not a standalone remote-unauthenticated path. Vendor-released patch: 155.0.8059.39, distributed through the Chrome stable channel; EPSS is 0.18% (7th percentile), SSVC records exploitation as 'none', and no public exploit identified at time of analysis, so this is a moderate, deprioritizable risk best handled in a normal patch cycle rather than an emergency response.
A missing authorization check in Chrome's network component lets crafted network traffic defeat the browser's web origin policy in Google Chrome desktop builds prior to 155.0.8059.39, which can be exploited by a remote, unauthenticated attacker only after the victim is socially engineered into loading attacker-controlled content (CVSS UI:R). The impact is integrity-only with unchanged scope (C:N/I:H/A:N, S:U): cross-origin boundaries can be crossed, but the flaw does not by itself provide code execution, credential theft, or availability loss, and Google assigns it a Chromium severity of Low. EPSS is 0.17% (6th percentile) and no public exploit identified at time of analysis; the vendor fix ships in Chrome 155.0.8059.39, so this is a moderate-score but low-priority issue.
Origin-policy bypass in Google Chrome's Omnibox affects all builds prior to 155.0.8059.39, allowing a remote attacker who delivers crafted network traffic to manipulate the address-bar component into acting on its behalf and violating web origin boundaries. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), no authentication or prior privileges are required, but the victim must interact with attacker-influenced content, and the resulting impact is confined to integrity - origin-policy enforcement - with no confidentiality or availability effect and no scope change. Google has released a fix in the 155.0.8059.39 stable channel update, there is no indication of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is very low at 0.17% (6th percentile), and CISA's SSVC assessment records exploitation: none, automatable: no, technical impact: partial, making this a moderate-priority patch-and-move-on item rather than an emergency.
IATO MCP plugin versions through 1.11.0 contain a missing authorization flaw (CWE-862) that lets an authenticated Contributor-level user perform privileged actions they are not permitted to execute, resulting in high integrity impact but no confidentiality or availability loss (CVSS 6.5). Exploitation requires a valid Contributor account on a WordPress site running the plugin and network access, with no user interaction; no public exploit code or active exploitation has been identified at time of analysis.
Incorrect authorization in Google Chrome's USB handling (CWE-863) allows a malicious, attacker-controlled Chrome extension to bypass system access restrictions on USB devices in Chrome versions prior to 155.0.8059.39. Exploitation is not a remote drive-by: it requires the victim to be socially engineered into installing and running the crafted extension, which is reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N (6.5, Medium) - unauthenticated over the network, but gated by mandatory user interaction, with integrity/access-restriction impact only and no confidentiality or availability impact. There is no confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and EPSS is low at 0.17% (6th percentile). A vendor patch is available in Chrome 155.0.8059.39.
Google Chrome before 155.0.8059.39 contains an improper input validation flaw in its SignIn component, allowing a remote unauthenticated attacker to bypass system access restrictions by socially engineering a victim into installing a crafted extension. Exploitation requires user interaction (UI:R) and results in a high integrity impact (I:H) but no confidentiality or availability impact (C:N/A:N); the EPSS score is 0.17% and no public exploit identified at time of analysis. Vendor patches are available, and CISA SSVC indicates low exploitation and automation potential.
Stored cross-site scripting in the Crocoblock JetElements For Elementor WordPress plugin (all versions through 2.9.2.2) allows an authenticated user with low privileges, such as a contributor or author, to inject persistent script content that executes in the browser of any other user who later views the affected page, including administrators. Per the independent assessment this is a Medium-severity issue (CVSS 6.5, CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) requiring a valid low-privileged account and user interaction, so sites that do not grant untrusted users content-editing roles are substantially less exposed. There is no public exploit identified at time of analysis and no KEV listing, though the reported scope change (S:C) means the injected script can affect resources beyond the vulnerable component's original security context; the vulnerability was reported by Patchstack.
Repository migration in Gitea through 28.0.0 can be driven into an unbounded paginated download loop that consumes server memory until exhaustion, denying service to other users. The flaw is reachable by an authenticated user holding repository-migration rights (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) who directs a migration at a source server they control and that reports max_response_items as 0, which Gitea treats as the loop's termination condition. Exploitation is not known to be active - no public exploit code identified at time of analysis - and EPSS is low at 0.17% (5th percentile), making this a genuine but moderate-priority availability issue; a vendor-released patch exists in Gitea 28.1.0.
Authorization bypass in the Permissions subsystem of Google Chrome allows a remote, unauthenticated attacker to reach restricted system functionality by delivering crafted network traffic to any browser version prior to 155.0.8059.39, with default configurations affected and no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Impact is bounded to limited confidentiality and integrity with no availability loss, Chromium rates the issue Medium, and no public exploit identified at time of analysis; EPSS is 0.17% (5th percentile). Google shipped the stable-channel fix in 155.0.8059.39.
Algorithmic complexity denial-of-service in Gitea 1.27.3 and earlier allows an authenticated user with permission to create issues or post comments to stall a server process by submitting a crafted ~1 MB body containing many Markdown links, keeping a CPU core busy for minutes while holding a database transaction open. The flaw is a quadratic rescan of preceding text for close/reopen keywords such as "closes" or "fixes" performed once per link (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, score 6.5). It is authentication-gated and no public exploit code has been identified at time of analysis; EPSS is low at 0.16% (4th percentile) and CISA SSVC records Exploitation: none.
Authenticated denial of service in Microsoft UFO prior to 3.0.9: a caller holding a valid API key can indefinitely block the /api/task_result/{task_name} endpoint by requesting a task name that maps to an existing session, causing the server to re-acquire the same non-reentrant lock twice (CWE-833 deadlock). In the vendor's default single-process configuration the hung request stalls the event-loop thread, taking down other HTTP endpoints, WebSocket connections, and dependent background interactions, while unknown or unmapped task names never reach the nested call and are harmless. CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) rates this purely as an availability impact requiring low privileges; no confirmed active exploitation and no public exploit code were identified at time of analysis, and multi-process or multi-worker deployments limit the blast radius to the affected worker.
Improper input validation in Backstage's @backstage/plugin-proxy-backend before 0.6.17 allows an authenticated user to craft a request URL containing path traversal sequences that the proxy forwards to a path outside the configured base path on an already-configured upstream target server. The flaw is bounded: the attacker must already hold an authenticated Backstage session (CVSS vector PR:L, unless an endpoint is deliberately configured with 'dangerously-allow-unauthenticated'), and only hosts that are already registered as proxy endpoints can be reached, so the escape is a redirect within an already-trusted target rather than a route to arbitrary internal systems. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; the issue is addressed by vendor-released fixes in @backstage/plugin-proxy-backend 0.6.17 and Backstage release v1.54.6.
An authenticated Backstage user who can run scaffolder templates can invoke built-in source-control actions (GitHub, GitLab, Azure DevOps, Bitbucket Cloud, Bitbucket Server) without supplying a personal SCM token, causing those actions to fall back to shared integration credentials and perform repository operations with broader privileges than the invoking user holds. The flaw affects deployments on Backstage versions prior to 1.54.6 that have SCM integration credentials configured; custom actions and SCM readers that do not accept a user-token input are unaffected. Exploitation requires the PR:L (authenticated) precondition and offers limited confidentiality and integrity impact with scope change, and no public exploit code has been identified at time of analysis.
Authenticated device registration in Microsoft UFO versions prior to 3.0.9 can be abused to make the server open WebSocket connections to internal hosts, because pinned-address enforcement is applied only to the initial destination while the underlying websockets client still follows HTTP redirects. An attacker with valid credentials who can supply a device server_url that passes Galaxy's URL validation can then have that endpoint return a 301/302/303/307/308 redirect to an internal address, causing a cross-origin TCP connection and WebSocket upgrade handshake to be sent before peer-IP validation runs. The impact is limited to the internal connection and handshake request - no arbitrary HTTP methods, response-body disclosure, completed AIP session, or cloud metadata access - and this is a medium-severity (CVSS 6.4) SSRF whose real-world priority is modest rather than urgent; no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV).
Insufficient password-hashing work factor in the Cloak.Ecto PBKDF2 field module causes hashes to be derived with roughly 18,750 times less computational effort than the configured parameters imply, letting anyone who already holds both the stored hash values and the configured :secret brute-force low-entropy plaintexts (such as email addresses) far more cheaply than the library promises. The affected code is cloak_ecto from 1.0.0-alpha.0 onward and cloak from 0.7.0 before 1.0.0-alpha.0; the vulnerable dump/1 callback passes config[:size] (default 32) into PBKDF2's iteration-count position, so each hash runs 32 rounds instead of the default 600,000. This is a post-compromise amplifier rather than a standalone remote exploit: it requires prior disclosure of the hash column and the application secret, and remains impractical against high-entropy values. No public exploit code was identified at time of analysis, and CISA KEV does not list this CVE; the CNA assigned CVSS 4.0 base 6.3 (medium), while our independent assessment rates it CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N, reflecting the privileged prerequisites and confidentiality-only impact.
DOM-based cross-site scripting in the client interface of HPE Networking ClearPass Policy Manager lets an unauthenticated remote attacker execute arbitrary script in the browser context of a legitimate interface user, but only if that user is successfully induced to interact with attacker-supplied input (UI:R) - typically by opening a crafted link. The impact is session-scoped to the targeted victim's browser: the published CVSS 3.1 score is 6.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L), while our independent assessment scores it consistently at moderate severity and adjusts the availability sub-score to None, since the appliance and other users are not directly compromised. There is no CISA KEV entry and no public exploit code identified at time of analysis, and the attack cannot succeed without victim participation, which substantially limits practical risk. This is a moderate-severity, moderate-priority issue rather than a top-tier emergency, and the HPE security bulletin (hpesbnw05158en_us) is the authoritative source for affected builds and fixed releases.
Integer overflow leading to a heap-based buffer overflow in GIMP's DICOM export plug-in allows a local user to corrupt memory when exporting an image whose width and height are large enough that the 32-bit width × height × bytes-per-pixel product wraps and undersizes the heap allocation. Exploitation requires the victim to initiate the export and involves a crafted image with extremely large dimensions, so the attack is local (AV:L) and user-interaction dependent (UI:R), with high attack complexity (AC:H); the assessed CVSS is 6.3 with high integrity and availability impact but no confidentiality impact. No public exploit code has been identified and there is no indication of confirmed active exploitation (CISA KEV), and no vendor-released patch version is identified in the available data.
An out-of-bounds heap read in tftp-hpa's rewrite_string() function (tftpd/remap.c) lets an unauthenticated remote attacker send a TFTP read or write request whose filename matches a configured remap 'jump' rule, causing the forked in.tftpd request handler to read past the end of a heap buffer and crash. Only tftp-hpa 5.4 through versions before 6.0 are affected, and exploitation is not possible in a default deployment: the daemon must be started with the remap feature enabled (the tftpd '-m'/mapfile option) and the rule set must contain at least one jump rule. The vendor-supplied CVSS 4.0 vector scores this 6.3 (medium), but the impact is limited to a low availability effect - the crashed process is the per-request child, not the listening daemon, so the practical result is aborted individual transfers rather than full service loss; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV).
Memory exhaustion in the SSSD (System Security Services Daemon) can be triggered by an unauthenticated local attacker who repeatedly initiates Identity Provider (IdP) pre-authentication flows without completing them, causing uncleared in-memory state to accumulate until authentication services degrade or terminate (denial of service, CVSS 6.2). The flaw (CWE-770) affects SSSD on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat OpenShift Container Platform 4, but only when IdP authentication is explicitly enabled, which is not the default configuration. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Denial of service in sssd passkey authentication handling allows any local user to crash the PAM responder by sending a crafted PAM request. The flaw, a missing state validation check leading to an uninitialized pointer dereference (CWE-476), affects sssd on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 when passkey authentication is enabled-a non-default configuration. With a CVSS score of 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), impact is limited to availability; no public exploit has been identified at time of analysis, and exploitation requires local access and the passkey feature to be active.
Denial of service in Elastic Endpoint on Windows can crash and repeatedly restart the endpoint protection process when it handles a specially crafted file name under Chinese, Japanese, or Korean system locales. The vendor advisory identifies fixes in Elastic Agent/Endpoint 8.19.22, 9.4.8, and 9.5.5 (ESA-2026-194), so Windows Elastic Defend deployments below those builds on the corresponding release lines should be treated as potentially affected. No public exploit code or CISA KEV entry was provided, and the independent assessment characterizes this as a moderate-priority, availability-only issue rather than a high-impact breach risk.
Stored cross-site scripting in Arista CloudVision CUE can let an authenticated, high-privilege administrator store malicious content in a configuration that later executes in another authenticated user's browser when that user views or compares the affected configuration. Successful exploitation could allow the attacker to act through the victim's authenticated session to access sensitive data, modify configurations, or disrupt managed wireless services. The issue is rated medium (6.2), requires high privileges and victim interaction, and no public exploit was identified at time of analysis.
Open redirect in Google Chrome's AppManifest handling (all builds prior to 155.0.8059.39) lets a remote attacker abuse a crafted HTML page to bypass web origin policy, giving low-level confidentiality and integrity impact that crosses a security scope boundary. Exploitation is not automatic: the attacker must host the malicious page and socially engineer a victim into visiting and interacting with it - the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, so no authentication is needed but user interaction is mandatory, and the attacker cannot trigger the redirect without a lured, interacting victim. No public exploit identified at time of analysis: SSVC reports Exploitation: none, EPSS is 0.20% (9th percentile), and Google has released a vendor patch in Chrome 155.0.8059.39.
Missing authorization in a Chrome API allows an attacker-crafted extension to leak sensitive information from Google Chrome installations running versions prior to 155.0.8059.39. Exploitation requires the victim to install and run the malicious extension, so it depends on successful social engineering and mandatory user interaction (CVSS 6.1, AV:L/PR:N/UI:R) rather than direct network reachability, with confidentiality rated High and a limited integrity impact. No public exploit code or active exploitation has been identified at time of analysis, EPSS is low at 0.19% (8th percentile), and Google has released a patched build, so auto-updated browsers at 155.0.8059.39 or later are not affected.
Incorrect authorization in the WebAppInstalls component of Google Chrome for Android before 155.0.8059.39 lets a remote, unauthenticated attacker bypass Android system access restrictions when a victim loads a crafted HTML page. Rated CVSS v3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and Chromium security severity Medium, the issue is a genuine but moderate-priority logic flaw rather than an emergency: EPSS is only 0.19% (8th percentile), no public exploit identified at time of analysis, and it is not in CISA KEV, with the Android-specific WebAppInstalls code path and mandatory user interaction being the main factors limiting real-world exploitation. Vendor-released patch: Chrome 155.0.8059.39.
An incorrect authorization flaw in the Core component of Google Chrome allows a crafted HTML page to bypass system access restrictions - but only after the attacker has already compromised the Chrome renderer process. This makes it a chained, second-stage sandbox escape rather than a standalone remote compromise: a separate renderer-level exploit is a hard prerequisite, and the victim must still load attacker-controlled content, which is why the assessed vector raises attack complexity to High (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, 6.1 base). No public exploit code has been identified at time of analysis and EPSS is low at 0.19% (8th percentile), but a vendor patch is available in Chrome 155.0.8059.39, so affected users should update without delay.
Incorrect authorization logic in Google Chrome for iOS versions prior to 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions by convincing a victim to open a crafted HTML page in the browser. Exploitation is gated entirely by social engineering (UI:R), and the resulting impact is bounded to low confidentiality and low integrity with a scope change, so no availability loss is expected; there is no public exploit identified at time of analysis and EPSS is very low (0.18%, 7th percentile). Google has released a fixed build, making this a genuine-but-low-priority issue rather than an urgent threat.
Stored cross-site scripting in Gitea's raw media API endpoint (GET /api/v1/repos/{owner}/{repo}/media/{filepath}) lets an authenticated user with push access to a repository have HTML files of up to 1 KiB rendered by the browser on the Gitea origin, executing JavaScript in the session of any victim who opens the media URL and acting with that victim's permissions. The flaw affects Gitea versions up to and including 28.0.0 and arises because the handler in routers/api/v1/repo/file.go wrote non-LFS file content directly to the HTTP response without the content-type and content-disposition headers Gitea normally applies to user-supplied content. Exploitation requires prior repository write access and mandatory victim interaction (the target must open the crafted media URL while authenticated), and a vendor fix is available in Gitea 28.1.0. EPSS is low at 0.17% (6th percentile), CISA SSVC records no observed exploitation and no automatable exploitation path, and no public exploit code was identified at time of analysis.
SSSD configured with the Microsoft Entra ID identity provider fails to neutralize single quotes in lookup names before embedding them into Microsoft Graph OData queries, enabling an authenticated local attacker to inject filter syntax. This can broaden user or group searches, leading to information disclosure of unintended directory objects and a denial of service through excessive processing and cache population. The CVSS vector (AV:L/PR:L) confirms the attack is local and requires low privileges, and exploitation is only possible when the non-default Entra ID backend is enabled; no public exploit or active exploitation is reported, and no EPSS score was provided.
Local denial of service in the HPE Networking ClearPass Policy Manager OnGuard agent lets an authenticated low-privilege user on an affected endpoint interrupt the normal operation of the agent service. Exploitation requires an existing local session on the host running the agent and a valid low-privilege account (AV:L, PR:L, UI:N), and the impact is confined to the OnGuard agent on that single endpoint rather than the ClearPass Policy Manager server itself. There is no confirmation of active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so this should be triaged as routine patching rather than an emergency; no EPSS score was supplied in the source data.
Heap memory corruption in the lrzsz lrz ZMODEM receive utility (all versions before 0.13.0) allows a malicious or compromised ZMODEM sender to overflow the fixed-size Pathname buffer in procheader() by supplying an overlong filename of up to 8192 bytes, crashing lrz and potentially enabling limited heap manipulation. Exploitation is not passive: the victim must be actively running the lrz receive utility and accept an inbound transfer from the attacker-controlled sender (UI:P/AT:P), and the demonstrated primary impact is denial of service rather than confirmed remote code execution. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV; the overall real-world risk is constrained by these preconditions, consistent with a moderate-severity rating.
Reflected cross-site scripting in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows unauthenticated remote attackers to inject arbitrary script into pages generated by the application, which executes in the browser of any user who opens a crafted link. All versions up to and including 2026-10-06 are considered affected, and exploitation requires victim interaction (a click on the attacker-supplied URL), limiting the attack to session cookie theft, credential phishing, or DOM manipulation within the victim's browser rather than server compromise. CVE-2026-12380 is rated CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and was reported by TR-CERT; the vendor was contacted but did not respond, so no vendor patch is available and no public exploit code was identified at time of analysis. Treat this as a low-to-moderate real-world priority rather than an urgent threat.
Repository collaborators with write access on self-hosted GitHub Enterprise Server 3.18 through 3.22 can delete a repository's current default branch through the GraphQL API and have an attacker-controlled branch become the new default, so that fresh clones and default-branch API requests receive unreviewed content. Exploitation is authenticated (a write-access collaborator is required, per CVSS PR:L) and additionally depends on the repository being configured to require pull-request review while not restricting branch deletion; repositories that restrict branch deletion are not exploitable. Impact is bounded to default-branch integrity with no confidentiality or availability loss, and no public exploit identified at time of analysis.
Malformed UTF-8 echoed back through an AMQP shortstr property can permanently disable RPC consumers built on the RabbitMQ Java client before 5.36.0, forcing the affected consumer to fail on every redelivery of a single poison message. An attacker with low-privileged broker access publishes a request whose property value (for example correlation-id) contains invalid UTF-8; ValueReader.readShortstr decodes those bytes into U+FFFD replacement characters, which re-encode to more than the 255-byte AMQP shortstr limit that ValueWriter.writeShortstr enforces, so reply publication throws an unchecked exception. In RpcServer.mainloop() and tutorial-style echo consumers that exception aborts the loop before acknowledgement, the broker requeues the message, and the consumer is stuck until the queue is purged. No public exploit identified at time of analysis; impact is confined to availability of the target consumer (reported CVSS 4.0 base 6.0; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H) with no code execution, authentication bypass, or data exposure.
Information disclosure in LiquidJS versions prior to 10.27.2 lets an attacker read prototype-inherited array elements that the ownPropertyOnly option is supposed to hide. When ownPropertyOnly is enabled and an attacker can influence prototype state (for example a polluted Array.prototype) or inherited array-index data on a scope array, rendering a template that uses negative indexing, the .first/.last accessors, the first/last/join/reverse/slice/compact filters, or {% for %} iteration can surface values that direct positive indexing and ordinary object-prototype reads continue to block. The flaw is confidentiality-only (CVSS 4.0 base 6.0, Medium; assessed CVSS 3.1 AV:N/AC:H/PR:L/UI:N/C:H/I:N/A:N), requires low-privileged access together with control over prototype/inherited data and the specific template operations, and no public exploit identified at time of analysis; it is inert on applications that do not enable ownPropertyOnly or are not already subject to prototype pollution.
Web origin policy bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets a local attacker using a co-installed app escape the browser's same-origin restrictions by winning a race condition in the Custom Tabs component. Exploitation is not remote: per the assessed vector (AV:L/AC:H/PR:L/UI:R) the attacker must already have a malicious app installed on the same device (low privileges, PR:L) and must rely on victim user interaction, typically opening a link that launches a Custom Tab. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is negligible at 0.09% (percentile 0%), so this is a moderate-priority hardening issue rather than an urgent one.
CloudVision CUE versions 2021.2.0 through 2026.2.0 contain an insecure direct object reference (IDOR) in the file-serving interface that allows an authenticated, low-privileged network user to read another user's transient data. Exploitation is opportunistic because the victim's transient data must be present at the moment of attack, and the attacker cannot modify or delete data (confidentiality impact only, with low availability impact). No public exploit code or active exploitation has been identified at time of analysis; the vendor CVSS 4.0 base score is 6.0 (medium severity), and independent assessment concurs with a moderate triage priority.