Information disclosure in Google Chrome's Omnibox affects versions prior to 155.0.8059.39, where a remote attacker who has already compromised the browser's renderer process can obtain sensitive information by enticing the victim to open a crafted HTML page. Exploitation is constrained by the renderer-compromise prerequisite, high attack complexity (AC:H), and required user interaction (UI:R), and the resulting impact is limited to confidentiality (C:H, I:N, A:N), consistent with a CVSS 3.1 base score of 5.3 and CWE-863 incorrect authorization. There is no public exploit identified at time of analysis and CISA SSVC records exploitation as none; a vendor patch (155.0.8059.39) is available.
Information disclosure in Google Chrome for iOS (Google's Safe Browsing component) affects versions prior to 155.0.8059.39, where a crafted HTML page can be used to observe a measurable discrepancy and extract sensitive information. The flaw is only reachable by a remote attacker who has already compromised Chrome's renderer process on iOS and who can get the victim to load the crafted page (UI:R), making exploitation a two-stage, high-complexity (AC:H) operation rather than a standalone attack, and CISA's SSVC assessment records Exploitation=None. There is no CISA KEV listing and no public exploit identified at time of analysis; Chromium rates the bug Medium and the vendor has released a patch, so the practical risk is best characterized as moderate with a strong precondition rather than imminent.
Information disclosure in Google Chrome's Autofill AI component (builds prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process read sensitive data by luring the victim to a crafted HTML page that engages the autofill feature. The flaw is rated CVSS 5.3 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) and stems from an observable discrepancy (CWE-203) rather than a memory-safety bug, so it is a chained post-exploitation primitive, not an initial-access vector: exploitation requires a separate renderer compromise plus socially engineered user interaction, and patched builds are not exploitable. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); CISA SSVC rates exploitation as 'none' and automatable as 'no', consistent with a genuine-but-low-priority information leak.
An unauthenticated remote attacker can exploit a race condition in Chromoting (Chrome Remote Desktop) within Google Chrome before version 155.0.8059.39 by socially engineering a victim into opening the vulnerable code path while delivering crafted network traffic, potentially bypassing system access restrictions. Exploitation requires the victim to be actively using Chromoting and to win a timing-dependent race condition (AC:H), making reliable attacks unlikely. The EPSS score is 0.14% (3rd percentile), the Chromium severity is Low, and no public exploit has been identified at time of analysis; the vendor has released a patch in 155.0.8059.39.
Information disclosure in Google Chrome's Proxy component on Windows allows an attacker positioned on the same adjacent network to obtain sensitive information from a victim by delivering crafted network traffic to Chrome builds prior to 155.0.8059.39. The high attack complexity (AC:H) means a single attempt is unlikely to succeed - specific proxy state or timing conditions must line up - and no public exploit has been identified at time of analysis, with CISA SSVC recording exploitation as 'none' and automatable as 'no'. Because the impact is confidentiality-only (no code execution, no integrity or availability effect) and the disclosure is rated partial technical impact, the practical priority is low-to-moderate despite Chromium's 'High' security severity label; Google has already published a fixed build.
Cross-origin WebSocket probing in the Punk Perl web framework (versions 0.48 up to but not including 0.55) allows a malicious web page to learn whether arbitrary GET paths, API operations, or mounted applications return a 2xx status. When Punk serves HTTP/2 or HTTP/3, an Extended CONNECT WebSocket handshake is routed as a GET by ps_serve_one, so it reaches every GET route while the Origin check - which only runs for matched websocket routes - is skipped; the handler's returned status becomes the handshake response, and any 2xx accepts the socket. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires user interaction (UI:R): a victim must load an attacker-controlled cross-origin page that scripts the WebSocket, and it is not exploitable over HTTP/1.1. The impact is limited to endpoint and authorization probing - no response content, integrity, or availability impact - and no public exploit code was identified at time of analysis.
Information disclosure in SSSD deployments configured to use Microsoft Entra ID as their identity backend, where a local low-privileged user can submit a crafted lookup request that is incorporated unsanitized into a directory query filter, manipulating the query logic to return directory data outside the requester's intended scope. Only hosts explicitly configured with the Entra ID backend are affected; standard AD, LDAP, or IPA backend deployments are not. Exploitation requires a pre-existing local account with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) and there is no remote path, so this is assessed as a moderate-severity, low-urgency issue with no public exploit identified at time of analysis.
Information disclosure in Google Chrome's Proxy Auth handling lets an attacker on the same adjacent network segment (same broadcast domain or a man-in-the-middle position on the traffic path) capture sensitive data that Chrome failed to properly clear from memory. Exploitation is unauthenticated per the assessed vector (CVSS:3.1/AV:A/AC:H/PR:N/UI:N) but carries high attack complexity, and it only works meaningfully when the victim's browser is configured to route traffic through an authenticating proxy, making this a narrow, environment-dependent leak rated CVSS 5.3. The flaw is rated Chromium security severity High, is tracked as EUVD-2026-93809, and is fixed in Chrome 155.0.8059.39; there is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis.
Heap exhaustion in the yawkat LZ4 Java library before 1.11.2 allows remote denial of service: net.jpountz.lz4.LZ4BlockInputStream.refill() checks that the compressedLen field of a legacy LZ4Block header is nonnegative but then allocates a compressed-input buffer of exactly that attacker-controlled size before any payload is read. Because each header is only a handful of bytes, a header-only stream can request a near-2 GiB allocation and crash the JVM with OutOfMemoryError, affecting any application that decompresses attacker-influenced LZ4 legacy-block data with the default reader configuration; no public exploit code or active exploitation was identified at time of analysis (CVSS 5.3, availability-only impact). The flaw is fixed in version 1.11.2, which rejects non-canonical oversized blocks by default.
Open redirect in the Arista CloudVision Portal login flow (CWE-601) lets a remote, unauthenticated attacker craft a login URL that, once a victim clicks it and completes the normal authentication process, sends that user's browser to an arbitrary external site. The issue carries a CVSS 4.0 base score of 5.3 and was assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N; the attacker needs no credentials but cannot trigger the redirect without victim interaction, and impact is limited to browser redirection with low confidentiality loss - primarily useful for enabling phishing or credential theft rather than code execution or data modification. Affected releases are CloudVision Portal 2020.3.0 through <2025.3.0, 2025.3.0 ≤2025.3.3, 2026.1.0 ≤2026.1.2, and 2026.2.0; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available per the Arista security advisory.
Authenticated users who are permitted to submit a Django model formset can delete database rows outside that formset's limiting queryset - without holding any permission on the targeted object - by forging management-form POST data when the affected model's primary key is editable through the form. The flaw is an authorization bypass through a user-controlled key (CWE-639) in django.forms.models.BaseModelFormSet.save_existing_objects(), rated CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) with integrity-only impact; it affects Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18, while models using the default AutoField/BigAutoField primary key are not affected. No public exploit code identified at time of analysis, and there is no confirmed active exploitation (not in CISA KEV); this is a genuinely moderate-severity authorization flaw and the signals are internally consistent.
Brute-force attacks against the Pusula Expert Mail authentication surface can succeed because the product does not adequately control the frequency of repeated login attempts, a CWE-799 anti-automation weakness rated CVSS 5.3. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), the flaw is remotely reachable with no authentication, no privileges, and no user interaction, meaning default-configuration instances that expose a webmail or login endpoint are affected; impact is limited to confidentiality, so a successful attack only yields whatever credentials are weak or guessable. There is no CISA KEV listing and no public exploit identified at time of analysis, and the issue was reported by TR-CERT; feasibility drops sharply where a WAF, IP rate limiting, external MFA, or network segmentation sits in front of the login endpoint.
Open redirect in the PingGateway Fragment Filter lets unauthenticated remote attackers craft a link that causes the gateway to send a victim to an attacker-controlled destination, with the CVSS 4.0 vector (UI:A) requiring the victim to actively interact with that link; the vendor-assigned base score is 5.1 (medium). Only deployments running PingGateway 7.1.0 and later, 2023.2.0 through 2024.11.1, or 2025.3.0 through 2025.11.1 and actually using the Fragment Filter feature are affected, while builds 2024.11.2, 2025.11.2, and 2026.3.0 or later are fixed. No public exploit code or confirmed active exploitation was identified at time of analysis (no CISA KEV listing), and the combination of mandatory user interaction with low confidentiality/integrity impact keeps practical risk moderate.
Incorrect authorization in Google Chrome for Android prior to 155.0.8059.39 allows a locally co-installed malicious application to obtain sensitive information from the browser through a social-engineering precondition. Exploitation is confined to the same Android device: a local attacker (the assessed vector requires no privileges, PR:N) must persuade the victim to install or run a hostile app alongside Chrome, and the high attack complexity (AC:H) reflects that non-trivial co-installation and user-interaction dependency; impact is limited to confidentiality, with no integrity or availability loss. There is no public exploit code and no confirmed active exploitation at time of analysis - CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial - and Google has released a vendor patch, so this is a low-to-moderate priority defect rather than an urgent one.
Local information disclosure in Google Chrome on Android versions prior to 155.0.8059.39 allows a co-installed malicious app to access sensitive information without user interaction or authentication, though exploitation requires high attack complexity and the pre-existence of an attacker-controlled app on the same device. This moderate-severity issue (CVSS 5.1) has no public exploit identified at time of analysis, and vendor patch 155.0.8059.39 is available.
Server-side request forgery (SSRF) in Arista CloudVision Portal allows an authenticated user with high privileges to manipulate the OIDC bearer token configuration and direct requests to arbitrary destinations. Affected versions include 2023.3.0 before 2025.3.0, 2025.3.0 through 2025.3.3, 2026.1.0 through 2026.1.2, and 2026.2.0. Exploitation requires pre-existing elevated access, limiting impact to subsequent-system confidentiality; no public exploit identified at time of analysis.
Server-side request forgery (SSRF) in Arista CloudVision Portal arises from insufficient validation of OIDC SSO provider configuration, allowing a user holding the specific high-privilege right to view and modify that configuration to direct CVP-originated requests to arbitrary destinations. The practical impact is limited rather than systemic: the CVSS 4.0 base of 5.1 and our independent CVSS 3.1 assessment (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N) both reflect that the attacker must already be a highly privileged CVP administrator with network reach to the management interface, and that the consequence is a low-confidentiality information-disclosure primitive rather than code execution or service disruption. There is no public exploit identified at time of analysis and no confirmed active exploitation (SSVC: Exploitation=none, Automatable=no); a vendor patch is available via Arista security advisory 0186, and the main residual risk is abuse or takeover of an already-privileged administrative account.
Stored cross-site scripting in the Formwork PHP content management system (versions up to and including 2.3.12) lets an authenticated user who can submit HTML content inject a script-bearing 'formaction' URI that survives the built-in DomSanitizer. The payload does not fire on its own: a second user must view and activate the injected form control (UI:P/UI:R) for the script to execute, which is why this is rated medium severity (CVSS 4.0 base 5.1; independently assessed CVSS 3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The flaw is fixed in Formwork 2.3.13, and no public exploit code has been identified at time of analysis.
OS command injection in Johnson Controls Illustra Standard - L4L China (versions before 6.0.0.66394 on Windows) allows an authenticated low-privilege attacker, with user interaction and an additional attack precondition, to execute arbitrary commands on subsequent connected systems, though the camera itself suffers no direct loss of confidentiality, integrity, or availability. The vendor CVSS 4.0 base score is 5.1, and no public exploit code or active exploitation has been identified at time of analysis. This moderate-severity issue requires a valid account on the device and passive user interaction, limiting its overall risk.
Information disclosure in the Backstage Kubernetes backend plugin (@backstage/plugin-kubernetes-backend) before 0.21.10 allows an authenticated catalog contributor who can create or modify kubernetes-cluster Resource entities to steer cluster discovery into an unsupported authentication mode, causing the backend to answer Kubernetes API requests using its own local in-cluster service-account identity rather than a catalog-supplied credential. The disclosure is bounded strictly by what that pod service account is already permitted to read via RBAC, and the leaked credential is used only against the local in-cluster API endpoint and is never transmitted to the catalog-supplied endpoint; exploitation requires a non-default catalog cluster discovery deployment, the relevant endpoint permissions, and over-privileged pod RBAC, which is why the assessed severity is low. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in 0.21.10 (shipped in the Backstage release v1.54.6).
Content injection in Backstage's cloud storage URL readers (the @backstage/backend-defaults package before 0.17.8) allows an attacker who holds write access to a configured AWS S3 bucket, AWS CodeCommit repository, or Azure Blob Storage container to craft object names containing path traversal segments so that an ingested object can collide with a protected file in the reader's output directory, overwriting or injecting content in certain deployment configurations. The issue is a CWE-22 improper-limitation-of-pathname flaw with an integrity-only impact, scored CVSS 4.4 (AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N), meaning exploitation demands high privileges (bucket write access) and a non-trivial collision condition, while confidentiality and availability are unaffected. No public exploit code and no confirmed active exploitation were identified at time of analysis, and a vendor patch is available in @backstage/backend-defaults 0.17.8 (Backstage v1.54.6).
Secret-derived values used during Scaffolder template iteration in Backstage can leak into task logs, exposing configured scaffolder.defaultEnvironment.secrets to anyone who can read those logs. Affected deployments run the @backstage/plugin-scaffolder-backend package prior to version 4.1.0, and exploitation requires a privileged, authenticated template author (PR:H in the CVSS vector) plus a deployment that has populated sensitive values in scaffolder.defaultEnvironment.secrets. The flaw only manifests when secret-derived values pass through a transforming Nunjucks filter inside an 'each' loop, since untransformed secrets were already redacted; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Realistic risk is moderate given the layered prerequisites, though the confidentiality impact for exposed credentials is high.
Gitea versions through 28.0.0 allow repository administrators to create new push mirrors through the API even when the site administrator has enabled the [mirror] DISABLE_NEW_PUSH restriction that the web UI honors. This is an authenticated, repository-admin-only authorization bypass (CVSS PR:H) that only crosses the intended security boundary on instances where that restriction is configured; on default configurations push mirrors are permitted, so the API behavior is not a violation. EPSS is 0.16% (5th percentile), no public exploit identified at time of analysis, and no CISA KEV activity is reported; the vendor fixed the issue in 28.1.0. The independent assessment rates this as a genuinely low-priority issue with assessed vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N.
Information disclosure in Bludit CMS 3.22.0 can be triggered through the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints, enabling an authenticated attacker with admin-area access to read sensitive data. The issue is a CWE-200 exposure flaw with a moderate CVSS score, and the authoritative assessment limits its practical severity because exploitation requires an authenticated session and has a confidentiality-only impact. No public exploit code or active exploitation is identified in the available data.
Authentication-protection bypass in the WebFactory Login Lockdown WordPress plugin at version 2.17 and earlier lets unauthenticated remote attackers evade the plugin's failed-login lockout by spoofing the client identifier it relies on to count and block attempts, enabling sustained credential brute-force against wp-login.php. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, score 4.8) confirms that no authentication or user interaction is required, while the HIGH attack complexity reflects the need to reliably reproduce the spoofing condition; the impact is bounded to defeating the throttling control rather than directly granting access. The issue is mapped to CWE-290 and was reported by Patchstack; there is no confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis.
Incorrect authorization in the Extensions component of Google Chrome prior to 155.0.8059.39 allows a crafted extension to spoof browser UI elements after it has been installed, giving a remote attacker a means of deceiving the user about what the browser is actually showing or requesting. Successful exploitation requires social engineering to convince the victim to install an untrusted extension (the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, Chromium severity Medium), so impact is limited to deceptive UI and low-level integrity loss rather than code execution or direct credential compromise, and unauthenticated remote attackers are the relevant threat model with user interaction as the practical gate. No public exploit code and no confirmed active exploitation were identified at time of analysis; environments that restrict extension installation through enterprise policy are largely protected, making this a genuinely low-to-moderate priority issue despite being network-reachable.
Information disclosure in Google Chrome on Android before 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to read memory outside the GPU sandbox by serving a crafted HTML page. The flaw (CWE-908, use of an uninitialized resource in the GPU path) is a chain-dependent bug rather than a standalone entry point: it requires a separate renderer compromise plus victim interaction to load malicious content, and the impact stops at memory disclosure with no code execution, integrity, or availability loss. No public exploit has been identified at time of analysis, EPSS is low at 0.24 percent (13th percentile), and Google has released a fix in Chrome 155.0.8059.39 at Chromium severity Medium.
Memory disclosure in Google Chrome on Android before 155.0.8059.39 lets a remote attacker who persuades a victim to open a crafted HTML page read uninitialized GPU memory that lies outside the browser sandbox, exposing data the page should never be able to observe. The bug is rated CVSS 3.1 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) - unauthenticated remote triggering is possible but requires the victim to actively load the malicious page, only confidentiality is partially affected, and there is no integrity or availability impact, so this is an information-leak primitive rather than a code-execution path. Risk is currently low: EPSS is 0.24% (13th percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list it, but the disclosure crosses the sandbox boundary, which is why Google assigned Medium severity and the vector shows a scope change.
Uninitialized memory handling in ANGLE, the graphics translation layer Chrome uses for WebGL and hardware-accelerated rendering on Windows, allows a remote attacker to read memory outside the browser sandbox by getting a victim to load a crafted HTML page. Only Chrome on Windows running builds earlier than 155.0.8059.39 is affected; the CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N, meaning the attack is remote and unauthenticated but requires user interaction, and the outcome is read-only out-of-sandbox memory disclosure with no integrity or availability impact. The issue is not confirmed actively exploited (no CISA KEV listing), no public exploit code has been identified, and EPSS is 0.24% (13th percentile), indicating low near-term exploitation likelihood; a vendor patch is available.
Information disclosure in Google Chrome on Windows lets remote attackers read memory outside the browser sandbox by convincing a user to open a crafted HTML page that exercises the ANGLE graphics translation layer. The affected builds are Chrome versions prior to 155.0.8059.39 on Windows; the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) confirms no authentication is required but that a victim must interact with the malicious page, and the Scope:Changed rating reflects that the read crosses the intended sandbox boundary even though there is no integrity or availability impact. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; EPSS is low at 0.24% (13th percentile), consistent with a moderate-priority defect that is patched by the vendor.
Uninitialized memory handling in ANGLE, Chrome's graphics translation layer on Windows, allows a remote attacker to read memory outside the browser sandbox when a user opens a crafted HTML page in Chrome builds prior to 155.0.8059.39. The attack is unauthenticated (PR:N) but depends on user interaction (UI:R) - the victim must navigate to attacker-controlled content that reaches the WebGL/graphics rendering path - and the impact is confidentiality-only, with no write or code-execution primitive. No public exploit identified at time of analysis, EPSS is low at 0.23% (12th percentile), and vendor-released patches are available, making this a moderate-priority patch-and-update item rather than an emergency.
Uninitialized-memory handling in Dawn, Chrome's WebGPU backend, allows unauthenticated remote attackers to read memory outside the browser sandbox on macOS when a victim loads a crafted HTML page in Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction - the victim must navigate to attacker-controlled content that exercises the WebGPU path - and the impact is bounded to information disclosure, with no code execution, data modification, or denial of service. EPSS is 0.23% (12th percentile) and no public exploit has been identified at time of analysis, so despite the 'High' Chromium triage label this is a moderate-priority issue; Google has shipped a fixed build.
Information disclosure in Google Chrome for Android versions prior to 155.0.8059.39 lets a remote attacker read a limited amount of GPU process memory outside the browser sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the malicious page) and yields only a partial read of uninitialized memory - no code execution, data modification, or denial of service - which is why Google rates it Chromium severity Low and our assessment scores it CVSS 4.7. There is no confirmed active exploitation and no public exploit identified at time of analysis, and exploitation likelihood is low (EPSS 0.19%, 8th percentile); a vendor patch is available in Chrome 155.0.8059.39 and later.
Out-of-sandbox memory disclosure affects Google Chrome on Android builds prior to 155.0.8059.39, where an uninitialized resource in Dawn, Chrome's WebGPU implementation, can be triggered by a crafted HTML page to leak memory contents. Exploitation is constrained: it requires the victim to open attacker-influenced content that exercises WebGPU (user interaction is mandatory, UI:R) and yields only a LOW-confidentiality read with no integrity or availability impact, giving a CVSS 3.1 base score of 4.7 and EPSS of just 0.19% (8th percentile). No public exploit code has been identified at time of analysis, this CVE is not on CISA KEV, and a vendor patch is available in Chrome 155.0.8059.39.
Memory disclosure outside the GPU boundary in Google Chrome on Android (versions prior to 155.0.8059.39) allows an attacker who has already compromised the Chrome renderer process to read uninitialized GPU-related memory via a crafted HTML page, providing a second-stage sandbox information-leak primitive. The flaw is not remotely exploitable in isolation: it requires a separate, prior renderer compromise plus user interaction (navigating to attacker-controlled HTML), and it yields only low-severity reads with no integrity or availability impact (CVSS 4.7, CWE-908; the independent assessment raises attack complexity to High to reflect the renderer-compromise prerequisite). No public exploit code has been identified and the issue is not in CISA KEV; EPSS is 0.19% (8th percentile), reinforcing that near-term exploitation risk is low. The vendor has released a fix in Chrome 155.0.8059.39.
An uninitialized resource flaw in the Video component of Google Chrome prior to version 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to craft an HTML page that reads memory outside the sandbox, leaking limited information. The vulnerability requires both a pre-existing renderer compromise and user interaction (victim must load attacker-controlled content), and no public exploit has been identified at time of analysis; EPSS is low at 0.19% (8th percentile). Our independent assessment rates this as a moderate-but-not-urgent issue - its practical value is primarily as a sandbox-escape/info-leak primitive within a larger exploit chain rather than a standalone attack, and a vendor patch is available.
An uninitialized-resource flaw in Chrome's ANGLE graphics abstraction layer on Windows allows a remote attacker who persuades a victim to render a crafted HTML page to read memory that should not be reachable from the renderer, potentially crossing the browser's sandbox boundary. The vulnerability affects Google Chrome on Windows prior to 155.0.8059.39, requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N) but does require user interaction, and is scored 4.7 with scope change because the leaked data can originate outside the sandboxed renderer. There is no public exploit code identified at time of analysis, EPSS is low at 0.19% (8th percentile), and a vendor patch is available.
Out-of-bounds memory reads in Google Chrome's ANGLE graphics layer (the WebGL/OpenGL ES translation backend) affect all versions prior to 155.0.8059.39, letting a remote attacker leak memory located outside the browser sandbox when a victim loads a crafted HTML page. The impact is disclosure-only: the changed-scope score (S:C) reflects a sandbox boundary crossing, but there is no integrity or availability effect, and per the assessed vector the attack still requires victim user interaction (UI:R) even though no authentication is needed (PR:N). No public exploit code has been identified at time of analysis, EPSS is low at 0.18% (6th percentile), and a vendor patch is available in Chrome 155.0.8059.39.
Out-of-bounds memory read in Google Chrome's Printing component on Windows (all versions prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to read memory outside the sandbox when a victim is socially engineered into loading a crafted HTML page. The flaw is rated Chromium security severity Medium and carries a CVSS v3.1 base score of 4.7 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), reflecting a scope-changing confidentiality-only leak with no integrity or availability impact. There is no confirmed active exploitation (not listed in CISA KEV) and no public exploit code identified at time of analysis; EPSS is 0.18% (6th percentile), and a vendor patch is available.
Out-of-sandbox memory disclosure in Google Chrome (desktop) versions prior to 155.0.8059.39 stems from a race condition (CWE-367) in the CacheStorage component, which an attacker can drive through a crafted HTML page to read memory beyond the renderer sandbox. The dominant limiting factor is that exploitation requires the attacker to have already compromised the renderer process - this flaw alone does not provide initial access and functions as a chain component rather than a primary entry point, and the victim must also load attacker-controlled content to trigger the timing-dependent race. Impact is confidentiality-only (memory read; no integrity or availability effect), the vendor has released a fixed build, EPSS is very low at 0.14% (3rd percentile), and no public exploit has been identified at time of analysis, with no CISA KEV listing.
Denial of service in SSSD allows a local, already-authenticated user who can reach the PAM responder and complete a GSSAPI authentication request to send a follow-up request over the same connection, dereferencing freed cached connection state and terminating the service, which disrupts system authentication. Per the authoritative assessment the issue is rated CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H): it is local-only, requires valid low-level credentials on the host, and is constrained by high attack complexity because the dangling-pointer dereference depends on request timing and sequencing over a reused connection. Impact is availability-only - no confidentiality or integrity effect - and no public exploit identified at time of analysis (no CISA KEV listing and no publicly available exploit code in the provided intelligence).
Local denial of service in the SSSD autofs responder allows an authenticated user on an affected host to exhaust memory by repeatedly racing concurrent map enumeration requests against map invalidation requests. Per the assessed vector (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H), the attack requires local, valid credentials and depends on winning a narrow timing window, so successful sustained exploitation is non-deterministic; hosts that do not run the autofs responder are not exposed. Impact is confined to availability - leaked memory accumulates until the autofs service is degraded or crashes - with no confidentiality or integrity effect. No public exploit code has been identified and there is no confirmed active exploitation (no CISA KEV listing), and the 4.7 base score reflects the local, high-complexity prerequisites rather than the broad enterprise presence of SSSD.
The SSSD Kerberos Credential Manager (KCM) responder can be crashed by an authenticated local user who holds a renewable Kerberos ticket-granting ticket, because a deferred callback in the TGT renewal path dereferences memory that has already been freed. Exploitation is conditional on the host being explicitly configured for KCM-based credential renewal (a non-default, feature-dependent prerequisite), and the assessed vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H (4.7) reflects local access, high attack complexity, and an availability-only impact confined to the sssd-kcm service. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); overall this is a medium/low-priority denial-of-service issue rather than a high-CVSS/low-real-risk outlier.
Handlebars (the handlebars.js npm package) versions 4.0.0 through 4.7.9 emit static template text into precompiled JavaScript without escaping sequences such as '</script>' or '<!--', so an application that precompiles attacker-controlled template text and inlines the generated source inside a <script> element can have that element terminated early and followed attacker markup parsed and executed - a cross-site scripting condition (CWE-116). Exploitation is narrow rather than universal: it requires the non-default pattern of running Handlebars.precompile() on untrusted template text and embedding the output directly in an inline script, plus a victim loading the resulting page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, 4.7); ordinary server-side rendering and precompiled templates served as external JavaScript files are explicitly unaffected. No public exploit code or confirmed active exploitation was identified at time of analysis, and the required user interaction and unusual integration keep practical risk below a typical network XSS. The issue is fixed in Handlebars 4.7.10.
Information disclosure in Google Chrome for iOS before 155.0.8059.39 allows an attacker with hands-on physical access to the device to obtain sensitive information through the browser's Mobile component. The flaw scores CVSS 3.1 base 4.6 (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), reflecting a high confidentiality impact that is heavily offset by the requirement for physical possession of the device; authentication or user interaction beyond having the unlocked device is not required per the assessed vector. No public exploit code has been identified at time of analysis, and Google rates the Chromium security severity as Low, so this is a low real-world priority despite the moderate score.
Missing authorization in the CredentialProvider component of Google Chrome on Windows (versions prior to 155.0.8059.39) lets an attacker with direct physical access to the machine read sensitive credential data. The vulnerability is strictly local and physical - CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - so it cannot be triggered over a network, cannot be automated (SSVC Automatable=no), and carries no integrity or availability impact, only confidentiality. CISA's SSVC assessment rates exploitation as none and no public exploit code or in-the-wild activity has been identified at time of analysis, keeping overall risk genuinely low and confined to shared, kiosk, loaner, or lost/stolen Windows devices.
Authentication and access-control bypass in Google Chrome on Android before version 155.0.8059.39 lets a malicious app already installed on the same device act as a confused deputy, driving Chrome's UI into a privileged page and circumventing system access restrictions. The flaw is local-only (AV:L) and requires the attacker to first get their app onto the victim's device via sideloading or a trojanized application, after which no further interaction with Chrome is needed (UI:N); impact is limited to partial confidentiality and integrity loss with no availability impact (CVSS 4.4). There is confirmed vendor patching but no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is negligible (0.11%, 1st percentile), ranking this as a low-to-moderate, local-only issue rather than an urgent priority.
A logic error in the Android kernel hardware-crypto driver routine kdn_set_sysregs_prot (hwcrypto-kdn.c) causes an information disclosure, but only for an attacker who already executes code with System-level privileges directly on the affected Pixel/Tensor device. The CVSS base score is 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting a local-only, high-privilege, confidentiality-only impact with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV (SSVC: Exploitation none). In practice this is a genuine-but-low-priority weakness that hardens an already-compromised or highly privileged execution context rather than a remotely reachable or pre-auth escalation path.
A missing permission check in the is_pd_allowed function of Android's gem_msg.c kernel source (CWE-862, Missing Authorization) allows an attacker who already holds System execution privileges to bypass an authorization decision and read otherwise-protected information. Impact is limited to local information disclosure - confidentiality-only (C:H) with no integrity or availability effect - and exploitation requires a local foothold running as System (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.4); no user interaction is needed. There is no public exploit identified at time of analysis, exploitation is assessed as non-automatable (SSVC Exploitation: none), and this is a low-priority, post-compromise authorization gap behind an already-high trust boundary rather than an initial-access bug. Google Devices reported the flaw and a fix is referenced through the Android/Pixel October 2026 security bulletin.
Denial of service in Elasticsearch stems from catastrophic backtracking in the ES|QL CHUNK function, which accepts user-supplied regular expressions as text-splitting separators without validating their computational complexity or bounding their execution time. An authenticated attacker who holds read access to any text-based index and can invoke CHUNK through ES|QL can submit a crafted pattern that drives exponential regex blowup, consuming excessive CPU on Elasticsearch worker threads and degrading query throughput for other tenants on the affected node, though the cluster does not crash. CVSS 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) reflects a bounded availability-only impact, no public exploit code was identified at time of analysis, and patched releases are available as Elasticsearch 8.19.22, 9.4.8, and 9.5.5 per Elastic security update ESA-2026-189.