Stack-based buffer overflow in the Windows Resilient File System (ReFS) driver allows an unauthenticated attacker with direct physical access to a device - for example by attaching or mounting an attacker-controlled ReFS-formatted volume - to corrupt kernel memory and bypass a security feature, resulting in a high integrity impact with no loss of confidentiality or availability. The assessed vector (AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) makes remote or scaled exploitation infeasible: the attacker must be physically present and the overflow is not reliably triggerable, and CISA's SSVC evaluation records no exploitation activity and no automatable path. No public exploit code has been identified at time of analysis.
A non-deterministic timing race in Mozilla Firefox's XPCOM component can be won by attacker-controlled web content to yield limited information disclosure and a small integrity impact inside the browser, affecting Firefox builds prior to 158 and Firefox ESR builds prior to 153.5. Exploitation requires the victim to load or interact with attacker-supplied content (UI:R) and to hit a narrow, hard-to-reproduce race window (AC:H); no credentials are required (PR:N), and impact stays at low confidentiality and integrity with no scope change and no availability effect. Risk is low across every signal available: EPSS 0.19% (8th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, while vendor-released patches (Firefox 158 and Firefox ESR 153.5) are already available.
Site isolation bypass in Google Chrome's ReadingMode component, fixed in 155.0.8059.79, lets a remote unauthenticated attacker cross a security boundary - but only after two hard preconditions are met: the renderer process must already be compromised, and the victim must be persuaded through social engineering to open a crafted HTML page. The CVSS 4.2 score (AV:N/AC:H/PR:N/UI:R) reflects that high attack complexity and required user interaction, EPSS is only 0.19% (8th percentile), SSVC records Exploitation: none and Automatable: no, and no public exploit identified at time of analysis. This is a low real-world priority despite Chromium's 'High' severity label, which reflects developer-side impact rather than attacker risk.
Improper trust attribution in JupyterLab's markdownviewer:trust and notebook:trust command-link handlers lets a Trust decision apply to the wrong document: the handler resolves the target via tracker.currentWidget when the user answers the dialog instead of retaining the document whose command button was clicked, so a second document that becomes current during the prompt is marked trusted while the original remains untrusted. The result is that command buttons in the incorrectly trusted document later run without any prompt, and for notebooks trust also marks all cells trusted, saves unsaved edits, and writes the server signature to disk. Per the assessed vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N, score 4.2) this is a narrow race that requires the user to actively answer Trust and requires a second document to become current in the window between the click and the answer; no public exploit identified at time of analysis, and vendor fixes are available in 4.5.11 and 4.6.4.
Token trust-source confusion in SAP's cloud-security-services-integration-library lets the HybridTokenAuthenticator component accept identity tokens minted by an IAS/XSUAA service binding that was never intended as the application's trust source, resulting in unauthorized access at limited confidentiality and integrity impact (CVSS 3.1 base 4.2, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N, no availability impact). Only deployments bound to multiple IAS/XSUAA service instances are exposed: an 'ambient' binding must exist for the flaw to trigger, and remote attackers must already hold a valid token issued by that ambient binding before they can authenticate, so single-binding SAP BTP Cloud Foundry applications are not affected. There is no public exploit identified at time of analysis, and all available signals point to a genuinely low-priority issue rather than an urgent one.
Authenticated users of GitLab Enterprise Edition can approve a merge request even when they themselves contributed commits to it, defeating the separation-of-duties control that approval rules are meant to enforce. The flaw stems from improper identity resolution and affects all EE versions from 16.11 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2, and it requires a valid authenticated account that has already pushed commits to the target merge request, with high attack complexity because the identity-resolution edge case is not trivially triggered. Impact is confined to review governance (integrity of the approval workflow) with no confidentiality or availability impact; this is a low-severity issue (vendor CVSS 3.1 base 4.2, CWE-863), and no public exploit identified at time of analysis.
Limited information disclosure and limited integrity tampering in Mozilla Firefox versions prior to 158 arise from a race condition (CWE-362) in the browser's Networking: DNS component, fixed by Mozilla in Firefox 158. Winning the race is non-deterministic and requires the victim to interact with attacker-influenced web content (UI:R) that drives the DNS resolution code path, which is why the high attack complexity (AC:H), the modest CVSS 3.1 base score of 4.2, and CISA's SSVC 'Automatable: no' rating all point to a constrained, opportunistic issue rather than a reliable remote compromise; no public exploit identified at time of analysis, and no KEV listing. Impact is bounded to partial confidentiality and integrity loss with no availability effect, so this is a genuinely low-to-moderate priority issue rather than a high-severity emergency.
Use-after-free triggered by a race condition in Mozilla Firefox's Graphics: Text rendering component allows remote attackers to achieve limited confidentiality and integrity impact (CVSS 4.2) when a victim loads attacker-controlled web content. The vulnerability affects Firefox builds before 158 and Firefox ESR before 153.5, and is mitigated in practice by a high attack complexity (AC:H) - exploitation depends on winning a non-deterministic timing window, cannot be automated at scale (CISA SSVC Automatable: no), and requires the victim to actively navigate to crafted content (UI:R, PR:N). There is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis; the issue is rated low-to-moderate priority, with independent assessment and vendor data in agreement.
Use-after-free in Mozilla Firefox's Graphics: CanvasWebGL component - triggered by a race condition (CWE-362) in the WebGL/canvas rendering path - allows a remote attacker who convinces a victim to load crafted web content to win a non-deterministic timing window and achieve limited information disclosure or limited data modification (CVSS 3.1: 4.2, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N). Only unpatched installations below Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5 are exposed; the issues were remediated in the Mozilla Foundation Security Advisories mfsa2026-106, mfsa2026-107, and mfsa2026-108. Exploitation is not observed by CISA's SSVC assessment (Exploitation: none) and no public exploit code has been identified at time of analysis; the high attack-complexity rating, mandatory user interaction, and lack of availability or code-execution impact keep this a genuinely low-priority memory-safety issue.
Elio through 1.13.0 writes the output of its external preview capture commands to predictable temporary paths, so an unprivileged local attacker who can guess or predict a victim's Elio process ID can pre-plant a symbolic link at that path and cause the victim's own preview of a media, font, or archive file to truncate and overwrite a file the victim owns. Exploitation requires an existing local foothold on a shared/multi-user host plus victim interaction (the victim must actively preview an affected file type), making this a medium-severity, low-real-world-priority integrity issue with no confidentiality impact; no public exploit code was identified at time of analysis and the issue is not in CISA KEV.