UI misrepresentation in PageInfo in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted Chrome extension. (Chromium security severity: Medium)
Privilege elevation in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)
Information leak in PrivateTokens in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a local attacker to obtain sensitive information via a local program. (Chromium security severity: Medium)
Confused deputy in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Incorrect authorization in CacheStorage in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted Chrome extension. (Chromium security severity: Medium)
Incorrect authorization in API in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Information leak in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Improper input validation in Prerender in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Improper state validation in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)
Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Improper input validation in WebPackaging in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Chromium security severity: Medium)
UI misrepresentation in FileAPI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Use after free in PowerBookmarks in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Security issue in Desktop in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Uninitialized resource in Images in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
Incorrect reference resolution in Images in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High)
Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Out of bounds read in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Use after free in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Use after free in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)
Information leak in Compositing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)
UI misrepresentation in iOSWeb in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
Use after free in Codecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)
Buffer overflow in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Type confusion in PDFium in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted PDF file. (Chromium security severity: High)
Uninitialized resource in Dawn in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Out of bounds read in ANGLE in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)
Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)
Heap exhaustion in the Apache ActiveMQ broker (6.0.0 before 6.3.3, and all versions before 5.19.12) allows an authenticated OpenWire client to drive the broker into an OutOfMemoryError by repeatedly requesting consumers on temporary destinations it does not own. Each rejected request is answered with InvalidDestinationException, but the orphaned Subscription object is never removed from the region's subscriptions map, so repeated attempts accumulate on the heap until the broker fails. The issue is availability-only, requires valid broker credentials and many repeated requests, and is fixed in 6.4.0, 6.3.3 and 5.19.12; no public exploit code, EPSS score, or CISA KEV entry was identified at time of analysis.
Insertion of sensitive information into sent data in the identity provider user synchronization in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with the delegated permission to update users from the identity provider to obtain other users' MFA secrets via the synchronization API response.
Authenticated ActiveMQ clients can spoof another user's connection, consumer, and session identifiers to consume from a victim's temporary destination, tear down a live subscription through duplicate ConsumerId registration followed by RemoveInfo or disconnect, or permanently delete an in-flight unacknowledged message with a forged MessageAck. Apache ActiveMQ from 6.0.0 before 6.3.3 and releases before 5.19.12, along with the ActiveMQ Broker/KahaDB component in the same ranges, are affected; upgrading to 6.4.0, 6.3.3, or 5.19.12 fixes the issue. No CISA KEV entry is supplied, no public exploit identified at time of analysis, and no EPSS score is available.
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a backlog of 21 or more newer active checkouts that prevents the expired checkout from being checked in and its password from being rotated.
Authorization bypass in Apache ActiveMQ deployments that explicitly enable the LDAPAuthorizationMapPlugin lets an attacker who can already authenticate to the broker create or address a destination whose name contains LDAP DN special characters (comma, plus, equals, backslash), perturbing the LDAP search base used for ACL lookups so that authorization checks resolve against the wrong scope. Only the 6.3.0 through 6.3.2 and 5.19.0 through 5.19.11 branches are in scope, and brokers that do not use LDAP-based authorization are not affected; 6.4.0 is unaffected. No public exploit identified at time of analysis, and the vendor has released fixes in 6.3.3, 5.19.12 and 6.4.0.
Cleartext transmission of sensitive information in the email configuration test in Devolutions Server 2026.3.13.0 and earlier allows an authenticated user with access to the test action to obtain the stored SMTP password via a request that names an attacker-controlled SMTP host.
Unbounded memory allocation in Apache.NMS.ActiveMQ through 2.2.0 allows a malicious or compromised broker, or an attacker able to intercept and modify an unencrypted OpenWire connection, to crash the .NET client application by sending a crafted frame with oversized or negative length fields. This is a low-severity, availability-only denial of service with no confidentiality, integrity, or code-execution impact. No public exploit code was identified at time of analysis, and exploitation requires control of the broker or an interception position rather than mere network reachability.
Server-side request forgery in the Active Directory credential validation in Devolutions Server 2026.3.12.0 and earlier allows an authenticated low-privileged user to capture the NetNTLMv2 hash of the DVLS service account via an attacker-controlled domain name in the request.
Cleartext storage of sensitive information in the user account data in Devolutions Server 2026.3.12.0 and earlier allows an attacker with read access to the database or a database backup to obtain users' TOTP shared secrets via the unencrypted copy of the security key written when an administrator saves a user.
Server-side request forgery in the Jira ticketing filter lookup in Devolutions Server 2026.2.22.0 and earlier allows an authenticated low-privileged user to obtain the stored Jira service account credentials via an attacker-controlled server address in the request.
Client-created deeply nested znode chains in Apache ZooKeeper 3.8.0 through 3.8.7 and 3.9.0 through 3.9.6 can exhaust the JVM stack while the server serializes its data tree to a snapshot, killing the snapshot thread and, because the same deep tree is rebuilt from the transaction log on restart, leaving the server unable to return to service. Scoring is CVSS 4.0 8.7 (AV:N/AC:L/PR:N/UI:N/VA:H) and an assessed CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, an availability-only impact; default deployments are exposed because the root ACL is open, so any client that can reach the client port and create znodes can trigger it, while deployments requiring authentication and ACLs for znode creation remove the unauthenticated path. No public exploit identified at time of analysis and there is no KEV listing; the vendor has released fixes in 3.8.8, 3.9.7 and 3.10.0.