Monthly
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.
DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.
Privilege escalation in FreeBSD's POSIX shared memory subsystem allows an unprivileged local user to gain root-level access by exploiting a race condition in the FIOSSHMLPGCNF ioctl handler. The kernel's largepage shared memory page-size configuration check is performed without holding the rangelock, enabling two concurrent callers to each observe an unconfigured object and write conflicting page sizes, corrupting kernel object state in an exploitable way. No public exploit code or CISA KEV entry has been identified at time of analysis; EPSS is 0.13% (3rd percentile), indicating low current exploitation probability, though local privilege escalation primitives in OS kernels are high-value targets for post-compromise and container-escape scenarios.
Apache Tomcat's Unix domain socket creation path exposes a TOCTOU race condition across versions 9.0.42-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, enabling an unauthorized local OS user to seize the socket before Tomcat finalizes access permissions. The vendor-assigned CVSS 8.1 with AV:N directly conflicts with the description's explicit 'local user' constraint and the inherently host-local nature of Unix domain sockets - the effective attack surface is limited to users with OS-level access on Tomcat hosts. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% (5th percentile), indicating negligible real-world exploitation pressure at time of analysis.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Remote code execution inside the Chrome sandbox is possible through a race condition in the Extensions component, exploitable via crafted network traffic against Google Chrome versions prior to 152.0.7977.65. Despite a CVSS score of 8.1, Chrome's own team rates this vulnerability Low severity - a notable divergence explained by the sandbox constraint: successful exploitation yields in-sandbox code execution rather than full OS-level compromise. No public exploit identified at time of analysis, and SSVC confirms no known active exploitation and that the attack cannot be automated reliably.
Unauthorized code execution in Sauter EY-modulo building-automation controllers (modu680-AS, modu660-AS, modu612-LC) and ecoS ecos504/ecos505 field controllers stems from a Time-of-Check Time-of-Use race in a network-facing service, which an unauthenticated remote attacker can win to bypass intended security controls. CERT@VDE (advisory VDE-2026-093) coordinated disclosure and CVSS 4.0 rates it 9.3 (Critical) with full confidentiality, integrity and availability loss. There is no public exploit identified at time of analysis and the CVE is not on CISA KEV.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
Race condition in filebrowser's TUS resumable upload handler allows authenticated low-privileged users to bypass declared Upload-Length limits by issuing concurrent PATCH requests to the same offset. Affected versions start at 2.24.0. A successful exploit causes files to be written beyond their declared sizes, and may trigger upload completion hooks for oversized payloads - potentially abusing downstream processing logic. No public exploit code or CISA KEV listing exists at time of analysis.
DNS rebinding SSRF in Weblate prior to version 2026.8 allows an authenticated user with VCS component URL management privileges to circumvent VCS_RESTRICT_PRIVATE protections and reach internal network services. The attack exploits the time gap between Weblate's initial hostname validation and the VCS client's subsequent independent DNS lookup - an attacker-controlled domain passes validation pointing to a public IP, then switches to an internal address before the actual VCS connection is made. Triggering a clone, fetch, push, or similar operation then causes Weblate to connect to internal VCS-compatible services and potentially expose their contents. No public exploit has been identified at time of analysis, though the DNS rebinding technique is well-understood and toolkits for it exist.
Privilege escalation in FreeBSD's POSIX shared memory subsystem allows an unprivileged local user to gain root-level access by exploiting a race condition in the FIOSSHMLPGCNF ioctl handler. The kernel's largepage shared memory page-size configuration check is performed without holding the rangelock, enabling two concurrent callers to each observe an unconfigured object and write conflicting page sizes, corrupting kernel object state in an exploitable way. No public exploit code or CISA KEV entry has been identified at time of analysis; EPSS is 0.13% (3rd percentile), indicating low current exploitation probability, though local privilege escalation primitives in OS kernels are high-value targets for post-compromise and container-escape scenarios.
Apache Tomcat's Unix domain socket creation path exposes a TOCTOU race condition across versions 9.0.42-9.0.120, 10.1.0-M1-10.1.57, and 11.0.0-M1-11.0.24, enabling an unauthorized local OS user to seize the socket before Tomcat finalizes access permissions. The vendor-assigned CVSS 8.1 with AV:N directly conflicts with the description's explicit 'local user' constraint and the inherently host-local nature of Unix domain sockets - the effective attack surface is limited to users with OS-level access on Tomcat hosts. No public exploit code or active exploitation has been identified; EPSS sits at 0.16% (5th percentile), indicating negligible real-world exploitation pressure at time of analysis.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Remote code execution inside the Chrome sandbox is possible through a race condition in the Extensions component, exploitable via crafted network traffic against Google Chrome versions prior to 152.0.7977.65. Despite a CVSS score of 8.1, Chrome's own team rates this vulnerability Low severity - a notable divergence explained by the sandbox constraint: successful exploitation yields in-sandbox code execution rather than full OS-level compromise. No public exploit identified at time of analysis, and SSVC confirms no known active exploitation and that the attack cannot be automated reliably.