Monthly
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
Repeated multipart file uploads to Misskey servers running versions 13.0.0 through 2025.4.1, or 2025.5.0 through 2026.7.0, can exhaust server storage and file descriptors and cause a denial of service, because temporary upload files are not reliably deleted after processing. The vulnerable upload path writes the temp file to disk before authentication is performed, so unauthenticated remote attackers can trigger it, and the behaviour holds regardless of whether federation is enabled. A single request is harmless - the impact is cumulative across sustained uploads - and the issue is resolved in Misskey 2026.7.0; no public exploit code has been identified at time of analysis.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Incomplete cleanup in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS before 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions using crafted network traffic, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector. Impact is materially constrained: only macOS hosts on an affected build with Chromoting enabled and reachable are in scope, and the realistic outcome is limited information exposure rather than full compromise, which is consistent with the vendor's 'Low' Chromium severity rating. Risk signals conflict sharply - the supplied CVSS score of 9.1 (C:H/I:N/A:H) and the authoritative assessed vector of C:L/I:N/A:N disagree - and must be reconciled before prioritization; EPSS is negligible at 0.17% (6th percentile), there is no KEV listing, and no public exploit identified at time of analysis. Vendor-released patch: Chrome 155.0.8059.39.
Incomplete cleanup in Dawn, Chrome's WebGPU implementation, allows a crafted HTML page to potentially corrupt GPU-process state and achieve code execution outside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to render attacker-controlled content that reaches the affected WebGPU/Dawn code path (CVSS UI:R with PR:N - unauthenticated remote attackers, but user interaction required), and the outcome is probabilistic rather than a guaranteed silent drive-by; the published base score is 9.6 while Google rates the issue Medium, and our assessed vector raises attack complexity to AC:H to reflect the difficulty of chaining a cleanup flaw into a reliable sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 155.0.8059.39 as the fix.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Denial of service in the Zcash Foundation's Zebra full node before 6.1.0 lets remote unauthenticated peers stall node synchronization by poisoning the stale parent_error_map used by the state write task, after which the next canonical block is rejected for roughly 2,000 blocks. Exploitation is gated by a narrow race window: the attacker must act as a network peer and deliver a coinbase-malleated block that shares a legitimate canonical block's hash before that canonical block propagates, an AC:H/AT:P timing condition, so reliable on-demand abuse is materially limited. Impact is availability-only (CVSS 4.0 8.2, VA:H with no confidentiality or integrity effect), unauthenticated per the PR:N vectors, and no public exploit code has been identified at time of analysis; a vendor-released patch is available in Zebra 6.1.0.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.
System access-restriction bypass in Google Chrome's Network component (versions prior to 152.0.7977.82) lets a remote attacker use crafted network traffic to circumvent enforced access controls, stemming from incomplete resource cleanup (CWE-459). The flaw carries a Chromium-rated High severity and a CVSS of 9.1 reflecting high confidentiality and availability impact; no public exploit is identified at time of analysis and EPSS is low (0.22%). Google fixed it in the 2026-09 stable desktop channel update.
Denial of service in Juniper Networks Junos OS and Junos OS Evolved affects the rpd routing process, which can be disrupted when a configured MVPN neighbor sends a crafted BGP MVPN update to a device running a non-default inter-region segmented VRF configured with 'protocols mvpn inter-region-template'. Exposure is narrow but real: the target must have that specialized multicast-VPN configuration and an established BGP MVPN peering relationship with the sender, and the CVSS 4.0 vector is unauthenticated (PR:N) with network reachability. Impact is availability-only (rpd disruption with automatic recovery, no confidentiality or integrity loss), the base score is 8.7 High with a low subsequent-system availability effect (SA:L) indicating a scope-crossing impact on routing, and no public exploit code or confirmed active exploitation is identified at time of analysis.
Repeated multipart file uploads to Misskey servers running versions 13.0.0 through 2025.4.1, or 2025.5.0 through 2026.7.0, can exhaust server storage and file descriptors and cause a denial of service, because temporary upload files are not reliably deleted after processing. The vulnerable upload path writes the temp file to disk before authentication is performed, so unauthenticated remote attackers can trigger it, and the behaviour holds regardless of whether federation is enabled. A single request is harmless - the impact is cumulative across sustained uploads - and the issue is resolved in Misskey 2026.7.0; no public exploit code has been identified at time of analysis.
VeraCrypt 1.26.29 (FUSE-T build) on macOS can leave a dismounted volume's decrypted contents readable, because VeraCrypt fails to terminate the FUSE-T auxiliary service (go-nfsv4) and its associated core-service helper processes, which keep serving the decrypted volume image (volume.dmg) over a loopback SMB session while retaining an open handle to the underlying raw device. An authenticated local user or process on the same host can then re-attach volume.dmg from the stale auxiliary mount, or simply reopen a previously accessed path (for example from the macOS Open Recent menu), and read the decrypted volume without supplying the passphrase again. The issue is specific to the FUSE-T build - the macFUSE build is explicitly unaffected - and requires that a volume was previously mounted and dismounted on that machine; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Incomplete cleanup in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS before 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions using crafted network traffic, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector. Impact is materially constrained: only macOS hosts on an affected build with Chromoting enabled and reachable are in scope, and the realistic outcome is limited information exposure rather than full compromise, which is consistent with the vendor's 'Low' Chromium severity rating. Risk signals conflict sharply - the supplied CVSS score of 9.1 (C:H/I:N/A:H) and the authoritative assessed vector of C:L/I:N/A:N disagree - and must be reconciled before prioritization; EPSS is negligible at 0.17% (6th percentile), there is no KEV listing, and no public exploit identified at time of analysis. Vendor-released patch: Chrome 155.0.8059.39.
Incomplete cleanup in Dawn, Chrome's WebGPU implementation, allows a crafted HTML page to potentially corrupt GPU-process state and achieve code execution outside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to render attacker-controlled content that reaches the affected WebGPU/Dawn code path (CVSS UI:R with PR:N - unauthenticated remote attackers, but user interaction required), and the outcome is probabilistic rather than a guaranteed silent drive-by; the published base score is 9.6 while Google rates the issue Medium, and our assessed vector raises attack complexity to AC:H to reflect the difficulty of chaining a cleanup flaw into a reliable sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 155.0.8059.39 as the fix.
Information disclosure in Google Chrome for iOS Autofill allows an attacker who lures a victim to a crafted HTML page to obtain sensitive form data that the browser failed to properly clear. Only Chrome for iOS builds prior to 155.0.8059.39 are affected; vulnerable instances require the Autofill feature to have been used so that sensitive data is actually present for the incomplete cleanup to expose. Exploitation requires no authentication (PR:N) but is gated by mandatory user interaction and social engineering (UI:R), meaning it cannot be triggered silently; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis. Note that the vendor-assigned CVSS of 8.8 overstates the impact relative to our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, base 6.5), which scores confidentiality impact only, with no integrity or availability effect.
Denial of service in the Zcash Foundation's Zebra full node before 6.1.0 lets remote unauthenticated peers stall node synchronization by poisoning the stale parent_error_map used by the state write task, after which the next canonical block is rejected for roughly 2,000 blocks. Exploitation is gated by a narrow race window: the attacker must act as a network peer and deliver a coinbase-malleated block that shares a legitimate canonical block's hash before that canonical block propagates, an AC:H/AT:P timing condition, so reliable on-demand abuse is materially limited. Impact is availability-only (CVSS 4.0 8.2, VA:H with no confidentiality or integrity effect), unauthenticated per the PR:N vectors, and no public exploit code has been identified at time of analysis; a vendor-released patch is available in Zebra 6.1.0.
Apache Tomcat 11.0.19 through 11.0.25, 10.1.53 through 10.1.59, and 9.0.116 through 9.0.121 can cause an unrelated user's request to fail when a malformed request triggers incomplete cleanup of request-processing state on a reachable HTTP connector. No authentication or user interaction is required, but the effect is fundamentally gated by a race window - the advisory itself states the failure occurs only 'depending on timing' - so it is non-deterministic and cannot be reliably triggered on demand, and the realistic worst case is intermittent failure of another user's individual request rather than sustained denial of service, data disclosure, or code execution. No public exploit code and no confirmed active exploitation were identified at time of analysis; the 7.3 base score reflects low impact across confidentiality, integrity, and availability, though our assessment rates attack complexity as High rather than Low.
Incomplete cleanup of sensitive resources in Google Chrome prior to 154.0.8037.57 (CWE-459) can expose data that should have been discarded, giving an attacker with local access to the affected system a way to read information they should not be able to reach. The vendor-tracked base score is 8.4, but our independent assessment re-scores the impact as confidentiality-only (C:H/I:N/A:N) and emphasizes the local attack vector (AV:L) - despite the PR:N/UI:N components in the vector, this is not a remote drive-by against a default browser install, and realistic exploitation requires local presence or the ability to execute within the browser/host context. EPSS is low at 0.25% (15th percentile), no public exploit code has been identified at time of analysis, and a vendor patch shipped in Chrome 154.0.8037.57, so real-world urgency is lower than the 8.4 base score implies.
System access-restriction bypass in Google Chrome's Network component (versions prior to 152.0.7977.82) lets a remote attacker use crafted network traffic to circumvent enforced access controls, stemming from incomplete resource cleanup (CWE-459). The flaw carries a Chromium-rated High severity and a CVSS of 9.1 reflecting high confidentiality and availability impact; no public exploit is identified at time of analysis and EPSS is low (0.22%). Google fixed it in the 2026-09 stable desktop channel update.