Monthly
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Universe checking state desynchronization in the Rocq Prover allows the kernel to continue accepting universe-inconsistent terms after a module using `Local Unset Universe Checking` is closed, despite user-visible diagnostics reporting the check as enabled. Once the module closes, Hurkens' paradox can be applied without axioms, plugins, or unsafe features to derive a proof of False, from which any proposition is provable. A public proof-of-concept is available, no patch exists, and neither `Print Assumptions` nor `Test Universe Checking` reveals the compromised kernel state.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
Incomplete cleanup of thread membership records in Mattermost allows a re-invited user to read private channel thread root post content and metadata they should no longer have access to. Affected are all Mattermost deployments on versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5. An authenticated user who was previously removed from or left a team, and is subsequently re-invited, can exploit stale membership records via the team threads API to access residual private channel thread data. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Silent incomplete replacement of Quadlet unit files in Podman 5.8.x causes stale security-sensitive directives to persist after a `podman quadlet install --replace` operation on non-reflink filesystems. The missing O_TRUNC flag in the file-open call, combined with a non-truncating `io.Copy` fallback when reflink fails, means that if the replacement Quadlet is shorter than the original, trailing content from the old file survives undetected. A local low-privileged user who uses this command to remove a capability grant (e.g., AddCapability) or an extra volume mount may unknowingly leave those directives active, resulting in containers running with unintended elevated privileges or unauthorized data exposure. No public exploit has been identified at time of analysis.
Stale public share links in filebrowser through 2.63.23 can silently redirect to unrelated files uploaded after a rename operation, unexpectedly exposing new content to anyone holding the original link. The defect (CWE-459, Incomplete Cleanup) arises because share records are keyed by file path rather than a file identifier - deletion triggers cleanup, but rename does not, leaving the share dormant. No public exploit or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 2.3 reflects the multi-step preconditions required, but the confidentiality risk is real for deployments where multiple users share create permissions on overlapping directories.
Stale public share links in File Browser 2.63.6-2.63.23 expose subsequently uploaded content to unauthenticated network access after a privileged user deletes another user's shared file without triggering proper link invalidation. Because the surviving share URL continues to resolve to whatever is later placed at the same storage path, an attacker who retains or discovers the original link can retrieve entirely unrelated files without authentication. No public exploit code is identified at time of analysis, and the CVSS 4.0 score of 2.3 reflects the constrained, multi-step preconditions required.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Universe checking state desynchronization in the Rocq Prover allows the kernel to continue accepting universe-inconsistent terms after a module using `Local Unset Universe Checking` is closed, despite user-visible diagnostics reporting the check as enabled. Once the module closes, Hurkens' paradox can be applied without axioms, plugins, or unsafe features to derive a proof of False, from which any proposition is provable. A public proof-of-concept is available, no patch exists, and neither `Print Assumptions` nor `Test Universe Checking` reveals the compromised kernel state.
Parser state isolation failure in misp-stix corrupts MISP event generation when the same parser instance is reused across independent STIX 1 and STIX 2 document conversions, causing retained artifacts - including galaxy clusters, passive DNS records, package titles, dates, and timestamps - from a prior document to contaminate subsequently generated MISP events. Applications directly consuming the misp-stix API with long-lived parser instances are at risk; the standard entry points that instantiate a fresh parser per file are not affected. No public exploit has been identified at time of analysis, and the CVSS 4.0 AT:P precondition metric confirms exploitation depends on a non-default deployment pattern compounded by attacker influence over document processing order.
Incomplete cleanup of thread membership records in Mattermost allows a re-invited user to read private channel thread root post content and metadata they should no longer have access to. Affected are all Mattermost deployments on versions 10.11.x through 10.11.20 and 11.7.x through 11.7.5. An authenticated user who was previously removed from or left a team, and is subsequently re-invited, can exploit stale membership records via the team threads API to access residual private channel thread data. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Disk exhaustion via orphaned temporary files in @fastify/multipart versions 3.0.0 through 10.1.0 allows unauthenticated remote clients to cause persistent denial of service against Fastify applications that use the `request.saveRequestFiles()` API. The defect is an incomplete fix of CVE-2025-24033: while the per-file cleanup path was previously patched, the iterator rejection raised between multipart parts falls outside that cleanup scope, leaving already-completed temporary files permanently on disk. Repeated client disconnections mid-upload cause linear, unbounded disk consumption that can exhaust storage and render the host or container unavailable. No public exploit identified at time of analysis, but the attack is trivially automatable given the unauthenticated, low-complexity network vector.
Silent incomplete replacement of Quadlet unit files in Podman 5.8.x causes stale security-sensitive directives to persist after a `podman quadlet install --replace` operation on non-reflink filesystems. The missing O_TRUNC flag in the file-open call, combined with a non-truncating `io.Copy` fallback when reflink fails, means that if the replacement Quadlet is shorter than the original, trailing content from the old file survives undetected. A local low-privileged user who uses this command to remove a capability grant (e.g., AddCapability) or an extra volume mount may unknowingly leave those directives active, resulting in containers running with unintended elevated privileges or unauthorized data exposure. No public exploit has been identified at time of analysis.