Monthly
An authenticated user with access to the EmailTask component in Google Cloud Application Integration (versions prior to 2026-06-30) can exploit a confused deputy weakness to read and exfiltrate arbitrary Google-internal files by supplying a crafted attachment file path. The flaw requires low-privilege authentication (PR:L) and no user interaction, with high confidentiality impact (C:H) on both the service and a subsequent system (SC:H). No public exploit code or active exploitation has been identified at time of analysis; the issue was patched server-side on 2026-06-30, so no customer action is required.
Information disclosure in Google Chrome desktop builds earlier than 154.0.8037.57 lets an attacker who shares a local network segment with the victim trigger a flaw that the assessed CVSS scores as high impact across confidentiality, integrity, and availability (CVSS 8.0, AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no authentication or elevated privileges (PR:N), but must be positioned on the same adjacent L2 segment as the target (AV:A) and must get the victim to load attacker-influenced content (UI:R) - a combination that substantially constrains mass or opportunistic exploitation. An official fix is already available on the stable channel and no public exploit code has been identified at time of analysis, so risk here is driven primarily by Chrome's ubiquity and by unpatched client exposure rather than by observed exploitation activity.
Sandbox escape in the WebView component of Google Chrome on Android (prior to version 152.0.7977.65) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox on the target device via a crafted HTML page. This CWE-610 externally controlled reference flaw represents the second stage of a chained exploit - requiring a companion renderer exploit to be viable - which substantially raises the real-world exploitation bar despite the CVSS 8.3 High score. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.33% (25th percentile), consistent with no observed active exploitation.
Server-side request forgery and credential theft in Grafana MCP Server lets an unauthenticated remote attacker steal the server's environment-configured Grafana service-account token by sending a crafted X-Grafana-URL request header, and pivot to reach arbitrary internal services including cloud metadata endpoints. The token grants the attacker the MCP server's full Grafana privileges, and the SSRF primitive exposes internal infrastructure behind the network perimeter. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed) rating and unauthenticated network vector make this a high-priority fix.
Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).
Cross-namespace privilege escalation in Apache Camel K (2.0.0-2.8.0, 2.9.0-2.9.1, 2.10.0) lets an authenticated Kubernetes user who can create Build resources dictate the target namespace for the resulting Pod, including the privileged operator namespace. By steering Pod generation into the operator's namespace, a tenant confined to their own namespace can break out of RBAC boundaries and interact with higher-privilege resources. CVSS 8.1; no public exploit identified at time of analysis and EPSS is negligible (0.02%), but SSVC rates the technical impact as total.
Remote unauthenticated attackers can exploit a server-side request forgery (SSRF) vulnerability in Microsoft Partner Center to access internal resources and perform spoofing attacks. The vulnerability allows high-level information disclosure with limited integrity impact, requiring no user interaction or special privileges. Microsoft has released a security patch, and while CVSS rates this 8.2 (High), no active exploitation or public proof-of-concept has been identified at time of analysis.
Local file inclusion in VertiGIS FM's upload/download mechanism allows authenticated attackers to read arbitrary server files by manipulating file paths during upload, with potential for remote code execution if web.config is obtained and NTLM-relay attacks via UNC path resolution. VertiGIS FM version 10.5.00119 and earlier are affected, and the vulnerability requires valid application credentials to exploit.
Improper symbolic link handling in Acronis Cyber Protect 17 for Windows (before build 41186) enables local attackers with limited privileges to escalate to system-level access through a race condition. An authenticated user can exploit this vulnerability to gain full control over the affected system, including reading sensitive data and modifying system configurations. No patch is currently available for this high-severity flaw.
Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability.
An authenticated user with access to the EmailTask component in Google Cloud Application Integration (versions prior to 2026-06-30) can exploit a confused deputy weakness to read and exfiltrate arbitrary Google-internal files by supplying a crafted attachment file path. The flaw requires low-privilege authentication (PR:L) and no user interaction, with high confidentiality impact (C:H) on both the service and a subsequent system (SC:H). No public exploit code or active exploitation has been identified at time of analysis; the issue was patched server-side on 2026-06-30, so no customer action is required.
Information disclosure in Google Chrome desktop builds earlier than 154.0.8037.57 lets an attacker who shares a local network segment with the victim trigger a flaw that the assessed CVSS scores as high impact across confidentiality, integrity, and availability (CVSS 8.0, AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). The attacker needs no authentication or elevated privileges (PR:N), but must be positioned on the same adjacent L2 segment as the target (AV:A) and must get the victim to load attacker-influenced content (UI:R) - a combination that substantially constrains mass or opportunistic exploitation. An official fix is already available on the stable channel and no public exploit code has been identified at time of analysis, so risk here is driven primarily by Chrome's ubiquity and by unpatched client exposure rather than by observed exploitation activity.
Sandbox escape in the WebView component of Google Chrome on Android (prior to version 152.0.7977.65) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox on the target device via a crafted HTML page. This CWE-610 externally controlled reference flaw represents the second stage of a chained exploit - requiring a companion renderer exploit to be viable - which substantially raises the real-world exploitation bar despite the CVSS 8.3 High score. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.33% (25th percentile), consistent with no observed active exploitation.
Server-side request forgery and credential theft in Grafana MCP Server lets an unauthenticated remote attacker steal the server's environment-configured Grafana service-account token by sending a crafted X-Grafana-URL request header, and pivot to reach arbitrary internal services including cloud metadata endpoints. The token grants the attacker the MCP server's full Grafana privileges, and the SSRF primitive exposes internal infrastructure behind the network perimeter. No public exploit identified at time of analysis, but the CVSS 8.6 (scope-changed) rating and unauthenticated network vector make this a high-priority fix.
Arbitrary code execution on the Jenkins controller affects the Jenkins OWASP ZAP Plugin version 1.0.7 and earlier, which incorrectly runs build operations on the controller node instead of the designated build agent. An attacker holding Item/Configure permission can leverage this misplaced execution to run arbitrary code in the security context of the controller, escaping agent isolation. No public exploit identified at time of analysis, and CISA SSVC records no known exploitation; EPSS is low at 0.39% (31st percentile).
Cross-namespace privilege escalation in Apache Camel K (2.0.0-2.8.0, 2.9.0-2.9.1, 2.10.0) lets an authenticated Kubernetes user who can create Build resources dictate the target namespace for the resulting Pod, including the privileged operator namespace. By steering Pod generation into the operator's namespace, a tenant confined to their own namespace can break out of RBAC boundaries and interact with higher-privilege resources. CVSS 8.1; no public exploit identified at time of analysis and EPSS is negligible (0.02%), but SSVC rates the technical impact as total.
Remote unauthenticated attackers can exploit a server-side request forgery (SSRF) vulnerability in Microsoft Partner Center to access internal resources and perform spoofing attacks. The vulnerability allows high-level information disclosure with limited integrity impact, requiring no user interaction or special privileges. Microsoft has released a security patch, and while CVSS rates this 8.2 (High), no active exploitation or public proof-of-concept has been identified at time of analysis.
Local file inclusion in VertiGIS FM's upload/download mechanism allows authenticated attackers to read arbitrary server files by manipulating file paths during upload, with potential for remote code execution if web.config is obtained and NTLM-relay attacks via UNC path resolution. VertiGIS FM version 10.5.00119 and earlier are affected, and the vulnerability requires valid application credentials to exploit.
Improper symbolic link handling in Acronis Cyber Protect 17 for Windows (before build 41186) enables local attackers with limited privileges to escalate to system-level access through a race condition. An authenticated user can exploit this vulnerability to gain full control over the affected system, including reading sensitive data and modifying system configurations. No patch is currently available for this high-severity flaw.
Acronis Cyber Protect 17 for Windows before build 41186 allows local attackers with standard user privileges to escalate to system-level access through improper handling of symbolic links. An authenticated attacker can exploit this vulnerability to gain full control over the affected system, including the ability to read, modify, or delete sensitive data and execute arbitrary code. No patch is currently available for this vulnerability.