Monthly
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Intel Active Management Technology (Intel AMT) and Intel Standard Manageability firmware contain an improper initialization flaw (CWE-665) that enables confidentiality compromise by a locally privileged system software adversary. The vulnerability arises when firmware fails to properly initialize memory or state, allowing residual data to be read by a subsequent privileged operation under specific attack conditions (AT:P per CVSS 4.0). No CISA KEV listing exists and no public proof-of-concept has been identified; Intel reported this through their own security advisory program (INTEL-SA-01427) and the CVSS 4.0 base score of 5.6 reflects the constrained local, high-privilege exploitation prerequisites.
Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
ICMP egress policy bypass in Docker Sandboxes (sbx) allows untrusted workloads - explicitly including AI agents - to defeat the documented ICMP block and reach arbitrary external hosts after a Docker daemon restart. The authorizer enforcing the ICMP egress restriction is applied only at network-creation time and is never re-applied when the daemon reconstructs network state from disk on restart, leaving the policy unenforced for the lifetime of the rebuilt network. No public exploit has been identified at time of analysis, but the bypass enables network reconnaissance and covert-channel data exfiltration directly contradicting the sbx threat model, which treats sandbox workloads as adversarial.
Cookie scope escalation in aiohttp's CookieJar persistence layer causes host-only cookies to lose their host-restricted status after a save/load cycle, allowing them to be transmitted to subdomains that the original server never authorized to receive them. Applications using pip/aiohttp <= 3.14.0 that invoke CookieJar.save() and CookieJar.load() for session persistence are affected. No public exploit code has been identified at time of analysis, but the impact is information disclosure: sensitive cookies - including session tokens or authentication credentials - may be sent to unintended subdomain endpoints, violating the HTTP cookie scoping model.
Improper initialization in Intel UEFI firmware (Ring 0 / Bare Metal OS layer) enables information disclosure on some Intel platforms. A system software-level adversary already holding high privileges can exploit this flaw under high-complexity, prerequisite-dependent conditions to expose sensitive memory contents, with confidentiality impact rated high but no integrity or availability effect. No public exploit exists and EPSS sits at 0.01% (2nd percentile), and SSVC classifies exploitation status as none - signals that are mutually consistent and indicate this is a low-urgency finding for most organizations.
Improper BIOS initialization in certain ThinkPad models enables local privileged users to modify system data and execute arbitrary code with high integrity impact. The vulnerability requires elevated privileges and local access, posing a risk to organizations where administrative users may be compromised or untrusted. No patch is currently available.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Concurrent TLS handshakes on Zephyr RTOS devices built with CONFIG_TLS_CREDENTIALS_BACKEND_PROTECTED_STORAGE cause a deterministic kernel panic and device reset via a NULL pointer dereference in the uninitialized credential mutex wait queue. The PSA Protected Storage credential backend in all affected Zephyr builds declared its serialization mutex without proper initialization, leaving its dlist sentinels as NULL; the fault triggers only on first contention but is fully deterministic once two threads race to acquire the lock. No public exploit has been identified and the issue is not in CISA KEV, though no exploit sophistication is required beyond opening multiple simultaneous TLS connections.
Intel Active Management Technology (Intel AMT) and Intel Standard Manageability firmware contain an improper initialization flaw (CWE-665) that enables confidentiality compromise by a locally privileged system software adversary. The vulnerability arises when firmware fails to properly initialize memory or state, allowing residual data to be read by a subsequent privileged operation under specific attack conditions (AT:P per CVSS 4.0). No CISA KEV listing exists and no public proof-of-concept has been identified; Intel reported this through their own security advisory program (INTEL-SA-01427) and the CVSS 4.0 base score of 5.6 reflects the constrained local, high-privilege exploitation prerequisites.
Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
ICMP egress policy bypass in Docker Sandboxes (sbx) allows untrusted workloads - explicitly including AI agents - to defeat the documented ICMP block and reach arbitrary external hosts after a Docker daemon restart. The authorizer enforcing the ICMP egress restriction is applied only at network-creation time and is never re-applied when the daemon reconstructs network state from disk on restart, leaving the policy unenforced for the lifetime of the rebuilt network. No public exploit has been identified at time of analysis, but the bypass enables network reconnaissance and covert-channel data exfiltration directly contradicting the sbx threat model, which treats sandbox workloads as adversarial.
Cookie scope escalation in aiohttp's CookieJar persistence layer causes host-only cookies to lose their host-restricted status after a save/load cycle, allowing them to be transmitted to subdomains that the original server never authorized to receive them. Applications using pip/aiohttp <= 3.14.0 that invoke CookieJar.save() and CookieJar.load() for session persistence are affected. No public exploit code has been identified at time of analysis, but the impact is information disclosure: sensitive cookies - including session tokens or authentication credentials - may be sent to unintended subdomain endpoints, violating the HTTP cookie scoping model.
Improper initialization in Intel UEFI firmware (Ring 0 / Bare Metal OS layer) enables information disclosure on some Intel platforms. A system software-level adversary already holding high privileges can exploit this flaw under high-complexity, prerequisite-dependent conditions to expose sensitive memory contents, with confidentiality impact rated high but no integrity or availability effect. No public exploit exists and EPSS sits at 0.01% (2nd percentile), and SSVC classifies exploitation status as none - signals that are mutually consistent and indicate this is a low-urgency finding for most organizations.
Improper BIOS initialization in certain ThinkPad models enables local privileged users to modify system data and execute arbitrary code with high integrity impact. The vulnerability requires elevated privileges and local access, posing a risk to organizations where administrative users may be compromised or untrusted. No patch is currently available.