Monthly
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
Physical access to a range of ASUS Z390-era motherboards - Prime Z390-A, Prime Z390-A/H10, the ROG Maximus XI family (Hero, Hero Wi-Fi, Formula, Code, Extreme, Apex, Gene), ROG Strix Z390-E/F Gaming, Pro WS C246 ACE and WS Z390 Pro - allows an attacker to read and write arbitrary host memory by inserting a specially crafted device, because the platform fails to correctly initialize the protections governing device memory access. The CVSS v4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, scope unchanged) confirms high confidentiality, integrity and availability impact with no authentication or user interaction required once hands-on access is obtained, but the decisive limiting factor is AV:P: the flaw is unreachable remotely or over a network and is realistically confined to evil-maid, supply-chain, repair-shop or shared-physical-access scenarios. ASUS is credited as the reporter and the vendor security advisory at https://www.asus.com/security-advisory is the authoritative reference; no public exploit identified at time of analysis.
Sandbox escape via improper initialization (CWE-665) in Google Chrome's Views UI framework on Windows, prior to version 153.0.8010.36, can lead to arbitrary code execution outside the browser sandbox. The attack is chained: an adversary must first compromise the renderer process through a separate vulnerability, then leverage social engineering to trigger the Views initialization flaw, elevating from renderer-level code execution to full host OS access. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the multi-step prerequisite bar, though the C:H/I:H/A:H impact profile warrants prompt patching.
Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Unauthenticated network-based attackers can cause a denial of service on Juniper EX4000-48T, EX4000-48P, and EX4000-48MP switches by sending high-volume traffic that crashes the FXPC component and forces a device restart. The vulnerability stems from improper resource initialization in the Internal Device Manager and results in complete service outage until automatic recovery completes. Affected versions include Junos OS 24.4 before 24.4R2 and 25.2 before 25.2R1, with no patch currently available.
Linux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged local users to overwrite read-only files, enabling trivial privilege escalation to root on Linux 5.8+.
A memory initialization issue was addressed. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
A malformed or misdirected BGP route update can crash the routing protocol daemon (rpd) on Juniper Networks Junos OS and Junos OS Evolved, taking down the control plane that maintains routing state across the device. The trigger is narrow but fully remote: a Long-Lived Graceful Restart (LLGR) stale route that is readvertised into a peer group that has not negotiated LLGR causes rpd to hit an improper-initialization condition (CWE-665) and abort. Per the CVSS vector the issue is unauthenticated (PR:N) on the network (AV:N) with high availability impact only, but the attacker must control or be an established BGP peer able to inject the stale route, so an existing adjacency is a practical prerequisite. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited (no CISA KEV listing); Juniper has released fixed software per advisory JSA112187, making this a patch-now availability risk for BGP-running fleets rather than an emergency.
Physical access to a range of ASUS Z390-era motherboards - Prime Z390-A, Prime Z390-A/H10, the ROG Maximus XI family (Hero, Hero Wi-Fi, Formula, Code, Extreme, Apex, Gene), ROG Strix Z390-E/F Gaming, Pro WS C246 ACE and WS Z390 Pro - allows an attacker to read and write arbitrary host memory by inserting a specially crafted device, because the platform fails to correctly initialize the protections governing device memory access. The CVSS v4.0 vector (AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H, scope unchanged) confirms high confidentiality, integrity and availability impact with no authentication or user interaction required once hands-on access is obtained, but the decisive limiting factor is AV:P: the flaw is unreachable remotely or over a network and is realistically confined to evil-maid, supply-chain, repair-shop or shared-physical-access scenarios. ASUS is credited as the reporter and the vendor security advisory at https://www.asus.com/security-advisory is the authoritative reference; no public exploit identified at time of analysis.
Sandbox escape via improper initialization (CWE-665) in Google Chrome's Views UI framework on Windows, prior to version 153.0.8010.36, can lead to arbitrary code execution outside the browser sandbox. The attack is chained: an adversary must first compromise the renderer process through a separate vulnerability, then leverage social engineering to trigger the Views initialization flaw, elevating from renderer-level code execution to full host OS access. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the multi-step prerequisite bar, though the C:H/I:H/A:H impact profile warrants prompt patching.
Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.
Unexpected system termination due to memory initialization flaw in Apple iOS, iPadOS, macOS, tvOS, watchOS, and visionOS allows a malicious application to forcibly crash the device. All versions prior to the listed fixed releases are affected. No active exploitation or publicly available exploit code was identified at time of analysis; EPSS indicates a low (0.16%) probability of exploitation.
Authentication bypass in Ubiquiti UniFi Protect Application (versions prior to 7.1.83) allows a network-adjacent attacker to circumvent authentication controls on UniFi Protect Cameras via an improper initialization flaw. The bypass yields total compromise of camera confidentiality, integrity, and availability, though exploitation depends on certain unspecified conditions and carries high attack complexity. No public exploit is identified at time of analysis, and EPSS probability is low (0.24%), consistent with the CISA SSVC assessment of no known exploitation.
Unauthenticated network-based attackers can cause a denial of service on Juniper EX4000-48T, EX4000-48P, and EX4000-48MP switches by sending high-volume traffic that crashes the FXPC component and forces a device restart. The vulnerability stems from improper resource initialization in the Internal Device Manager and results in complete service outage until automatic recovery completes. Affected versions include Junos OS 24.4 before 24.4R2 and 25.2 before 25.2R1, with no patch currently available.
Linux kernel contains a flaw known as 'Dirty Pipe' where improper pipe buffer flag initialization allows unprivileged local users to overwrite read-only files, enabling trivial privilege escalation to root on Linux 5.8+.
A memory initialization issue was addressed. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.