Monthly
Sandboxed remote code execution in Google Chrome's CacheStorage API (prior to 152.0.7977.82) allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by luring a user to visit a specially crafted HTML page. The root cause is CWE-668 (Exposure of Resource to Wrong Sphere), where CacheStorage improperly exposes resources to an unintended security context. No public exploit code has been identified and SSVC reports exploitation status as none, though the patch is available and update is strongly recommended.
Craft CMS exposes arbitrary environment variables and secrets to authenticated control panel users due to premature interpolation of ${ENV_VAR} patterns in the elementId parameter before Twig sandbox evaluation - a design flaw that bypasses the sandbox entirely because substitution occurs outside the renderer. Affected versions span both the 4.x and 5.x release lines from their respective RC1 milestones through just before 4.18.2 and 5.10.6. An attacker holding any control panel account can exfiltrate CRAFT_SECURITY_KEY and all other configured secrets via a blind, error-based extraction loop, enabling session forgery, privilege escalation, and theft of database, SMTP, API, and blob storage credentials; no public exploit or active exploitation has been identified at time of analysis.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Exposure of a scanning VM's VNC service in Fortinet FortiSandbox 5.0.0-5.0.2 and 4.4.3-4.4.8 lets an unauthenticated remote attacker reach the VNC server of the sandbox virtual machines used for malware detonation via ordinary network requests. Because these VMs run and observe live malware samples, unauthorized VNC access can expose sensitive analysis sessions and potentially allow interaction with the detonation environment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in PraisonAI before 1.5.115 allows authenticated agents to read other agents' system prompts and conversation history by exploiting missing uniqueness enforcement on agent identifiers in the MultiAgentLedger component. An attacker who can register an agent with a colliding ID receives the same ledger instance as the victim, breaking tenant isolation in multi-agent deployments. No public exploit identified at time of analysis, though the upstream GHSA advisory (GHSA-766v-q9x3-g744) publishes a working proof-of-concept demonstrating the collision.
Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author to directly manipulate trusted DAV property databases, leading to integrity violations and child process crashes. With a CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) and SSVC technical impact rated 'total' with automatable=yes, the flaw is highly impactful, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape and information disclosure in Mozilla Firefox's Process Sandboxing component allows a malicious web page to leak data across the security boundary that isolates content processes from the rest of the browser and host. All Firefox versions prior to 151 and ESR versions prior to 140.11 are affected. The scope-changed CVSS 3.1 score of 8.6 reflects that a successful attack crosses the sandbox boundary, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js process by abusing async generator `yield*` semantics to smuggle a host-realm exception into sandbox code, where the attacker pivots through `.constructor.constructor` to reach `process` and `child_process.execSync`. The flaw is exploitable by any attacker who can run JavaScript inside the sandbox, has publicly available exploit code, and carries SSVC technical impact 'total' with automatable=yes, though EPSS remains low at 0.05% (17th percentile) and the CVE is not listed in CISA KEV.
Cross-instance cache poisoning in Open WebUI allows administrators on one instance to inject malicious tool server configurations into shared Redis cache, affecting users on other instances. The vulnerability stems from missing Redis key prefixes on tool_servers and terminal_servers cache entries in backend/open_webui/utils/tools.py. When multiple Open WebUI instances share a Redis backend (a documented multi-region/blue-green deployment pattern), an admin on Instance A can configure a malicious tool server that overwrites Instance B's cache, causing Instance B users to send tool call payloads-containing chat content, user identity, and OAuth tokens-to attacker-controlled servers. Exploitation requires privileged access (CVSS PR:H) but crosses instance boundaries (Scope:Changed), enabling data exfiltration and prompt injection delivery. Vendor-released patch: version 0.9.0 addresses the missing prefix issue.
Remote code execution in VM2 (npm package) allows complete sandbox escape via null-prototype exception handling flaw. Attackers can execute arbitrary system commands on the host by exploiting a logic error in the exception proxy mechanism that incorrectly handles objects with null prototypes. Public exploit code exists and the vulnerability affects all versions prior to 3.11.2. The CVSS 9.8 severity reflects network-accessible, unauthenticated exploitation requiring no user interaction - however, real-world risk depends on whether untrusted users can supply code to the VM2 sandbox in a given deployment.
Sandboxed remote code execution in Google Chrome's CacheStorage API (prior to 152.0.7977.82) allows a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by luring a user to visit a specially crafted HTML page. The root cause is CWE-668 (Exposure of Resource to Wrong Sphere), where CacheStorage improperly exposes resources to an unintended security context. No public exploit code has been identified and SSVC reports exploitation status as none, though the patch is available and update is strongly recommended.
Craft CMS exposes arbitrary environment variables and secrets to authenticated control panel users due to premature interpolation of ${ENV_VAR} patterns in the elementId parameter before Twig sandbox evaluation - a design flaw that bypasses the sandbox entirely because substitution occurs outside the renderer. Affected versions span both the 4.x and 5.x release lines from their respective RC1 milestones through just before 4.18.2 and 5.10.6. An attacker holding any control panel account can exfiltrate CRAFT_SECURITY_KEY and all other configured secrets via a blind, error-based extraction loop, enabling session forgery, privilege escalation, and theft of database, SMTP, API, and blob storage credentials; no public exploit or active exploitation has been identified at time of analysis.
Cross-container isolation bypass in proot-distro 5.1.5 and earlier (Termux) lets a crafted backup archive read and write files across otherwise isolated containers when a victim runs 'proot-distro restore'. Because the restore logic trusts the archive's hardlink 'linkname' to name the source container without verifying it matches the container being restored, an attacker who convinces a user to restore a malicious .tar can exfiltrate secrets (SSH keys, API credentials, databases) from one container into an attacker-controlled one, or inject attacker data into a different container. Publicly available exploit code exists (full PoCs are embedded in the GHSA advisory); no public active exploitation is known.
Exposure of a scanning VM's VNC service in Fortinet FortiSandbox 5.0.0-5.0.2 and 4.4.3-4.4.8 lets an unauthenticated remote attacker reach the VNC server of the sandbox virtual machines used for malware detonation via ordinary network requests. Because these VMs run and observe live malware samples, unauthorized VNC access can expose sensitive analysis sessions and potentially allow interaction with the detonation environment. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Information disclosure in PraisonAI before 1.5.115 allows authenticated agents to read other agents' system prompts and conversation history by exploiting missing uniqueness enforcement on agent identifiers in the MultiAgentLedger component. An attacker who can register an agent with a colliding ID receives the same ledger instance as the victim, breaking tenant isolation in multi-agent deployments. No public exploit identified at time of analysis, though the upstream GHSA advisory (GHSA-766v-q9x3-g744) publishes a working proof-of-concept demonstrating the collision.
Improper path handling in the mod_dav_fs module of Apache HTTP Server 2.4.67 and earlier permits a WebDAV content author to directly manipulate trusted DAV property databases, leading to integrity violations and child process crashes. With a CVSS of 9.1 (AV:N/AC:L/PR:N/UI:N) and SSVC technical impact rated 'total' with automatable=yes, the flaw is highly impactful, though there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Sandbox escape and information disclosure in Mozilla Firefox's Process Sandboxing component allows a malicious web page to leak data across the security boundary that isolates content processes from the rest of the browser and host. All Firefox versions prior to 151 and ESR versions prior to 140.11 are affected. The scope-changed CVSS 3.1 score of 8.6 reflects that a successful attack crosses the sandbox boundary, though there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%).
Sandbox escape in vm2 (patriksimek/vm2) versions prior to 3.11.3 enables remote code execution on the host Node.js process by abusing async generator `yield*` semantics to smuggle a host-realm exception into sandbox code, where the attacker pivots through `.constructor.constructor` to reach `process` and `child_process.execSync`. The flaw is exploitable by any attacker who can run JavaScript inside the sandbox, has publicly available exploit code, and carries SSVC technical impact 'total' with automatable=yes, though EPSS remains low at 0.05% (17th percentile) and the CVE is not listed in CISA KEV.
Cross-instance cache poisoning in Open WebUI allows administrators on one instance to inject malicious tool server configurations into shared Redis cache, affecting users on other instances. The vulnerability stems from missing Redis key prefixes on tool_servers and terminal_servers cache entries in backend/open_webui/utils/tools.py. When multiple Open WebUI instances share a Redis backend (a documented multi-region/blue-green deployment pattern), an admin on Instance A can configure a malicious tool server that overwrites Instance B's cache, causing Instance B users to send tool call payloads-containing chat content, user identity, and OAuth tokens-to attacker-controlled servers. Exploitation requires privileged access (CVSS PR:H) but crosses instance boundaries (Scope:Changed), enabling data exfiltration and prompt injection delivery. Vendor-released patch: version 0.9.0 addresses the missing prefix issue.
Remote code execution in VM2 (npm package) allows complete sandbox escape via null-prototype exception handling flaw. Attackers can execute arbitrary system commands on the host by exploiting a logic error in the exception proxy mechanism that incorrectly handles objects with null prototypes. Public exploit code exists and the vulnerability affects all versions prior to 3.11.2. The CVSS 9.8 severity reflects network-accessible, unauthenticated exploitation requiring no user interaction - however, real-world risk depends on whether untrusted users can supply code to the VM2 sandbox in a given deployment.