Monthly
A logic error in the Xen hypervisor's re-worked mitigation for Zenbleed (CVE-2023-20593 / XSA-433) leaves the AMD DE_CFG 'chicken-bit' workaround unset precisely when it is required, potentially allowing a guest to leak stale vector-register data across privilege boundaries on AMD Zen2 hosts. Only systems running a Xen build that contains the reworked workaround (addressed by XSA-515) on vulnerable AMD Zen2 processors are affected, and the attacker must already have code execution inside a guest domain on that same host. This is a local, microarchitectural-timing-dependent issue with no public exploit identified at time of analysis and a low EPSS score (0.16%), so the 9.8 network-vector CVSS rating supplied in some feeds materially overstates the real exposure. Per the authoritative assessment, the true profile is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
JIT miscompilation in Mozilla Firefox's JavaScript engine can cause the browser to generate incorrect native code for attacker-supplied scripts, giving a malicious page high confidentiality and integrity impact within the affected browsing context. The flaw affects Firefox builds prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5; exploitation is remote and requires no credentials (PR:N) but is gated by user interaction, since the victim must load attacker-controlled web content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1). No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but vendor-released patches exist in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Release-routing integrity failure in Capgo before 12.128.2 lets an authorized app or channel manager covertly steer which update bundle unnamed clients receive. Because the platform permits multiple public channels per app/platform to coexist and silently resolves channel-less /updates requests to a single hidden 'winner' channel, a low-privileged insider can manipulate default update state and serve a chosen bundle to clients that did not specify a channel. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Incomplete security-constraint logging in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, 11.0.0-M1-11.0.22) omits special roles and empty authorization constraints when the effective web.xml is written to the log, giving administrators an inaccurate view of the deployed access-control configuration. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC marks exploitation status as none, despite the inflated 9.1 CVSS published by Apache. The practical effect is misleading audit/diagnostic output rather than direct attacker compromise.
Access-control bypass in Apache Tomcat's RewriteValve (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, and 11.0.0-M1-11.0.22) arises because once the first condition in an OR (`[OR]`) chain matched, subsequent non-OR conditions were never evaluated. Where operators rely on chained rewrite conditions to gate or restrict requests, an attacker can satisfy only the first condition and have later guard conditions silently skipped, leading to information disclosure or unintended request routing. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Apache has released fixes in 11.0.23, 10.1.56, and 9.0.119.
Code injection in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows authenticated attackers to execute arbitrary PHP via the LDAP autovalues option, which previously evaluated user-influenced expressions as code. The upstream maintainers removed code evaluation support entirely in the fixed releases. EPSS sits at 0.05% (14th percentile) and there is no public exploit identified at time of analysis, but the issue is patched and rated CVSS 7.5.
Logic error in Luanti 5 (formerly Minetest) game engine before 5.15.2 allows malicious mods to gain unauthorized access to security-restricted APIs by intercepting mod environment setup. When any mod is designated as trusted (via secure.trusted_mods or secure.http_mods), a specially crafted mod can exploit the environment initialization sequence to receive the insecure environment or HTTP API access intended only for trusted mods. CVSS 8.1 reflects local attack vector with high complexity but no authentication required and scope change with high confidentiality/integrity/availability impact. GitHub security advisory and two fix commits confirm patch availability. No CISA KEV listing or public exploit code identified at time of analysis.
Connection slot exhaustion in Deadwood (MaraDNS 3.5.0036) allows remote unauthenticated attackers to cause denial of service by triggering lookups for zones with unresolvable authoritative nameserver addresses. This resource exhaustion vulnerability (CWE-670) has CVSS 7.5 severity and EPSS data indicates low exploitation probability. No public exploit identified at time of analysis, though the attack mechanism appears straightforward given the network-accessible attack vector with low complexity.
A logic error in the Xen hypervisor's re-worked mitigation for Zenbleed (CVE-2023-20593 / XSA-433) leaves the AMD DE_CFG 'chicken-bit' workaround unset precisely when it is required, potentially allowing a guest to leak stale vector-register data across privilege boundaries on AMD Zen2 hosts. Only systems running a Xen build that contains the reworked workaround (addressed by XSA-515) on vulnerable AMD Zen2 processors are affected, and the attacker must already have code execution inside a guest domain on that same host. This is a local, microarchitectural-timing-dependent issue with no public exploit identified at time of analysis and a low EPSS score (0.16%), so the 9.8 network-vector CVSS rating supplied in some feeds materially overstates the real exposure. Per the authoritative assessment, the true profile is AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N.
JIT miscompilation in Mozilla Firefox's JavaScript engine can cause the browser to generate incorrect native code for attacker-supplied scripts, giving a malicious page high confidentiality and integrity impact within the affected browsing context. The flaw affects Firefox builds prior to 158, Firefox ESR prior to 115.43, and Firefox ESR prior to 153.5; exploitation is remote and requires no credentials (PR:N) but is gated by user interaction, since the victim must load attacker-controlled web content (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N, base 8.1). No public exploit code has been identified at time of analysis and EPSS is low at 0.16% (4th percentile), but vendor-released patches exist in Firefox 158, Firefox ESR 115.43, and Firefox ESR 153.5.
Premature expiry of multicast forwarding state in Arista EOS can be triggered by a specially crafted packet sent by an unauthenticated attacker who is positioned on the same Layer 2 or otherwise adjacent network segment, causing temporary loss of multicast traffic on the affected interfaces. This is an availability-only denial of service (CVSS 4.0 reports VA:H with VC:N/VI:N; the CVSS 3.1 assessment is AV:A/AC:L/PR:N/UI:N with impact limited to A:H), so the 'Information Disclosure' tag attached to the record does not reflect the actual impact. Exploitation additionally requires that multicast forwarding (PIM/IGMP) is actively configured on the targeted interface - a default, non-multicast deployment is not exposed - and the disruption is transient, since traffic resumes once forwarding state is rebuilt. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Integrity and availability impact in Firefox's JIT JavaScript engine allows remote attackers to cause malicious script outcomes or denial of service. Versions prior to 153 are affected. Exploitation requires a victim to visit a crafted
Release-routing integrity failure in Capgo before 12.128.2 lets an authorized app or channel manager covertly steer which update bundle unnamed clients receive. Because the platform permits multiple public channels per app/platform to coexist and silently resolves channel-less /updates requests to a single hidden 'winner' channel, a low-privileged insider can manipulate default update state and serve a chosen bundle to clients that did not specify a channel. There is no public exploit identified at time of analysis, and the issue is not in CISA KEV.
Incomplete security-constraint logging in Apache Tomcat (8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, 11.0.0-M1-11.0.22) omits special roles and empty authorization constraints when the effective web.xml is written to the log, giving administrators an inaccurate view of the deployed access-control configuration. There is no public exploit identified at time of analysis, EPSS is low (0.17%, 7th percentile), and CISA SSVC marks exploitation status as none, despite the inflated 9.1 CVSS published by Apache. The practical effect is misleading audit/diagnostic output rather than direct attacker compromise.
Access-control bypass in Apache Tomcat's RewriteValve (versions 8.5.0-8.5.100, 9.0.0.M1-9.0.118, 10.1.0-M1-10.1.55, and 11.0.0-M1-11.0.22) arises because once the first condition in an OR (`[OR]`) chain matched, subsequent non-OR conditions were never evaluated. Where operators rely on chained rewrite conditions to gate or restrict requests, an attacker can satisfy only the first condition and have later guard conditions silently skipped, leading to information disclosure or unintended request routing. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; Apache has released fixes in 11.0.23, 10.1.56, and 9.0.119.
Code injection in Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allows authenticated attackers to execute arbitrary PHP via the LDAP autovalues option, which previously evaluated user-influenced expressions as code. The upstream maintainers removed code evaluation support entirely in the fixed releases. EPSS sits at 0.05% (14th percentile) and there is no public exploit identified at time of analysis, but the issue is patched and rated CVSS 7.5.
Logic error in Luanti 5 (formerly Minetest) game engine before 5.15.2 allows malicious mods to gain unauthorized access to security-restricted APIs by intercepting mod environment setup. When any mod is designated as trusted (via secure.trusted_mods or secure.http_mods), a specially crafted mod can exploit the environment initialization sequence to receive the insecure environment or HTTP API access intended only for trusted mods. CVSS 8.1 reflects local attack vector with high complexity but no authentication required and scope change with high confidentiality/integrity/availability impact. GitHub security advisory and two fix commits confirm patch availability. No CISA KEV listing or public exploit code identified at time of analysis.
Connection slot exhaustion in Deadwood (MaraDNS 3.5.0036) allows remote unauthenticated attackers to cause denial of service by triggering lookups for zones with unresolvable authoritative nameserver addresses. This resource exhaustion vulnerability (CWE-670) has CVSS 7.5 severity and EPSS data indicates low exploitation probability. No public exploit identified at time of analysis, though the attack mechanism appears straightforward given the network-accessible attack vector with low complexity.