Monthly
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
Logic flaw in Capgo before 12.128.12 lets authenticated attackers continue serving soft-deleted application bundles to end-user devices because the /updates endpoint omits an app_versions.deleted filter when joining channels. Affected operators of the Capgo live-update service (a CodePush-style OTA platform for Capacitor mobile apps) can have purged bundles re-selected and pushed downstream, undermining rollback and removal workflows. No public exploit identified at time of analysis and the issue is not present in CISA KEV.
Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Bearer token revocation bypass in OpenClaw gateway allows attackers to authenticate using rotated-out tokens until process restart. OpenClaw gateway HTTP and WebSocket handlers captured bearer authentication configuration at startup, failing to re-resolve credentials after SecretRef rotation. Attackers possessing a previously valid token can maintain unauthorized gateway access to /v1/* endpoints, /tools/invoke, plugin routes, and canvas upgrade paths even after operators rotate secrets, believing the old token is revoked. Fixed in version 2026.4.15. CVSS 9.2 reflects network-accessible attack with high complexity; no public exploit identified at time of analysis.
Gitea through 1.27.3 grants the named recipient of a private-repository transfer temporary read collaborator access so they can review the repository, but rejecting or cancelling that transfer never revokes the collaboration, leaving the recipient with persistent read access to the private repository's code, issues, pull requests and wiki, including the ability to clone it, without any notification to the repository owner. Exploitation requires the repository owner to initiate a transfer of a private repository to a specific authenticated Gitea user who lacks prior access, and the affected party is that designated recipient rather than an arbitrary user; it is not attacker-initiated against default configurations. Severity is moderate (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; published base score 4.3) with no public exploit identified at time of analysis and a low EPSS of 0.27% (17th percentile). Vendor-released patch: Gitea 28.0.0.
UI spoofing in Google Chrome builds prior to 155.0.8059.39 lets an attacker who has already compromised the browser's renderer process present falsified interface elements to the victim through a crafted HTML page. The precondition of an existing renderer foothold, combined with required user interaction and the high attack complexity of reliably triggering the underlying use-after-release on a Session object, sharply limits practical exploitation - the realized effect is spoofed UI, not code execution or data theft. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none, and Google classifies the underlying Chromium issue as low severity, making this a routine, low-priority patching item.
Use-after-release in Google Chrome's FontAccess (Local Font Access API) lets an attacker who has already compromised the renderer process bypass web origin policy by luring a victim to a crafted HTML page in Chrome versions prior to 155.0.8059.39. Successful exploitation yields no confidentiality loss but a high integrity impact, as the attacker can subvert origin boundaries from inside an already-broken renderer; the required renderer compromise is a hard prerequisite and makes this a defense-in-depth, medium-severity issue rather than a standalone remote entry point. No public exploit identified at time of analysis, EPSS is low at 0.31% (22nd percentile), and Google has released a fixed build. The CVSS vector shows PR:N/UI:R, meaning unauthenticated attackers are relevant but victim interaction (loading the page) is mandatory; our own assessment rates attack complexity as High rather than Low given the prerequisite renderer foothold.
UI spoofing in Google Chrome (all versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process fake browser interface elements - such as dialogs, permission prompts or address-bar style chrome - in front of the user via a crafted HTML page. The weakness is a use-after-free of a released resource (CWE-672) in UI code: unauthenticated from a network standpoint (PR:N), but gated behind a prior renderer compromise, mandatory user interaction (UI:R) and non-trivial timing/state conditions (AC:H). Independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - strictly a user-interface integrity issue with no confidentiality or availability impact - and Chromium rated it Low. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Cross-origin data disclosure in Google Chrome versions prior to 155.0.8059.39 stems from a use-after-release defect in the browser's Core component, but it is not independently exploitable: a remote attacker must first have already compromised Chrome's sandboxed renderer process through a separate, unrelated vulnerability, then persuade the victim to load a crafted HTML page. Only limited confidentiality impact is possible (CVSS 3.1, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N; Chromium security severity: Low), with high attack complexity reflecting the non-deterministic timing needed to touch the freed resource. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a chain-stage bug rather than a standalone threat.
In the Linux kernel's Btrfs filesystem, running a block-group balance/relocation on a filesystem that has quota groups enabled can force creation of a relocation root while qgroup_account_snapshot() is committing a pending snapshot, leaving a stale metadata tree reference whose extent item has already been dropped. When delayed refs are processed the kernel hits lookup_inline_extent_backref() with a WARNING and fails the ref insertion with -117 (EUCLEAN), aborting the transaction and flipping the affected Btrfs filesystem read-only; recovery requires unmount and repair/mount, making this strictly an availability issue (no confidentiality or integrity impact). The defect is local-only: the assessed vector is AV:L/AC:H/PR:L/UI:N with high attack complexity, and the assessed risk is LOW despite the Medium 5.5 CVSS base score, because it requires (a) local access able to issue Btrfs administrative ioctls - balance/relocation normally needs CAP_SYS_ADMIN - (b) a filesystem explicitly created or mounted with quota/qgroups enabled, a non-default option, and (c) tight timing between relocation and snapshot creation. EPSS is 0.17% (5th percentile), there is no KEV entry, and no public exploit code was identified at time of analysis; vendor-released patches exist in stable 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
Token revocation bypass in Apache CXF's DefaultEncryptingOAuthDataProvider allows revoked OAuth access and refresh tokens to remain functionally valid indefinitely - the provider continues to decrypt them successfully and TokenIntrospectionService returns active:true in direct violation of RFC 7009 and RFC 7662 mandates. All Apache CXF deployments using this built-in OAuth data provider and relying on token revocation as a security control are affected across the 3.6.x, 4.1.x, and 4.2.x branches. An attacker or suspended user who retains a revoked token can continue accessing protected resources as though revocation never occurred, bypassing intended authorization boundaries. No public exploit has been identified at time of analysis, though the attack requires no tooling beyond a standard HTTP client.
Logic flaw in Capgo before 12.128.12 lets authenticated attackers continue serving soft-deleted application bundles to end-user devices because the /updates endpoint omits an app_versions.deleted filter when joining channels. Affected operators of the Capgo live-update service (a CodePush-style OTA platform for Capacitor mobile apps) can have purged bundles re-selected and pushed downstream, undermining rollback and removal workflows. No public exploit identified at time of analysis and the issue is not present in CISA KEV.
Information disclosure in Arista EOS on platforms with hardware IPsec support can occur when physical interface flaps or specific agent restarts cause IPsec tunnels to re-establish while reusing existing Security Associations, leading to sequence number mismatches between endpoints. The CVSS 4.0 base score of 8.2 reflects high confidentiality impact reachable over the network, though attack requirements (AT:P) indicate specific preconditions must be met. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Bearer token revocation bypass in OpenClaw gateway allows attackers to authenticate using rotated-out tokens until process restart. OpenClaw gateway HTTP and WebSocket handlers captured bearer authentication configuration at startup, failing to re-resolve credentials after SecretRef rotation. Attackers possessing a previously valid token can maintain unauthorized gateway access to /v1/* endpoints, /tools/invoke, plugin routes, and canvas upgrade paths even after operators rotate secrets, believing the old token is revoked. Fixed in version 2026.4.15. CVSS 9.2 reflects network-accessible attack with high complexity; no public exploit identified at time of analysis.
Gitea through 1.27.3 grants the named recipient of a private-repository transfer temporary read collaborator access so they can review the repository, but rejecting or cancelling that transfer never revokes the collaboration, leaving the recipient with persistent read access to the private repository's code, issues, pull requests and wiki, including the ability to clone it, without any notification to the repository owner. Exploitation requires the repository owner to initiate a transfer of a private repository to a specific authenticated Gitea user who lacks prior access, and the affected party is that designated recipient rather than an arbitrary user; it is not attacker-initiated against default configurations. Severity is moderate (assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; published base score 4.3) with no public exploit identified at time of analysis and a low EPSS of 0.27% (17th percentile). Vendor-released patch: Gitea 28.0.0.
UI spoofing in Google Chrome builds prior to 155.0.8059.39 lets an attacker who has already compromised the browser's renderer process present falsified interface elements to the victim through a crafted HTML page. The precondition of an existing renderer foothold, combined with required user interaction and the high attack complexity of reliably triggering the underlying use-after-release on a Session object, sharply limits practical exploitation - the realized effect is spoofed UI, not code execution or data theft. No public exploit code has been identified at time of analysis, CISA's SSVC assessment records exploitation as none, and Google classifies the underlying Chromium issue as low severity, making this a routine, low-priority patching item.
Use-after-release in Google Chrome's FontAccess (Local Font Access API) lets an attacker who has already compromised the renderer process bypass web origin policy by luring a victim to a crafted HTML page in Chrome versions prior to 155.0.8059.39. Successful exploitation yields no confidentiality loss but a high integrity impact, as the attacker can subvert origin boundaries from inside an already-broken renderer; the required renderer compromise is a hard prerequisite and makes this a defense-in-depth, medium-severity issue rather than a standalone remote entry point. No public exploit identified at time of analysis, EPSS is low at 0.31% (22nd percentile), and Google has released a fixed build. The CVSS vector shows PR:N/UI:R, meaning unauthenticated attackers are relevant but victim interaction (loading the page) is mandatory; our own assessment rates attack complexity as High rather than Low given the prerequisite renderer foothold.
UI spoofing in Google Chrome (all versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process fake browser interface elements - such as dialogs, permission prompts or address-bar style chrome - in front of the user via a crafted HTML page. The weakness is a use-after-free of a released resource (CWE-672) in UI code: unauthenticated from a network standpoint (PR:N), but gated behind a prior renderer compromise, mandatory user interaction (UI:R) and non-trivial timing/state conditions (AC:H). Independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - strictly a user-interface integrity issue with no confidentiality or availability impact - and Chromium rated it Low. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Cross-origin data disclosure in Google Chrome versions prior to 155.0.8059.39 stems from a use-after-release defect in the browser's Core component, but it is not independently exploitable: a remote attacker must first have already compromised Chrome's sandboxed renderer process through a separate, unrelated vulnerability, then persuade the victim to load a crafted HTML page. Only limited confidentiality impact is possible (CVSS 3.1, AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N; Chromium security severity: Low), with high attack complexity reflecting the non-deterministic timing needed to touch the freed resource. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA SSVC exploitation: none), so this is best treated as a chain-stage bug rather than a standalone threat.
In the Linux kernel's Btrfs filesystem, running a block-group balance/relocation on a filesystem that has quota groups enabled can force creation of a relocation root while qgroup_account_snapshot() is committing a pending snapshot, leaving a stale metadata tree reference whose extent item has already been dropped. When delayed refs are processed the kernel hits lookup_inline_extent_backref() with a WARNING and fails the ref insertion with -117 (EUCLEAN), aborting the transaction and flipping the affected Btrfs filesystem read-only; recovery requires unmount and repair/mount, making this strictly an availability issue (no confidentiality or integrity impact). The defect is local-only: the assessed vector is AV:L/AC:H/PR:L/UI:N with high attack complexity, and the assessed risk is LOW despite the Medium 5.5 CVSS base score, because it requires (a) local access able to issue Btrfs administrative ioctls - balance/relocation normally needs CAP_SYS_ADMIN - (b) a filesystem explicitly created or mounted with quota/qgroups enabled, a non-default option, and (c) tight timing between relocation and snapshot creation. EPSS is 0.17% (5th percentile), there is no KEV entry, and no public exploit code was identified at time of analysis; vendor-released patches exist in stable 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.