Monthly
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
wolfSSL's x86_64 Curve25519 scalar multiplication yields a non-canonical shared secret when carry propagation overflows into bit 255 during final modular reduction, producing a result in [p, 2^255) rather than the required canonical range [0, p). Both the x64 and AVX2 hand-written assembly paths in fe_x25519_asm.S are affected, and only specific edge-case scalar/point combinations trigger the flaw. wolfSSL self-reported this correctness defect and published a fix via GitHub PR #10536; no public exploit exists and the vulnerability is absent from CISA KEV.
Incorrect errno calculation in Netatalk 2.1.0 through 4.4.2 allows remote unauthenticated attackers to cause minor service disruption by triggering simultaneous error conditions that produce invalid composite error codes via bitwise OR misuse. The flaw (CWE-682, Incorrect Calculation) diverts execution into incorrect error-handling paths within the AFP file-sharing service, affecting availability at a low level (A:L) with no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.7 (Low) and high attack complexity (AC:H) reflect a limited real-world threat.
Incorrect hexadecimal-to-integer conversion in Netatalk 2.0.0 through 4.4.2 stems from a macro that fails to handle uppercase hex digits (A-F) correctly, producing wrong integer values during AFP protocol processing. An authenticated remote attacker with low privileges can exploit the flaw under high-complexity conditions to cause minor integrity corruption - for example, corrupted filename or attribute encoding. No public exploit code exists and the vulnerability is not listed in CISA KEV, making real-world exploitation unlikely in most environments. Fixed in Netatalk 4.5.0.
Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required. No vendor patch available.
Zebra's block validator fails to count transparent signature operations correctly, allowing malicious miners to create blocks that exceed the 20,000 sigop consensus limit and trigger network splits between Zebra and zcashd nodes. The vulnerability affects Zebra versions prior to 4.4.0 and stems from two distinct accounting flaws: (1) coinbase input scriptSigs were excluded from legacy sigop counts, hiding up to 98 operations, and (2) P2SH redeem script sigops were only computed during mempool validation but never aggregated during block validation. A miner could craft a single block with 1,334+ P2SH spends to exceed the limit and partition the Zcash network. Vendor-released patch: Zebra 4.4.0 (confirmed by GitHub advisory GHSA-jv4h-j224-23cc). No public exploit identified at time of analysis.
Remote code execution within the Chrome renderer sandbox is achievable against all Chrome versions prior to 151.0.7922.169 by delivering a crafted HTML page to a victim user. The root cause is an incorrect arithmetic or numeric calculation in V8, Chrome's JavaScript engine, which can be triggered purely through JavaScript execution in a standard browsing session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS score of 8.8 and the universality of Chrome's user base make this a high-priority patching candidate.
Privilege escalation in Intel TDX Guest software before version 0.3.1 stems from an incorrect calculation (CWE-682) within Ring 3 user application code, enabling a local, high-privilege adversary to elevate privileges within a Trust Domain. The CVSS 4.0 vector confirms local access with high privileges required and low C/I/A impact on the vulnerable system, with no subsequent-system (host/hypervisor) impact. No public exploit exists and the vulnerability is absent from CISA KEV, placing real-world risk squarely in multi-tenant confidential computing scenarios where intra-guest privilege containment is a security objective.
Denial-of-service conditions in Cisco IOS XE Software stem from multiple incorrect calculation flaws (CWE-682) discoverable over the network without authentication, capable of crashing the affected device and disrupting all traffic transiting it. The CVSS scope change (S:C) indicates impact extends beyond the vulnerable component itself, consistent with a network appliance crash affecting downstream routing and switching functions across an enterprise. Internally discovered and disclosed by Cisco as part of a proactive software hardening initiative, no public exploit identified at time of analysis and CISA KEV status is absent.
Memory-safety corruption in Mozilla Firefox stems from a JIT miscompilation in the JavaScript engine's WebAssembly component, fixed in Firefox 153 and Firefox ESR 140.13. An attacker who lures a victim to a malicious page can supply crafted WebAssembly that the Just-In-Time compiler translates incorrectly, corrupting engine state to disclose memory or achieve code execution in the content process. There is no public exploit identified at time of analysis and the EPSS score is very low (0.15%, 5th percentile), so no active exploitation is indicated despite the 9.8 rating.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
wolfSSL's x86_64 Curve25519 scalar multiplication yields a non-canonical shared secret when carry propagation overflows into bit 255 during final modular reduction, producing a result in [p, 2^255) rather than the required canonical range [0, p). Both the x64 and AVX2 hand-written assembly paths in fe_x25519_asm.S are affected, and only specific edge-case scalar/point combinations trigger the flaw. wolfSSL self-reported this correctness defect and published a fix via GitHub PR #10536; no public exploit exists and the vulnerability is absent from CISA KEV.
Incorrect errno calculation in Netatalk 2.1.0 through 4.4.2 allows remote unauthenticated attackers to cause minor service disruption by triggering simultaneous error conditions that produce invalid composite error codes via bitwise OR misuse. The flaw (CWE-682, Incorrect Calculation) diverts execution into incorrect error-handling paths within the AFP file-sharing service, affecting availability at a low level (A:L) with no confidentiality or integrity impact. No public exploit or active exploitation has been identified at time of analysis; the CVSS score of 3.7 (Low) and high attack complexity (AC:H) reflect a limited real-world threat.
Incorrect hexadecimal-to-integer conversion in Netatalk 2.0.0 through 4.4.2 stems from a macro that fails to handle uppercase hex digits (A-F) correctly, producing wrong integer values during AFP protocol processing. An authenticated remote attacker with low privileges can exploit the flaw under high-complexity conditions to cause minor integrity corruption - for example, corrupted filename or attribute encoding. No public exploit code exists and the vulnerability is not listed in CISA KEV, making real-world exploitation unlikely in most environments. Fixed in Netatalk 4.5.0.
Ledger Bitcoin app versions 2.1.0 and 2.1.1 contain an address derivation vulnerability that allows attackers to cause incorrect Bitcoin addresses to be displayed by exploiting improper handling of. Rated medium severity (CVSS 4.1), this vulnerability is no authentication required. No vendor patch available.
Zebra's block validator fails to count transparent signature operations correctly, allowing malicious miners to create blocks that exceed the 20,000 sigop consensus limit and trigger network splits between Zebra and zcashd nodes. The vulnerability affects Zebra versions prior to 4.4.0 and stems from two distinct accounting flaws: (1) coinbase input scriptSigs were excluded from legacy sigop counts, hiding up to 98 operations, and (2) P2SH redeem script sigops were only computed during mempool validation but never aggregated during block validation. A miner could craft a single block with 1,334+ P2SH spends to exceed the limit and partition the Zcash network. Vendor-released patch: Zebra 4.4.0 (confirmed by GitHub advisory GHSA-jv4h-j224-23cc). No public exploit identified at time of analysis.