Monthly
Consensus divergence in the Zcash Foundation's Zebra node (zebrad up to and including v4.4.1) lets remote unauthenticated attackers force a chain split between Zebra and zcashd validators. Zebra's P2SH signature-operation counter short-circuits on disabled script opcodes and returns a partial count, so it can accept a block that zcashd rejects for exceeding MAX_BLOCK_SIGOPS (20,000); an attacker only needs to broadcast transactions spending P2SH outputs with crafted redeem scripts and wait for any Zebra miner (~30% of network hashrate) to mine them. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the advisory includes a concrete, reproducible technique, and the CVSS 4.0 score is 9.3.
An out-of-bounds read in Tor before 0.4.9.7 can be triggered by a malicious circuit participant sending an END, TRUNCATE, or TRUNCATED cell whose payload omits the reason byte, potentially crashing the Tor process with limited confidentiality impact and high availability impact. Only relay or circuit-endpoint actors that can deliver the malformed cell within a circuit meet the exploitation conditions, and the assessed impact is most consistent with denial of service rather than confirmed remote data exfiltration. No public exploit was identified at time of analysis (EPSS 0.01%, SSVC exploitation: none); the vendor-released fix is Tor 0.4.9.7.
Information disclosure in Google Chrome before 155.0.8059.39 allows a remote attacker to leak sensitive information from the browser when a victim loads a crafted HTML page that exercises the Sanitizer API, exploiting an implementation that does not deliver the functionality as specified. The attack requires no authentication (PR:N) but does require the user to open attacker-controlled web content (UI:R), and the impact is confined to low confidentiality with no integrity or availability effect, yielding a CVSS 3.1 base score of 4.3 and a Chromium-assigned severity of Low. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none, so this is a low-priority update-and-move-on issue rather than an urgent threat.
Web origin policy bypass in Google Chrome on iOS prior to 155.0.8059.39 allows remote attackers to cross origin boundaries and alter content the browser should treat as belonging to a different site, after a victim is persuaded through social engineering to load crafted network traffic (CVSS 6.5, C:N/I:H/A:N). No authentication is required (PR:N), but the mandatory user interaction (UI:R) keeps the attack non-automatable under CISA's SSVC assessment, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation is further constrained by a low EPSS score of 0.21% (11th percentile) and by integrity-only impact that exposes no confidential data and causes no denial of service, which is why this is rated a genuine Medium-severity issue rather than a high-priority emergency.
Proxy functionality in Google Chrome on Windows prior to 152.0.7977.65 incorrectly implements specified behavior, enabling an adjacent-network attacker to intercept or infer sensitive information by sending crafted network traffic. The flaw is Windows-platform-specific and is classified by the Chromium security team as Low severity, consistent with the high attack complexity and adjacency requirement that constrain realistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.13%, placing this in the 3rd percentile of exploitability.
Denial of service in Exim before 4.99.2 on musl libc systems allows remote attackers to crash mail server connection instances by sending malformed DNS PTR records that trigger an octal printing bug in the dn_expand function. The vulnerability requires high network complexity to exploit but results in service unavailability for affected connections. No patch version confirmation available from provided references.
Out-of-bounds heap write in Exim before 4.99.2 allows unauthenticated remote attackers to cause denial of service and potentially corrupt memory when the JSON lookup feature is enabled and malformed JSON is present in untrusted email headers, due to incorrect backslash escape sequence handling in the JSON operator.
DNS traffic amplification via cyclic nameserver delegation in Technitium DNS Server versions before 15.0 enables unauthenticated remote attackers to conduct distributed denial-of-service (DDoS) attacks. Attackers can exploit misconfigured or maliciously crafted DNS delegation chains to create resolution loops, forcing the server to generate significantly larger response traffic than the initial query size. This amplification can be weaponized against third-party victims, with the vulnerable server acting as an unwitting participant in reflection attacks. CVSS 7.2 (High) reflects network-accessible exploitation requiring no authentication, with cross-scope impact affecting availability and integrity of downstream systems.
Logic error in uutils coreutils cut utility causes incorrect behavior when combining the -s (only-delimited), -z (null-terminated), and -d '' (empty delimiter) flags, resulting in unfiltered records being emitted instead of suppressed. This breaks data integrity for automated pipelines relying on cut -s to exclude records without delimiters, affecting local users with limited privileges. The vulnerability has low exploitability (CVSS 3.3, SSVC indicates no exploitation status and non-automatable attack), but poses information disclosure and data corruption risks in security-sensitive data processing workflows.
uutils coreutils tr utility misdefines POSIX character classes [:graph:] and [:print:], incorrectly including ASCII space (0x20) in [:graph:] and excluding it from [:print:] - the opposite of standard behavior. This logic error causes unintended data modification or loss when tr is used in automated scripts or data pipelines that depend on correct character class semantics, such as deletion of graphical characters inadvertently removing all spaces and corrupting structured data. Affects coreutils versions prior to 0.8.0; patch is available from vendor.
Consensus divergence in the Zcash Foundation's Zebra node (zebrad up to and including v4.4.1) lets remote unauthenticated attackers force a chain split between Zebra and zcashd validators. Zebra's P2SH signature-operation counter short-circuits on disabled script opcodes and returns a partial count, so it can accept a block that zcashd rejects for exceeding MAX_BLOCK_SIGOPS (20,000); an attacker only needs to broadcast transactions spending P2SH outputs with crafted redeem scripts and wait for any Zebra miner (~30% of network hashrate) to mine them. There is no public exploit identified at time of analysis and it is not on CISA KEV, but the advisory includes a concrete, reproducible technique, and the CVSS 4.0 score is 9.3.
An out-of-bounds read in Tor before 0.4.9.7 can be triggered by a malicious circuit participant sending an END, TRUNCATE, or TRUNCATED cell whose payload omits the reason byte, potentially crashing the Tor process with limited confidentiality impact and high availability impact. Only relay or circuit-endpoint actors that can deliver the malformed cell within a circuit meet the exploitation conditions, and the assessed impact is most consistent with denial of service rather than confirmed remote data exfiltration. No public exploit was identified at time of analysis (EPSS 0.01%, SSVC exploitation: none); the vendor-released fix is Tor 0.4.9.7.
Information disclosure in Google Chrome before 155.0.8059.39 allows a remote attacker to leak sensitive information from the browser when a victim loads a crafted HTML page that exercises the Sanitizer API, exploiting an implementation that does not deliver the functionality as specified. The attack requires no authentication (PR:N) but does require the user to open attacker-controlled web content (UI:R), and the impact is confined to low confidentiality with no integrity or availability effect, yielding a CVSS 3.1 base score of 4.3 and a Chromium-assigned severity of Low. No public exploit code has been identified at time of analysis and CISA's SSVC decision framework rates exploitation as none, so this is a low-priority update-and-move-on issue rather than an urgent threat.
Web origin policy bypass in Google Chrome on iOS prior to 155.0.8059.39 allows remote attackers to cross origin boundaries and alter content the browser should treat as belonging to a different site, after a victim is persuaded through social engineering to load crafted network traffic (CVSS 6.5, C:N/I:H/A:N). No authentication is required (PR:N), but the mandatory user interaction (UI:R) keeps the attack non-automatable under CISA's SSVC assessment, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Exploitation is further constrained by a low EPSS score of 0.21% (11th percentile) and by integrity-only impact that exposes no confidential data and causes no denial of service, which is why this is rated a genuine Medium-severity issue rather than a high-priority emergency.
Proxy functionality in Google Chrome on Windows prior to 152.0.7977.65 incorrectly implements specified behavior, enabling an adjacent-network attacker to intercept or infer sensitive information by sending crafted network traffic. The flaw is Windows-platform-specific and is classified by the Chromium security team as Low severity, consistent with the high attack complexity and adjacency requirement that constrain realistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.13%, placing this in the 3rd percentile of exploitability.
Denial of service in Exim before 4.99.2 on musl libc systems allows remote attackers to crash mail server connection instances by sending malformed DNS PTR records that trigger an octal printing bug in the dn_expand function. The vulnerability requires high network complexity to exploit but results in service unavailability for affected connections. No patch version confirmation available from provided references.
Out-of-bounds heap write in Exim before 4.99.2 allows unauthenticated remote attackers to cause denial of service and potentially corrupt memory when the JSON lookup feature is enabled and malformed JSON is present in untrusted email headers, due to incorrect backslash escape sequence handling in the JSON operator.
DNS traffic amplification via cyclic nameserver delegation in Technitium DNS Server versions before 15.0 enables unauthenticated remote attackers to conduct distributed denial-of-service (DDoS) attacks. Attackers can exploit misconfigured or maliciously crafted DNS delegation chains to create resolution loops, forcing the server to generate significantly larger response traffic than the initial query size. This amplification can be weaponized against third-party victims, with the vulnerable server acting as an unwitting participant in reflection attacks. CVSS 7.2 (High) reflects network-accessible exploitation requiring no authentication, with cross-scope impact affecting availability and integrity of downstream systems.
Logic error in uutils coreutils cut utility causes incorrect behavior when combining the -s (only-delimited), -z (null-terminated), and -d '' (empty delimiter) flags, resulting in unfiltered records being emitted instead of suppressed. This breaks data integrity for automated pipelines relying on cut -s to exclude records without delimiters, affecting local users with limited privileges. The vulnerability has low exploitability (CVSS 3.3, SSVC indicates no exploitation status and non-automatable attack), but poses information disclosure and data corruption risks in security-sensitive data processing workflows.
uutils coreutils tr utility misdefines POSIX character classes [:graph:] and [:print:], incorrectly including ASCII space (0x20) in [:graph:] and excluding it from [:print:] - the opposite of standard behavior. This logic error causes unintended data modification or loss when tr is used in automated scripts or data pipelines that depend on correct character class semantics, such as deletion of graphical characters inadvertently removing all spaces and corrupting structured data. Affects coreutils versions prior to 0.8.0; patch is available from vendor.