Monthly
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.
Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. Those documents are then delivered to lower-privileged users such as team leads who generate them, creating a stealthy credential exfiltration channel. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. Apple has released patches across all affected platforms; no public exploit or CISA KEV listing is identified at time of analysis.
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.
Evidence-validation bypass in @hulumi/policies (npm) before 1.3.2 lets actors in a deployment pipeline suppress Cloudflare and deployment-governance policy violations by supplying unrelated but compliant-looking evidence. Because validators accepted stack-wide evidence shortcuts rather than correlating proof to the specific protected resource, evidence from one zone, hostname, origin, or repository could silence guardrails for a completely different resource in the same stack. No public exploit identified at time of analysis; the issue was reported by VulnCheck and fixed by correlating evidence to the protected resource in 1.3.2.
Privilege escalation in Sudo through 1.9.17p2 allows any local user holding a sudo rule to execute arbitrary commands when ptrace-based intercept mode is enabled. The intercept layer in exec_ptrace.c monitored only execve(2) system calls, leaving execveat(2) - and the fexecve libc wrapper built atop it - entirely uninspected, bypassing both policy enforcement and audit logging. No public exploit has been identified at time of analysis; the upstream fix is available as a confirmed commit to the sudo-project repository.
Spring Security 7.1.0's InetAddressMatchers utility contains a flaw in its IP address classification logic - the matchInternal() and matchExternal() builders may incorrectly categorize certain IP addresses as belonging to internal or external networks, enabling unauthenticated remote attackers to bypass IP-based access controls under high-complexity conditions. Applications that rely on InetAddressMatchers to enforce network-level access restrictions are exposed to limited information disclosure where restricted endpoints or data may become accessible to external parties. No public exploit code exists and no CISA KEV listing is present, indicating no confirmed active exploitation at time of analysis.
Remote code execution in Craft CMS allows authenticated users with Twig template access to escape the sandbox via permissive Yii framework functionality, achieving full confidentiality, integrity, and availability compromise on the host system. The root cause is CWE-693 (Protection Mechanism Failure): the Twig sandbox policy was configured to permit dangerous Yii framework methods capable of executing arbitrary code, rather than enforcing a tight allowlist. The vendor confirmed and patched this as a high-severity RCE in release 5.10.7; no public exploit code has been confirmed at time of analysis, though a Hackrate hacktivity report exists referencing the issue.
Kimai's Twig sandbox exposes server-wide secrets through an unrestricted config() function in administrator-uploaded invoice and export templates, affecting all versions before 2.56.0. An administrator with template upload privileges can craft a malicious template that renders sensitive configuration values - including LDAP bind passwords and SAML SP private keys - directly into invoice or export documents. Those documents are then delivered to lower-privileged users such as team leads who generate them, creating a stealthy credential exfiltration channel. No public exploit identified at time of analysis, and no CISA KEV listing is present in the provided data.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
Content Security Policy enforcement failure in Safari's AudioWorklet contexts allows remote attackers to bypass CSP restrictions when a user processes maliciously crafted web content. Affected platforms include Safari before 26.5, iOS and iPadOS before 18.7.9/26.5, and macOS Tahoe before 26.5. Apple has released patches across all affected platforms; no public exploit or CISA KEV listing is identified at time of analysis.
UEFI protection mechanism failure in NVIDIA DGX Spark allows a privileged local user to bypass the UEFI administrator password, undermining firmware-level access controls. The CVSS vector (AV:L/PR:H/S:C/I:H) confirms local high-privilege access is required, but a successful exploit extends beyond the OS security boundary - a scope change that elevates the real-world impact. No public exploit code and no CISA KEV listing have been identified at time of analysis, keeping real-world risk contained to insider-threat and physical-access scenarios.
Authenticated Twig sandbox escape in Winter CMS before 1.2.13 lets backend users holding template-editing permissions (cms.manage_pages, cms.manage_layouts, or cms.manage_partials) break out of the CMS 'safe mode' to read and modify arbitrary database records, run raw SQL including DDL like DROP TABLE, exfiltrate backend administrator credentials, and achieve PHP remote code execution by writing PHP into a page, layout, or partial code section. It is an incomplete-fix follow-up (bypass) of CVE-2024-54149, whose method-name blocklist missed Eloquent's __call forwarding to the query builder. Rated CVSS 4.0 9.3 (VulnCheck); no public exploit is identified as actively used, though the vendor advisory and added test cases publish working payloads.
Hidden volume creation in VeraCrypt 1.26.6 through 1.26.28 leaves forensically detectable plaintext markers inside file-hosted hidden volume containers, directly undermining plausible deniability guarantees. The FormatNoFs and FormatFat functions apply a quick-format optimization that writes zeroed sectors at predictable 128 MiB intervals via WriteFile, bypassing the EncryptDataUnits path that would fill the area with indistinguishable ciphertext; a forensic examiner with access to the container can identify these anomalous plaintext artifacts and infer hidden volume presence. Encryption strength and hidden-volume contents are not compromised - impact is confined to deniability failure. No public exploit has been identified and this vulnerability is not listed in CISA KEV.