Monthly
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
Capsule, the Kubernetes multi-tenancy and policy framework (projectcapsule/capsule), mishandles case-insensitive sorting in its forbidden-list lookup on versions prior to 0.13.7, allowing an authenticated tenant owner to slip denied metadata keys past api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions - potentially altering cluster policies, network exposure, or pod scheduling outside the tenant boundary. Exploitation is conditional: the cluster administrator's forbidden list must mix capitalized and lowercase keys (or otherwise produce different case-insensitive and byte-order sortings), which is why the assessed vector is AV:N/AC:H/PR:L with scope change and high integrity impact. The flaw maps to CWE-697 (Incorrect Comparison), and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis; a vendor fix is available in 0.13.7.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
Authentication bypass in MemOS (MemTensor), a memory operating system for LLMs and AI agents, lets an unauthenticated remote attacker impersonate a trusted internal principal with full 'all' scopes. When AUTH_ENABLED=true but the undocumented INTERNAL_SERVICE_SECRET variable is left unset, a null-versus-null comparison in the internal-request check fails open, exposing admin API-key management and all data endpoints. Rated CVSS 4.0 9.3 (critical) by VulnCheck; no public exploit identified at time of analysis, though the flaw is trivially reproducible from the disclosed source.
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Authorization-model destruction in FlaskBB forum software (versions up to and including 2.2.0) lets an authenticated administrator wipe all six built-in permission groups through the management bulk-delete AJAX endpoint. Because the endpoint compares JSON integer group IDs against string literals, the guard meant to protect built-in groups never matches and silently allows their removal, collapsing the forum's entire permission model and potentially bricking the site. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in commit a5da9a5.
Detection bypass in @hulumi/policies versions prior to 1.4.0 allows IAM trust policies that list multiple OIDC federated providers to evade the G_OIDC_1 and G_OIDC_2 policy checks for GitHub Actions OIDC roles. Consumers of HulumiHardeningPack or HulumiGithubHardeningPack can therefore ship roles with wildcard sub: conditions - assumable by untrusted forked-PR workflows - while the validator falsely reports compliance, including missing the AdministratorAccess blast-radius flag. No public exploit identified at time of analysis, and there is no CISA KEV listing.
The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value check on the secret_key in the autheticate_user function. On installations where the plugin API key is not configured, unauthenticated attackers can create administrative accounts and take over the WordPress site.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Detection bypass in OISF Suricata before 7.0.17 and 8.0.6 lets an unauthenticated remote attacker who can craft an aligned IPv4/IPv6 flow pair make the engine treat the two flows as one, corrupting flowbit and IP-only state so signatures may fail to fire. The root cause is a family-blind comparison in src/flow-hash.c (CWE-697, CVSS 5.9, AV:N/AC:H/PR:N/UI:N/I:H), reflecting a targeted technique rather than opportunistic scanning because the attacker must line up raw address words, ports, protocol, VLAN, recursion level, live device and hash bucket across families. Impact is confined to the IDS/IPS's own detection-integrity logic - no host confidentiality or availability loss was assessed - and no public exploit code was identified at time of analysis, though vendor patches are available in 7.0.17 and 8.0.6.
Capsule, the Kubernetes multi-tenancy and policy framework (projectcapsule/capsule), mishandles case-insensitive sorting in its forbidden-list lookup on versions prior to 0.13.7, allowing an authenticated tenant owner to slip denied metadata keys past api.ValidateForbidden and bypass configured namespace, Service, or delegated node metadata restrictions - potentially altering cluster policies, network exposure, or pod scheduling outside the tenant boundary. Exploitation is conditional: the cluster administrator's forbidden list must mix capitalized and lowercase keys (or otherwise produce different case-insensitive and byte-order sortings), which is why the assessed vector is AV:N/AC:H/PR:L with scope change and high integrity impact. The flaw maps to CWE-697 (Incorrect Comparison), and no public exploit code or confirmed in-the-wild activity has been identified at time of analysis; a vendor fix is available in 0.13.7.
A hardening release for Cisco Secure Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, and Cisco Secure Firewall Management Center (FMC) Software addresses a class of internally discovered defects grouped under CVE-2026-20333, described as incorrect comparison conditions (CWE-697) that can lead to high confidentiality, integrity, and availability impact (CVSS 8.8). Affected deployments span ASA 9.16 through 9.24, FTD 7.0 through 10.0.0, and FMC 7.0 through 10.0.1, and exploitation requires network reachability to the affected management/data plane plus valid low-privilege credentials (CVSS vector PR:L), so this is not an unauthenticated remote attack. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); Cisco resolved it proactively through the cisco-sa-hardening-asaftdfmc-uvpPROhN advisory rather than in response to a reported incident.
Authentication bypass in XenForo before 2.3.13 lets unauthenticated attackers redeem a valid OAuth2 authorization code for a real access/refresh token pair by submitting empty client_secret and code_verifier values at the token endpoint. Because PHP treats empty strings as falsy, both client-secret verification and PKCE code-verifier checks are silently skipped, defeating client authentication and the PKCE binding. Reported by VulnCheck with a vendor patch available; no public exploit identified at time of analysis, and no EPSS or KEV signal was supplied.
Authentication bypass in MemOS (MemTensor), a memory operating system for LLMs and AI agents, lets an unauthenticated remote attacker impersonate a trusted internal principal with full 'all' scopes. When AUTH_ENABLED=true but the undocumented INTERNAL_SERVICE_SECRET variable is left unset, a null-versus-null comparison in the internal-request check fails open, exposing admin API-key management and all data endpoints. Rated CVSS 4.0 9.3 (critical) by VulnCheck; no public exploit identified at time of analysis, though the flaw is trivially reproducible from the disclosed source.
Privilege escalation via authorization bypass in Wolf CMS (through 0.8.3.1) lets any authenticated non-administrative user reach the BackupRestoreController and create, download, and restore site backups that should be admin-only. The root cause is a PHP operator-precedence mistake in the permission-check expression, so the access control evaluates incorrectly and grants low-privileged accounts admin-tier backup functionality. Publicly available exploit code exists (published by VulnCheck), but there is no public exploit identified in CISA KEV, so active exploitation is not confirmed.
Authorization-model destruction in FlaskBB forum software (versions up to and including 2.2.0) lets an authenticated administrator wipe all six built-in permission groups through the management bulk-delete AJAX endpoint. Because the endpoint compares JSON integer group IDs against string literals, the guard meant to protect built-in groups never matches and silently allows their removal, collapsing the forum's entire permission model and potentially bricking the site. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in commit a5da9a5.
Detection bypass in @hulumi/policies versions prior to 1.4.0 allows IAM trust policies that list multiple OIDC federated providers to evade the G_OIDC_1 and G_OIDC_2 policy checks for GitHub Actions OIDC roles. Consumers of HulumiHardeningPack or HulumiGithubHardeningPack can therefore ship roles with wildcard sub: conditions - assumable by untrusted forked-PR workflows - while the validator falsely reports compliance, including missing the AdministratorAccess blast-radius flag. No public exploit identified at time of analysis, and there is no CISA KEV listing.
The SureTriggers WordPress plugin through version 1.0.78 contains an authentication bypass due to a missing empty value check on the secret_key in the autheticate_user function. On installations where the plugin API key is not configured, unauthenticated attackers can create administrative accounts and take over the WordPress site.