Monthly
Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.
Improper state validation in Google Chrome's Performance component (all versions prior to 152.0.7977.65) enables remote attackers to read memory contents within the Chrome sandbox by luring a user to a crafted HTML page. The scope is contained to the sandbox (S:U), limiting blast radius to in-process data, but sensitive browser state such as cookies, session tokens, or page content may be exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.22% (13th percentile) corroborates low observed exploitation activity.
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. Fixed in 4.1.137.Final and 4.2.17.Final; no public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.1 (Critical).
Forcepoint One Endpoint (F1E) on macOS prior to version v26.04.5758 allows any standard, non-administrative local user to disable the SafariExtension component that enforces Data Loss Prevention browser controls, effectively creating a blind spot in the organization's DLP posture. The CWE-754 root cause indicates the agent fails to properly validate exceptional or edge-case conditions when processing requests that alter the extension's operational state, permitting a low-privilege account to defeat a security control intended to require elevated rights. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.
Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.
Improper state validation in Google Chrome's Performance component (all versions prior to 152.0.7977.65) enables remote attackers to read memory contents within the Chrome sandbox by luring a user to a crafted HTML page. The scope is contained to the sandbox (S:U), limiting blast radius to in-process data, but sensitive browser state such as cookies, session tokens, or page content may be exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.22% (13th percentile) corroborates low observed exploitation activity.
Mutual-TLS authentication bypass in the Netty network framework (io.netty.handler.ssl.SslClientHelloHandler) lets an unauthenticated remote attacker reach routes protected only by per-SNI clientAuth=REQUIRE. A ClientHello whose 4-byte handshake header is split across TLS records trips a wrong-offset bounds check, throwing IndexOutOfBoundsException and calling select(ctx, null), which falls back to the default SslContext (clientAuth NONE/OPTIONAL) instead of the SNI-matched context. Fixed in 4.1.137.Final and 4.2.17.Final; no public exploit identified at time of analysis, but the CVSS 4.0 base score is 9.1 (Critical).
Forcepoint One Endpoint (F1E) on macOS prior to version v26.04.5758 allows any standard, non-administrative local user to disable the SafariExtension component that enforces Data Loss Prevention browser controls, effectively creating a blind spot in the organization's DLP posture. The CWE-754 root cause indicates the agent fails to properly validate exceptional or edge-case conditions when processing requests that alter the extension's operational state, permitting a low-privilege account to defeat a security control intended to require elevated rights. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated denial of service in @fastify/busboy versions 1.0.0 through 3.2.0 allows any network attacker to crash the Node.js process by submitting a multipart form with a header whose name collides with a prototype-inherited JavaScript property such as __proto__ or constructor. The internal header store uses a plain object inheriting from Object.prototype, so the inherited property resolves to a truthy non-array value that triggers a synchronous TypeError when array methods are invoked on it; in direct write/end usage paths this exception propagates uncaught and terminates the process. No public exploit code has been identified at time of analysis, but the attack is trivially constructable given the detailed advisory.
Unauthenticated remote denial of service in the Russh SSH library (versions ≤ 0.62.3) allows any network attacker to crash individual server key-exchange sessions by sending a single SSH_MSG_KEX_ECDH_INIT packet containing a 32-byte all-zero Curve25519 public key. The defect triggers under the default server configuration - no special deployment required - causing a Rust bounds-check panic in encode_mpint before host-key signature verification ever occurs. A public proof-of-concept is documented in GHSA-5xvq-cp9x-6p6r; no active exploitation is confirmed in CISA KEV.
Denial of service in the Intel NPU Driver firmware (all versions) is achievable by any local authenticated low-privileged user through an improper conditions check (CWE-754) in the Ring 1 device driver layer. The flaw allows an unprivileged software process operating under an authenticated user context to trigger a high-availability-impact disruption - likely a driver crash or system hang - with no attack requirements and no user interaction beyond the attacker's own actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the low complexity and minimal privilege bar make it straightforward to exploit on any affected Intel Core Ultra system where the NPU driver is loaded.
Denial of service in Intel PROSet/Wireless WiFi Software affects the Ring 2 device driver layer, where an improper conditions check (CWE-754) can be triggered by an adjacent, unauthenticated attacker with no user interaction required. The vulnerability collapses wireless availability on the affected host and, per the CVSS 4.0 vector, cascades to subsequent system availability as well, meaning dependent network-connected services may also be disrupted. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Denial of service in Intel(R) NPU Driver affects all versions via an improper conditions check (CWE-754) reachable from Ring 3 (user applications). A locally authenticated, low-privileged user can trigger the flaw without any special attack prerequisites or user interaction, resulting in high availability impact to the vulnerable system. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, the low complexity of exploitation combined with the growing deployment of NPU-equipped Intel platforms warrants prompt patching.
Denial of service in Intel PROSet/Wireless WiFi Software device drivers (Ring 2) allows an unauthenticated adjacent-network attacker to crash or disable the wireless subsystem on affected systems. The flaw stems from an improper conditions check (CWE-754) within the WiFi driver stack, meaning edge-case or malformed network input is not handled safely, leading to complete availability loss of the vulnerable system. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the low-complexity, zero-privilege attack vector makes this straightforward to trigger from WiFi range.