Monthly
Unauthenticated remote requests can crash Go services that embed kin-openapi before 0.148.0: posting a YAML body containing .nan, .inf, or -.inf to an OpenAPI 3.1 operation carrying a numeric constraint drives the bundled santhosh-tekuri/jsonschema v6.0.2 into a nil big.Rat dereference, panicking inside ValidateRequest. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), reflecting availability-only impact: a standard net/http server recovers the panic per connection so the effect is usually a single dropped request, while non-net/http hosts or panics raised in application goroutines can terminate the process. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the need to reach an OAS 3.1 spec, accept application/yaml (or application/x-yaml), and hit an operation with a numeric constraint keeps this a genuine but bounded denial-of-service issue.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Arbitrary code execution confined to the renderer sandbox in Google Chrome builds prior to 155.0.8059.39, reachable when a user opens a crafted HTML page that drives the DevTools state-validation path into an inconsistent state. The flaw is network-delivered and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but exploitation is gated by mandatory user interaction (UI:R), which is why CISA's SSVC decision framework rates it as not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis; Google rates the Chromium severity as High and has shipped a fixed build, so the practical exposure is limited to unpatched clients that have not yet received the auto-update.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or compromised broker - or anyone positioned to modify broker traffic - send a table field carrying a longstr whose declared length exceeds 0x7FFFFFFF; the client accepts it silently instead of returning ErrSyntax, leaves the declared bytes unread, and then parses every following field and frame from the wrong offset. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, i.e. unauthenticated remote input that can corrupt parsing integrity and disrupt connection availability, but with high attack complexity because the victim application must first connect to an attacker-controlled or subverted broker (or be subject to a man-in-the-middle on that connection), and with no confidentiality impact since the Go library is memory-safe and this is a logic-level desynchronization rather than memory corruption. Vendor-released patch v1.13.0 fixes the defect; no public exploit code identified at time of analysis, and the vendor's CVSS 4.0 score of 9.5 with full High subsequent-system impact overstates real-world risk.
Improper state validation in the Skia graphics library, as shipped in Google Chrome prior to 153.0.8010.47, lets an attacker who already controls a compromised renderer process read memory outside the browser sandbox by serving a crafted HTML page. Exploitation requires the victim to load the malicious page (UI:R) and depends on chaining with a separate renderer compromise, which is why the vector carries AC:H despite the network attack path. Vendor status is "Patch available"; no public exploit code and no CISA KEV listing were present in the supplied intelligence, so the flaw should be treated as a sandbox-escape primitive rather than an observed, widely exploited issue.
Authorization bypass in Zalando Skipper's `opaAuthorizeRequestWithBody` filter allows unauthenticated remote attackers to deliver forbidden request bodies to upstream services by inflating the declared `Content-Length` beyond the configured OPA body-size limit. When a body exceeds `-open-policy-agent-max-request-body-size` (default 1 MB), `ExtractHttpBodyOptionally` skips body extraction and returns nil bytes to OPA, causing deny-on-presence Rego policies to evaluate an empty `parsed_body` and fail open, while the complete forbidden payload is still forwarded upstream unchanged. This is an incomplete remediation of CVE-2026-50197 - the prior fix addressed only chunked/HTTP-2 requests with negative `Content-Length`; the oversized `Content-Length` path was never considered. No public exploit has been identified at time of analysis, though the GHSA advisory includes a working reproduction harness.
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.
Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.
Improper state validation in Google Chrome's Performance component (all versions prior to 152.0.7977.65) enables remote attackers to read memory contents within the Chrome sandbox by luring a user to a crafted HTML page. The scope is contained to the sandbox (S:U), limiting blast radius to in-process data, but sensitive browser state such as cookies, session tokens, or page content may be exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.22% (13th percentile) corroborates low observed exploitation activity.
Unauthenticated remote requests can crash Go services that embed kin-openapi before 0.148.0: posting a YAML body containing .nan, .inf, or -.inf to an OpenAPI 3.1 operation carrying a numeric constraint drives the bundled santhosh-tekuri/jsonschema v6.0.2 into a nil big.Rat dereference, panicking inside ValidateRequest. The assessed CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), reflecting availability-only impact: a standard net/http server recovers the panic per connection so the effect is usually a single dropped request, while non-net/http hosts or panics raised in application goroutines can terminate the process. No public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation; the need to reach an OAS 3.1 spec, accept application/yaml (or application/x-yaml), and hit an operation with a numeric constraint keeps this a genuine but bounded denial-of-service issue.
Denial of service in Juniper Networks Junos OS on MX Series routers equipped with SPC3 services line cards and configured for source NAT: the Packet Forwarding Engine fails to drop a specific malformed IPv6 packet and instead creates a session and allocates NAT resources, so sustained delivery of such packets exhausts the session/NAT pool and disrupts all traffic through the device until it is rebooted. The issue is remotely reachable and unauthenticated (no credentials and no user interaction required), and availability-only - there is no path to code execution or data disclosure. Exploitation is constrained by two non-default prerequisites, namely SPC3 hardware and an active source NAT configuration, and no public exploit code has been identified at time of analysis; impact is limited to the affected device profile, so this is a targeted operational-availability risk rather than a universal emergency.
Arbitrary code execution confined to the renderer sandbox in Google Chrome builds prior to 155.0.8059.39, reachable when a user opens a crafted HTML page that drives the DevTools state-validation path into an inconsistent state. The flaw is network-delivered and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but exploitation is gated by mandatory user interaction (UI:R), which is why CISA's SSVC decision framework rates it as not automatable. No public exploit code and no confirmed active exploitation were identified at time of analysis; Google rates the Chromium severity as High and has shipped a fixed build, so the practical exposure is limited to unpatched clients that have not yet received the auto-update.
Authenticated users with any valid account on Anjvision YSSD-RTMP-H5 firmware 3.3.2.4 can silently reset the administrator password back to its default value and corrupt the device's in-memory authentication state by sending an empty-body HTTP POST to the /setUserConfig endpoint, which the web server routes through its SOAP-RPC handler without ever checking the caller's privilege level. Because the handler trusts any authenticated session as administrative, a low-privileged account is effectively sufficient to seize administrative control and to cause an availability impact on the device; only a device reload clears the corrupted state. Exploitation requires a valid account on the web interface (PR:L per the CVSS 4.0 vector and our independent CVSS 3.1 assessment of AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), and no public exploit code or active exploitation has been identified at time of analysis - the issue was surfaced through CISA ICS advisory ICSA-26-272-05 rather than through observed attacks.
Parsing desynchronization in the RabbitMQ amqp091-go AMQP 0.9.1 client library before 1.13.0 lets a malicious or compromised broker - or anyone positioned to modify broker traffic - send a table field carrying a longstr whose declared length exceeds 0x7FFFFFFF; the client accepts it silently instead of returning ErrSyntax, leaves the declared bytes unread, and then parses every following field and frame from the wrong offset. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H, i.e. unauthenticated remote input that can corrupt parsing integrity and disrupt connection availability, but with high attack complexity because the victim application must first connect to an attacker-controlled or subverted broker (or be subject to a man-in-the-middle on that connection), and with no confidentiality impact since the Go library is memory-safe and this is a logic-level desynchronization rather than memory corruption. Vendor-released patch v1.13.0 fixes the defect; no public exploit code identified at time of analysis, and the vendor's CVSS 4.0 score of 9.5 with full High subsequent-system impact overstates real-world risk.
Improper state validation in the Skia graphics library, as shipped in Google Chrome prior to 153.0.8010.47, lets an attacker who already controls a compromised renderer process read memory outside the browser sandbox by serving a crafted HTML page. Exploitation requires the victim to load the malicious page (UI:R) and depends on chaining with a separate renderer compromise, which is why the vector carries AC:H despite the network attack path. Vendor status is "Patch available"; no public exploit code and no CISA KEV listing were present in the supplied intelligence, so the flaw should be treated as a sandbox-escape primitive rather than an observed, widely exploited issue.
Authorization bypass in Zalando Skipper's `opaAuthorizeRequestWithBody` filter allows unauthenticated remote attackers to deliver forbidden request bodies to upstream services by inflating the declared `Content-Length` beyond the configured OPA body-size limit. When a body exceeds `-open-policy-agent-max-request-body-size` (default 1 MB), `ExtractHttpBodyOptionally` skips body extraction and returns nil bytes to OPA, causing deny-on-presence Rego policies to evaluate an empty `parsed_body` and fail open, while the complete forbidden payload is still forwarded upstream unchanged. This is an incomplete remediation of CVE-2026-50197 - the prior fix addressed only chunked/HTTP-2 requests with negative `Content-Length`; the oversized `Content-Length` path was never considered. No public exploit has been identified at time of analysis, though the GHSA advisory includes a working reproduction harness.
Unauthenticated payment event forgery in XenForo before 2.3.13 stems from a logic error in the PayPal REST webhook signature verification routine: when the incoming `auth_algo` header value cannot be mapped to a supported hash function, the verification function incorrectly returns `true`, causing the application to accept fabricated webhook payloads as legitimate PayPal events. Any XenForo installation with PayPal REST payment integration enabled prior to version 2.3.13 is affected. No public exploit code has been identified at time of analysis, but the vulnerability is trivially exploitable against the webhook endpoint by any network-accessible attacker.
Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.
Improper state validation in Google Chrome's Performance component (all versions prior to 152.0.7977.65) enables remote attackers to read memory contents within the Chrome sandbox by luring a user to a crafted HTML page. The scope is contained to the sandbox (S:U), limiting blast radius to in-process data, but sensitive browser state such as cookies, session tokens, or page content may be exposed. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.22% (13th percentile) corroborates low observed exploitation activity.