Monthly
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Fork-controlled workflow code execution is possible in Gitea (through 1.27.3) when Actions is enabled and a repository runs a shared run-level concurrency group: an attacker who can open a fork pull request plants workflow content in an approval-gated run, a sibling run in the same concurrency group cancels the blocked job and drives the run terminal while it still carries the approval flag, and a later maintainer approval re-queues the already-cancelled job so a matching runner claims and executes it. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - lower than the 8.8 base figure because the decisive step is a human maintainer approval plus a race against a sibling run and an available accepting runner - and no public exploit code has been identified at time of analysis. No public exploit identified at time of analysis; EPSS is 0.16% (4th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total.
Improper enforcement of the marketplace settlement workflow in Klever-Go prior to 1.7.20 lets an authenticated seller settle a resting-bid NFT auction through the Claim seller-accept branch while leaving the claimed order loadable with a future EndTime and stale CurrentBid/CurrentBidder values. A later bidder can then submit a higher bid, be debited, and trigger a refund to the previous bidder even though the NFT has already been delivered, while Claim and CancelOrder both reject that bidder because IsClaimed is true - leaving them unable to obtain the NFT or recover their funds. The flaw is purely an integrity/business-logic issue (CWE-841, assessed CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N with no confidentiality or availability impact, matching the vendor's 7.1 CVSS 4.0 rating); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in 1.7.20.
Google Chrome for desktop is affected by a security defect that Google addressed in a stable-channel update published on its Chrome Releases blog; the CVE record itself carries no description, no CVSS vector, and no CWE identifier, so the precise impact, attack vector, and required privilege level cannot be determined from available data. Because the affected component is a desktop browser, exploitation would most plausibly require the victim to browse attacker-controlled or compromised web content, but that is an inference from product type rather than from the CVE record. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data.
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated low-privilege user on the management plane drive the product's API with out-of-order or state-skipping requests that defeat intended workflow checks, with possible data tampering, denial of service, and information disclosure. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus the ability to craft non-sequential workflow calls, and SSVC records Exploitation as 'none' and Automatable as 'no', so there is no public exploit identified at time of analysis. EPSS is low at 0.31% (24th percentile), and our independent assessment rates the practical severity below the vendor's 8.8 because the assessed vector is AC:H with only low confidentiality, integrity, and availability impact.
strongSwan 5.9.7 through versions prior to 6.1.0 lets unauthenticated network attackers drive an IKEv2 responder running charon/libcharon into creating a Child Security Association before the IKE authentication exchange has completed, giving low-level impacts to confidentiality, integrity and availability (CVSS 3.1 base 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Reachability over UDP 500/4500 is what drives the score rather than severe impact, and there is a public advisory but no public exploit identified at time of analysis; EPSS is 0.34% (27th percentile), indicating low near-term exploitation likelihood. The vendor-released patch is strongSwan 6.1.0, published alongside a September 2026 batch of unrelated strongSwan fixes (CVE-2026-78123, -78124, -78126, -78127, -78129 through -78131).
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.
Unauthenticated remote attackers who can reach a Windows DNS Server over UDP/TCP 53 can drive the service into a denial-of-service state on affected Windows Server 2012 through 2025 (including Server Core) and Windows 10 1607/1809 builds. The defect is a workflow/state-enforcement logic flaw rather than memory corruption, and the assessed impact is availability-only (C:N/I:N/A:H), which produces the CVSS 3.1 base score of 7.5 with PR:N, AC:L and UI:N. No public exploit identified at time of analysis, and CISA's SSVC rates exploitation as none while marking the issue automatable, so it is a credible but second-tier priority; Microsoft has released fixes in the monthly Windows security update.
Fork-controlled workflow code execution is possible in Gitea (through 1.27.3) when Actions is enabled and a repository runs a shared run-level concurrency group: an attacker who can open a fork pull request plants workflow content in an approval-gated run, a sibling run in the same concurrency group cancels the blocked job and drives the run terminal while it still carries the approval flag, and a later maintainer approval re-queues the already-cancelled job so a matching runner claims and executes it. The independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H - lower than the 8.8 base figure because the decisive step is a human maintainer approval plus a race against a sibling run and an available accepting runner - and no public exploit code has been identified at time of analysis. No public exploit identified at time of analysis; EPSS is 0.16% (4th percentile) and CISA SSVC records Exploitation: none, Automatable: no, Technical Impact: total.
Improper enforcement of the marketplace settlement workflow in Klever-Go prior to 1.7.20 lets an authenticated seller settle a resting-bid NFT auction through the Claim seller-accept branch while leaving the claimed order loadable with a future EndTime and stale CurrentBid/CurrentBidder values. A later bidder can then submit a higher bid, be debited, and trigger a refund to the previous bidder even though the NFT has already been delivered, while Claim and CancelOrder both reject that bidder because IsClaimed is true - leaving them unable to obtain the NFT or recover their funds. The flaw is purely an integrity/business-logic issue (CWE-841, assessed CVSS:3.1 7.1, AV:N/AC:L/PR:L/UI:N with no confidentiality or availability impact, matching the vendor's 7.1 CVSS 4.0 rating); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor fix is available in 1.7.20.
Google Chrome for desktop is affected by a security defect that Google addressed in a stable-channel update published on its Chrome Releases blog; the CVE record itself carries no description, no CVSS vector, and no CWE identifier, so the precise impact, attack vector, and required privilege level cannot be determined from available data. Because the affected component is a desktop browser, exploitation would most plausibly require the victim to browse attacker-controlled or compromised web content, but that is an inference from product type rather than from the CVE record. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data.
Improper enforcement of the behavioral workflow in NVIDIA Infrastructure Controller for Linux (versions 0 through 1.9) lets an authenticated low-privilege user on the management plane drive the product's API with out-of-order or state-skipping requests that defeat intended workflow checks, with possible data tampering, denial of service, and information disclosure. Exploitation is not remote-unauthenticated: it requires a valid low-privilege account plus the ability to craft non-sequential workflow calls, and SSVC records Exploitation as 'none' and Automatable as 'no', so there is no public exploit identified at time of analysis. EPSS is low at 0.31% (24th percentile), and our independent assessment rates the practical severity below the vendor's 8.8 because the assessed vector is AC:H with only low confidentiality, integrity, and availability impact.
strongSwan 5.9.7 through versions prior to 6.1.0 lets unauthenticated network attackers drive an IKEv2 responder running charon/libcharon into creating a Child Security Association before the IKE authentication exchange has completed, giving low-level impacts to confidentiality, integrity and availability (CVSS 3.1 base 7.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Reachability over UDP 500/4500 is what drives the score rather than severe impact, and there is a public advisory but no public exploit identified at time of analysis; EPSS is 0.34% (27th percentile), indicating low near-term exploitation likelihood. The vendor-released patch is strongSwan 6.1.0, published alongside a September 2026 batch of unrelated strongSwan fixes (CVE-2026-78123, -78124, -78126, -78127, -78129 through -78131).
SSH authentication bypass in MikroTik RouterOS allows any unauthenticated network attacker to skip the entire SSH user-authentication phase by triggering a client-requested rekey, causing the server to advance directly into the connection protocol and accept session channel and exec requests. The result is unauthenticated file creation, overwrite, and exfiltration within the RouterOS managed file namespace - including support bundles containing configuration and diagnostic data. Publicly available exploit code exists, CERT-PL has published dedicated research, and a companion CERT-PL post titled 'vulnerabilities-in-mikrotik-routeros-actively-exploited' suggests observed exploitation in the wild, though CISA KEV listing is not confirmed in the available data.
Token minting without source debit in klever-go's percentage-transfer royalty path (`processPercentageRoyaltiesTransfer`) allows an asset owner who configures a 100% split royalty to cause the blockchain to credit the full royalty amount to an attacker-controlled address on every subsequent transfer by any holder, while the sender debit is silently skipped due to an early-return guard placed before the collection call. The exploit fires automatically on third-party transfers once the asset is configured, enabling unbounded off-books token inflation. A full Go unit test and on-chain transaction trace confirming the mint are publicly available; no CISA KEV listing exists, but the patch's inclusion of a hardcoded freeze list for six specific Klever mainnet addresses strongly implies active exploitation occurred prior to the fix.
Team membership disruption in Kimai before 2.63.0 allows authenticated teamleads to permanently strip all members from any team they can edit by exploiting a non-atomic delete-before-validate workflow in the PATCH /api/teams/{id} endpoint. The endpoint deletes all existing member rows before completing validation of the replacement list; when a malformed payload triggers a validation error, the deletion is not rolled back, leaving teams with no members or teamleaders and collapsing team-based access control. No public exploit has been identified and active exploitation is not confirmed by CISA KEV, but the CVSS 4.0 score of 8.7 and low-privilege attack vector make this a credible insider or compromised-account threat.
Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.