Authentication Bypass
Monthly
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.
Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.
Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.
ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.
Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.
Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
Navigation restriction bypass in the Glic component of Google Chrome for Android (versions prior to 151.0.7922.72) allows unauthenticated remote attackers to circumvent browser policy enforcement by directing victims to a crafted HTML page. The integrity-only impact (I:H) reflects the ability to navigate users past enforced restrictions, though confidentiality and availability are unaffected. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and the vulnerability is not listed in CISA KEV - vendor-released patch is available in Chrome 151.0.7922.72.
Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Same-origin policy bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows an unauthenticated remote attacker to perform unauthorized cross-origin write operations against a victim's browser context. Exploitation requires the victim to visit a specially crafted HTML page (UI:R), making it a socially-engineered threat rather than a purely opportunistic one. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing or public exploit code has been identified, consistent with the Chromium team's own 'Medium' severity rating; however, Chrome's ubiquitous deployment makes even medium-severity findings broadly relevant.
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables a crafted extension to bypass same-origin policy protections and read data from cross-origin browser contexts. Exploitation requires convincing a target user to install a malicious Chrome Extension, placing this firmly in the social-engineering-dependent threat category. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and an EPSS of 0.13% at the 3rd percentile reflects minimal real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.
Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.
Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.
Same Origin Policy bypass in Google Chrome's FedCM (Federated Credential Management) subsystem prior to version 151.0.7922.72 enables remote attackers to achieve high-integrity cross-origin impact by luring victims to a crafted HTML page. The flaw stems from an inappropriate implementation in the FedCM API, which fails to enforce origin boundaries correctly (CWE-693). No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability despite the network-accessible attack vector.
Navigation restriction bypass in Google Chrome's Presentation component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent enforced browser navigation policies via a specially crafted HTML page. The flaw carries a high integrity impact (I:H) with no privilege requirement on the attacker's side, though victim interaction is mandatory. EPSS sits at 0.22% (13th percentile) and SSVC classifies exploitation as 'none' with a non-automatable profile, placing this in the patch-but-not-emergency tier for most organizations. No public exploit code identified at time of analysis.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to violate cross-origin isolation boundaries by luring a user to visit a specially crafted HTML page. The CVSS vector assigns High integrity impact with no privilege requirement, meaning successful exploitation could enable an attacker to inject or manipulate cross-origin content within the victim's browser session. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), with SSVC confirming no observed exploitation - placing this in the patch-on-schedule rather than emergency-response tier.
Site isolation bypass in Google Chrome's Extensions subsystem before version 151.0.7922.72 allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page, enabling access to or modification of data from other loaded origins. This is a chained exploit primitive - it depends on prior renderer compromise - making it a significant escalation step rather than a standalone entry point. No public exploit code has been identified and CISA SSVC rates exploitation status as none, consistent with the low EPSS score of 0.22% (13th percentile).
Same-origin policy bypass in Google Chrome's ControlledFrame component prior to version 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to an unsuspecting user. The root cause is insufficient policy enforcement (CWE-346) within the ControlledFrame API, allowing an attacker to subvert origin boundaries and achieve high-integrity cross-origin impact. No active exploitation is confirmed - CISA KEV is not triggered, SSVC reports exploitation as none, and EPSS sits at a low 0.22% (13th percentile) - indicating this is a meaningful but currently theoretical browser integrity risk.
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.
Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Authorization bypass in OliveTin's synchronous action execution endpoints exposes full command log output to users holding exec permission but explicitly denied logs access. Versions prior to 3000.17.0 of this Go-based web shell interface are affected; the StartActionAndWait and StartActionByGetAndWait handlers return a complete LogEntry without invoking the isLogEntryAllowed ACL check that governs log visibility elsewhere in the application. No public exploit code exists and no CISA KEV listing is associated with this issue, placing real-world exploitation risk in context with the required authenticated access.
Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
GitLab CE/EE permits an authenticated developer-role user who has been removed from a project to continue committing code changes by exploiting improper authorization checks on merge request collaboration settings (CWE-863). The flaw spans a massive version range from 10.6 through 19.2.0, affecting both Community and Enterprise editions. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists on HackerOne, and the issue has been patched in 19.0.5, 19.1.3, and 19.2.1.
Improper access control in GitLab CE/EE exposes CI/CD test report contents to authenticated users holding only guest-role permissions, allowing unauthorized read access to data from projects they should not be able to view. Affected versions span 18.4 through pre-19.0.5, 19.1 through pre-19.1.3, and 19.2 through pre-19.2.1. Publicly available exploit code exists via a disclosed HackerOne report, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Information disclosure in GitLab CE/EE (all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an authenticated user holding only the Developer role to reach unauthorized information because internal request handling enforces insufficient access controls (CWE-201). Publicly available exploit code exists (referenced HackerOne report #3658324), but there is no public exploit identified as being used in active attacks. With a CVSS of 8.5 driven by a scope-changing confidentiality impact, this is a meaningful privilege/authorization boundary failure rather than a full remote code execution flaw.
Unauthorized disclosure of project import source information in GitLab CE/EE stems from a missing authorization check (CWE-863), allowing unauthenticated remote users to view sensitive metadata about how a project was originally imported. All GitLab installations running versions from 16.6 up to 19.0.4, 19.1.2, and 19.2.0 are affected. A publicly available exploit exists via a disclosed HackerOne report, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Improper authorization in a GitLab CE/EE projects API endpoint allows an authenticated user holding the Maintainer role to modify protected branch configurations beyond what their role should permit, across all versions from 12.8 through 19.2.0. Maintainer-role users - commonly assigned in enterprise GitLab deployments - can exploit this to weaken or remove branch protection rules that enforce code review gates and direct-push restrictions. A publicly available exploit exists via HackerOne report 3807593; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the POC materially lowers the bar for exploitation.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Rate-limit bypass in @fastify/rate-limit before 11.2.0 lets IPv6-capable clients defeat request throttling by rotating source addresses across a controlled /64 range or by re-encoding the same address in different textual forms, because buckets are keyed on the verbatim request.ip string. Applications relying on this plugin to protect authentication, password-reset, OTP, or expensive API endpoints can be brute-forced or abused when trustProxy is enabled and IPv6 reaches the origin. No public exploit identified at time of analysis; the flaw is fixed in 11.2.0 via IPv6 canonicalization and a default /64 prefix mask.
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints `/config/<parent_dhash>` and `/blob/<parent_dhash>` silently accept an undocumented POST method that carries none of the `adding_configs` or `adding_blobs` capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
The Node.js permission model fails to validate the final resolved output path when generating diagnostic reports via process.report, allowing a local low-privileged attacker to write report files to filesystem locations outside the paths explicitly permitted by the --allow-fs-write flag. Affected are Node.js 26.x through 26.5.0, 24.x through 24.18.0, and 22.x through 22.23.1 (confirmed via EUVD-2026-51369). No public exploit code exists and no active exploitation has been confirmed; the fix is available in Node.js 26.5.1 released 2026-07-29.
Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.
Account takeover in Ente Museum Server versions through 2.0.34 is achievable by an authenticated user designated as a victim's emergency contact, bypassing the configured recovery waiting period via a crafted `approve-recovery` API request. The vulnerability requires a pre-established trust relationship - the attacker must already be configured as the victim's emergency contact - which limits opportunistic mass exploitation, consistent with the low EPSS score of 0.17%. Security researcher VokeCyber has published a public technical writeup and blog post detailing the attack; no confirmed active exploitation or KEV listing exists at time of analysis.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected `kr_mr_store_settings()` function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.
Missing authorization in Keycloak's administrative API allows a scoped administrator to exceed their privilege boundary by linking identity providers to organizations they are not authorized to manage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat products. An administrator who holds identity provider management permissions but lacks organization management rights can silently reconfigure authentication flows for organizations outside their administrative scope, potentially redirecting user logins through attacker-controlled providers. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Client policy enforcement in Keycloak is bypassable by any user holding client management privileges who exploits a group-name collision across the group hierarchy. Because the policy engine resolves group membership by display name rather than unique identifier, an attacker can create or join a group in a different part of the hierarchy that shares a name with a privileged policy group, then register or update OAuth/OIDC clients without satisfying the required security hardening profiles. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.
Information disclosure in Koollab LMS allows authenticated users to access other users' course completion data without authorization. The vulnerability
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrator accounts, by supplying a valid user UUID to the 2FA validation endpoint without providing primary credentials. Affected version 5.3.2 (and potentially earlier versions) exposes sensitive data and permits limited modification once an account is compromised. No active exploitation or public exploit code is known at the time of analysis.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Koollab LMS 5.3.2 allows unauthenticated remote attackers to access sensitive user data (name, internal identifier, scores, lesson status, position, and cached state) via the SCORM API due to improper access controls. No exploit code or active exploitation is known, and the base CVSS score of 3.7 reflects low impact.
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny service to any user by knowing their email address. The vulnerability, assigned a low CVSS score of 3.7, does not compromise data but can disrupt user sessions. No active exploitation or public proof-of-concept has been reported at the time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Order integrity bypass in the PayU CommercePro Plugin for WordPress (versions through 3.8.9) enables unauthenticated remote attackers to tamper with WooCommerce order totals, shipping details, and metadata without paying the correct amount. The plugin processes payment-gateway callbacks without verifying the cryptographic signature that PayU issues, meaning any HTTP client can forge a callback and manipulate arbitrary orders. A publicly available proof-of-concept exploit exists per WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Authenticated authorization bypass in Event Booking Manager for WooCommerce ≤5.3.7 allows contributor-level users to modify site‑wide WooCommerce payment settings - including enabling/disabling payments, altering cart redirects, login requirements, confirmation pages, and ticket statuses - undermining booking integrity and checkout flows. No active exploitation or public exploit is currently reported.
Unauthorized disclosure of employee compensation data affects Infor Global HR v11.24.10.01.33, where the Employee Compensation View function fails to verify that the requesting user owns the record being retrieved. By altering an identifier in a crafted GET request, an attacker can enumerate and read the salary and compensation details of arbitrary employees. There is no public exploit identified at time of analysis, though a third-party technical writeup describing the issue is referenced.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Authentication bypass in Cosmos-Server 0.22.18 and earlier allows any holder of a valid Constellation device API key to impersonate any user (including admin) to backend applications by sending crafted x-cosmos-user headers. The tokenMiddleware prematurely returns before stripping these headers when the request originates from the Constellation tunnel, bypassing JWT authentication, MFA, and the AdminOnly access gate. Publicly available exploit code exists but no active exploitation has been reported.
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.
Improper access control in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privilege users to view sensitive data restricted to privileged users. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) and affects specific version ranges of both products. No public exploit or active exploitation has been identified, and IBM has released a patch.
Archive of any chat room without authorization in Let's Chat 0.3.0–0.4.8 allows any authenticated user to permanently remove private or password-protected rooms by sending DELETE requests. Room IDs can be enumerated via the rooms listing endpoint, and recovery requires direct database manipulation. A proof-of-concept exploit exists.
Unauthorized file disclosure in Let's Chat 0.3.0 through 0.4.8 allows authenticated attackers to download file attachments from any room, including private and password-protected rooms, by exploiting missing room membership checks in the file retrieval endpoint. Attackers can enumerate likely MongoDB ObjectIds to recover files uploaded by other users, effectively bypassing all room-level access restrictions. No public exploit identified at time of analysis, but the issue is trivially exploitable due to the absence of proper authorization checks.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.
Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.
Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.
Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.
Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.
Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.
ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.
Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.
Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.
Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.
Navigation restriction bypass in the Glic component of Google Chrome for Android (versions prior to 151.0.7922.72) allows unauthenticated remote attackers to circumvent browser policy enforcement by directing victims to a crafted HTML page. The integrity-only impact (I:H) reflects the ability to navigate users past enforced restrictions, though confidentiality and availability are unaffected. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and the vulnerability is not listed in CISA KEV - vendor-released patch is available in Chrome 151.0.7922.72.
Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.
Same-origin policy bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows an unauthenticated remote attacker to perform unauthorized cross-origin write operations against a victim's browser context. Exploitation requires the victim to visit a specially crafted HTML page (UI:R), making it a socially-engineered threat rather than a purely opportunistic one. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing or public exploit code has been identified, consistent with the Chromium team's own 'Medium' severity rating; however, Chrome's ubiquitous deployment makes even medium-severity findings broadly relevant.
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables a crafted extension to bypass same-origin policy protections and read data from cross-origin browser contexts. Exploitation requires convincing a target user to install a malicious Chrome Extension, placing this firmly in the social-engineering-dependent threat category. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and an EPSS of 0.13% at the 3rd percentile reflects minimal real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.
Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.
Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.
Same Origin Policy bypass in Google Chrome's FedCM (Federated Credential Management) subsystem prior to version 151.0.7922.72 enables remote attackers to achieve high-integrity cross-origin impact by luring victims to a crafted HTML page. The flaw stems from an inappropriate implementation in the FedCM API, which fails to enforce origin boundaries correctly (CWE-693). No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability despite the network-accessible attack vector.
Navigation restriction bypass in Google Chrome's Presentation component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent enforced browser navigation policies via a specially crafted HTML page. The flaw carries a high integrity impact (I:H) with no privilege requirement on the attacker's side, though victim interaction is mandatory. EPSS sits at 0.22% (13th percentile) and SSVC classifies exploitation as 'none' with a non-automatable profile, placing this in the patch-but-not-emergency tier for most organizations. No public exploit code identified at time of analysis.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to violate cross-origin isolation boundaries by luring a user to visit a specially crafted HTML page. The CVSS vector assigns High integrity impact with no privilege requirement, meaning successful exploitation could enable an attacker to inject or manipulate cross-origin content within the victim's browser session. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), with SSVC confirming no observed exploitation - placing this in the patch-on-schedule rather than emergency-response tier.
Site isolation bypass in Google Chrome's Extensions subsystem before version 151.0.7922.72 allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page, enabling access to or modification of data from other loaded origins. This is a chained exploit primitive - it depends on prior renderer compromise - making it a significant escalation step rather than a standalone entry point. No public exploit code has been identified and CISA SSVC rates exploitation status as none, consistent with the low EPSS score of 0.22% (13th percentile).
Same-origin policy bypass in Google Chrome's ControlledFrame component prior to version 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to an unsuspecting user. The root cause is insufficient policy enforcement (CWE-346) within the ControlledFrame API, allowing an attacker to subvert origin boundaries and achieve high-integrity cross-origin impact. No active exploitation is confirmed - CISA KEV is not triggered, SSVC reports exploitation as none, and EPSS sits at a low 0.22% (13th percentile) - indicating this is a meaningful but currently theoretical browser integrity risk.
Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.
Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.
Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.
Authorization bypass in OliveTin's synchronous action execution endpoints exposes full command log output to users holding exec permission but explicitly denied logs access. Versions prior to 3000.17.0 of this Go-based web shell interface are affected; the StartActionAndWait and StartActionByGetAndWait handlers return a complete LogEntry without invoking the isLogEntryAllowed ACL check that governs log visibility elsewhere in the application. No public exploit code exists and no CISA KEV listing is associated with this issue, placing real-world exploitation risk in context with the required authenticated access.
Authentication bypass on the Autel MaxiCharger AC Elite Home EV charger allows physically present attackers to access device functionality without credentials via the exposed USB interface. The CWE-306 flaw represents a complete absence of authentication on the USB attack surface, not a weak implementation - any USB-connected party is immediately granted access. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis; real-world risk is bounded by the physical access prerequisite inherent to the AV:P vector.
Tool call injection in Pydantic AI's UI adapters (AG-UI via Agent.to_ag_ui()/AGUIAdapter, and Vercel AI via VercelAIAdapter) enables remote unauthenticated clients to force execution of registered server-side tools with attacker-supplied arguments, bypassing the framework's message-sanitization defense. The flaw affects pydantic-ai and pydantic-ai-slim versions 1.88.0-1.107.0 and 2.0.0b1-2.4.x. No public exploit code or CISA KEV listing exists at time of analysis, but the attack is low-complexity and exploitable against default configurations of applications using either UI adapter.
GitLab CE/EE permits an authenticated developer-role user who has been removed from a project to continue committing code changes by exploiting improper authorization checks on merge request collaboration settings (CWE-863). The flaw spans a massive version range from 10.6 through 19.2.0, affecting both Community and Enterprise editions. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists on HackerOne, and the issue has been patched in 19.0.5, 19.1.3, and 19.2.1.
Improper access control in GitLab CE/EE exposes CI/CD test report contents to authenticated users holding only guest-role permissions, allowing unauthorized read access to data from projects they should not be able to view. Affected versions span 18.4 through pre-19.0.5, 19.1 through pre-19.1.3, and 19.2 through pre-19.2.1. Publicly available exploit code exists via a disclosed HackerOne report, though no active exploitation has been confirmed by CISA KEV at time of analysis.
Information disclosure in GitLab CE/EE (all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1) allows an authenticated user holding only the Developer role to reach unauthorized information because internal request handling enforces insufficient access controls (CWE-201). Publicly available exploit code exists (referenced HackerOne report #3658324), but there is no public exploit identified as being used in active attacks. With a CVSS of 8.5 driven by a scope-changing confidentiality impact, this is a meaningful privilege/authorization boundary failure rather than a full remote code execution flaw.
Unauthorized disclosure of project import source information in GitLab CE/EE stems from a missing authorization check (CWE-863), allowing unauthenticated remote users to view sensitive metadata about how a project was originally imported. All GitLab installations running versions from 16.6 up to 19.0.4, 19.1.2, and 19.2.0 are affected. A publicly available exploit exists via a disclosed HackerOne report, though no confirmed active exploitation (CISA KEV) has been recorded at time of analysis.
Improper authorization in a GitLab CE/EE projects API endpoint allows an authenticated user holding the Maintainer role to modify protected branch configurations beyond what their role should permit, across all versions from 12.8 through 19.2.0. Maintainer-role users - commonly assigned in enterprise GitLab deployments - can exploit this to weaken or remove branch protection rules that enforce code review gates and direct-push restrictions. A publicly available exploit exists via HackerOne report 3807593; no confirmed active exploitation (CISA KEV) has been identified at time of analysis, though the POC materially lowers the bar for exploitation.
Information disclosure in GitLab Enterprise Edition's AI-assisted code review feature allows authenticated users to access data from projects they are not authorized to view. Affected versions are 19.1.x before 19.1.3 and 19.2.x before 19.2.1. An attacker with any level of authenticated access can craft malicious code content that, when processed by the AI review engine, causes the model to return information from unauthorized projects - a classic prompt injection boundary-crossing attack. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog.
Improper authorization enforcement during token generation in GitLab Enterprise Edition allows an authenticated low-privilege user to bypass administrator-configured tool governance policies. Affected are all GitLab EE installations running 19.1 before 19.1.3 and 19.2 before 19.2.1. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the network-accessible, low-privilege attack vector makes this a realistic insider threat in enterprises relying on GitLab EE's governance controls.
JWT malleability in joserfc versions 1.7.1 and prior allows a low-privileged user holding a valid token to craft alternate byte-distinct representations by exploiting the library's acceptance of non-conforming trailing Base64 padding (==), which violates the JOSE specification. Applications using deny-list-based token revocation or anti-replay protection are at risk of bypass, since a padding-modified token hashes to a different value that will not match the stored revoked-token record. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; the vendor-released fix is joserfc 1.7.2.
Rate-limit bypass in @fastify/rate-limit before 11.2.0 lets IPv6-capable clients defeat request throttling by rotating source addresses across a controlled /64 range or by re-encoding the same address in different textual forms, because buckets are keyed on the verbatim request.ip string. Applications relying on this plugin to protect authentication, password-reset, OTP, or expensive API endpoints can be brute-forced or abused when trustProxy is enabled and IPv6 reaches the origin. No public exploit identified at time of analysis; the flaw is fixed in 11.2.0 via IPv6 canonicalization and a default /64 prefix mask.
Missing authorization in MWDB Core versions 2.0.0 through 2.18.x allows any authenticated user to bypass capability-based access controls and upload malware configuration and text blob objects they are not permitted to add. The deprecated legacy endpoints `/config/<parent_dhash>` and `/blob/<parent_dhash>` silently accept an undocumented POST method that carries none of the `adding_configs` or `adding_blobs` capability checks enforced on the documented PUT method. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, but the low attack complexity and network accessibility make it a meaningful privilege-boundary bypass in any multi-user MWDB Core deployment. Vendor-released patch v2.19.0 resolves the issue.
HTTPS agent connection pooling in Node.js fails to distinguish PFX credentials when encoded as an object versus an array, enabling authentication bypass under specific mutual-TLS configurations. Affected are Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0. A high-privileged local actor who controls HTTPS agent configuration can induce the runtime to reuse a TLS session authenticated with one PFX credential for a request that should require a different (or no) credential, undermining certificate-based identity verification. No public exploit or CISA KEV listing has been identified at time of analysis.
The Node.js permission model fails to validate the final resolved output path when generating diagnostic reports via process.report, allowing a local low-privileged attacker to write report files to filesystem locations outside the paths explicitly permitted by the --allow-fs-write flag. Affected are Node.js 26.x through 26.5.0, 24.x through 24.18.0, and 22.x through 22.23.1 (confirmed via EUVD-2026-51369). No public exploit code exists and no active exploitation has been confirmed; the fix is available in Node.js 26.5.1 released 2026-07-29.
Payment bypass in Gridbox (Joomla extension by balbooa.com) versions 1.0.0 through 2.20.1 allows unauthenticated remote attackers to circumvent payment enforcement due to improper authorization checks (CWE-285), enabling acquisition of paid content or order completion without payment. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is remotely exploitable with no authentication or user interaction required. No public exploit has been identified at time of analysis, though SSVC designates the attack as automatable with partial technical impact, raising concerns about systematic financial fraud at scale.
Account takeover in Ente Museum Server versions through 2.0.34 is achievable by an authenticated user designated as a victim's emergency contact, bypassing the configured recovery waiting period via a crafted `approve-recovery` API request. The vulnerability requires a pre-established trust relationship - the attacker must already be configured as the victim's emergency contact - which limits opportunistic mass exploitation, consistent with the low EPSS score of 0.17%. Security researcher VokeCyber has published a public technical writeup and blog post detailing the attack; no confirmed active exploitation or KEV listing exists at time of analysis.
Insecure Direct Object Reference in MasterStudy LMS WordPress Plugin (all versions through 3.7.14) allows authenticated Instructors to permanently delete media attachments belonging to any other WordPress user. The `stm_lms_delete_cover()` function accepts a caller-supplied `file_id` and passes it directly to WordPress's `wp_delete_attachment()` without verifying that the requesting user owns the referenced attachment. Because WordPress stores attachments with sequential integer IDs, an Instructor-level account holder can iterate over IDs to destroy course materials, profile images, or uploaded documents created by students, other instructors, or administrators. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated settings hijacking in the Klubraum Membership Request WordPress plugin (versions ≤1.1.0) allows any remote attacker to overwrite the plugin's Klubraum API token and configuration by invoking the unprotected `kr_mr_store_settings()` function. Substituting the API token with an attacker-controlled value effectively redirects club membership request data to an adversary's Klubraum account, constituting full service integration takeover. No public exploit or CISA KEV listing is identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this trivially exploitable against any reachable WordPress installation running the plugin.
Missing authorization in Keycloak's administrative API allows a scoped administrator to exceed their privilege boundary by linking identity providers to organizations they are not authorized to manage. Affected deployments include Red Hat Build of Keycloak, Red Hat Single Sign-On 7, and related Red Hat products. An administrator who holds identity provider management permissions but lacks organization management rights can silently reconfigure authentication flows for organizations outside their administrative scope, potentially redirecting user logins through attacker-controlled providers. No public exploit code exists and this vulnerability is not listed in CISA KEV at time of analysis.
Client policy enforcement in Keycloak is bypassable by any user holding client management privileges who exploits a group-name collision across the group hierarchy. Because the policy engine resolves group membership by display name rather than unique identifier, an attacker can create or join a group in a different part of the hierarchy that shares a name with a privileged policy group, then register or update OAuth/OIDC clients without satisfying the required security hardening profiles. No public exploit has been identified at time of analysis, and active exploitation has not been confirmed by CISA KEV.
Privilege escalation to administrator in the Spreadsheet Price Changer for WooCommerce and WP E-commerce - Light WordPress plugin (all versions through 2.4.37) lets unauthenticated attackers create new admin accounts through the unprotected user_filter function. Because no capability or nonce check gates the routine, any remote visitor can seize full control of the WordPress site, making this a critical site-takeover flaw; no public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Port-based access-control bypass in Apache Traffic Server stems from URL and userinfo mis-parsing that causes the proxy to evaluate ACL rules against an incorrect port value, allowing restricted backend ports to be reached. All three maintained release branches are affected - 8.0.0 through 8.1.9, 9.0.0 through 9.2.14, and 10.0.0 through 10.1.3 - meaning the majority of deployed ATS instances are vulnerable. No public exploit or active exploitation has been identified at time of analysis, but the Changed scope (S:C) in the CVSS vector signals that successful exploitation crosses the proxy-to-backend boundary, amplifying real-world impact beyond the ATS process itself.
Integrity compromise in Koollab LMS allows authenticated learners to falsify lesson completion records via the SCORM commit endpoint without viewing material. Affects version 5.3.2, compromising training and compliance records. No public exploit or active exploitation identified at time of analysis.
Information disclosure in Koollab LMS allows authenticated users to access other users' course completion data without authorization. The vulnerability
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.
An authentication bypass in Koollab LMS allows unauthenticated attackers to take over any account, including administrator accounts, by supplying a valid user UUID to the 2FA validation endpoint without providing primary credentials. Affected version 5.3.2 (and potentially earlier versions) exposes sensitive data and permits limited modification once an account is compromised. No active exploitation or public exploit code is known at the time of analysis.
Two-factor authentication bypass in Koollab LMS allows attackers to supply a client-controlled TOTP seed and generate a valid one-time password, bypassing the second authentication factor. This can lead to unauthorized access to administrator accounts if TOTP is enabled. No public exploit or active exploitation has been identified at time of analysis.
Information disclosure in Koollab LMS 5.3.2 allows unauthenticated remote attackers to access sensitive user data (name, internal identifier, scores, lesson status, position, and cached state) via the SCORM API due to improper access controls. No exploit code or active exploitation is known, and the base CVSS score of 3.7 reflects low impact.
Forced session termination via the login kickout endpoint in Koollab LMS allows unauthenticated attackers to deny service to any user by knowing their email address. The vulnerability, assigned a low CVSS score of 3.7, does not compromise data but can disrupt user sessions. No active exploitation or public proof-of-concept has been reported at the time of analysis.
Easy Appointments WordPress plugin through version 3.12.26 exposes an insecure direct object reference (IDOR) that lets any subscriber-level user overwrite the customer metadata of another user's appointment by reusing a nonce harvested from their own edit form. The shared nonce mechanism provides CSRF protection but no ownership enforcement, so an attacker can target arbitrary appointment IDs without restriction. A publicly available proof-of-concept exists (WPScan), and the vulnerability can be chained into a notification hijack: when an administrator approves an affected appointment with customer notifications enabled, the confirmation email is delivered to the attacker-controlled address rather than the legitimate customer, exposing booking details to an unauthorized party.
Order integrity bypass in the PayU CommercePro Plugin for WordPress (versions through 3.8.9) enables unauthenticated remote attackers to tamper with WooCommerce order totals, shipping details, and metadata without paying the correct amount. The plugin processes payment-gateway callbacks without verifying the cryptographic signature that PayU issues, meaning any HTTP client can forge a callback and manipulate arbitrary orders. A publicly available proof-of-concept exploit exists per WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
The Survey Form Block WordPress plugin up to and including version 1.0.1 lacks a capability check in its get_all_data() AJAX function, enabling authenticated users with minimal Subscriber roles to export entire survey submission datasets and column metadata without authorization. This data exposure vulnerability (CVSS 4.3) is patched by the vendor but has not been observed in active exploitation or public exploits.
Authenticated authorization bypass in Event Booking Manager for WooCommerce ≤5.3.7 allows contributor-level users to modify site‑wide WooCommerce payment settings - including enabling/disabling payments, altering cart redirects, login requirements, confirmation pages, and ticket statuses - undermining booking integrity and checkout flows. No active exploitation or public exploit is currently reported.
Unauthorized disclosure of employee compensation data affects Infor Global HR v11.24.10.01.33, where the Employee Compensation View function fails to verify that the requesting user owns the record being retrieved. By altering an identifier in a crafted GET request, an attacker can enumerate and read the salary and compensation details of arbitrary employees. There is no public exploit identified at time of analysis, though a third-party technical writeup describing the issue is referenced.
A path equivalence bypass in goshs lets attackers retrieve blocked files and the ACL configuration file by appending a trailing slash to the request path. The sendFile handler derives the authorization-check filename from the raw URL while opening the file from the cleaned path, so a trailing slash yields an empty string for the check and defeats the block list and the rule that hides the .goshs file. No public exploit has been identified, but a proof-of-concept test is included in the patch; the vulnerability is not currently in CISA's Known Exploited Vulnerabilities catalog.
Authentication bypass in Cosmos-Server 0.22.18 and earlier allows any holder of a valid Constellation device API key to impersonate any user (including admin) to backend applications by sending crafted x-cosmos-user headers. The tokenMiddleware prematurely returns before stripping these headers when the request originates from the Constellation tunnel, bypassing JWT authentication, MFA, and the AdminOnly access gate. Publicly available exploit code exists but no active exploitation has been reported.
Authentication bypass in Cosmos Server 0.22.18 allows unauthenticated attackers to leak Constellation device metadata via the public-devices endpoint. The handler accepts any non-empty Authorization header but does not validate the bearer token, exposing device names, IPs, and role flags. Publicly available exploit code exists, but no active exploitation is reported; the vulnerability is patched in version 0.22.19.
SMTP header injection in SuperPlane allows unauthenticated attackers to inject arbitrary SMTP headers via CRLF sequences in webhook event payload titles, enabling email spoofing (bypassing SPF/DKIM), content manipulation, and data exfiltration via Bcc. No public exploit identified at time of analysis; patch available in v0.30.0.
Improper access control in IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privilege users to view sensitive data restricted to privileged users. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity) and affects specific version ranges of both products. No public exploit or active exploitation has been identified, and IBM has released a patch.
Archive of any chat room without authorization in Let's Chat 0.3.0–0.4.8 allows any authenticated user to permanently remove private or password-protected rooms by sending DELETE requests. Room IDs can be enumerated via the rooms listing endpoint, and recovery requires direct database manipulation. A proof-of-concept exploit exists.
Unauthorized file disclosure in Let's Chat 0.3.0 through 0.4.8 allows authenticated attackers to download file attachments from any room, including private and password-protected rooms, by exploiting missing room membership checks in the file retrieval endpoint. Attackers can enumerate likely MongoDB ObjectIds to recover files uploaded by other users, effectively bypassing all room-level access restrictions. No public exploit identified at time of analysis, but the issue is trivially exploitable due to the absence of proper authorization checks.
HTTP request smuggling in Rouille 0.3.3 through 3.6.2 allows remote attackers to bypass access controls by injecting bare line feed characters (0x0A) into header values. The framework forwards these headers verbatim to backends like Go net/http or Python http.server, which interpret the raw LF as a request delimiter, enabling a smuggled request with attacker-chosen method, path, and headers. Publicly available exploit code exists, increasing the risk for deployments using Rouille as a proxy.