Information Disclosure
Monthly
Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.
Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.
Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.
Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The built-in sqlite module in Node.js 26.x before v26.5.1 fails to invalidate tag store iterators when a prepared statement is reset, creating a TOCTOU window that a network-reachable, unauthenticated attacker (requiring user interaction) can abuse to achieve high integrity impact against the affected application. Fixed in Node.js v26.5.1 released 2026-07-29 by Matteo Collina. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, the High integrity impact (I:H) in the CVSS vector warrants prompt patching for any application actively using the Node.js built-in sqlite module.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
Improper TLS certificate validation in IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 allows man-in-the-middle attackers to obtain sensitive information. The attack is remotely exploitable with high complexity but requires no authentication or user interaction. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated remote attackers can extract sensitive information from the igloohome Smart Lock Mobile App source code to bypass authentication and access backend services. This affects version 3.2.3 and earlier, with a CVSS score of 5.3 (medium) and no known exploits or active exploitation.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.
HTTP request smuggling in tiny-http versions through 0.12.0 allows remote attackers to desynchronize request processing between a front-end proxy and the vulnerable backend. By sending a Transfer-Encoding header with an arbitrary value, the library unconditionally switches to chunked decoding and discards the Content-Length, enabling request smuggling and connection exhaustion. Public exploit code exists, but active exploitation remains unconfirmed.
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.
Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.
Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.
Denial of service in Xen libfsimage's iso9660 driver can be triggered by a local attacker mounting a crafted ISO image, crashing the Xen host. The vulnerability arises from insufficient validation of size and offset fields in Rock Ridge Continuation Entry (CE) records, leading to out-of-bounds memory access. Although the CVSS score is only 5.5 (Medium), the attack requires user interaction (mounting the ISO), and no patch version is specified in the provided data; active exploitation status is unknown.
Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.
Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.
Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.
Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The built-in sqlite module in Node.js 26.x before v26.5.1 fails to invalidate tag store iterators when a prepared statement is reset, creating a TOCTOU window that a network-reachable, unauthenticated attacker (requiring user interaction) can abuse to achieve high integrity impact against the affected application. Fixed in Node.js v26.5.1 released 2026-07-29 by Matteo Collina. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, the High integrity impact (I:H) in the CVSS vector warrants prompt patching for any application actively using the Node.js built-in sqlite module.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
HTTP request smuggling in Apache Traffic Server allows unauthenticated remote attackers to interfere with how the proxy and backend servers interpret HTTP request boundaries, enabling cache poisoning and limited information disclosure. Versions 9.0.0 through 9.2.14 and 10.0.0 through 10.1.3 are confirmed affected per Apache advisory. The Scope Changed (S:C) CVSS metric reflects that exploitation crosses the proxy boundary to impact downstream backend systems. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unanchored regular expression matching in Apache Traffic Server exposes a high-severity bypass that allows remote unauthenticated attackers to circumvent regex-based access controls, potentially leaking protected content (C:H) and enabling limited unauthorized writes (I:L). All 9.0.x through 9.2.14 and 10.0.x through 10.1.3 deployments that rely on regex-driven rules for routing, ACL, or header policy enforcement are at risk. No public exploit code has been identified at time of analysis, and CISA has not listed this in KEV, but the low-complexity, unauthenticated network attack path makes it a realistic opportunistic target for any actor aware of the flaw.
Koollab LMS 5.3.2 exposes correct quiz answers through the course status endpoint to authenticated learners without requiring legitimate assessment completion. An attacker with a valid student account can retrieve answers and compromise exam integrity.
Exposure of hard-coded AWS IAM credentials in Koollab LMS 5.3.2 allows authenticated attackers with low privileges to access shared multi-tenant S3 buckets and SQS queues, leading to sensitive data disclosure, content injection, and job manipulation. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated information disclosure in the ShinyStat Analytics WordPress plugin (versions before 1.0.17) exposes non-published WooCommerce product data - including draft, pending, and private listings - via an unprotected REST API endpoint that performs no authorization check. Any internet-accessible WordPress/WooCommerce site running an affected version is vulnerable without credentials or user interaction, consistent with the AV:N/AC:L/PR:N/UI:N CVSS vector. A publicly available proof-of-concept is documented by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Information disclosure via path traversal in Pagy's I18n locale handler allows an attacker to verify the existence and readability of arbitrary
Sensitive header disclosure in datamodel-code-generator allows Authorization, Cookie, and Proxy-Authorization headers to be leaked to cross-origin redirect targets when fetching remote schemas. Affects versions prior to 0.63.0. A public proof-of-concept exploit exists, but no active exploitation has been reported and the CVSS score is low (3.7).
Information disclosure in the dashboard component of IBM Sterling B2B Integrator and File Gateway 6.2.x allows low‑privileged authenticated users to view sensitive details embedded in source code comments. No active exploitation or public proof‑of‑concept code is known at this time; the advisory carries a CVSS base score of 4.3 and is categorized as low severity.
Information disclosure in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.x allows authenticated remote attackers to view sensitive data embedded in source code comments of a mailbox component. Affected versions include 6.2.0.0 through 6.2.0.5_2, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1. No public exploit or active exploitation has been reported.
Information disclosure in IBM Sterling B2B Integrator and File Gateway 6.2.x allows authenticated privileged users to read sensitive data from application log files. No public exploit code or active exploitation has been identified at time of analysis.
Improper TLS certificate validation in IBM TS4500 CLI tool versions 0.1.31 through 1.12.0.0 allows man-in-the-middle attackers to obtain sensitive information. The attack is remotely exploitable with high complexity but requires no authentication or user interaction. No public exploit or active exploitation has been identified at the time of analysis.
Unauthenticated remote attackers can extract sensitive information from the igloohome Smart Lock Mobile App source code to bypass authentication and access backend services. This affects version 3.2.3 and earlier, with a CVSS score of 5.3 (medium) and no known exploits or active exploitation.
Physical access to IBM PowerVM Hypervisor firmware with Transparent Memory Encryption (TME) enabled can allow an attacker to decrypt protected memory contents due to insufficient entropy. This information disclosure vulnerability affects firmware versions FW1110.00–FW1110.20 and FW1060.00–FW1060.71, potentially exposing sensitive data stored in memory. No public exploit code or active exploitation evidence is available at the time of analysis.
Out-of-bounds read in pglogical's apply worker allows a malicious publisher to disclose adjacent process memory or crash the subscriber. The vulnerability affects pglogical subscribers where a subscription is directed to an attacker-controlled endpoint. In default PostgreSQL installations creating a subscription requires superuser privileges, but in managed deployments where subscription creation has been delegated to non‑superuser roles lower‑privileged attackers can exploit this.
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
HTTP request smuggling vulnerability in Rouille's proxy implementation allows remote attackers to desynchronize HTTP message boundaries using a CL.TE attack. Affected versions 0.3.3 through 3.6.2. Publicly available exploit code exists, but no active exploitation has been reported.
HTTP request smuggling in tiny-http versions through 0.12.0 allows remote attackers to desynchronize request processing between a front-end proxy and the vulnerable backend. By sending a Transfer-Encoding header with an arbitrary value, the library unconditionally switches to chunked decoding and discards the Content-Length, enabling request smuggling and connection exhaustion. Public exploit code exists, but active exploitation remains unconfirmed.
Quadratic time complexity in CPython's xml.etree.ElementTree.findall(), iterfind(), and find() methods allows denial of service when processing XML documents with many same-tag siblings and XPath index predicates. Affected versions are CPython before 3.15.0. No active exploitation or public exploit identified at time of analysis.
Race condition in Xen's grant table version switching (v2 to v1) allows remote unauthenticated attackers to cause low confidentiality impact and denial of service under specific conditions. The vulnerability arises when hypervisor code drops and re-acquires the grant table lock during a version switch, creating a window where status frame properties can change inconsistently. No public exploit has been identified at time of analysis, and the CVSS network attack vector may be misleading as exploitation likely requires a guest domain to initiate the switch.
Race condition in Xen Grant Table version switching from v1 to v2 allows a malicious guest VM to cause low confidentiality impact and limited denial of service. The vulnerability occurs when hypervisor code drops and reacquires the grant table lock during the version transition, creating a window where reference counts become inconsistent. No active exploitation or public exploit code has been identified at time of analysis.
Information disclosure in Xen's vNUMA configuration handling allows low-privileged authenticated attackers to read sensitive guest data during domain destruction. A race condition between the device model retrieving configuration and the simultaneous cleanup of that data permits unauthorized access to memory layout or other confidential information. No public exploit is identified, and the vulnerability is not known to be actively exploited at this time.
Denial of service in Xen libfsimage's iso9660 driver can be triggered by a local attacker mounting a crafted ISO image, crashing the Xen host. The vulnerability arises from insufficient validation of size and offset fields in Rock Ridge Continuation Entry (CE) records, leading to out-of-bounds memory access. Although the CVSS score is only 5.5 (Medium), the attack requires user interaction (mounting the ISO), and no patch version is specified in the provided data; active exploitation status is unknown.