Information Disclosure
Monthly
Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.
Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.
UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.
UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.
Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.
Cross-origin data leakage in Google Chrome's WebProtect component (prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by loading a crafted HTML page. The flaw stems from an inappropriate implementation of origin validation (CWE-346), allowing WebProtect to fail its primary function of enforcing same-origin boundaries within Chrome's sandboxed renderer. No active exploitation has been confirmed by CISA KEV, no public POC has been identified, and EPSS at 0.21% (11th percentile) indicates low near-term exploitation probability - though this vulnerability's relevance as a component in chained browser exploit chains elevates its strategic significance beyond the raw score.
Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.
Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.
Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.
Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The built-in sqlite module in Node.js 26.x before v26.5.1 fails to invalidate tag store iterators when a prepared statement is reset, creating a TOCTOU window that a network-reachable, unauthenticated attacker (requiring user interaction) can abuse to achieve high integrity impact against the affected application. Fixed in Node.js v26.5.1 released 2026-07-29 by Matteo Collina. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, the High integrity impact (I:H) in the CVSS vector warrants prompt patching for any application actively using the Node.js built-in sqlite module.
HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.
Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.
UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.
UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.
Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.
Cross-origin data leakage in Google Chrome's WebProtect component (prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by loading a crafted HTML page. The flaw stems from an inappropriate implementation of origin validation (CWE-346), allowing WebProtect to fail its primary function of enforcing same-origin boundaries within Chrome's sandboxed renderer. No active exploitation has been confirmed by CISA KEV, no public POC has been identified, and EPSS at 0.21% (11th percentile) indicates low near-term exploitation probability - though this vulnerability's relevance as a component in chained browser exploit chains elevates its strategic significance beyond the raw score.
Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.
Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.
Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.
Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.
UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.
UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.
Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.
Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.
Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.
Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.
Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.
Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.
Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.
Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.
Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.
Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.
Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.
Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.
Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.
Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.
Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.
Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.
Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.
Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.
Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.
A use-after-free vulnerability exists in SQLite 3.41 when the jsonBlobAppendNode() function is invoked subsequent to sqlite3DbFree() being called on the aBlob member of the Parse structure.
The BGR decoder in ImageMagick prior to 7.1.2-27 fails to check for end-of-file at all necessary code paths, allowing remote unauthenticated attackers to trigger a heap buffer over-read via a crafted image file. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms network-exploitable, zero-prerequisite access with impact limited to partial memory disclosure. No active exploitation (CISA KEV) and no public POC have been identified at the time of analysis; a vendor-released patch is available in version 7.1.2-27.
Response body/Content-Length desynchronization in undici's retry interceptor allows a malicious or faulty upstream server to induce HTTP response smuggling against downstream clients of proxy and gateway applications. Affected versions span undici before 6.28.0, the 7.x line before 7.29.0, and the 8.x line before 8.9.0. An upstream that deliberately returns a partial response with mismatched framing and closes the socket early can cause the retry interceptor to assemble a body of a different length than the attached Content-Length, leading downstream consumers to experience response desynchronization, connection hangs, or data corruption. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV.
Cross-origin credential header leakage in linuxfabrik-lib prior to v6.0.0 exposes API tokens from authenticated monitoring requests to attacker-controlled redirect targets. The lib.url.fetch() function relied on httpx's default redirect behavior, which strips only Authorization and Cookie on cross-origin hops - leaving custom credential headers like X-Auth-Token and X-Api-Key forwarded verbatim to whatever host the redirect points to. This is particularly severe for Redfish/BMC monitoring workflows where X-Auth-Token grants privileged hardware management access. No public exploit has been identified at time of analysis, and active exploitation is not confirmed in CISA KEV.
Symlink-following in Linuxfabrik monitoring-plugins 6.0.0 allows a local low-privileged user sharing the plugin account to overwrite or corrupt arbitrary root-owned files. The logfile check's legacy database migration resolved a predictable /tmp path via os.rename() without guarding against symlink substitution, and sqlite3.connect() would then follow the attacker-planted link during a root-executed check run. No public exploit has been identified, and exploitation is additionally constrained by the non-default kernel setting fs.protected_symlinks=0, meaningfully reducing real-world risk on hardened systems.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
Path traversal in DriveLock's built-in web service exposes arbitrary files readable by the service account to any authenticated remote user. The flaw, discovered by ZDI (ZDI-CAN-28713) and disclosed as ZDI-26-288, exists because the web service on TCP port 4568 accepts user-supplied path strings and passes them directly to file operations without sanitization, allowing directory traversal sequences to escape the intended working directory. No public exploit code or active exploitation has been identified at time of analysis, and a vendor security bulletin has been published.
Directory traversal in DriveLock's built-in web service (TCP port 4568) permits unauthenticated remote attackers to read arbitrary files in the context of the service account, bypassing all authentication controls. The root cause is unsanitized user-supplied path input passed directly into file operations (CWE-22), making exploitation mechanically trivial for any attacker with network reach to the affected port. No public exploit code or active exploitation has been identified at time of analysis; the ZDI-CAN-28719 disclosure was handled through the Zero Day Initiative responsible disclosure program.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Approval bypass in GitLab Enterprise Edition allows authenticated users to merge code into protected branches without satisfying required approval rules by exploiting a race condition in the approval rule processing pipeline. Affected deployments span GitLab EE versions 17.0 through 19.2, with fixed releases available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, though the integrity risk is significant in regulated environments where protected branch approvals serve as a primary code integrity control.
Confidential issue title disclosure in GitLab CE/EE affects all versions from 8.8 through 19.2 (pre-fix), allowing unauthenticated access to sensitive issue titles via improper authorization checks on publicly accessible merge requests. An attacker who can access a public merge request linked to a confidential issue can read the confidential issue's title without any project membership or authentication. No active exploitation confirmed in CISA KEV, but a publicly available exploit exists via HackerOne report 3708242, and EPSS data was not provided - risk is moderate given broad version impact and low exploitation complexity.
Sensitive information disclosure in GitLab EE's virtual registries feature allows low-privileged authenticated users to trigger improper forwarding of upstream requests, potentially exposing sensitive data - such as credentials or authentication headers - to unintended hosts. All GitLab EE versions from 18.8 through pre-19.2.1 are affected, with patched releases now available at 19.0.5, 19.1.3, and 19.2.1. No public exploit code has been identified and this vulnerability does not appear in CISA KEV, indicating no confirmed active exploitation at time of analysis.
Out-of-bounds read in Zephyr RTOS 4.2.0 through 4.4.0 allows a high-privileged local shell user to disclose device memory contents or crash the system via the coredump print shell command. The 16-bit tgt_code field from a stored coredump header is used as an unbounded index into a static 7-element string pointer array in print_coredump_hdr(), enabling reads up to ~64K entries past the array boundary that are then dereferenced and printed as a C string. No public exploit has been identified and no CISA KEV listing exists; the CVSS 3.0 base score accurately reflects that exploitation is constrained by local high-privilege access and deliberate coredump storage manipulation.
Certificate trust bypass in S2OPC versions 1.5.0 through 1.x (prior to 2.0.0) allows a remote attacker to have certificates signed by an expired root CA accepted as fully trusted due to missing validity period enforcement in the CycloneCrypto wrapper layer. The flaw affects OPC UA communications protected by this library, enabling potential interception or tampering of industrial protocol traffic. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Incorrect SUID/SGID bit preservation in fuse-overlayfs before version 1.17 allows a low-privileged process inside a rootless container to leave an upper-layer file with mode 4777 (setuid plus world-writable) by triggering a copy-up via open(O_TRUNC) or truncate. The vulnerability is confined to local container contexts and carries a CVSS 4.0 score of 2.0, reflecting narrow exploitation conditions and limited integrity-only impact. No active exploitation (KEV) or public exploit code has been identified at time of analysis.
Xlight FTP Server before 3.9.5 on Windows leaks the system's GetTickCount() value to unauthenticated remote attackers via the standard FTP listener. Sending a USER command with a username ending in the :adm suffix triggers an internal admin protocol code path pre-authentication, causing the server to embed Windows timing data in the FTP 331 response - no separate admin port or configuration change required. No active exploitation is confirmed (not in CISA KEV), but the attack is trivially executable against any default installation with network access to the FTP port.
Out-of-bounds read in Autodesk AutoCAD, AutoCAD LT, and DWG TrueView is triggered when parsing maliciously crafted DWG or DXF files, potentially resulting in application crash or memory disclosure. The attack requires a user to open a weaponized design file, making social engineering the primary delivery mechanism. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor-released patch is available via Autodesk advisory ADSK-SA-2026-0009.
Denial-of-service in veraPDF-parser allows a remote unauthenticated attacker to crash or hang the PDF validation service by submitting a crafted PDF containing a Type 1 font whose /FontDescriptor /FontFile PostScript program exploits one of three unbounded resource primitives: a massive array allocation, a zero-increment for-loop, or a self-referential recursive user-dictionary lookup. All veraPDF-parser releases prior to 1.30.2 and 1.31.23 are affected across both active version branches. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; vendor-released patches exist for both branches.
Memory and CPU exhaustion in veraPDF-parser's embedded PostScript interpreter allows remote unauthenticated attackers to crash the PDF validator by submitting a single crafted PDF. All 1.30.x releases prior to 1.30.2 and all 1.31.x releases prior to 1.31.23 of the Maven artifact org.verapdf:parser are affected. No public exploit code has been confirmed at time of analysis, but the GHSA advisory discloses the exact operator names, payload byte sequence, and affected source line numbers, making independent reproduction trivial without requiring any structural PDF framing.
Node.js Permission Model fails to enforce filesystem write restrictions for the trace events subsystem, allowing a local attacker with low privileges to write files to paths explicitly blocked by the operator via the --experimental-permission flag. Rated Low severity (CVSS 3.3), this flaw affects Node.js 22.x through 22.23.1, 24.x through 24.18.0, and 26.x through 26.5.0, and is one of ten CVEs addressed in the July 2026 Node.js security release. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the fix is available in Node.js 26.5.1 released 2026-07-29.
HTTP request smuggling exposure in Node.js 26.x arises because the HTTP server failed to reject incoming requests that exceed the configured maximum header count, creating an inconsistent parsing boundary exploitable by adversaries. Rated Low severity (CVSS 3.7) by the Node.js security team and fixed in v26.5.1 released 2026-07-29, the flaw is classified under CWE-444 and is most dangerous in reverse-proxy deployments where header-count enforcement differs between the frontend proxy and the Node.js backend. No public exploit code and no CISA KEV listing have been identified at time of analysis.
The built-in sqlite module in Node.js 26.x before v26.5.1 fails to invalidate tag store iterators when a prepared statement is reset, creating a TOCTOU window that a network-reachable, unauthenticated attacker (requiring user interaction) can abuse to achieve high integrity impact against the affected application. Fixed in Node.js v26.5.1 released 2026-07-29 by Matteo Collina. No public exploit code exists and no CISA KEV listing is present at time of analysis; however, the High integrity impact (I:H) in the CVSS vector warrants prompt patching for any application actively using the Node.js built-in sqlite module.
HTTPS session reuse in Node.js 22.x, 24.x, and 26.x fails to bind identity checks to reused TLS sessions, enabling a low-privileged attacker with access to a shared HTTPS agent context to obtain confidential data across session boundaries. Rated CVSS 6.3 Medium with Scope:Changed and C:H, reflecting the cross-connection identity confusion impact even though the attack is gated behind AC:H and PR:L. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated file system disclosure in balbooa.com's Gridbox extension for Joomla (versions 1.0.0 through 2.20.1) exposes arbitrary server-side file paths to remote unauthenticated attackers via multiple vulnerable endpoints. The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N confirms zero-barrier network exploitation requiring no credentials, interaction, or special configuration. SSVC assesses exploitation as none at time of analysis and the attack as automatable with partial technical impact; EPSS at 0.14% (4th percentile) reflects currently low exploitation probability despite the accessible attack surface. No public exploit code or active exploitation (CISA KEV) has been identified.
IP-based security controls in applications using @fastify/forwarded before 3.0.2 can be bypassed by injecting a horizontal tab character into X-Forwarded-For header entries. The parser strips only space characters during whitespace normalization, violating RFC 7230's definition of optional whitespace (which includes both SP and HTAB), causing the resolved IP string to carry a trailing tab. Any application performing exact-string security decisions on the resolved address - allowlists, blocklists, per-IP rate limit keys, or audit log correlation - will silently fail to match the expected value, allowing an attacker to evade those controls. No public exploit has been identified at time of analysis, and no KEV listing exists; however, exploitation requires no authentication or special configuration beyond controlling HTTP request headers.
Non-atomic JSON Patch application in cJSON through 1.7.19 allows an attacker who controls the patch document to silently corrupt the target JSON structure even when the API returns a failure status. The apply_patch() function in cJSON_Utils.c deletes existing target members before completing operation validation, meaning a malformed replace (missing value) or move (unresolvable destination) permanently destroys data from the in-memory document tree - defeating the RFC 6902 all-or-nothing contract that callers rely on to reject bad patches safely. No public exploit has been identified at time of analysis, but a detailed researcher disclosure and direct source code reference are publicly available, which may lower the barrier to exploitation; KEV status is not confirmed.
Persistent session hijacking in Grav Login Plugin before 3.8.13 allows any attacker holding a captured Remember Me cookie to authenticate indefinitely, bypassing the configured session timeout. The root cause is a PHP type-comparison bug in TokenStorage.php's findTriplet() method: the expiry check compares an array value against a scalar timestamp, a comparison that always evaluates incorrectly in PHP, effectively nullifying the token lifetime enforcement. No active exploitation confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, but the flaw is straightforward to weaponize given a captured cookie.
File integrity compromise in Joomla Content Editor (JCE) before version 2.20.2 allows authenticated users holding file management permissions to rename files to invalid names - enabling creation of hidden dot-prefixed files (e.g., .htaccess, .env) and silent overwriting of existing files at the destination path. The root cause (CWE-20) is missing validation of the user-supplied target filename in the JCE rename API endpoint. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.14% (4th percentile) indicates very low opportunistic exploitation probability, though the ability to silently replace sensitive server-side files such as .htaccess adds practical gravity that the CVSS integrity score alone does not fully convey.
GNU Bison's grammar directive processing exposes an arbitrary file write path via the %output and %header directives, which accept filesystem paths without restriction and silently override caller-supplied output options. Any environment that processes attacker-supplied Bison grammar files - including CI/CD build pipelines and developer workstations - is at risk of having generated parser files written to attacker-chosen locations, potentially overwriting sensitive files accessible to the Bison process. Version 3.8.2 is confirmed vulnerable; no public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.
HTTP/2 HPACK dynamic table desynchronization in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) exposes a premature-state-update flaw in header compression logic. An unauthenticated remote attacker can trigger an HPACK encode failure, leaving the server's encoder table out of sync with the peer decoder's table and corrupting all subsequent header blocks transmitted on that HTTP/2 connection. No public exploit has been identified at time of analysis; the AC:H rating indicates reliable triggering requires specific conditions, and CISA KEV does not list this vulnerability.
Out-of-bounds read in Apache Traffic Server's DNS answer parser (CWE-125) allows unauthenticated remote attackers - or adversaries capable of influencing DNS responses - to leak partial heap memory contents or crash the ATS process, affecting all three active release branches (8.x, 9.x, 10.x). The CVSS 6.5 Medium rating reflects no authentication barrier and no user interaction required, though impact is limited to partial confidentiality and availability loss with no integrity impact. No public exploit code and no CISA KEV listing are identified at time of analysis, but the network attack surface is broad given that every proxied request triggers DNS resolution.
Cross-connection information disclosure in Apache Traffic Server (versions 8.0.0-8.1.9, 9.0.0-9.2.14, and 10.0.0-10.1.3) allows remote unauthenticated attackers to receive data belonging to other clients because the proxy improperly reuses upstream server sessions and tunnels. Because the scope changes across trust boundaries, one client can be served another client's response data, making this a confidentiality-critical issue in a shared caching/proxy tier. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; exploitation is timing/condition dependent (CVSS AC:H).
Improper TLS certificate validation in Apache Traffic Server (ATS) versions 9.0.0-9.2.14 and 10.0.0-10.1.3 allows multiplexed HTTP/2 origin connections to be reused for requests targeting hostnames not covered by the existing connection's server certificate. When ATS coalesces HTTP/2 connections to origin servers, it omits the check confirming the server certificate's Subject Alternative Names cover the new request's hostname, meaning traffic may be silently routed over a connection authenticated for a different host. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.2.15 and 10.1.4.
HTTP/2-to-HTTP/1 protocol conversion in Apache Traffic Server 10.0.0-10.1.3 forwards origin HTTP/2 trailers to downstream HTTP/1 clients without the required chunked transfer encoding framing, enabling HTTP response smuggling. The CVSS 8.3 Scope:Changed rating reflects that exploitation impacts downstream HTTP/1 clients architecturally separate from ATS itself, with potential for cache poisoning, response injection, and limited information disclosure. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.
Memory corruption in Apache Traffic Server during HPACK/XPACK header decoding exposes affected deployments to denial of service. Versions spanning the 8.x, 9.x, and 10.x release lines are affected, with unauthenticated remote attackers able to craft malformed compressed headers that trigger an integer overflow (CWE-190), corrupting server memory. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) scores 5.9 Medium, reflecting that while no authentication is required, elevated attack complexity limits opportunistic mass exploitation; no public exploit has been identified at time of analysis and this vulnerability is not listed in CISA KEV.