Information Disclosure
Monthly
Host object identity crosses the vm2 sandbox boundary when Promise resolution delivers objects to sandbox callbacks, allowing sandboxed code to mutate host objects and perform identity checks via WeakMap. The vulnerability stems from Promise.prototype.then wrapping that uses ensureThis() for conversion instead of stronger cross-realm proxying; when no prototype mapping exists, ensureThis() returns the original host object unmodified. This sandbox escape affects vm2 versions up to 3.10.5 and is fixed in 3.11.0.
Istio versions prior to 1.28.6 and 1.29.2 allow authenticated attackers to perform Server-Side Request Forgery (SSRF) attacks via RequestAuthentication resources with malicious jwksUri values pointing to internal services, enabling istiod to fetch sensitive data from localhost or link-local IPs and distribute it to Envoy proxies through xDS configuration. The vulnerability requires an authenticated user to create or modify a RequestAuthentication resource, limiting the attack surface to cluster administrators or users with API access. A partial mitigation was released in earlier versions (1.29.1, 1.28.5, 1.27.8) but was incomplete; the complete fix is in versions 1.28.6 and 1.29.2.
OpenEXR versions 3.0.0-3.2.8, 3.3.0-3.3.10, and 3.4.0-3.4.10 suffer from unbounded shift operations in the readVariableLengthInteger() function when parsing variable-length integers from untrusted EXR files. Attackers can craft malicious EXR files with excessive continuation bytes to trigger left shifts exceeding 64 bits on a 64-bit integer, causing undefined behavior that may lead to information disclosure or denial of service. The vulnerability is remotely exploitable without authentication or user interaction against any application processing untrusted EXR input; no public exploit code has been identified at the time of analysis.
Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.
Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.
Kubetail Dashboard prior to version 0.14.0 fails to validate the Origin header on WebSocket connection upgrades, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks. An authenticated user visiting a malicious web page can be exploited to stream their Kubernetes container logs-including credentials, tokens, and PII often present in logs-to an attacker-controlled server. The vulnerability affects both desktop deployments at localhost:7500 and cluster deployments behind HTTP basic auth, with browser ambient credentials automatically attached to the WebSocket handshake.
Tor before version 0.4.9.7 mishandles memory accounting in the conflux out-of-order queue during queue clearing operations, leading to a denial-of-service condition through resource exhaustion. Unauthenticated remote attackers can exploit this via network-level packet manipulation to trigger improper queue state management, causing availability degradation on affected Tor relays and clients. The vulnerability has a low severity CVSS score (3.7) due to attack complexity and availability-only impact, with no confirmed active exploitation at time of analysis.
Tor before version 0.4.9.7 can incorrectly attempt or accept BEGIN_DIR cells over conflux legs, a Tor relay multiplexing feature, enabling potential integrity violations in circuit construction. The vulnerability has a CVSS score of 3.7 (low severity) with impact limited to integrity rather than confidentiality or availability. No public exploit code or active exploitation has been identified at the time of analysis.
Free5GC Access and Mobility Function (AMF) versions up to 1.4.3 fail to enforce 3GPP TS 33.501 §6.9.5.1 concurrent security procedure rules, allowing NAS Security Mode Command (SMC) to execute simultaneously with N2 handover procedures. This causes security context mismatches between the UE and network when SMC activates a new KAMF while N2 HandoverRequest carries Next Hop (NH) and Next Hop Chaining Counter (NCC) derived from the old KAMF, resulting in different KgNB key derivation at the target gNB and UE and breaking access stratum (AS) security integrity. Source code analysis confirms missing cross-procedure validation in SecurityMode() and handleHandoverRequiredMain() functions; packet evidence demonstrates Rule 2 violation (SMC initiated during ongoing N2 handover).
Free5GC Access and Mobility Management Function (AMF) v4.2.1 and earlier fails to verify UE Security Capabilities in NGAP PathSwitchRequest messages, allowing a malicious gNB to overwrite the AMF's stored security algorithm preferences with arbitrary values. These corrupted capabilities are then propagated in PathSwitchRequestAcknowledge and subsequent HandoverRequest messages, causing all inter-gNB handovers for affected UEs to fail due to algorithm mismatches. This results in persistent handover denial-of-service until UE re-registration. The vulnerability is directly contrary to 3GPP TS 33.501 §6.7.3.1 verification requirements and has been demonstrated with a public proof-of-concept using Free5GC v4.2.1 and UERANSIM.
DNS rebinding vulnerability in Gotenberg allows unauthenticated remote attackers to bypass SSRF protections and access internal services via Chromium URL conversion routes. When a URL is submitted for PDF conversion, Gotenberg validates the resolved IP address against a deny-list but discards the pinned result. Chromium then performs independent DNS resolution multiple times, creating a race condition where an attacker controlling DNS can return a public IP during validation and a private IP during connection, allowing access to loopback services, cloud metadata endpoints, or internal networks. Exploitation succeeds approximately 10% per attempt with trivial automation.
Spring Cloud AWS SNS HTTP/HTTPS endpoint handlers (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) in versions 3.0.0-3.4.2, 4.0.0, and 4.0.1 fail to verify the cryptographic signature of incoming SNS messages, allowing unauthenticated attackers who know the endpoint URL to send forged SNS notifications, subscription confirmations, or unsubscribe requests. This enables attackers to trigger arbitrary message processing, auto-confirm malicious topic subscriptions, or force unsubscription from legitimate topics. Fixed in Spring Cloud AWS 4.0.2 with signature verification enabled by default; 3.x line receives no patch and must use workarounds.
Vercel CLI leaks authentication tokens in JSON output when running in non-interactive mode with credentials passed via command-line arguments. Affected versions 50.16.0 through 52.0.0 expose plaintext tokens in suggested follow-up commands when operations cannot complete autonomously, allowing token capture in CI/CD logs and automation transcripts. Information disclosure risk is elevated in automated deployment pipelines where CLI output is logged.
Weblate versions before 5.17.1 allow authenticated users to enumerate translations in projects they cannot access via the screenshots, tasks, and component link API endpoints. An attacker with valid credentials but no project access can probe these APIs to discover the existence and metadata of private translations, leading to information disclosure of project structure and language coverage that should remain hidden. The vulnerability requires authentication but has a low attack complexity, affecting confidentiality only without enabling further compromise.
Hono's bodyLimit() middleware fails to reliably enforce maxSize restrictions on chunked or unknown-length HTTP requests (Transfer-Encoding: chunked), allowing oversized payloads to reach application handlers and return HTTP 200 instead of 413 Payload Too Large. Versions prior to 4.12.16 are vulnerable when handlers do not fully read the request body, read only initial chunks before returning, or catch and suppress read errors. This bypasses the documented guarantee that oversized requests are rejected before business logic execution.
BSON operator injection in ShellHub Community v0.24.1 and earlier allows any authenticated user to crash the device list API endpoint by supplying MongoDB operators as filter field names or sort_by values without input validation. Two attack vectors exist in api/store/mongo/query-options.go: unvalidated filter param.Name values become raw BSON map keys, and the sort_by query parameter is passed directly into a $sort pipeline stage. A validated proof-of-concept exists against v0.24.1. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.06% (19th percentile), indicating low real-world exploitation probability despite a public PoC.
Unauthorized cross-owner data access in Backstage's catalog-backend-module-unprocessed plugin allows any authenticated user to read unprocessed entity records belonging to other teams or owners, bypassing the Backstage permission framework entirely. The vulnerability affects all installations of this optional plugin running versions prior to 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, 0.0.15 of the common package, and 0.2.30 of the UI package. EPSS is 0.03% (7th percentile) and the vulnerability is not in CISA KEV, indicating low exploitation probability; however, in multi-tenant Backstage deployments the data exposure risk is real and no public exploit has been identified at time of analysis.
Timing side-channel in pyquorum's modular multiplication allows remote attackers to recover Shamir secret-sharing values by measuring operation latency. The `mul_mod` function in all versions prior to 0.2.1 uses a binary expansion loop whose iteration count and branch path vary with the Hamming weight of the secret-derived operand, creating a measurable timing oracle. Given sufficient query volume and low-latency network access to an exposed secret-sharing service, an attacker can statistically correlate timing measurements to progressively reconstruct protected secrets. No public exploit code has been identified at time of analysis; EPSS is 0.07% (21st percentile) and the vulnerability is not in CISA KEV.
Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.
Statamic CMS versions before 5.73.21 and 6.0-6.14.x disclose whether an email address is registered via differential responses from the forgot password endpoint, enabling unauthenticated attackers to enumerate valid user accounts and facilitate downstream credential-based attacks. The vulnerability has a CVSS score of 5.3 (low confidentiality impact) and no public exploit code or active exploitation has been identified.
Open redirect vulnerability in Masa CMS allows unauthenticated remote attackers to craft malicious URLs on trusted Masa CMS domains that redirect victims to attacker-controlled sites via improper validation of scheme-relative URLs (paths beginning with //). This can be exploited for phishing attacks and potential token exposure in certain authentication flows. The vulnerability affects versions prior to 7.2.10, 7.3.15, 7.4.10, and 7.5.3, with CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:N/UI:P).
Information disclosure in PicoTronica e-Clinic Healthcare System ECHS 5.7 allows remote unauthenticated attackers to extract sensitive data via the Response Header Handler in the /cdemos/echs/api/v2/ endpoint. The vulnerability has been publicly disclosed with exploit code available, and a patch (version 5.7.1) has been released by the vendor.
Vvveb before version 1.0.8.2 allows unauthenticated remote attackers to disclose sensitive server information including absolute file paths, internal class namespaces, line numbers, and source code excerpts by accessing the admin password-reset endpoint and triggering a fatal error caused by missing namespace imports. The debug exception handler renders full stack traces to unauthenticated requests, enabling reconnaissance attacks without authentication or user interaction. No active exploitation confirmed, but the vulnerability is easily discoverable and exploitable over the network.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Uninitialized GPU memory disclosure in Google Chrome for Android (prior to 148.0.7778.96) enables a post-exploitation information leak from process memory. Exploitation requires that the attacker has already compromised the renderer process - making this a chained vulnerability, not a standalone entry point. No active exploitation is confirmed (not in CISA KEV, SSVC exploitation status: none), and EPSS sits at 0.03% (8th percentile), consistent with a low-real-world-priority issue despite the C:H confidentiality rating.
UI spoofing via insufficient WebApp policy enforcement in Google Chrome prior to 148.0.7778.96 allows a remote attacker to mislead users about the trustworthiness of browser UI elements by delivering a crafted HTML page. All Chrome users on versions below 148.0.7778.96 are affected across desktop platforms, including those on Red Hat and SUSE Linux distributions. No active exploitation has been identified (SSVC: none; EPSS 0.05%, 16th percentile), and the patch is vendor-confirmed available in the stable channel release.
Side-channel information leakage in the Media component of Google Chrome prior to 148.0.7778.96 enables remote attackers to read partial cross-origin data by enticing a user to visit a specially crafted HTML page. The flaw exploits measurable timing or resource-usage signals during media processing, violating browser Same-Origin Policy isolation at the side-channel level rather than through direct memory access. No public exploit code exists and EPSS exploitation probability is 0.03%, placing this firmly in low real-world priority - though it remains relevant for environments handling sensitive cross-origin data such as financial portals or SSO flows.
UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.
Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.
Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.
Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.
UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.
UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.
Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.
UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.
V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.
UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.
UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.
Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.
Arbitrary read/write in Google Chrome's DataTransfer component prior to version 148.0.7778.96 is exploitable by a remote attacker who has already compromised the renderer process, using a specially crafted HTML page to bypass input validation. This is a chained post-exploitation primitive rather than an initial-access vector - the renderer must already be under attacker control before this flaw becomes useful. SSVC rates exploitation as none and technical impact as partial; EPSS at 0.03% (9th percentile) and the absence of any CISA KEV listing indicate no observed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.
Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.
Uninitialized memory use in Chrome's WebCodecs component exposes potentially sensitive process memory contents to remote attackers via crafted HTML pages. All Chrome versions prior to 148.0.7778.96 are affected, with the flaw requiring only that a victim navigate to an attacker-controlled page. No active exploitation has been identified; EPSS sits at the 7th percentile and SSVC rates exploitation as none, placing this in the moderate-priority tier despite the high confidentiality impact signaled by CVSS.
Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.
Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.
Google Chrome versions prior to 148.0.7778.96 contain insufficient input validation in DevTools that allows remote attackers with a compromised renderer process to leak cross-origin data through crafted HTML pages. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world exploitation but presenting a significant attack chaining vector for multi-stage exploits. Patch available from vendor.
Insufficient input validation in the FileSystem API in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to perform arbitrary file read and write operations through a malicious HTML page. The vulnerability requires prior renderer compromise and user interaction with a crafted page, limiting its attack surface despite network-accessible vectors. Vendor has released a patched version.
Insufficient policy enforcement in DirectSockets API in Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary read and write operations through a crafted malicious Chrome extension. The vulnerability requires user interaction (extension installation) but affects the core security model of the browser's socket access control, exposing local network resources to unauthorized access by untrusted extensions.
Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.
Information disclosure in Google Chrome prior to 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive data from process memory through a race condition triggered by a crafted HTML page. The vulnerability requires renderer process compromise and user interaction but results in high confidentiality impact with no integrity or availability consequences. Chromium security team rates this as Medium severity; no active exploitation has been publicly confirmed.
Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.
Google Chrome prior to version 148.0.7778.96 contains a race condition in shared storage that allows a remote attacker with a compromised renderer process to leak cross-origin data through a crafted HTML page. The vulnerability requires user interaction and renderer compromise but can disclose sensitive information across origin boundaries, classified as medium severity by Chromium security team.
Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.
Out-of-bounds read in Skia graphics library within Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. The vulnerability requires user interaction and relies on renderer compromise, limiting real-world exploitation despite the information disclosure impact. Chromium classified this as Medium severity; no active exploitation has been publicly confirmed.
UI spoofing via insufficient input validation in Google Chrome prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft malicious HTML pages that deceive users about the legitimate UI elements. The attack requires renderer process compromise as a prerequisite and user interaction with the crafted page, limiting real-world applicability to multi-stage attacks. Chromium assessed this as medium severity; no public exploit code or active exploitation has been identified.
Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to perform arbitrary memory read and write operations via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, user interaction, and high attack complexity, making it a post-exploitation vector rather than a primary attack surface. Patch is available from vendor.
Integer overflow in ANGLE graphics library in Google Chrome prior to version 148.0.7778.96 allows remote attackers to leak cross-origin data by delivering a crafted HTML page that triggers the vulnerability. The vulnerability requires user interaction (visiting a malicious webpage) but can bypass same-origin policy protections, exposing sensitive data from other domains. No public exploit code or active exploitation has been confirmed at analysis time.
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.
Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.
UI spoofing in Google Chrome on iOS prior to version 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the browser interface. The vulnerability stems from insufficient validation of untrusted input and has a CVSS score of 5.4 (medium severity). Exploitation requires user interaction with a malicious webpage but can result in information disclosure and denial of service on affected iOS devices.
Uninitialized memory use in Dawn (GPU abstraction layer) in Google Chrome prior to version 148.0.7778.96 allows remote attackers to read potentially sensitive information from process memory by opening a crafted HTML page. The vulnerability requires user interaction (clicking/viewing the malicious page) but no authentication, and has a high confidentiality impact. Chromium security team classified this as high severity; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds memory read in Google Chrome's font handling allows remote attackers to leak sensitive information via a crafted HTML page when users visit a malicious website. Chrome versions prior to 148.0.7778.96 are affected. The vulnerability requires user interaction (clicking a link or visiting a page) but occurs over the network without authentication. Information disclosure risk is limited (CVSS C:L) with no impact on integrity or availability, but the Chromium security severity designation of High indicates concern about potential information leakage in real-world exploitation.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
PyLoad-ng WebUI discloses internal Python stack traces and source file paths to unauthenticated remote attackers via a global exception handler on the `/web/<path:filename>` endpoint. An attacker can request non-existent templates or craft malformed requests to trigger server exceptions and extract implementation details in HTTP responses without authentication. This information disclosure facilitates reconnaissance for follow-on attacks but does not enable direct code execution or data theft.
Authenticated remote attackers with low privileges can read arbitrary files via insufficient access controls in the web-based management interface of Cisco IoT Field Network Director. Exploitation requires valid login credentials and submission of crafted input through the management UI; successful attacks result in unauthorized file disclosure but do not enable modification or system disruption. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
FlowiseAI Flowise up to version 3.0.12 allows remote unauthenticated information disclosure through manipulation of the account verification endpoint. An attacker can exploit improper input validation in the verify function of the account service to extract sensitive information over the network. Publicly available exploit code exists, and the vendor has recommended upgrading to address this issue.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the application to known security weaknesses. Authenticated local attackers with high complexity conditions can achieve limited information disclosure and integrity compromise (CVSS 4.6). No active exploitation or public POC identified at time of analysis.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
Information disclosure in FlowiseAI Flowise up to version 3.0.12 allows remote attackers to extract sensitive data through the Login function in the API Response Handler component. The vulnerability requires high attack complexity and is difficult to exploit, but successful exploitation results in confidentiality impact without authentication requirements. No public confirmation of active exploitation has been identified at time of analysis.
HCL BigFix RunBookAI 11.2 contains weak input handling in a text input component that may disclose sensitive information to high-privilege users. The vulnerability stems from continued reliance on less-secure input validation mechanisms, creating operational risk through potential misconfiguration. While the CVSS score is low (2.7) due to requirement for high-privilege access and limited confidentiality impact, the information disclosure channel could expose credentials or operational data to authenticated administrators.
Memory exhaustion denial-of-service in the Linux kernel's ti_fpc202 misc driver allows a local low-privileged user to degrade system availability through a memory leak introduced in the probe function. The root cause is improper release of device tree child node references during driver initialization when iterating over nodes, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). No active exploitation is confirmed - no public exploit identified at time of analysis - and the extremely low EPSS score of 0.02% (4th percentile) reflects the niche hardware dependency and local-only attack surface.
Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.
Resource leak in the Linux kernel's mtk-smi (MediaTek System Memory Interface) driver allows a local, low-privileged attacker on MediaTek SoC-based systems to cause a denial of service by exhausting kernel device references. The driver fails to call put_device() on the SMI device reference obtained during common probe when late probe failure (e.g., -EPROBE_DEFER) or driver unbind occurs, leaving dangling references that accumulate over repeated cycles. No public exploit identified at time of analysis and EPSS at 0.02% (7th percentile) indicates very low exploitation probability; patches are available across multiple stable branches.
Device reference leak in the Linux kernel's MediaTek SMI (mtk-smi) memory driver can cause resource exhaustion and denial of service on affected MediaTek SoC-based systems. The flaw exists in the larb (Local Arbiter) probe path, where a reference acquired during SMI device lookup is never released when late probe failure occurs (e.g., probe deferral) or when the driver is unbound - leaving the kernel device struct's reference count permanently inflated. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is very low and narrowly scoped to hardware running MediaTek SoCs.
Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.
Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The `ghes_new()` function enforces a maximum size check against `GHES_ESTATUS_MAX_SIZE` (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via `cper_estatus_print_section()` triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.
Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The `ceph_zero_partial_object()` function omits the RADOS snapshot context (`snapc`) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.
Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.
Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.
Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.
Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.
Out-of-bounds read in the Linux kernel's EFI/CPER ARM processor error record handler allows firmware-supplied records with a crafted or malformed `section_length` value to cause the kernel to read far beyond the allocated CPER buffer, potentially leaking contents of firmware-mapped memory regions to system logs. Affected systems are ARM-based machines with UEFI/APEI/GHES support running any Linux kernel prior to the patched stable releases (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0). No public exploit has been identified, EPSS is 0.02% (7th percentile), and the vulnerability is absent from CISA KEV.
Host object identity crosses the vm2 sandbox boundary when Promise resolution delivers objects to sandbox callbacks, allowing sandboxed code to mutate host objects and perform identity checks via WeakMap. The vulnerability stems from Promise.prototype.then wrapping that uses ensureThis() for conversion instead of stronger cross-realm proxying; when no prototype mapping exists, ensureThis() returns the original host object unmodified. This sandbox escape affects vm2 versions up to 3.10.5 and is fixed in 3.11.0.
Istio versions prior to 1.28.6 and 1.29.2 allow authenticated attackers to perform Server-Side Request Forgery (SSRF) attacks via RequestAuthentication resources with malicious jwksUri values pointing to internal services, enabling istiod to fetch sensitive data from localhost or link-local IPs and distribute it to Envoy proxies through xDS configuration. The vulnerability requires an authenticated user to create or modify a RequestAuthentication resource, limiting the attack surface to cluster administrators or users with API access. A partial mitigation was released in earlier versions (1.29.1, 1.28.5, 1.27.8) but was incomplete; the complete fix is in versions 1.28.6 and 1.29.2.
OpenEXR versions 3.0.0-3.2.8, 3.3.0-3.3.10, and 3.4.0-3.4.10 suffer from unbounded shift operations in the readVariableLengthInteger() function when parsing variable-length integers from untrusted EXR files. Attackers can craft malicious EXR files with excessive continuation bytes to trigger left shifts exceeding 64 bits on a 64-bit integer, causing undefined behavior that may lead to information disclosure or denial of service. The vulnerability is remotely exploitable without authentication or user interaction against any application processing untrusted EXR input; no public exploit code has been identified at the time of analysis.
Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.
Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.
Kubetail Dashboard prior to version 0.14.0 fails to validate the Origin header on WebSocket connection upgrades, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks. An authenticated user visiting a malicious web page can be exploited to stream their Kubernetes container logs-including credentials, tokens, and PII often present in logs-to an attacker-controlled server. The vulnerability affects both desktop deployments at localhost:7500 and cluster deployments behind HTTP basic auth, with browser ambient credentials automatically attached to the WebSocket handshake.
Tor before version 0.4.9.7 mishandles memory accounting in the conflux out-of-order queue during queue clearing operations, leading to a denial-of-service condition through resource exhaustion. Unauthenticated remote attackers can exploit this via network-level packet manipulation to trigger improper queue state management, causing availability degradation on affected Tor relays and clients. The vulnerability has a low severity CVSS score (3.7) due to attack complexity and availability-only impact, with no confirmed active exploitation at time of analysis.
Tor before version 0.4.9.7 can incorrectly attempt or accept BEGIN_DIR cells over conflux legs, a Tor relay multiplexing feature, enabling potential integrity violations in circuit construction. The vulnerability has a CVSS score of 3.7 (low severity) with impact limited to integrity rather than confidentiality or availability. No public exploit code or active exploitation has been identified at the time of analysis.
Free5GC Access and Mobility Function (AMF) versions up to 1.4.3 fail to enforce 3GPP TS 33.501 §6.9.5.1 concurrent security procedure rules, allowing NAS Security Mode Command (SMC) to execute simultaneously with N2 handover procedures. This causes security context mismatches between the UE and network when SMC activates a new KAMF while N2 HandoverRequest carries Next Hop (NH) and Next Hop Chaining Counter (NCC) derived from the old KAMF, resulting in different KgNB key derivation at the target gNB and UE and breaking access stratum (AS) security integrity. Source code analysis confirms missing cross-procedure validation in SecurityMode() and handleHandoverRequiredMain() functions; packet evidence demonstrates Rule 2 violation (SMC initiated during ongoing N2 handover).
Free5GC Access and Mobility Management Function (AMF) v4.2.1 and earlier fails to verify UE Security Capabilities in NGAP PathSwitchRequest messages, allowing a malicious gNB to overwrite the AMF's stored security algorithm preferences with arbitrary values. These corrupted capabilities are then propagated in PathSwitchRequestAcknowledge and subsequent HandoverRequest messages, causing all inter-gNB handovers for affected UEs to fail due to algorithm mismatches. This results in persistent handover denial-of-service until UE re-registration. The vulnerability is directly contrary to 3GPP TS 33.501 §6.7.3.1 verification requirements and has been demonstrated with a public proof-of-concept using Free5GC v4.2.1 and UERANSIM.
DNS rebinding vulnerability in Gotenberg allows unauthenticated remote attackers to bypass SSRF protections and access internal services via Chromium URL conversion routes. When a URL is submitted for PDF conversion, Gotenberg validates the resolved IP address against a deny-list but discards the pinned result. Chromium then performs independent DNS resolution multiple times, creating a race condition where an attacker controlling DNS can return a public IP during validation and a private IP during connection, allowing access to loopback services, cloud metadata endpoints, or internal networks. Exploitation succeeds approximately 10% per attempt with trivial automation.
Spring Cloud AWS SNS HTTP/HTTPS endpoint handlers (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) in versions 3.0.0-3.4.2, 4.0.0, and 4.0.1 fail to verify the cryptographic signature of incoming SNS messages, allowing unauthenticated attackers who know the endpoint URL to send forged SNS notifications, subscription confirmations, or unsubscribe requests. This enables attackers to trigger arbitrary message processing, auto-confirm malicious topic subscriptions, or force unsubscription from legitimate topics. Fixed in Spring Cloud AWS 4.0.2 with signature verification enabled by default; 3.x line receives no patch and must use workarounds.
Vercel CLI leaks authentication tokens in JSON output when running in non-interactive mode with credentials passed via command-line arguments. Affected versions 50.16.0 through 52.0.0 expose plaintext tokens in suggested follow-up commands when operations cannot complete autonomously, allowing token capture in CI/CD logs and automation transcripts. Information disclosure risk is elevated in automated deployment pipelines where CLI output is logged.
Weblate versions before 5.17.1 allow authenticated users to enumerate translations in projects they cannot access via the screenshots, tasks, and component link API endpoints. An attacker with valid credentials but no project access can probe these APIs to discover the existence and metadata of private translations, leading to information disclosure of project structure and language coverage that should remain hidden. The vulnerability requires authentication but has a low attack complexity, affecting confidentiality only without enabling further compromise.
Hono's bodyLimit() middleware fails to reliably enforce maxSize restrictions on chunked or unknown-length HTTP requests (Transfer-Encoding: chunked), allowing oversized payloads to reach application handlers and return HTTP 200 instead of 413 Payload Too Large. Versions prior to 4.12.16 are vulnerable when handlers do not fully read the request body, read only initial chunks before returning, or catch and suppress read errors. This bypasses the documented guarantee that oversized requests are rejected before business logic execution.
BSON operator injection in ShellHub Community v0.24.1 and earlier allows any authenticated user to crash the device list API endpoint by supplying MongoDB operators as filter field names or sort_by values without input validation. Two attack vectors exist in api/store/mongo/query-options.go: unvalidated filter param.Name values become raw BSON map keys, and the sort_by query parameter is passed directly into a $sort pipeline stage. A validated proof-of-concept exists against v0.24.1. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.06% (19th percentile), indicating low real-world exploitation probability despite a public PoC.
Unauthorized cross-owner data access in Backstage's catalog-backend-module-unprocessed plugin allows any authenticated user to read unprocessed entity records belonging to other teams or owners, bypassing the Backstage permission framework entirely. The vulnerability affects all installations of this optional plugin running versions prior to 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, 0.0.15 of the common package, and 0.2.30 of the UI package. EPSS is 0.03% (7th percentile) and the vulnerability is not in CISA KEV, indicating low exploitation probability; however, in multi-tenant Backstage deployments the data exposure risk is real and no public exploit has been identified at time of analysis.
Timing side-channel in pyquorum's modular multiplication allows remote attackers to recover Shamir secret-sharing values by measuring operation latency. The `mul_mod` function in all versions prior to 0.2.1 uses a binary expansion loop whose iteration count and branch path vary with the Hamming weight of the secret-derived operand, creating a measurable timing oracle. Given sufficient query volume and low-latency network access to an exposed secret-sharing service, an attacker can statistically correlate timing measurements to progressively reconstruct protected secrets. No public exploit code has been identified at time of analysis; EPSS is 0.07% (21st percentile) and the vulnerability is not in CISA KEV.
Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.
Statamic CMS versions before 5.73.21 and 6.0-6.14.x disclose whether an email address is registered via differential responses from the forgot password endpoint, enabling unauthenticated attackers to enumerate valid user accounts and facilitate downstream credential-based attacks. The vulnerability has a CVSS score of 5.3 (low confidentiality impact) and no public exploit code or active exploitation has been identified.
Open redirect vulnerability in Masa CMS allows unauthenticated remote attackers to craft malicious URLs on trusted Masa CMS domains that redirect victims to attacker-controlled sites via improper validation of scheme-relative URLs (paths beginning with //). This can be exploited for phishing attacks and potential token exposure in certain authentication flows. The vulnerability affects versions prior to 7.2.10, 7.3.15, 7.4.10, and 7.5.3, with CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:N/UI:P).
Information disclosure in PicoTronica e-Clinic Healthcare System ECHS 5.7 allows remote unauthenticated attackers to extract sensitive data via the Response Header Handler in the /cdemos/echs/api/v2/ endpoint. The vulnerability has been publicly disclosed with exploit code available, and a patch (version 5.7.1) has been released by the vendor.
Vvveb before version 1.0.8.2 allows unauthenticated remote attackers to disclose sensitive server information including absolute file paths, internal class namespaces, line numbers, and source code excerpts by accessing the admin password-reset endpoint and triggering a fatal error caused by missing namespace imports. The debug exception handler renders full stack traces to unauthenticated requests, enabling reconnaissance attacks without authentication or user interaction. No active exploitation confirmed, but the vulnerability is easily discoverable and exploitable over the network.
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Uninitialized GPU memory disclosure in Google Chrome for Android (prior to 148.0.7778.96) enables a post-exploitation information leak from process memory. Exploitation requires that the attacker has already compromised the renderer process - making this a chained vulnerability, not a standalone entry point. No active exploitation is confirmed (not in CISA KEV, SSVC exploitation status: none), and EPSS sits at 0.03% (8th percentile), consistent with a low-real-world-priority issue despite the C:H confidentiality rating.
UI spoofing via insufficient WebApp policy enforcement in Google Chrome prior to 148.0.7778.96 allows a remote attacker to mislead users about the trustworthiness of browser UI elements by delivering a crafted HTML page. All Chrome users on versions below 148.0.7778.96 are affected across desktop platforms, including those on Red Hat and SUSE Linux distributions. No active exploitation has been identified (SSVC: none; EPSS 0.05%, 16th percentile), and the patch is vendor-confirmed available in the stable channel release.
Side-channel information leakage in the Media component of Google Chrome prior to 148.0.7778.96 enables remote attackers to read partial cross-origin data by enticing a user to visit a specially crafted HTML page. The flaw exploits measurable timing or resource-usage signals during media processing, violating browser Same-Origin Policy isolation at the side-channel level rather than through direct memory access. No public exploit code exists and EPSS exploitation probability is 0.03%, placing this firmly in low real-world priority - though it remains relevant for environments handling sensitive cross-origin data such as financial portals or SSO flows.
UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.
Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.
Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.
Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.
UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.
UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.
Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.
UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.
V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.
UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.
UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.
Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.
Arbitrary read/write in Google Chrome's DataTransfer component prior to version 148.0.7778.96 is exploitable by a remote attacker who has already compromised the renderer process, using a specially crafted HTML page to bypass input validation. This is a chained post-exploitation primitive rather than an initial-access vector - the renderer must already be under attacker control before this flaw becomes useful. SSVC rates exploitation as none and technical impact as partial; EPSS at 0.03% (9th percentile) and the absence of any CISA KEV listing indicate no observed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.
Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.
Uninitialized memory use in Chrome's WebCodecs component exposes potentially sensitive process memory contents to remote attackers via crafted HTML pages. All Chrome versions prior to 148.0.7778.96 are affected, with the flaw requiring only that a victim navigate to an attacker-controlled page. No active exploitation has been identified; EPSS sits at the 7th percentile and SSVC rates exploitation as none, placing this in the moderate-priority tier despite the high confidentiality impact signaled by CVSS.
Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.
Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.
Google Chrome versions prior to 148.0.7778.96 contain insufficient input validation in DevTools that allows remote attackers with a compromised renderer process to leak cross-origin data through crafted HTML pages. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world exploitation but presenting a significant attack chaining vector for multi-stage exploits. Patch available from vendor.
Insufficient input validation in the FileSystem API in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to perform arbitrary file read and write operations through a malicious HTML page. The vulnerability requires prior renderer compromise and user interaction with a crafted page, limiting its attack surface despite network-accessible vectors. Vendor has released a patched version.
Insufficient policy enforcement in DirectSockets API in Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary read and write operations through a crafted malicious Chrome extension. The vulnerability requires user interaction (extension installation) but affects the core security model of the browser's socket access control, exposing local network resources to unauthorized access by untrusted extensions.
Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.
Information disclosure in Google Chrome prior to 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive data from process memory through a race condition triggered by a crafted HTML page. The vulnerability requires renderer process compromise and user interaction but results in high confidentiality impact with no integrity or availability consequences. Chromium security team rates this as Medium severity; no active exploitation has been publicly confirmed.
Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.
Google Chrome prior to version 148.0.7778.96 contains a race condition in shared storage that allows a remote attacker with a compromised renderer process to leak cross-origin data through a crafted HTML page. The vulnerability requires user interaction and renderer compromise but can disclose sensitive information across origin boundaries, classified as medium severity by Chromium security team.
Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.
Out-of-bounds read in Skia graphics library within Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. The vulnerability requires user interaction and relies on renderer compromise, limiting real-world exploitation despite the information disclosure impact. Chromium classified this as Medium severity; no active exploitation has been publicly confirmed.
UI spoofing via insufficient input validation in Google Chrome prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft malicious HTML pages that deceive users about the legitimate UI elements. The attack requires renderer process compromise as a prerequisite and user interaction with the crafted page, limiting real-world applicability to multi-stage attacks. Chromium assessed this as medium severity; no public exploit code or active exploitation has been identified.
Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to perform arbitrary memory read and write operations via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, user interaction, and high attack complexity, making it a post-exploitation vector rather than a primary attack surface. Patch is available from vendor.
Integer overflow in ANGLE graphics library in Google Chrome prior to version 148.0.7778.96 allows remote attackers to leak cross-origin data by delivering a crafted HTML page that triggers the vulnerability. The vulnerability requires user interaction (visiting a malicious webpage) but can bypass same-origin policy protections, exposing sensitive data from other domains. No public exploit code or active exploitation has been confirmed at analysis time.
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.
Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.
UI spoofing in Google Chrome on iOS prior to version 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the browser interface. The vulnerability stems from insufficient validation of untrusted input and has a CVSS score of 5.4 (medium severity). Exploitation requires user interaction with a malicious webpage but can result in information disclosure and denial of service on affected iOS devices.
Uninitialized memory use in Dawn (GPU abstraction layer) in Google Chrome prior to version 148.0.7778.96 allows remote attackers to read potentially sensitive information from process memory by opening a crafted HTML page. The vulnerability requires user interaction (clicking/viewing the malicious page) but no authentication, and has a high confidentiality impact. Chromium security team classified this as high severity; no public exploit code or active exploitation has been confirmed at time of analysis.
Out-of-bounds memory read in Google Chrome's font handling allows remote attackers to leak sensitive information via a crafted HTML page when users visit a malicious website. Chrome versions prior to 148.0.7778.96 are affected. The vulnerability requires user interaction (clicking a link or visiting a page) but occurs over the network without authentication. Information disclosure risk is limited (CVSS C:L) with no impact on integrity or availability, but the Chromium security severity designation of High indicates concern about potential information leakage in real-world exploitation.
HCL BigFix Service Management (SM) leaks sensitive information through improper error handling in its reporting module. Unauthenticated remote attackers can trigger unhandled exceptions by submitting invalid or out-of-range values to the consumer_company parameter during report-viewing requests, exposing application details in error messages. CVSS score is moderate (5.3) but reflects low confidentiality impact with no integrity or availability impact.
PyLoad-ng WebUI discloses internal Python stack traces and source file paths to unauthenticated remote attackers via a global exception handler on the `/web/<path:filename>` endpoint. An attacker can request non-existent templates or craft malformed requests to trigger server exceptions and extract implementation details in HTTP responses without authentication. This information disclosure facilitates reconnaissance for follow-on attacks but does not enable direct code execution or data theft.
Authenticated remote attackers with low privileges can read arbitrary files via insufficient access controls in the web-based management interface of Cisco IoT Field Network Director. Exploitation requires valid login credentials and submission of crafted input through the management UI; successful attacks result in unauthorized file disclosure but do not enable modification or system disruption. No public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated remote attackers can enumerate valid user accounts on Cisco Identity Services Engine through an identity management API endpoint by analyzing differentiated error responses to crafted requests. The vulnerability enables account enumeration with no authentication required, network-accessible attack surface, and low complexity exploitation, resulting in partial information disclosure of valid usernames on affected systems.
FlowiseAI Flowise up to version 3.0.12 allows remote unauthenticated information disclosure through manipulation of the account verification endpoint. An attacker can exploit improper input validation in the verify function of the account service to extract sensitive information over the network. Publicly available exploit code exists, and the vendor has recommended upgrading to address this issue.
HCL BigFix Service Management exposes server banner information containing software versions and system details accessible to adjacent network attackers through a non-default interaction, enabling reconnaissance for targeted attacks against known vulnerabilities. The vulnerability requires adjacent network access and user interaction, resulting in limited confidentiality impact with no integrity or availability consequences. CVSS 2.6 indicates low severity, though information disclosure can facilitate secondary attacks.
HCL BigFix Service Management (SM) contains an insecure or outdated WSGI server implementation that exposes the application to known security weaknesses. Authenticated local attackers with high complexity conditions can achieve limited information disclosure and integrity compromise (CVSS 4.6). No active exploitation or public POC identified at time of analysis.
Credential exposure in HCL BigFix Service Management (SM) version 23 leaves credentials insufficiently protected for a brief window while the application communicates with an internal backend service, which an attacker who can capture that traffic could reuse to authenticate to the backend. The flaw was self-reported by HCL and carries a CVSS 7.5 (confidentiality-only) rating; there is no public exploit identified at time of analysis and EPSS is negligible (0.03%, 8th percentile). CISA's SSVC framing rates exploitation as none and the issue as not automatable, indicating low immediate urgency.
HCL BigFix Service Management fails to sanitize spreadsheet data (CSV, XLS, XLSX) before export, allowing authenticated users to inject formulas or malicious content that executes when recipients open the files in spreadsheet applications. An attacker with legitimate service management access can craft payloads in data fields that, when exported and opened by targeted users, may exfiltrate information or trigger unintended actions-though modern Excel versions mitigate this with untrusted content warnings. CVSS 4.6 reflects moderate risk limited to authenticated users and required user interaction (opening the file).
HCL BigFix Service Management fails to strip EXIF metadata from uploaded images, allowing authenticated users to inadvertently expose sensitive location information and other metadata embedded in image files. The vulnerability requires user interaction (image upload and viewing) but poses a direct confidentiality risk to organizations handling location-sensitive imagery through the application.
HCL BigFix Service Management contains unauthenticated-accessible directories that are not linked in the user interface but can be reached through direct URL access, enabling authenticated users with low privileges to disclose sensitive information or access restricted functionality. The vulnerability requires authenticated access, user interaction, and higher-than-average attack complexity; active exploitation status has not been confirmed.
HCL BigFix Service Management lacks secure X-Content-Type-Options HTTP headers, allowing browsers to perform MIME-type sniffing that could lead to malicious content being interpreted as executable code. The vulnerability requires local authentication, high attack complexity, and user interaction, affecting confidentiality and availability with a CVSS score of 3.7. No active exploitation or public exploit code is documented at time of analysis.
HCL BigFix Service Management (SM) contains a cross-site request forgery (CSRF) vulnerability that allows authenticated users with sufficient privileges to perform unauthorized actions or access sensitive data through malicious web requests. The vulnerability requires user interaction (such as clicking a malicious link) and affects confidentiality but not integrity or availability, resulting in a CVSS score of 2.6. No active exploitation has been publicly reported.
Information disclosure in FlowiseAI Flowise up to version 3.0.12 allows remote attackers to extract sensitive data through the Login function in the API Response Handler component. The vulnerability requires high attack complexity and is difficult to exploit, but successful exploitation results in confidentiality impact without authentication requirements. No public confirmation of active exploitation has been identified at time of analysis.
HCL BigFix RunBookAI 11.2 contains weak input handling in a text input component that may disclose sensitive information to high-privilege users. The vulnerability stems from continued reliance on less-secure input validation mechanisms, creating operational risk through potential misconfiguration. While the CVSS score is low (2.7) due to requirement for high-privilege access and limited confidentiality impact, the information disclosure channel could expose credentials or operational data to authenticated administrators.
Memory exhaustion denial-of-service in the Linux kernel's ti_fpc202 misc driver allows a local low-privileged user to degrade system availability through a memory leak introduced in the probe function. The root cause is improper release of device tree child node references during driver initialization when iterating over nodes, classified as CWE-401 (Missing Release of Memory after Effective Lifetime). No active exploitation is confirmed - no public exploit identified at time of analysis - and the extremely low EPSS score of 0.02% (4th percentile) reflects the niche hardware dependency and local-only attack surface.
Silent error suppression in the Linux kernel's NTFS3 filesystem driver allows a local authenticated user to trigger inode inconsistency by causing attr_set_size() to fail during file truncation. Affected systems running NTFS3-mounted volumes may experience filesystem corruption or denial of service without any visible error signal to the kernel. No active exploitation has been identified (EPSS 0.02%, not in CISA KEV), and vendor-released patches are available in Linux 7.0 and 6.19.6.
Resource leak in the Linux kernel's mtk-smi (MediaTek System Memory Interface) driver allows a local, low-privileged attacker on MediaTek SoC-based systems to cause a denial of service by exhausting kernel device references. The driver fails to call put_device() on the SMI device reference obtained during common probe when late probe failure (e.g., -EPROBE_DEFER) or driver unbind occurs, leaving dangling references that accumulate over repeated cycles. No public exploit identified at time of analysis and EPSS at 0.02% (7th percentile) indicates very low exploitation probability; patches are available across multiple stable branches.
Device reference leak in the Linux kernel's MediaTek SMI (mtk-smi) memory driver can cause resource exhaustion and denial of service on affected MediaTek SoC-based systems. The flaw exists in the larb (Local Arbiter) probe path, where a reference acquired during SMI device lookup is never released when late probe failure occurs (e.g., probe deferral) or when the driver is unbound - leaving the kernel device struct's reference count permanently inflated. With EPSS at 0.02% (7th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is very low and narrowly scoped to hardware running MediaTek SoCs.
Memory allocation underflow in the Linux kernel ASoC SOF (Sound Open Firmware) ipc4-topology module allows local authenticated users to trigger a denial of service via bytes control handling that fails to account for the full data structure size. The vulnerability affects kernel versions prior to specific stable releases (6.6.128, 6.12.75, 6.18.16, 6.19.6, and 7.0) where the allocation size calculation omits the sof_ipc4_control_data structure, potentially causing memory exhaustion or kernel crash when processing audio topology configuration.
Out-of-bounds read in the Linux kernel's APEI/GHES subsystem crashes affected systems when processing malformed or oversized CPER (Common Platform Error Record) data supplied by non-conformant firmware. The `ghes_new()` function enforces a maximum size check against `GHES_ESTATUS_MAX_SIZE` (64KB), but the underlying buffer is allocated using the actual page count from the BIOS CPER table location, which may be smaller; when firmware supplies error data exceeding the allocated buffer, subsequent CPER printing via `cper_estatus_print_section()` triggers a kernel OOPS (level-3 page fault) and system crash. No active exploitation is confirmed: EPSS is 0.02% at the 7th percentile, and this vulnerability is absent from the CISA KEV catalog.
Snapshot data integrity corruption in the Linux kernel's CephFS driver allows a local authenticated user to silently corrupt immutable snapshot content by performing a fallocate hole-punch operation on a mounted CephFS volume. The `ceph_zero_partial_object()` function omits the RADOS snapshot context (`snapc`) when issuing OSD zeroing writes, causing those writes to propagate into snapshot objects rather than being scoped to the live file layer only. Affected environments are limited to those running CephFS mounts with active snapshots; no active exploitation is confirmed (absent from CISA KEV), and EPSS sits at 0.02%, though a developer-supplied reproducer effectively functions as proof-of-concept.
Reference count leak in the Linux kernel's mtk-mdp (MediaTek Media Data Path) driver allows a local low-privileged user on MediaTek SoC hardware to cause incremental resource exhaustion. The missing platform_device_put() call in mtk_mdp_remove() means each driver removal cycle permanently leaks one reference to the VPU platform device, preventing kernel memory reclamation. No public exploit exists and EPSS sits at 0.02% (7th percentile); patches are confirmed across eight stable kernel branches.
Memory exhaustion in the Linux kernel's drm/atmel-hlcdc DRM driver gradually degrades availability on systems using Atmel/Microchip HLCDC display controller hardware. The atomic_destroy_state callback incorrectly releases only framebuffer references while omitting the call to __drm_atomic_helper_plane_destroy_state(), causing drm_crtc_commit objects (64 bytes each) to accumulate in kernel slab memory across every DRM atomic commit operation. Impact is limited to local denial of service through eventual OOM on embedded platforms using SAMA5 SoCs; no public exploit identified at time of analysis and EPSS is 0.02% (7th percentile), reflecting negligible exploitation interest.
Kernel crash in the Linux hfsplus filesystem driver results from a VFS enforcement change (commit af153bb63a33) that requires all inodes to carry a standard file-type mode bit, which hfsplus special inodes (catalog file, extents overflow file, attributes file, etc.) historically did not. Any local user able to trigger access to those special inodes on a mounted HFS+ volume can cause a kernel panic, producing a high-availability denial-of-service. No public exploit code exists and EPSS sits at 0.02% (7th percentile), reflecting low opportunistic exploitation likelihood, but the bug is deterministically reproducible against any unpatched kernel configured with hfsplus support.
Division by zero in the Linux kernel's rtw89 WiFi driver can crash the kernel when beacon interval is zero during beacon tracking. Discovered via fuzz testing, this local vulnerability (AV:L/PR:L) affects systems running any Linux kernel from initial commit through stable branches prior to 6.18.16, 6.19.6, and 7.0. An authenticated local attacker can trigger a kernel panic, resulting in a complete denial of service on the affected host. No public exploit exists and no active exploitation has been observed.
Out-of-bounds read in the Linux kernel's EFI/CPER ARM processor error record handler allows firmware-supplied records with a crafted or malformed `section_length` value to cause the kernel to read far beyond the allocated CPER buffer, potentially leaking contents of firmware-mapped memory regions to system logs. Affected systems are ARM-based machines with UEFI/APEI/GHES support running any Linux kernel prior to the patched stable releases (5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, 7.0). No public exploit has been identified, EPSS is 0.02% (7th percentile), and the vulnerability is absent from CISA KEV.