Suse
Monthly
An unidentified security weakness affects software distributed as part of Ubuntu Linux, based on a report filed by the vendor (Canonical/Ubuntu). Because the description, CVSS metrics, CWE, and CPE data are all absent, the specific impact, attack vector, and authentication requirements cannot be determined; exploitation prerequisites are unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the provided data, and the affected package, feature, or deployment mode must be confirmed through the forthcoming Ubuntu Security Notice or NVD entry before any exposure judgment is made.
Risk cannot be meaningfully assessed for Ubuntu Linux security update CVE-2026-96281 because the affected package, vulnerability type, and impact are undisclosed. The CVE is reported by the Ubuntu vendor with a generic 'security update' description, but no CVSS score, CWE, CPE, or advisory details are available, leaving the attack vector, authentication requirements, and exploitation status unknown. No public exploit has been identified at time of analysis, and no KEV status is indicated.
Ubuntu Linux is the only identified touchpoint for CVE-2026-95290, which was reported through the vendor's own security channel but arrives with an empty description, no CVSS score or vector, no CWE mapping, and no listed affected versions. Because neither the affected package nor the exploitation prerequisites can be derived from the available data, the actual impact - whether local privilege escalation, denial of service, or remote code execution - remains undetermined, and no public exploit identified at time of analysis. Defenders should treat this as an intelligence gap rather than evidence of low severity, and pull the authoritative record from the Ubuntu Security tracker before making any exposure or patching decision.
CVE-2026-95289 is an Ubuntu-tracked security issue whose impact on Ubuntu systems cannot currently be characterized, because no description, CVSS vector, CVSS score, or CWE classification accompanies the record. The only confirmed attribute is provenance: the entry was reported through the Ubuntu vendor channel, which means an Ubuntu Security Notice and a corresponding upstream advisory should exist but were not supplied in the available intelligence. No affected versions, CPE identifiers, references, EPSS score, or KEV status are present, so this analysis cannot state who is exposed, what an attacker gains, or whether exploitation is practical; no public exploit identified at time of analysis, and patch status is likewise undetermined. Per the independent assessment, risk cannot be meaningfully assessed from the available data, and teams should treat this as an unenriched record pending retrieval of the authoritative Ubuntu advisory.
Google Chrome desktop stable-channel builds are affected by a vulnerability that Google addressed in its September 2026 stable-channel release, with the specific triggering component, root cause, and severity not disclosed in the available intelligence. Realistic exploitation would require a victim to browse to or render attacker-controlled web content in a browser that has not yet applied the fix, making user interaction the primary limiting factor, while Chrome's silent auto-update mechanism confines exposure largely to installations that have not yet restarted or updated. There is no public exploit code identified at time of analysis and no CISA KEV listing, and with no CVSS vector, no CWE, and no EPSS probability available, the risk cannot be scored quantitatively from the supplied data.
Google Chrome desktop users on the stable channel are affected by CVE-2026-95346, a flaw that Google addressed through a Stable Channel Update for Desktop documented on the Chrome Releases blog. The supplied advisory is the only reference, and no description, CVSS score, CWE, or CPE data accompanies this CVE, so the specific vulnerability class, affected build range, and impact cannot be confirmed from the available intelligence; exploitation prerequisites are likewise unconfirmed. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available per the Chrome Releases advisory, so the primary exposure is the window between patch publication and the user restarting the browser. Because the CVSS vector is absent, authentication requirements cannot be confirmed from available data, and remote unauthenticated default-configuration exploitation should not be assumed.
CVE-2026-95342 cannot be characterized beyond its origin: the record is attributed to the Ubuntu vendor source, but no description, CVSS vector, CWE, or CPE data has been published, leaving the affected package, affected versions, and achievable attacker impact entirely unidentified. No CISA KEV entry and no public exploit code are associated with this identifier, so there is no public exploit identified at time of analysis; equally, no EPSS-style likelihood can be derived without a description or score. Ubuntu administrators should treat this as an intelligence gap rather than a confirmed threat and monitor the vendor advisory channel for the first substantive disclosure.
Impact for CVE-2026-95295 cannot be determined from the available data: the record is tracked by the Ubuntu security team against a package distributed with Ubuntu Linux, but it carries no description, no CVSS vector, and no CWE classification, so the attack vector, required privileges, and user interaction requirements are all unconfirmed. Because no exploitation evidence, KEV listing, or public proof-of-concept is provided, there is no public exploit identified at time of analysis, and the EPSS-style risk signal is absent. The practical consequence is that prioritization must be deferred until the Ubuntu CVE tracker and the corresponding upstream advisory are consulted to identify the specific package, the affected release(s), and whether default installations are exposed.
Ubuntu is tracking CVE-2026-95340, but the intelligence available for this analysis contains no description, CVSS vector, CWE class, affected package name, or version range, so neither the impact nor the attack surface can be characterised at this time. No public exploit code and no evidence of active exploitation were identified at time of analysis, which reflects an absence of data rather than a confirmed low risk. The Ubuntu Security tracker entry for this CVE is the authoritative source and must be retrieved before any exposure or prioritisation decision is made.
Google Chrome on the stable desktop channel is the affected product in CVE-2026-95361, an entry for which a vendor fix is indicated as available via a Chrome Releases stable-channel update. The intelligence record is unusually thin: no description, no CVSS score or vector, no CWE, no CPE, no EPSS probability and no CISA KEV listing were supplied, so the specific defect class, attack vector and privilege requirements cannot be stated. No public exploit code has been identified at time of analysis, and the Ubuntu vendor attribution plus the Chrome Releases advisory reference indicate this is a coordinated upstream-then-distributor patch flow rather than an actively exploited event.
Exploitation and impact for CVE-2026-95294 cannot be established from the available intelligence: the description is empty, no CVSS score or vector was assigned, no CWE mapping was provided, and no EPSS or KEV signal accompanies the record. The single traceable data point is the reporter field, which designates Ubuntu as the reporting vendor, meaning the affected component is most likely an Ubuntu-maintained package with a corresponding Ubuntu Security Notice (USN) that has not yet been surfaced in this dataset. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), so any characterization of severity - remote versus local, authenticated versus unauthenticated, code execution versus denial of service - would be speculation until the USN and NVD entry are reviewed.
Impact cannot be characterized for CVE-2026-95303 because the record supplies no description, no CVSS score or vector, no CWE mapping, and no CPE or version identifiers - the only usable signal is a reporting attribution to the Ubuntu vendor source. Because neither the affected component nor the attack prerequisites are known, no exploitability determination is possible; no public exploit is identified at time of analysis, and this should not be read as evidence that none exists. Treat this entry as unresolved and retrieve the authoritative Ubuntu Security Notice or the upstream NVD record before making any exposure, prioritization, or remediation decision.
Google Chrome desktop builds are affected by a security weakness corrected in a Chrome Releases stable-channel update, but the vulnerability's description, CVSS score, CVSS vector, and CWE are all absent from the available intelligence, so the precise impact class (for example memory corruption, type confusion, or a sandbox escape) cannot be confirmed from this dataset. Consistent with the affected product and the referenced advisory, the most plausible exploitation path requires a victim to run an unpatched Chrome desktop build and load attacker-controlled web content, with user interaction via visiting a malicious or compromised page; authentication requirements are not confirmed from available data. No public exploit identified at time of analysis and no CISA KEV entry is present, while a vendor patch is available, which confines practical risk to installations that have not yet applied the stable-channel update.
Google Chrome desktop (stable channel) installations are affected by CVE-2026-95327, a security defect for which Google has published a stable-channel update and a patch is available from the vendor. Because no description, CVSS score or vector, or CWE was supplied with this CVE, the precise impact, attack vector, and affected version range cannot be established from the available intelligence; the only concrete signal is that a vendor fix exists, so residual exposure is confined to unpatched installations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score or CISA KEV entry was provided to indicate elevated real-world risk.
CVE-2026-95300 is currently an unpopulated record: the supplied intelligence contains no description, no CVSS score or vector, no CWE classification, and no CPE data, so the flaw's nature and impact cannot be characterized at this time. The single attribution available is that the record was reported by the Ubuntu vendor source, which suggests Ubuntu may be the coordinating or affected vendor, but no package, version, or component is identified. With no KEV listing and no public exploit code referenced in the input, there is no public exploit identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Google Chrome desktop (stable channel) builds predating the September 2026 stable-channel update carry a flaw that the vendor has already fixed, but the available intelligence contains no description, CWE, or CVSS vector, so the precise impact cannot be characterized from the supplied data. The affected component is the Google Chrome stable desktop browser, and exploitation would require the victim to run an unpatched build and, in most realistic scenarios, to load attacker-controlled web content, meaning user interaction is likely a prerequisite. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided to quantify exploitation likelihood; the principal mitigating factor is that the fix is already shipping through Chrome's automatic update mechanism, which sharply limits the exposure window for most managed and consumer deployments.
Google Chrome desktop (stable channel) is affected by a vulnerability that is documented only through Google's stable-channel release advisory, with no accompanying description, CVSS score or vector, CWE mapping, EPSS probability, or KEV listing available at time of analysis. Because the technical details of the underlying flaw are absent, the concrete impact on confidentiality, integrity, or availability cannot be characterized, and the only independently confirmed facts are the affected product (Chrome desktop stable) and that a vendor patch exists. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data; as with most Chrome browser issues, the practical limiting factor is that exploitation typically requires the victim to load attacker-controlled web content rather than being reachable without interaction. Organizations should treat this as a patch-management item and apply the current stable-channel update rather than as an immediate emergency, while acknowledging that the risk assessment is based on very limited signal.
Google Chrome desktop builds are the subject of a stable-channel security release documented in Google's Chrome Releases advisory, referenced under CVE-2026-95363, which was reported by the Ubuntu vendor channel. The record is effectively a data void: no description, CVSS score or vector, CWE, or CPE data were supplied, so raw severity cannot be computed and the affected feature, attack vector, and whether user interaction is required remain unconfirmed. There is no public exploit identified at time of analysis and no CISA KEV listing, while a vendor patch is available per the vendor-reported patch data; treat this as an undetermined-severity item until the advisory and NVD record are populated, and apply the Chrome stable-channel update as the primary action.
Google Chrome's desktop stable channel is affected by an unspecified security defect that has been addressed in a vendor-released stable channel update (referenced via the Chrome Releases blog). Details of the underlying bug are not publicly characterized in the available data: the CVE carries no description, no CVSS score or vector, no CWE mapping, and no EPSS probability, so the precise attack surface, prerequisite configuration, and worst-case impact cannot be determined from the supplied intelligence. There is no CISA KEV listing and no public exploit identified at time of analysis, and because a patch is already available from the vendor and Chrome ships with an automatic update mechanism, real-world exposure is effectively bounded to installations that have not yet been updated.
Ubuntu is the only product context associated with CVE-2026-95320, attributed solely through a vendor-coordination credit to the Ubuntu security team, and no description, affected package, version range, or vulnerable component has been published. Because the record carries no CVSS score or vector, no CWE assignment, no CPE identifiers, no EPSS estimate, no CISA KEV listing, and no public exploit code, the impact and attack prerequisites are entirely unknown and cannot be inferred. No public exploit has been identified at time of analysis, and no vendor-released patch has been identified at time of analysis; this entry should be treated as an unresolved placeholder to be re-triaged once the CVE record and the corresponding Ubuntu advisory are published.
Peer-identity verification bypass in the mdtls DTLS library causes a failed certificate/peer-identity check to be treated exactly like a successful one, allowing a man-in-the-middle to impersonate the intended peer to any client that relies on mdtls for authentication. The assessed impact is high for confidentiality and integrity with no availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but exploitation is conditional: the attacker must already hold an active interception position between the mdtls client and its peer, such as an adjacent-network foothold, a hostile Wi-Fi or gateway, or DNS/ARP/BGP redirection, and must present a substitute certificate. There is no public exploit identified at time of analysis and no vendor-released patch identified in the available data; the issue was reported through the Ubuntu vendor channel, and authentication requirements are not confirmed from available data.
No impact statement can be made for CVE-2026-95321: the record carries an empty description, no CVSS score or vector, no CWE, no references, and no EPSS, KEV, or POC signals, so neither the vulnerable component nor the consequence of exploitation is defined. The single attribution is a vendor:ubuntu report, which indicates the CVE was surfaced through Ubuntu's security tracking channel but does not identify the affected package, source component, or upstream project. Authentication requirements, deployment prerequisites, and attack vector are all unconfirmable from the available data, and no public exploit code has been identified at time of analysis. Analysts should treat this as an intelligence gap requiring verification against Ubuntu security notices rather than as a validated vulnerability with a known severity.
Risk cannot be meaningfully assessed for CVE-2026-95323 because the record contains no description, no CVSS score or vector, no CWE mapping, and no affected-product identifiers, leaving a vendor attribution to Ubuntu as the only intelligence available. With no information about the vulnerable component, its deployment mode, or the attacker's required position, no impact statement, authentication requirement, or exploitation precondition can be derived. There is no public exploit identified at time of analysis, and this should be handled as an unenriched placeholder record that is re-evaluated once NVD or the Ubuntu security team publishes a description and severity metrics.
Google Chrome on desktop is the confirmed affected product, with the fix delivered through the September 2026 stable-channel update documented on the Chrome Releases blog, yet the underlying flaw cannot be characterized from the available record because no description, CVSS vector, or CWE was provided. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS signal was supplied, so no public exploit identified at time of analysis. Because the affected component, version range, and any required user interaction or sandbox-escaping prerequisites are unknown, severity remains unquantified and defenders should treat the vendor advisory as the authoritative source rather than inferring impact from this entry.
CVE-2026-95305 cannot be meaningfully risk-assessed because the record is a near-total data void: the description is '[Unknown description]', and no CVSS score, CVSS vector, CWE, references, CPE data, EPSS score, KEV status, or POC data accompanies it. The single intelligence signal available is the reporting source - vendor:ubuntu - which indicates an Ubuntu-associated report or packaged component but does not establish the upstream project, the vulnerable feature, the affected version range, or the attacker's required position. Consequently, whether exploitation requires authentication, user interaction, or a non-default configuration is unknown, and no public exploit code has been identified at time of analysis - a statement that reflects missing evidence rather than a confirmed negative.
Unspecified security defects in the Google Chrome desktop browser (stable channel) are addressed by the September 2026 stable-channel update, which is the only substantive technical anchor available for CVE-2026-95364. Affected parties are organizations and users running pre-update Chrome desktop stable builds, including Ubuntu-packaged deployments given that the issue was reported by vendor:ubuntu; the vulnerability class, attack vector, and authentication requirements cannot be confirmed because no description, CVSS vector, or CWE was supplied. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; EPSS and NVD data are unavailable, so severity cannot be independently graded.
Google Chrome on the desktop stable channel is the only affected product identified by the supplied intelligence, which consists of a single Chrome Releases stable-channel advisory, and the specific vulnerability class, affected component, and impact are not disclosed in the available data. No CVSS score or vector, CWE, EPSS probability, or KEV listing accompanies this record, so severity cannot be quantified and the exploitation prerequisites remain unconfirmed; there is no public exploit identified at time of analysis. Because a fixed build is already published, residual risk is chiefly a patch-rollout problem - users remain exposed only until they move to the patched stable-channel version - and no exploitation activity, in-the-wild evidence, or proof-of-concept has been reported in the data provided.
Risk cannot be meaningfully assessed from the available data - CVE-2026-95275 exists only as a bare record attributed to the Ubuntu vendor source, with no description, no CVSS vector, no CWE classification, and no affected-product identification. Because neither the vulnerable component nor the attack surface is known, it is impossible to state what an attacker could accomplish, which Ubuntu release or package is implicated, or whether exploitation would require authentication, local access, or user interaction. The record carries no CISA KEV listing, no publicly available exploit code, and no EPSS signal, so the only defensible posture is to treat the identifier as unverified and pending enrichment from NVD or the Ubuntu security advisory before any risk statement is issued.
Google Chrome (desktop stable channel) is affected by a security defect for which the vendor has published a fix as part of its September 2026 Stable Channel Update, the single reference attached to this CVE. The record contains no description, no CVSS vector, and no CWE, so the specific vulnerable component, the attack vector, and any required user interaction are undetermined from the available data; based only on the product identity, the most plausible exploitation path would be a victim rendering attacker-controlled web content in the browser, but that is an inference rather than a stated condition. Authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis; the vendor patch is available and Chrome's auto-update mechanism deploys it without user action.
A denial of service in Netdata Agent versions prior to 2.10.4 lets an authenticated streaming child agent crash the parent Netdata agent that collects its metrics, repeatedly disabling centralized monitoring. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must already be an accepted child in the parent-child streaming topology and then sends an oversized CHART SLOT value in the plugins.d streaming protocol; the parent parses it as a chart-cache index, attempts an approximately 16 GiB allocation for the chart-pointer array, fails, and aborts via fatal(). There is no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis (the vulnerability is not in CISA KEV); the real risk is bounded and operational, concentrated in deployments that accept streaming children and in multitenant or partially trusted streaming setups.
An authenticated Netdata child agent can crash its parent agent by streaming an oversized DIMENSION SLOT value in the plugins.d protocol, triggering an integer overflow that leads to a heap out-of-bounds write and termination of the parent process. Affected deployments are Netdata parent-child streaming setups running versions prior to 2.10.4 (including nightly builds earlier than 2.10.0-782-nightly); the attacker must already control or have compromised a child agent that is authenticated to the parent, so exploitation is limited to denial of service with no confidentiality or integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is moderate rather than urgent, and it is fully closed by upgrading to the fixed release.
Unauthenticated writes to the Netdata settings store are possible in versions 2.0.0 through 2.10.x because the /api/v3/settings endpoint was registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, letting remote callers send PUT requests that bypass the operator-configured 'allow dashboard from' IP allowlist. An attacker with network reachability to the agent's HTTP/dashboard listener (default TCP 19999) can persist attacker-controlled JSON into {varlib}/settings/default.json, tamper with its version counter, and repeatedly push near-20 MiB payloads to exhaust disk space, though the file does not govern data collection or security policy. Impact is capped at low integrity and low availability (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L); no public exploit code was identified at time of analysis and there is no evidence of confirmed active exploitation. The issue is fixed in Netdata 2.11.0.
Privilege escalation in GNU C Library (glibc) 2.14 through 2.44 stems from a TOCTOU race in ld.so when expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs. A local low-privileged (PR:L) attacker can exploit this only where fs.protected_hardlinks is disabled and a suitable setuid/setgid binary exists, by hard-linking the binary and winning a race to swap an intermediate path component for a symlink so the loader loads an attacker-controlled shared object with the program's elevated privileges. No public exploit identified at time of analysis; major Linux distributions enable fs.protected_hardlinks by default, sharply limiting exposure.
Deleted or deprovisioned users can retain authorization on hosts running SSSD with the LDAP access provider when ldap_access_order includes ppolicy or lockout, because a user lookup that returns zero results trips a fail-open path that reports success and caches an allow decision. A remote attacker who already holds valid account context on the SSSD-managed host (authenticated, PR:L) can exploit this after offboarding to keep reading information and make limited modifications, giving low confidentiality and integrity impact (CVSS 3.1 5.4 Medium). The flaw only affects non-default access configurations that explicitly enable ppolicy/lockout ordering, and no public exploit identified at time of analysis.
Denial of service in radare2 prior to 6.2.0 lets a crafted NE (New Executable) binary hang the tool indefinitely by driving the relocation fixup-chain parser into an unbounded loop that allocates a fresh relocation object on every pass, exhausting CPU and memory until the process is killed or the user aborts it. The attack is local and requires the victim to open the attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), with availability impact only and no confidentiality or integrity effect, so this is a genuine but low-urgency issue. No public exploit code was identified at time of analysis and the flaw is fixed in version 6.2.0.
radare2 versions prior to 6.2.0 can leak uninitialized or adjacent heap memory into JSON output, and may crash the process, when an analyst runs the explicit pFB or pFBj print command over an attacker-supplied binary property list. The root cause is an under-allocated, non-NUL-terminated UTF-8 conversion buffer in the binary-plist Unicode parser (CWE-125, out-of-bounds read) that the JSON encoder then scans as a C string. All signals agree this is a low-priority local issue: the CVSS vector is AV:L/PR:N/UI:R with only low confidentiality and low availability impact, there is no network vector, no privilege gain, and no write or code-execution primitive; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released fix: 6.2.0.
Denial of service in radare2 versions prior to 6.2.0 allows an attacker to exhaust memory and processing time in the analyst's session by supplying a small crafted full-memory Windows crash dump (dmp64 format), which the 64-bit dump parser opens without validating input-controlled page counts against the actual file size. Exploitation is local and requires user interaction - a victim must open the malicious dump (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - and the impact is confined to availability, with no code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Loading a crafted Apple Preferred Executable Format (PEF) file into radare2 prior to 6.2.0 can consume excessive CPU and stall or hang the analysis session, because the PEF loader accepts relocation-section counts that are not validated against the number of sections or the relocation records actually present in the input. The bug is reached through normal binary-format auto-detection, so simply opening or auto-analyzing the malformed file is sufficient; the attack is local and needs user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and results only in denial of service, with no confidentiality, integrity, or code-execution impact and no network-reachable attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in radare2 6.2.0.
Opening a crafted ELF binary with radare2 or rabin2 before version 6.2.0 can drive a heap out-of-bounds read in the ELF parser and terminate the process, giving anyone who can supply the file to an analyst a local denial of service (CWE-125, CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:H). The trigger is a program-header count of 0xffff (ELF's PN_XNUM sentinel) paired with a small real count in shdr[0].sh_info: the parser allocates the program-header array using the resolved count while several consumers still iterate over the original 65535 value, reading past the allocation. Exploitation requires the user to open an untrusted binary, no public exploit code or confirmed in-the-wild activity has been reported, and memory disclosure or code execution has not been demonstrated, so the practical impact is a crash of the analysis process rather than a compromise.
Heap memory corruption and denial of service in radare2 versions prior to 6.2.0 occur when the CPython .pyc marshal parser processes a crafted bytecode file that declares a string length of 0xffffffff, wrapping the size-plus-one allocation to zero before attacker-controlled data and fill bytes are written past the heap buffer. Exploitation is local and requires user interaction - an analyst must open or inspect the malicious .pyc with r2 or rabin2 - and no privileges are needed per the CVSS vector (AV:L/PR:N/UI:R), with impact confined to corrupting or crashing the analysis process. Arbitrary code execution is possible in principle but has not been demonstrated, no public exploit code has been identified at time of analysis, and the 5.5 CVSS score reflects a genuinely low-priority issue for most environments. Only workflows that routinely open untrusted .pyc files (malware analysis, CTF, reverse-engineering) are realistically at risk.
A local out-of-bounds read in radare2 6.0 and earlier (fixed in 6.2.0) can crash or corrupt the analysis session when an analyst opens a crafted Mach-O binary containing Swift type or class metadata. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), reflecting a 4-byte read immediately before the allocated field-metadata buffer that yields at most a process termination or incorrect metadata processing - no attacker-observable memory disclosure has been demonstrated, and the 'Information Disclosure' tag on this record is not substantiated by the advisory. Exploitation requires the victim to deliberately load an untrusted Mach-O file (user interaction), and there is no remote or unauthenticated path; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Malformed ZeroMQ AUX_DATA control messages can terminate the Decode worker's control thread in SGLang 0 through 0.5.15, letting an unauthenticated attacker who can reach the Decode control PULL socket take the inference server offline. The flaw is a missing input-validation check on the control-message path (availability-only impact; no data exposure or code execution), and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H for a base score of 5.9. Exploitation is realistic only where the Decode control socket is exposed beyond localhost in disaggregated or multi-node deployments, which is why the attack complexity is rated High; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
HTTP response splitting in the Dancer2 Perl web framework before version 2.2.0 allows an attacker to inject arbitrary response headers and split an HTTP response when an application derives a response header NAME from request-controlled data: Dancer2's headers_to_array routine strips CR and LF from header values but not from names, so a crafted name reaches the PSGI server intact and, if that server does not validate header keys, the bytes following the CRLF are written to the wire as their own header line. The issue is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), but exploitation is gated by two concrete application-specific preconditions - the app must reflect attacker input into a header key rather than a value, and the underlying PSGI server must fail to reject malformed keys - so default deployments are generally not vulnerable. No CISA KEV entry exists and no public exploit code was identified at time of analysis; EPSS is 0.19% (9th percentile) and CISA SSVC records exploitation as none and automatable exploitation as no, so all signals converge on low real-world priority despite the Medium CVSS.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
Loading a crafted .yrc compiled rules file crashes YARA 4.5.8 (libyara) by driving an internal assertion to abort, giving an attacker a denial-of-service primitive against any process that parses untrusted compiled rules. The malicious file declares num_buffers=0 in its arena header, which reaches yr_arena_get_ptr() in libyara/arena.c and trips a failed assertion, terminating the host application. Exploitation is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) and publicly available exploit code exists per the SSVC assessment (Exploitation: poc), though no confirmed active exploitation in CISA KEV has been reported and EPSS is low at 0.20% (10th percentile). Impact is limited to availability (process crash) with no confidentiality or integrity loss and no privilege escalation.
Ubuntu Linux is the affected platform for CVE-2026-92162, which was reported through the vendor's own security-update channel, but the available record does not disclose the vulnerable package, the component involved, or the conditions an attacker would need to exploit it. No CVSS score or vector was published, so the attack vector, privilege requirements, and user-interaction prerequisites cannot be confirmed from the supplied data. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS signal accompanies this record; the practical risk cannot be meaningfully estimated until the associated Ubuntu Security Notice (USN) is retrieved and read.
Parsing a crafted, malformed YAML document with yaml-cpp 0.9.0 can underflow the scanner's indentation stack, crashing the parser and potentially leaking small amounts of process memory. The trigger is an unverified simple key - for example a plain scalar that spans a line break - which leaves a stale reference to an indent level that is subsequently popped, driving Scanner::PopAllIndents() past the bottom of the stack (CWE-822, untrusted pointer dereference); the practical outcome is a denial-of-parse/crash with at most Low confidentiality impact. Only yaml-cpp 0.9.0 is implicated, the consuming application must actually parse untrusted YAML for the bug to be reachable, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 5.1) reflects that local access requirement; EPSS is a low 0.28% (21st percentile) and there is no public exploit code identified at time of analysis, only a crash reproducer documented in upstream issue #1475 and fixed by pull request #1476.
Denial of service in vLLM through 0.29.0 allows remote, unauthenticated attackers to exhaust the Mooncake connector's sender task pool by submitting prefill requests that are rejected before engine admission, causing legitimate KV-cache transfers to be delayed by up to roughly 480 seconds while the service's health checks keep reporting success. The issue only affects deployments running disaggregated prefill/decode with the MooncakeConnector KV-transfer backend (kv_producer/kv_consumer roles), which is a specialized, non-default topology rather than a standard single-node vLLM serve; a standard vLLM installation is not exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis - the VulnCheck advisory and an upstream GitHub pull request (PR #51236) that adds an orphan-transfer timeout constitute the primary public signals, and impact is bounded to availability degradation rather than crash, data disclosure, or code execution.
Path-confusion access-control bypass in Envoy Proxy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 allows remote, unauthenticated clients to reach resources that a path-based Envoy policy (path-based route selection or path-based authorization) intended to protect. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource, so a request like /admin;x=1 is matched by Envoy against an unprotected fallback route while the backend still serves the protected resource; Envoy's legacy ignore_path_parameters_in_path_matching option only truncates at the first semicolon and does not reproduce per-segment backend behavior. Exploitation is conditional (it requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment) and the assessed impact is limited to Low confidentiality with no integrity or availability effect; no public exploit identified at time of analysis.
Path confusion in Envoy Proxy lets remote, unauthenticated clients bypass path-based authorization and routing policy by attaching semicolon parameters to dot and dotdot segments - a request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled, so a client can present one path to Envoy's policy engine and a different effective path to the upstream. The security consequence materializes only when Envoy itself makes a path-based RBAC or routing decision on the uncollapsed value, or when a downstream/upstream collapses the segment per RFC 3986 while Envoy does not; without such a mismatch the exposure is limited to low-confidentiality impact. The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no public exploit code was identified at time of analysis and no CISA KEV or EPSS signal was provided. Note that the attached tag reads 'Authentication Bypass', but the assessed impact is a moderate-severity access-control (path confusion) bypass, not an authentication bypass.
A stack buffer overflow in libstoragemgmt's SCSI VPD page 0x80 serial-number parser lets an attacker who controls a local or virtual storage device crash or destabilize the host process that enumerates that device, yielding a denial of service with no confidentiality or integrity impact (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5). Exploitation requires low privileges on the host (PR:L, so an authenticated/local actor) plus the ability to attach or present a device, and it only triggers when the affected process actually queries the device's serial number - the vector is local, not remotely reachable over a network. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the practical risk is concentrated in environments that enumerate untrusted or attacker-attachable storage, such as multi-tenant virtualization or hosts that accept hostile removable, iSCSI, or hypervisor-presented disks.
Process termination in Envoy Proxy affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 when a scoped IPv6 address (for example fe80::1%1) reaches either the ORIGINAL_DST transparent-proxy cluster path or a QUIC client connection undergoing port migration; the address is re-serialized with its percent scope suffix and then handed to inet_pton, which cannot parse it, so an EnvoyException is thrown and the process aborts. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.3), meaning an unauthenticated remote condition can be reached without user interaction but only under narrow, topology-dependent prerequisites, and impact is availability-only - there is no confidentiality or integrity loss. This is a genuine but conditional availability-only issue: it is not a default configuration (transparent proxying with ORIGINAL_DST, or QUIC, must be in use and the destination must actually be a scoped/link-local IPv6 address), no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal was supplied with the data.
Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.
File owners on Nextcloud Server cannot release TYPE_TOKEN file locks that other users have placed on their files, leaving the file locked with no in-product recovery path; administrators currently have to clear the orphaned lock directly in the database. The defect is an access-control gap (CWE-284) reachable over the network by any authenticated user who can acquire a token lock, typically in shared-folder or multi-user collaboration scenarios, and it is availability-only - no confidentiality or integrity impact - as reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. No public exploit code has been identified and there is no evidence of active exploitation, so despite a 6.5 base score this behaves as an accidental or malicious file-lockout rather than a scalable remote attack.
Stack-based buffer overflow in fetchmail when built with NTLM support allows a malicious or compromised mail server to trigger memory corruption by sending a crafted NTLM Type 2 challenge, potentially leading to remote code execution, authentication failure, or process termination. Exploitation requires fetchmail to be built with NTLM and configured to authenticate via NTLM against an attacker-controlled or man-in-the-middle'd server; no public exploit code or active exploitation has been identified. The flaw carries a CVSS score of 8.1 with high confidentiality, integrity, and availability impact, though reliable RCE is limited by stack-frame layout and modern memory hardening (stack canaries, ASLR, FORTIFY_SOURCE) on RHEL builds.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Out-of-bounds writes in the Triton bincount sampling kernel of vLLM through 0.29.0 let unauthenticated remote clients corrupt a neighboring request's repetition-penalty state by submitting multimodal audio input that contains a token ID equal to the model's vocabulary size. The root cause is an unvalidated array index (CWE-129): prompt and output token IDs are used to index the penalty prompt-presence bitset and output bin counts without any bounds check against vocab_size, so a one-past-the-end token spills into the adjacent request's mask/count rows. Impact is integrity-only and confined to altered repetition-penalty behavior for concurrently served requests - there is no code execution, data disclosure, or denial of service - and exploitation requires a CUDA GPU with compute capability >= 8.0, a multimodal model accepting audio tokens, and concurrent traffic in a shared, multi-tenant deployment; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Sampling-parameter validation in vLLM before 0.29.0 checks the allowed_token_ids allowlist against the tokenizer vocabulary size instead of the model's output logits width, so a remote client calling the OpenAI-compatible inference API can supply token IDs that are valid for the tokenizer but out of range for the model output (the advisory's cited case is a multimodal model with 128257 tokenizer tokens versus 128256 output logits). Those out-of-range IDs pass validation and reach the GPU sampling path, where LogitBiasState's Triton logit-bias kernel indexes past the valid logits row and corrupts shared GPU logits state, causing concurrent victim requests in the same batch to sample tokens outside their own allowlists. The impact is limited to sampling-constraint integrity (no data disclosure, crash, or code execution) in shared or multi-tenant deployments, and it is inert on models whose tokenizer and output vocabularies are the same size; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
An out-of-bounds write in osmo-ggsn 1.14.0 allows a remote, unauthenticated sender of GTP signalling to corrupt process memory by delivering a PDP context whose GSN-Address sub-field is malformed; the decoder writes length-driven data without adequately bounding it to the destination buffer. The practical impact is availability-oriented - the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) indicates a low-complexity remote trigger that can crash or destabilise the GGSN, with a limited integrity effect, rather than a confirmed confidentiality breach. No public exploit code identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC records Exploitation as 'none', though Automatable is 'yes'. Vendor/reference commit-level fix code is available upstream.
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local user to read plaintext VM credentials - including passwords - that the component passes directly on process command-line arguments during VM creation or installation. Exploitation is timing-dependent: the secret is only readable while a provisioning operation is in flight, and it also requires that /proc process arguments remain visible to other users (i.e., the host is not hardened with a hidepid-style mount option), so risk concentrates on multi-user or shared virtualization hosts. It yields no code execution and no privilege escalation, but a disclosed password compromises access to the affected VM; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local attacker who can enumerate other users' process arguments to read guest VM installation credentials such as rootPassword and userPassword. The credentials are passed by install_machine.py as a JSON command-line argument during VM creation, so exposure is limited to the window while an administrator's installation workflow is running and depends on the host's process-visibility policy (e.g. /proc without hidepid=2). Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires local access plus a concurrently active install and cannot be triggered remotely or unauthenticated.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
Improper UTF-8 percent-decoding in uri-js through 4.4.1 lets remote, unauthenticated attackers feed crafted percent-encoded URIs that the library converts into ASCII metacharacters such as '/', '\', '.' and CRLF, enabling downstream path traversal or CRLF injection wherever the decoded output is consumed without re-validation. The flaw is remotely triggerable with no authentication or user interaction (CVSS:4.0 base 6.9; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), but real-world harm is constrained by the consuming application: no code execution, no availability impact, and no effect at all if the downstream code re-validates the decoded string. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is currently a latent input-neutralization weakness for applications that treat uri-js output as already-sanitized rather than a live exploitation campaign.
Denial of service in AnyIO versions prior to 4.14.2: the process-pool implementation behind to_process.run_sync() starts worker processes with stderr wired to a pipe that the parent never drains, so a worker that writes more than the roughly 64 KiB pipe buffer to sys.stderr blocks on write() before it can return its stdout protocol response, leaving the awaiting process-pool call hung indefinitely. Applications are exposed only if they actually use AnyIO's process pool and run worker functions whose stderr volume can be driven by untrusted or faulty input - for example verbose tracebacks or logging produced by attacker-influenced data - while code paths that never touch to_process, or that already close/redirect worker stderr, are unaffected. Impact is limited to availability (hang), with no confidentiality, integrity, or code-execution effect, and per the vendor and independent assessment this is a local, low-privilege-scoped flaw (CVSS:4.0 AV:L/PR:L and CVSS:3.1 AV:L/PR:L, A:H); no public exploit code exists and no active exploitation has been confirmed (no public exploit identified at time of analysis).
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Certificate revocation checking in the OCSP client shipped with Red Hat Build of Apache Camel for Spring Boot 4 can be bypassed because the client does not verify the OCSP-signing Extended Key Usage (EKU) on the certificate that signs an OCSP response, allowing a revoked certificate that still chains to a trusted CA to be accepted as valid. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), although exploitation is conditional: the deployment must actually rely on this OCSP client for revocation checking and the attacker must already possess a revoked-but-chainable certificate. No public exploit identified at time of analysis, and this is assessed as a genuine but moderate-priority integrity flaw rather than a high-urgency issue.
A signed/unsigned type mismatch in Netty's Memcache binary protocol codec desynchronizes frame boundaries, allowing an unauthenticated, network-positioned attacker to smuggle responses across a shared or proxied memcache connection (CVSS 3.1 base 6.5, Medium). The flaw is reachable only when the Memcache binary codec is explicitly wired into a network-exposed Netty pipeline - a non-default configuration - and the affected code ships inside Red Hat Fuse 7, JBoss Enterprise Application Platform 7, Single Sign-On 7, and the Red Hat Build of Apache Camel for Spring Boot 4. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not in CISA KEV); impact is limited to confidentiality and integrity (C:L/I:L) with no availability effect.
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Cross-origin information disclosure in Google Chrome (through the bundled Skia graphics library) affects versions prior to 153.0.8010.52, where improper state validation lets a crafted HTML page cause the renderer to expose data belonging to another origin. Exploitation requires the victim to load an attacker-controlled page (UI:R) and yields only partial confidentiality impact - no code execution, data modification, or denial of service - which is why the CVSS base score is a modest 4.3. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and the vendor has released a fixed build, so this should be treated as a low-priority, patch-routinely item rather than an emergency.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 153.0.8010.52) lets a remote, unauthenticated attacker misrepresent interface elements to a user who visits a crafted HTML page, but only if the victim is successfully socially engineered into trusting the falsified prompt. Exploitation requires mandatory user interaction (CVSS UI:R) and produces only a limited integrity impact - no code execution, no data exfiltration, and no availability loss - which is why Chromium rates it Low severity. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation and rates the issue non-automatable with partial technical impact, and the vendor has released a patch in Chrome 153.0.8010.52.
Information disclosure in the Paint component of Google Chrome desktop allows unauthenticated remote attackers to obtain sensitive information when a victim renders a crafted HTML page, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5). Exploitation is gated by mandatory user interaction (UI:R), keeping it out of the automatable category under CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit code has been identified at time of analysis. The confidentiality-only impact - no integrity or availability effect, no code execution or sandbox escape reported - makes this a genuine but modest issue rather than an urgent priority; Google has released a fixed build, so exposure ends once Chrome is updated to 153.0.8010.52 or later.
Cross-origin information disclosure in Google Chrome's Permissions implementation allows a remote attacker to leak data across origin boundaries when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.52. Exploitation requires user interaction (the victim must load the page) but no authentication or special privileges, and the impact is limited to low-sensitivity data exposure (CVSS 4.3, Chromium severity Medium). No public exploit code or confirmed active exploitation was identified at time of analysis, and the auto-updating Stable channel sharply narrows the exposure window once 153.0.8010.52 propagates.
Memory disclosure in Google Chrome prior to 153.0.8010.52 allows a local attacker to read out-of-bounds data through the browser's DataTransfer implementation, with the sandbox-crossing scope change (S:C) in the CVSS vector indicating the leaked memory can originate outside the renderer process rather than from within the attacker's own context. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 6.3) exploitation requires the attacker to already be running a local program on the victim's machine and to use social engineering to obtain user interaction, and it produces only confidentiality impact with no integrity or availability effect, so this is an information-disclosure bug rather than a sandbox escape or code-execution primitive. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (it is not in CISA KEV); Google has shipped version 153.0.8010.52, which resolves the flaw.
An unidentified security weakness affects software distributed as part of Ubuntu Linux, based on a report filed by the vendor (Canonical/Ubuntu). Because the description, CVSS metrics, CWE, and CPE data are all absent, the specific impact, attack vector, and authentication requirements cannot be determined; exploitation prerequisites are unknown, and no public exploit code has been identified at time of analysis. Risk cannot be meaningfully assessed from the provided data, and the affected package, feature, or deployment mode must be confirmed through the forthcoming Ubuntu Security Notice or NVD entry before any exposure judgment is made.
Risk cannot be meaningfully assessed for Ubuntu Linux security update CVE-2026-96281 because the affected package, vulnerability type, and impact are undisclosed. The CVE is reported by the Ubuntu vendor with a generic 'security update' description, but no CVSS score, CWE, CPE, or advisory details are available, leaving the attack vector, authentication requirements, and exploitation status unknown. No public exploit has been identified at time of analysis, and no KEV status is indicated.
Ubuntu Linux is the only identified touchpoint for CVE-2026-95290, which was reported through the vendor's own security channel but arrives with an empty description, no CVSS score or vector, no CWE mapping, and no listed affected versions. Because neither the affected package nor the exploitation prerequisites can be derived from the available data, the actual impact - whether local privilege escalation, denial of service, or remote code execution - remains undetermined, and no public exploit identified at time of analysis. Defenders should treat this as an intelligence gap rather than evidence of low severity, and pull the authoritative record from the Ubuntu Security tracker before making any exposure or patching decision.
CVE-2026-95289 is an Ubuntu-tracked security issue whose impact on Ubuntu systems cannot currently be characterized, because no description, CVSS vector, CVSS score, or CWE classification accompanies the record. The only confirmed attribute is provenance: the entry was reported through the Ubuntu vendor channel, which means an Ubuntu Security Notice and a corresponding upstream advisory should exist but were not supplied in the available intelligence. No affected versions, CPE identifiers, references, EPSS score, or KEV status are present, so this analysis cannot state who is exposed, what an attacker gains, or whether exploitation is practical; no public exploit identified at time of analysis, and patch status is likewise undetermined. Per the independent assessment, risk cannot be meaningfully assessed from the available data, and teams should treat this as an unenriched record pending retrieval of the authoritative Ubuntu advisory.
Google Chrome desktop stable-channel builds are affected by a vulnerability that Google addressed in its September 2026 stable-channel release, with the specific triggering component, root cause, and severity not disclosed in the available intelligence. Realistic exploitation would require a victim to browse to or render attacker-controlled web content in a browser that has not yet applied the fix, making user interaction the primary limiting factor, while Chrome's silent auto-update mechanism confines exposure largely to installations that have not yet restarted or updated. There is no public exploit code identified at time of analysis and no CISA KEV listing, and with no CVSS vector, no CWE, and no EPSS probability available, the risk cannot be scored quantitatively from the supplied data.
Google Chrome desktop users on the stable channel are affected by CVE-2026-95346, a flaw that Google addressed through a Stable Channel Update for Desktop documented on the Chrome Releases blog. The supplied advisory is the only reference, and no description, CVSS score, CWE, or CPE data accompanies this CVE, so the specific vulnerability class, affected build range, and impact cannot be confirmed from the available intelligence; exploitation prerequisites are likewise unconfirmed. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV, but a vendor patch is available per the Chrome Releases advisory, so the primary exposure is the window between patch publication and the user restarting the browser. Because the CVSS vector is absent, authentication requirements cannot be confirmed from available data, and remote unauthenticated default-configuration exploitation should not be assumed.
CVE-2026-95342 cannot be characterized beyond its origin: the record is attributed to the Ubuntu vendor source, but no description, CVSS vector, CWE, or CPE data has been published, leaving the affected package, affected versions, and achievable attacker impact entirely unidentified. No CISA KEV entry and no public exploit code are associated with this identifier, so there is no public exploit identified at time of analysis; equally, no EPSS-style likelihood can be derived without a description or score. Ubuntu administrators should treat this as an intelligence gap rather than a confirmed threat and monitor the vendor advisory channel for the first substantive disclosure.
Impact for CVE-2026-95295 cannot be determined from the available data: the record is tracked by the Ubuntu security team against a package distributed with Ubuntu Linux, but it carries no description, no CVSS vector, and no CWE classification, so the attack vector, required privileges, and user interaction requirements are all unconfirmed. Because no exploitation evidence, KEV listing, or public proof-of-concept is provided, there is no public exploit identified at time of analysis, and the EPSS-style risk signal is absent. The practical consequence is that prioritization must be deferred until the Ubuntu CVE tracker and the corresponding upstream advisory are consulted to identify the specific package, the affected release(s), and whether default installations are exposed.
Ubuntu is tracking CVE-2026-95340, but the intelligence available for this analysis contains no description, CVSS vector, CWE class, affected package name, or version range, so neither the impact nor the attack surface can be characterised at this time. No public exploit code and no evidence of active exploitation were identified at time of analysis, which reflects an absence of data rather than a confirmed low risk. The Ubuntu Security tracker entry for this CVE is the authoritative source and must be retrieved before any exposure or prioritisation decision is made.
Google Chrome on the stable desktop channel is the affected product in CVE-2026-95361, an entry for which a vendor fix is indicated as available via a Chrome Releases stable-channel update. The intelligence record is unusually thin: no description, no CVSS score or vector, no CWE, no CPE, no EPSS probability and no CISA KEV listing were supplied, so the specific defect class, attack vector and privilege requirements cannot be stated. No public exploit code has been identified at time of analysis, and the Ubuntu vendor attribution plus the Chrome Releases advisory reference indicate this is a coordinated upstream-then-distributor patch flow rather than an actively exploited event.
Exploitation and impact for CVE-2026-95294 cannot be established from the available intelligence: the description is empty, no CVSS score or vector was assigned, no CWE mapping was provided, and no EPSS or KEV signal accompanies the record. The single traceable data point is the reporter field, which designates Ubuntu as the reporting vendor, meaning the affected component is most likely an Ubuntu-maintained package with a corresponding Ubuntu Security Notice (USN) that has not yet been surfaced in this dataset. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (no CISA KEV entry), so any characterization of severity - remote versus local, authenticated versus unauthenticated, code execution versus denial of service - would be speculation until the USN and NVD entry are reviewed.
Impact cannot be characterized for CVE-2026-95303 because the record supplies no description, no CVSS score or vector, no CWE mapping, and no CPE or version identifiers - the only usable signal is a reporting attribution to the Ubuntu vendor source. Because neither the affected component nor the attack prerequisites are known, no exploitability determination is possible; no public exploit is identified at time of analysis, and this should not be read as evidence that none exists. Treat this entry as unresolved and retrieve the authoritative Ubuntu Security Notice or the upstream NVD record before making any exposure, prioritization, or remediation decision.
Google Chrome desktop builds are affected by a security weakness corrected in a Chrome Releases stable-channel update, but the vulnerability's description, CVSS score, CVSS vector, and CWE are all absent from the available intelligence, so the precise impact class (for example memory corruption, type confusion, or a sandbox escape) cannot be confirmed from this dataset. Consistent with the affected product and the referenced advisory, the most plausible exploitation path requires a victim to run an unpatched Chrome desktop build and load attacker-controlled web content, with user interaction via visiting a malicious or compromised page; authentication requirements are not confirmed from available data. No public exploit identified at time of analysis and no CISA KEV entry is present, while a vendor patch is available, which confines practical risk to installations that have not yet applied the stable-channel update.
Google Chrome desktop (stable channel) installations are affected by CVE-2026-95327, a security defect for which Google has published a stable-channel update and a patch is available from the vendor. Because no description, CVSS score or vector, or CWE was supplied with this CVE, the precise impact, attack vector, and affected version range cannot be established from the available intelligence; the only concrete signal is that a vendor fix exists, so residual exposure is confined to unpatched installations. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS score or CISA KEV entry was provided to indicate elevated real-world risk.
CVE-2026-95300 is currently an unpopulated record: the supplied intelligence contains no description, no CVSS score or vector, no CWE classification, and no CPE data, so the flaw's nature and impact cannot be characterized at this time. The single attribution available is that the record was reported by the Ubuntu vendor source, which suggests Ubuntu may be the coordinating or affected vendor, but no package, version, or component is identified. With no KEV listing and no public exploit code referenced in the input, there is no public exploit identified at time of analysis, and risk cannot be meaningfully assessed from the provided data.
Google Chrome desktop (stable channel) builds predating the September 2026 stable-channel update carry a flaw that the vendor has already fixed, but the available intelligence contains no description, CWE, or CVSS vector, so the precise impact cannot be characterized from the supplied data. The affected component is the Google Chrome stable desktop browser, and exploitation would require the victim to run an unpatched build and, in most realistic scenarios, to load attacker-controlled web content, meaning user interaction is likely a prerequisite. There is no KEV listing and no public exploit identified at time of analysis, and no EPSS score was provided to quantify exploitation likelihood; the principal mitigating factor is that the fix is already shipping through Chrome's automatic update mechanism, which sharply limits the exposure window for most managed and consumer deployments.
Google Chrome desktop (stable channel) is affected by a vulnerability that is documented only through Google's stable-channel release advisory, with no accompanying description, CVSS score or vector, CWE mapping, EPSS probability, or KEV listing available at time of analysis. Because the technical details of the underlying flaw are absent, the concrete impact on confidentiality, integrity, or availability cannot be characterized, and the only independently confirmed facts are the affected product (Chrome desktop stable) and that a vendor patch exists. There is no public exploit identified at time of analysis, and authentication requirements are not confirmed from available data; as with most Chrome browser issues, the practical limiting factor is that exploitation typically requires the victim to load attacker-controlled web content rather than being reachable without interaction. Organizations should treat this as a patch-management item and apply the current stable-channel update rather than as an immediate emergency, while acknowledging that the risk assessment is based on very limited signal.
Google Chrome desktop builds are the subject of a stable-channel security release documented in Google's Chrome Releases advisory, referenced under CVE-2026-95363, which was reported by the Ubuntu vendor channel. The record is effectively a data void: no description, CVSS score or vector, CWE, or CPE data were supplied, so raw severity cannot be computed and the affected feature, attack vector, and whether user interaction is required remain unconfirmed. There is no public exploit identified at time of analysis and no CISA KEV listing, while a vendor patch is available per the vendor-reported patch data; treat this as an undetermined-severity item until the advisory and NVD record are populated, and apply the Chrome stable-channel update as the primary action.
Google Chrome's desktop stable channel is affected by an unspecified security defect that has been addressed in a vendor-released stable channel update (referenced via the Chrome Releases blog). Details of the underlying bug are not publicly characterized in the available data: the CVE carries no description, no CVSS score or vector, no CWE mapping, and no EPSS probability, so the precise attack surface, prerequisite configuration, and worst-case impact cannot be determined from the supplied intelligence. There is no CISA KEV listing and no public exploit identified at time of analysis, and because a patch is already available from the vendor and Chrome ships with an automatic update mechanism, real-world exposure is effectively bounded to installations that have not yet been updated.
Ubuntu is the only product context associated with CVE-2026-95320, attributed solely through a vendor-coordination credit to the Ubuntu security team, and no description, affected package, version range, or vulnerable component has been published. Because the record carries no CVSS score or vector, no CWE assignment, no CPE identifiers, no EPSS estimate, no CISA KEV listing, and no public exploit code, the impact and attack prerequisites are entirely unknown and cannot be inferred. No public exploit has been identified at time of analysis, and no vendor-released patch has been identified at time of analysis; this entry should be treated as an unresolved placeholder to be re-triaged once the CVE record and the corresponding Ubuntu advisory are published.
Peer-identity verification bypass in the mdtls DTLS library causes a failed certificate/peer-identity check to be treated exactly like a successful one, allowing a man-in-the-middle to impersonate the intended peer to any client that relies on mdtls for authentication. The assessed impact is high for confidentiality and integrity with no availability impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N), but exploitation is conditional: the attacker must already hold an active interception position between the mdtls client and its peer, such as an adjacent-network foothold, a hostile Wi-Fi or gateway, or DNS/ARP/BGP redirection, and must present a substitute certificate. There is no public exploit identified at time of analysis and no vendor-released patch identified in the available data; the issue was reported through the Ubuntu vendor channel, and authentication requirements are not confirmed from available data.
No impact statement can be made for CVE-2026-95321: the record carries an empty description, no CVSS score or vector, no CWE, no references, and no EPSS, KEV, or POC signals, so neither the vulnerable component nor the consequence of exploitation is defined. The single attribution is a vendor:ubuntu report, which indicates the CVE was surfaced through Ubuntu's security tracking channel but does not identify the affected package, source component, or upstream project. Authentication requirements, deployment prerequisites, and attack vector are all unconfirmable from the available data, and no public exploit code has been identified at time of analysis. Analysts should treat this as an intelligence gap requiring verification against Ubuntu security notices rather than as a validated vulnerability with a known severity.
Risk cannot be meaningfully assessed for CVE-2026-95323 because the record contains no description, no CVSS score or vector, no CWE mapping, and no affected-product identifiers, leaving a vendor attribution to Ubuntu as the only intelligence available. With no information about the vulnerable component, its deployment mode, or the attacker's required position, no impact statement, authentication requirement, or exploitation precondition can be derived. There is no public exploit identified at time of analysis, and this should be handled as an unenriched placeholder record that is re-evaluated once NVD or the Ubuntu security team publishes a description and severity metrics.
Google Chrome on desktop is the confirmed affected product, with the fix delivered through the September 2026 stable-channel update documented on the Chrome Releases blog, yet the underlying flaw cannot be characterized from the available record because no description, CVSS vector, or CWE was provided. Exploitation status is unconfirmed: there is no CISA KEV listing and no public exploit code identified at time of analysis, and no EPSS signal was supplied, so no public exploit identified at time of analysis. Because the affected component, version range, and any required user interaction or sandbox-escaping prerequisites are unknown, severity remains unquantified and defenders should treat the vendor advisory as the authoritative source rather than inferring impact from this entry.
CVE-2026-95305 cannot be meaningfully risk-assessed because the record is a near-total data void: the description is '[Unknown description]', and no CVSS score, CVSS vector, CWE, references, CPE data, EPSS score, KEV status, or POC data accompanies it. The single intelligence signal available is the reporting source - vendor:ubuntu - which indicates an Ubuntu-associated report or packaged component but does not establish the upstream project, the vulnerable feature, the affected version range, or the attacker's required position. Consequently, whether exploitation requires authentication, user interaction, or a non-default configuration is unknown, and no public exploit code has been identified at time of analysis - a statement that reflects missing evidence rather than a confirmed negative.
Unspecified security defects in the Google Chrome desktop browser (stable channel) are addressed by the September 2026 stable-channel update, which is the only substantive technical anchor available for CVE-2026-95364. Affected parties are organizations and users running pre-update Chrome desktop stable builds, including Ubuntu-packaged deployments given that the issue was reported by vendor:ubuntu; the vulnerability class, attack vector, and authentication requirements cannot be confirmed because no description, CVSS vector, or CWE was supplied. No public exploit code has been identified at time of analysis, and there is no confirmed actively exploited (CISA KEV) status; EPSS and NVD data are unavailable, so severity cannot be independently graded.
Google Chrome on the desktop stable channel is the only affected product identified by the supplied intelligence, which consists of a single Chrome Releases stable-channel advisory, and the specific vulnerability class, affected component, and impact are not disclosed in the available data. No CVSS score or vector, CWE, EPSS probability, or KEV listing accompanies this record, so severity cannot be quantified and the exploitation prerequisites remain unconfirmed; there is no public exploit identified at time of analysis. Because a fixed build is already published, residual risk is chiefly a patch-rollout problem - users remain exposed only until they move to the patched stable-channel version - and no exploitation activity, in-the-wild evidence, or proof-of-concept has been reported in the data provided.
Risk cannot be meaningfully assessed from the available data - CVE-2026-95275 exists only as a bare record attributed to the Ubuntu vendor source, with no description, no CVSS vector, no CWE classification, and no affected-product identification. Because neither the vulnerable component nor the attack surface is known, it is impossible to state what an attacker could accomplish, which Ubuntu release or package is implicated, or whether exploitation would require authentication, local access, or user interaction. The record carries no CISA KEV listing, no publicly available exploit code, and no EPSS signal, so the only defensible posture is to treat the identifier as unverified and pending enrichment from NVD or the Ubuntu security advisory before any risk statement is issued.
Google Chrome (desktop stable channel) is affected by a security defect for which the vendor has published a fix as part of its September 2026 Stable Channel Update, the single reference attached to this CVE. The record contains no description, no CVSS vector, and no CWE, so the specific vulnerable component, the attack vector, and any required user interaction are undetermined from the available data; based only on the product identity, the most plausible exploitation path would be a victim rendering attacker-controlled web content in the browser, but that is an inference rather than a stated condition. Authentication requirements are not confirmed from available data, and no public exploit identified at time of analysis; the vendor patch is available and Chrome's auto-update mechanism deploys it without user action.
A denial of service in Netdata Agent versions prior to 2.10.4 lets an authenticated streaming child agent crash the parent Netdata agent that collects its metrics, repeatedly disabling centralized monitoring. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5), the attacker must already be an accepted child in the parent-child streaming topology and then sends an oversized CHART SLOT value in the plugins.d streaming protocol; the parent parses it as a chart-cache index, attempts an approximately 16 GiB allocation for the chart-pointer array, fails, and aborts via fatal(). There is no confidentiality or integrity impact, and no public exploit code has been identified at time of analysis (the vulnerability is not in CISA KEV); the real risk is bounded and operational, concentrated in deployments that accept streaming children and in multitenant or partially trusted streaming setups.
An authenticated Netdata child agent can crash its parent agent by streaming an oversized DIMENSION SLOT value in the plugins.d protocol, triggering an integer overflow that leads to a heap out-of-bounds write and termination of the parent process. Affected deployments are Netdata parent-child streaming setups running versions prior to 2.10.4 (including nightly builds earlier than 2.10.0-782-nightly); the attacker must already control or have compromised a child agent that is authenticated to the parent, so exploitation is limited to denial of service with no confidentiality or integrity impact (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, 6.5). No public exploit code was identified at time of analysis and the issue is not listed in CISA KEV; risk is moderate rather than urgent, and it is fully closed by upgrading to the fixed release.
Unauthenticated writes to the Netdata settings store are possible in versions 2.0.0 through 2.10.x because the /api/v3/settings endpoint was registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, letting remote callers send PUT requests that bypass the operator-configured 'allow dashboard from' IP allowlist. An attacker with network reachability to the agent's HTTP/dashboard listener (default TCP 19999) can persist attacker-controlled JSON into {varlib}/settings/default.json, tamper with its version counter, and repeatedly push near-20 MiB payloads to exhaust disk space, though the file does not govern data collection or security policy. Impact is capped at low integrity and low availability (CVSS 3.1 base 6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L); no public exploit code was identified at time of analysis and there is no evidence of confirmed active exploitation. The issue is fixed in Netdata 2.11.0.
Privilege escalation in GNU C Library (glibc) 2.14 through 2.44 stems from a TOCTOU race in ld.so when expanding $ORIGIN in DT_RPATH for setuid/setgid (AT_SECURE) programs. A local low-privileged (PR:L) attacker can exploit this only where fs.protected_hardlinks is disabled and a suitable setuid/setgid binary exists, by hard-linking the binary and winning a race to swap an intermediate path component for a symlink so the loader loads an attacker-controlled shared object with the program's elevated privileges. No public exploit identified at time of analysis; major Linux distributions enable fs.protected_hardlinks by default, sharply limiting exposure.
Deleted or deprovisioned users can retain authorization on hosts running SSSD with the LDAP access provider when ldap_access_order includes ppolicy or lockout, because a user lookup that returns zero results trips a fail-open path that reports success and caches an allow decision. A remote attacker who already holds valid account context on the SSSD-managed host (authenticated, PR:L) can exploit this after offboarding to keep reading information and make limited modifications, giving low confidentiality and integrity impact (CVSS 3.1 5.4 Medium). The flaw only affects non-default access configurations that explicitly enable ppolicy/lockout ordering, and no public exploit identified at time of analysis.
Denial of service in radare2 prior to 6.2.0 lets a crafted NE (New Executable) binary hang the tool indefinitely by driving the relocation fixup-chain parser into an unbounded loop that allocates a fresh relocation object on every pass, exhausting CPU and memory until the process is killed or the user aborts it. The attack is local and requires the victim to open the attacker-supplied file (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H), with availability impact only and no confidentiality or integrity effect, so this is a genuine but low-urgency issue. No public exploit code was identified at time of analysis and the flaw is fixed in version 6.2.0.
radare2 versions prior to 6.2.0 can leak uninitialized or adjacent heap memory into JSON output, and may crash the process, when an analyst runs the explicit pFB or pFBj print command over an attacker-supplied binary property list. The root cause is an under-allocated, non-NUL-terminated UTF-8 conversion buffer in the binary-plist Unicode parser (CWE-125, out-of-bounds read) that the JSON encoder then scans as a C string. All signals agree this is a low-priority local issue: the CVSS vector is AV:L/PR:N/UI:R with only low confidentiality and low availability impact, there is no network vector, no privilege gain, and no write or code-execution primitive; no public exploit code has been identified at time of analysis and the issue is not in CISA KEV. Vendor-released fix: 6.2.0.
Denial of service in radare2 versions prior to 6.2.0 allows an attacker to exhaust memory and processing time in the analyst's session by supplying a small crafted full-memory Windows crash dump (dmp64 format), which the 64-bit dump parser opens without validating input-controlled page counts against the actual file size. Exploitation is local and requires user interaction - a victim must open the malicious dump (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) - and the impact is confined to availability, with no code execution or data disclosure. No public exploit code and no confirmed active exploitation were identified at time of analysis.
Loading a crafted Apple Preferred Executable Format (PEF) file into radare2 prior to 6.2.0 can consume excessive CPU and stall or hang the analysis session, because the PEF loader accepts relocation-section counts that are not validated against the number of sections or the relocation records actually present in the input. The bug is reached through normal binary-format auto-detection, so simply opening or auto-analyzing the malformed file is sufficient; the attack is local and needs user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R) and results only in denial of service, with no confidentiality, integrity, or code-execution impact and no network-reachable attack surface. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in radare2 6.2.0.
Opening a crafted ELF binary with radare2 or rabin2 before version 6.2.0 can drive a heap out-of-bounds read in the ELF parser and terminate the process, giving anyone who can supply the file to an analyst a local denial of service (CWE-125, CVSS 3.1 5.5, AV:L/AC:L/PR:N/UI:R, C:N/I:N/A:H). The trigger is a program-header count of 0xffff (ELF's PN_XNUM sentinel) paired with a small real count in shdr[0].sh_info: the parser allocates the program-header array using the resolved count while several consumers still iterate over the original 65535 value, reading past the allocation. Exploitation requires the user to open an untrusted binary, no public exploit code or confirmed in-the-wild activity has been reported, and memory disclosure or code execution has not been demonstrated, so the practical impact is a crash of the analysis process rather than a compromise.
Heap memory corruption and denial of service in radare2 versions prior to 6.2.0 occur when the CPython .pyc marshal parser processes a crafted bytecode file that declares a string length of 0xffffffff, wrapping the size-plus-one allocation to zero before attacker-controlled data and fill bytes are written past the heap buffer. Exploitation is local and requires user interaction - an analyst must open or inspect the malicious .pyc with r2 or rabin2 - and no privileges are needed per the CVSS vector (AV:L/PR:N/UI:R), with impact confined to corrupting or crashing the analysis process. Arbitrary code execution is possible in principle but has not been demonstrated, no public exploit code has been identified at time of analysis, and the 5.5 CVSS score reflects a genuinely low-priority issue for most environments. Only workflows that routinely open untrusted .pyc files (malware analysis, CTF, reverse-engineering) are realistically at risk.
A local out-of-bounds read in radare2 6.0 and earlier (fixed in 6.2.0) can crash or corrupt the analysis session when an analyst opens a crafted Mach-O binary containing Swift type or class metadata. The CVSS 3.1 score is 3.3 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L), reflecting a 4-byte read immediately before the allocated field-metadata buffer that yields at most a process termination or incorrect metadata processing - no attacker-observable memory disclosure has been demonstrated, and the 'Information Disclosure' tag on this record is not substantiated by the advisory. Exploitation requires the victim to deliberately load an untrusted Mach-O file (user interaction), and there is no remote or unauthenticated path; no public exploit identified at time of analysis and the issue is not in CISA KEV.
Malformed ZeroMQ AUX_DATA control messages can terminate the Decode worker's control thread in SGLang 0 through 0.5.15, letting an unauthenticated attacker who can reach the Decode control PULL socket take the inference server offline. The flaw is a missing input-validation check on the control-message path (availability-only impact; no data exposure or code execution), and the assessed CVSS 3.1 vector is AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H for a base score of 5.9. Exploitation is realistic only where the Decode control socket is exposed beyond localhost in disaggregated or multi-node deployments, which is why the attack complexity is rated High; no public exploit has been identified at time of analysis and the issue is not in CISA KEV.
An out-of-bounds read in LibreOffice's PICT image import path allows a crafted PICT image - one whose stored palette index exceeds the number of entries in its colour palette - to read memory past the end of the palette buffer, crashing the application and potentially disclosing a small amount of adjacent heap memory. Exploitation requires a victim to locally open a document or image that embeds the malicious PICT file; no authentication or non-default configuration is required because PICT import is a standard feature, and the assessed CVSS vector carries an Exploit Maturity of Proof-of-Concept (E:P), indicating proof-of-concept exploit code exists, though there is no confirmed active exploitation (no CISA KEV listing). Our independent assessment rates this as a moderate-severity, denial-of-service-oriented client-side memory-safety bug (CVSS 3.1 base 5.4-equivalent, AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H) rather than a high-priority remotely exploitable flaw.
Information disclosure in LibreOffice allows a crafted document containing hyperlinks to cause local environment-variable and INI-file values to be expanded into the URL and exfiltrated to a remote server when the victim opens the file. The flaw is an incomplete fix for CVE-2024-12426: the earlier guard matched only some ways of naming the package content provider, so a URL naming it differently still reached the expansion logic, whereas fixed builds match the provider during URL checking. Exploitation requires the victim to open an attacker-supplied document (UI:R / UI:P) on the local attack vector, there is no public exploit identified at time of analysis, and the primary impact is confidentiality only (no integrity or availability loss).
Stack buffer overflow in LibreOffice's font subsetting path can crash the application and corrupt memory when a document containing an embedded CFF font is exported to PDF. The vulnerable routine converts CFF (Compact Font Format) glyphs to Type 1 operators during subsetting and writes them into a fixed-size stack buffer without verifying remaining capacity, so a glyph that emits many operators overflows the buffer (CWE-787). Exploitation is local and requires the victim to open an attacker-supplied document and trigger the subsetting code path (typically a PDF export); the CVSS v4.0 base score is 5.4 with PR:N and UI:P, and despite a proof-of-concept maturity rating (E:P) indicating publicly available exploit code exists, there is no confirmed active exploitation (not in CISA KEV). The most likely outcome is an application crash (VA:H) with limited confidentiality and integrity impact; headless or server-side document-to-PDF conversion services that ingest untrusted files are the highest-risk deployment mode.
Stack-based out-of-bounds write in LibreOffice's CFF font hint parser allows an attacker to corrupt memory and crash the application when a victim opens a document that embeds a maliciously crafted font. Affected are LibreOffice versions before the fix that checks the hint count against the array's actual capacity; exploitation requires the victim to open the crafted file (local vector, user interaction) and no authentication, with confirmed impact limited to a crash plus limited confidentiality/integrity effects-reliable arbitrary code execution is not demonstrated. No CISA KEV listing indicates active exploitation, but the CVSS 4.0 exploit maturity metric E:P indicates publicly available exploit code exists, so patching should be prioritized for users who handle untrusted documents.
Heap buffer overflow in LibreOffice Draw's PDF import path allows a crafted PDF to corrupt heap memory and crash the application when a victim opens or imports the document; the independent assessment rates confidentiality and integrity impact as low but availability impact as high, making denial of service the most realistic outcome. Exploitation requires local delivery and mandatory user interaction, and no authentication or non-default configuration is needed because PDF import is a standard feature. Publicly available exploit code exists per the CVSS 4.0 E:P metric, but there is no confirmed active exploitation (no CISA KEV entry); no EPSS score was provided.
Heap-based buffer overflow in LibreOffice's PDF import filter, reachable through LibreOffice Draw, can crash the application or corrupt heap memory when a victim opens a specially crafted encrypted PDF whose encryption dictionary declares a decryption-key length larger than the fixed-size key buffer the importer fills. Exploitation is local and requires user interaction (AV:L, UI:P/UI:R, PR:N per the CVSS 4.0 vector; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H), so there is no remote or unauthenticated network trigger and only encrypted PDFs reach the flawed code path; the impact skews heavily toward availability (VA:H) with limited confidentiality and integrity effects. There is no CISA KEV listing indicating confirmed active exploitation, but the supplied CVSS 4.0 vector carries an exploit-maturity metric of E:P, meaning publicly available exploit code exists at proof-of-concept level. This is a moderate-priority memory-corruption bug, not an urgent one, because delivery requires convincing a user to open a malicious encrypted file locally.
Heap buffer overflow in LibreOffice's WMF graphics import path affects documents embedding a crafted Windows Metafile, allowing a local attacker to corrupt memory when the victim opens the file. The flaw arises in a text record that carries its own character advance widths, where the count of advance values and the text length are read independently and need not agree, so rendering walks the advance array past its end when the array is shorter than the text. No public exploit code has been identified at time of analysis, and the impact profile is crash-dominant (confidentiality and integrity Low, availability High), making realistic outcomes denial of service rather than reliable code execution. EPSS is not provided, but exploitation requires the victim to open a malicious document (AV:L, UI:P), so real-world priority is assessed as low despite the MEDIUM CVSS of 5.4.
HTTP response splitting in the Dancer2 Perl web framework before version 2.2.0 allows an attacker to inject arbitrary response headers and split an HTTP response when an application derives a response header NAME from request-controlled data: Dancer2's headers_to_array routine strips CR and LF from header values but not from names, so a crafted name reaches the PSGI server intact and, if that server does not validate header keys, the bytes following the CRLF are written to the wire as their own header line. The issue is unauthenticated and requires no user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, 6.5 Medium), but exploitation is gated by two concrete application-specific preconditions - the app must reflect attacker input into a header key rather than a value, and the underlying PSGI server must fail to reject malformed keys - so default deployments are generally not vulnerable. No CISA KEV entry exists and no public exploit code was identified at time of analysis; EPSS is 0.19% (9th percentile) and CISA SSVC records exploitation as none and automatable exploitation as no, so all signals converge on low real-world priority despite the Medium CVSS.
Layout template disclosure in Dancer2, the Perl web application framework, allows an unauthenticated remote requester to retrieve one of an application's layout templates by requesting a path that is spelled differently from, but resolves identically to, the layout directory. Versions before 2.2.0 are affected, and the flaw is reachable only when the AutoPage handler is explicitly turned on via the auto_page setting, which is off by default; the attacker exploits the gap between the handler's literal text comparison of the request path and the canonicalising lookup that follows, using a doubled slash, a dot segment, a percent-encoded slash, or a differently-cased path on a case-insensitive filesystem. Impact is confined to reading another layout template - no code execution, no credentials, no write access - and no public exploit code has been identified at time of analysis, with EPSS at 0.19% (8th percentile).
Loading a crafted .yrc compiled rules file crashes YARA 4.5.8 (libyara) by driving an internal assertion to abort, giving an attacker a denial-of-service primitive against any process that parses untrusted compiled rules. The malicious file declares num_buffers=0 in its arena header, which reaches yr_arena_get_ptr() in libyara/arena.c and trips a failed assertion, terminating the host application. Exploitation is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.5) and publicly available exploit code exists per the SSVC assessment (Exploitation: poc), though no confirmed active exploitation in CISA KEV has been reported and EPSS is low at 0.20% (10th percentile). Impact is limited to availability (process crash) with no confidentiality or integrity loss and no privilege escalation.
Ubuntu Linux is the affected platform for CVE-2026-92162, which was reported through the vendor's own security-update channel, but the available record does not disclose the vulnerable package, the component involved, or the conditions an attacker would need to exploit it. No CVSS score or vector was published, so the attack vector, privilege requirements, and user-interaction prerequisites cannot be confirmed from the supplied data. No public exploit code has been identified at time of analysis, and no CISA KEV listing or EPSS signal accompanies this record; the practical risk cannot be meaningfully estimated until the associated Ubuntu Security Notice (USN) is retrieved and read.
Parsing a crafted, malformed YAML document with yaml-cpp 0.9.0 can underflow the scanner's indentation stack, crashing the parser and potentially leaking small amounts of process memory. The trigger is an unverified simple key - for example a plain scalar that spans a line break - which leaves a stale reference to an indent level that is subsequently popped, driving Scanner::PopAllIndents() past the bottom of the stack (CWE-822, untrusted pointer dereference); the practical outcome is a denial-of-parse/crash with at most Low confidentiality impact. Only yaml-cpp 0.9.0 is implicated, the consuming application must actually parse untrusted YAML for the bug to be reachable, and the assessed vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L, 5.1) reflects that local access requirement; EPSS is a low 0.28% (21st percentile) and there is no public exploit code identified at time of analysis, only a crash reproducer documented in upstream issue #1475 and fixed by pull request #1476.
Denial of service in vLLM through 0.29.0 allows remote, unauthenticated attackers to exhaust the Mooncake connector's sender task pool by submitting prefill requests that are rejected before engine admission, causing legitimate KV-cache transfers to be delayed by up to roughly 480 seconds while the service's health checks keep reporting success. The issue only affects deployments running disaggregated prefill/decode with the MooncakeConnector KV-transfer backend (kv_producer/kv_consumer roles), which is a specialized, non-default topology rather than a standard single-node vLLM serve; a standard vLLM installation is not exposed. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis - the VulnCheck advisory and an upstream GitHub pull request (PR #51236) that adds an orphan-transfer timeout constitute the primary public signals, and impact is bounded to availability degradation rather than crash, data disclosure, or code execution.
Path-confusion access-control bypass in Envoy Proxy before versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1 allows remote, unauthenticated clients to reach resources that a path-based Envoy policy (path-based route selection or path-based authorization) intended to protect. Envoy matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource, so a request like /admin;x=1 is matched by Envoy against an unprotected fallback route while the backend still serves the protected resource; Envoy's legacy ignore_path_parameters_in_path_matching option only truncates at the first semicolon and does not reproduce per-segment backend behavior. Exploitation is conditional (it requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment) and the assessed impact is limited to Low confidentiality with no integrity or availability effect; no public exploit identified at time of analysis.
Path confusion in Envoy Proxy lets remote, unauthenticated clients bypass path-based authorization and routing policy by attaching semicolon parameters to dot and dotdot segments - a request such as /user/..;foo=bar/admin is not canonicalized to /admin even when path normalization is enabled, so a client can present one path to Envoy's policy engine and a different effective path to the upstream. The security consequence materializes only when Envoy itself makes a path-based RBAC or routing decision on the uncollapsed value, or when a downstream/upstream collapses the segment per RFC 3986 while Envoy does not; without such a mismatch the exposure is limited to low-confidentiality impact. The issue is fixed in Envoy 1.36.10, 1.37.6, 1.38.4, and 1.39.1; no public exploit code was identified at time of analysis and no CISA KEV or EPSS signal was provided. Note that the attached tag reads 'Authentication Bypass', but the assessed impact is a moderate-severity access-control (path confusion) bypass, not an authentication bypass.
A stack buffer overflow in libstoragemgmt's SCSI VPD page 0x80 serial-number parser lets an attacker who controls a local or virtual storage device crash or destabilize the host process that enumerates that device, yielding a denial of service with no confidentiality or integrity impact (CVSS 3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5). Exploitation requires low privileges on the host (PR:L, so an authenticated/local actor) plus the ability to attach or present a device, and it only triggers when the affected process actually queries the device's serial number - the vector is local, not remotely reachable over a network. No public exploit code was identified at time of analysis and there is no confirmed active exploitation (CISA KEV); the practical risk is concentrated in environments that enumerate untrusted or attacker-attachable storage, such as multi-tenant virtualization or hosts that accept hostile removable, iSCSI, or hypervisor-presented disks.
Process termination in Envoy Proxy affects versions prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1 when a scoped IPv6 address (for example fe80::1%1) reaches either the ORIGINAL_DST transparent-proxy cluster path or a QUIC client connection undergoing port migration; the address is re-serialized with its percent scope suffix and then handed to inet_pton, which cannot parse it, so an EnvoyException is thrown and the process aborts. The assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H (5.3), meaning an unauthenticated remote condition can be reached without user interaction but only under narrow, topology-dependent prerequisites, and impact is availability-only - there is no confidentiality or integrity loss. This is a genuine but conditional availability-only issue: it is not a default configuration (transparent proxying with ORIGINAL_DST, or QUIC, must be in use and the destination must actually be a scoped/link-local IPv6 address), no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS signal was supplied with the data.
Isochronous OUT stream handling in usbredir can leave a stream's single transfer buffer permanently unsubmitted when a transfer count of 1 is used, which defeats the bounds check in usbredirhost_iso_packet() and lets a usbredir peer write beyond the end of the packet descriptor array on every subsequent isochronous packet. The flaw is an out-of-bounds write (CWE-787) affecting usbredir as shipped in Red Hat Enterprise Linux 6 through 10, and the published CVSS:3.1 vector (AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H, score 4.1) reflects a local, high-complexity, privileged trigger path whose dominant impact is availability loss rather than code execution. No public exploit identified at time of analysis, and the bug is not listed as confirmed actively exploited (CISA KEV); the realistic risk is materially lower than the raw memory-corruption classification suggests.
File owners on Nextcloud Server cannot release TYPE_TOKEN file locks that other users have placed on their files, leaving the file locked with no in-product recovery path; administrators currently have to clear the orphaned lock directly in the database. The defect is an access-control gap (CWE-284) reachable over the network by any authenticated user who can acquire a token lock, typically in shared-folder or multi-user collaboration scenarios, and it is availability-only - no confidentiality or integrity impact - as reflected in the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. No public exploit code has been identified and there is no evidence of active exploitation, so despite a 6.5 base score this behaves as an accidental or malicious file-lockout rather than a scalable remote attack.
Stack-based buffer overflow in fetchmail when built with NTLM support allows a malicious or compromised mail server to trigger memory corruption by sending a crafted NTLM Type 2 challenge, potentially leading to remote code execution, authentication failure, or process termination. Exploitation requires fetchmail to be built with NTLM and configured to authenticate via NTLM against an attacker-controlled or man-in-the-middle'd server; no public exploit code or active exploitation has been identified. The flaw carries a CVSS score of 8.1 with high confidentiality, integrity, and availability impact, though reliable RCE is limited by stack-frame layout and modern memory hardening (stack canaries, ASLR, FORTIFY_SOURCE) on RHEL builds.
SMTP smuggling in Exim before 4.100.1 allows a remote, unauthenticated attacker to desynchronize message boundaries so that a message a receiving system reconstructs does not match any message actually sent, by first provoking a rejection during DATA processing and then delivering crafted follow-on data. The assessed impact is integrity-only (CVSS 4.0, AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N): no confidentiality or availability loss is expected, and successful abuse hinges on high attack complexity and on how downstream mail systems interpret the smuggled end-of-data boundary. The practical payoff is sender spoofing that can bypass SPF, DKIM, or DMARC alignment where other systems trust this Exim host as a relay, so it is a moderate, integrity-focused issue rather than a top priority; no public exploit has been identified at time of analysis.
A use-after-free memory-safety flaw in Exim before 4.100.1 can crash the mail transfer agent process when the daemon is compiled against the GnuTLS TLS backend and configured with certain non-default TLS settings; once a vulnerable server is reachable over the network, no authentication (PR:N) or user interaction (UI:N) is required, but the CVSS vector reflects high attack complexity (AC:H) because the triggering configuration is unusual and non-default. The assessed impact is availability-only (C:N/I:N/A:L) - a crash or degraded service rather than code execution or data exposure. There is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, so practical risk is confined to the narrow subset of Exim deployments using GnuTLS with the specific triggering TLS options.
An out-of-bounds write in Exim versions before 4.100.1 occurs when the MTA is built and configured to use Proxy-Protocol (the hosts_proxy option) and accepts a PROXY header from an attacker-controlled or spoofed proxy, allowing remote memory corruption (CWE-787) with high integrity impact and low confidentiality/availability impact. The flaw is remotely reachable but unauthenticated only in the sense that no credentials are needed (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L, vendor score 7.0); the high attack complexity reflects that Proxy-Protocol is off by default and the attacker must be positioned on, or able to spoof, the trusted-proxy path in front of Exim. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS score was provided; a fixed release, Exim 4.100.1, exists and is the primary remedy.
Path traversal in rclone's Docker volume plugin ('rclone serve docker', versions 1.56.0 through 1.75.0) lets an attacker who can submit a VolumeDriver.Create request to the plugin socket make the privileged rclone process create a directory and mount an attacker-specified remote filesystem at an arbitrary host path. The attacker must already be in a high-privileged, socket-scoped position (PR:H) - normally the Docker daemon itself or, in a multi-tenant orchestration environment, a workload allowed to request named volumes - and no user interaction is required. Impact is bounded to unauthorized directory creation and remote-filesystem mounting over host paths rather than arbitrary code execution, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available in 1.75.1.
Autobahn Python releases prior to 26.7.1 enforce the maxMessagePayloadSize receive limit against the compressed on-the-wire frame length rather than the inflated message size, so an unauthenticated remote client can send a small permessage-deflate frame that decompresses far past the configured application message cap and is nonetheless allocated, reassembled, validated, and handed to application callbacks. The impact is resource-exhaustion pressure scored at CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, availability-only), and the advisory does not establish confidentiality or integrity impact despite the general 'Information Disclosure' tag; no public exploit identified at time of analysis. Exposure is limited to WebSocket endpoints that negotiate permessage-compress (permessage-deflate or the bzip2/snappy/brotli backends) - endpoints that do not accept a compression extension for the connecting client are unaffected.
Local low-privileged users on Red Hat Enterprise Linux 9 and 10 systems running the cockpit-files module can abuse the privileged 'Paste as owner' feature by pre-staging a directory that contains a symbolic link, causing ownership changes to be applied to files outside the intended paste destination and thereby compromising data integrity (and, in some cases, confidentiality if the new ownership grants unauthorized read access). Exploitation is not remote - it requires local, authenticated access (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:L) and only completes when a more privileged operator performs the paste and actively selects a non-original owner, which is the primary limiting factor; no public exploit code and no confirmed active exploitation were identified at time of analysis. The issue is a genuine but locally scoped privilege/integrity problem, not a high-urgency remote threat.
A symlink race condition (CWE-363) in cockpit-files, the file-management component shipped with the Cockpit web console on Red Hat Enterprise Linux 9 and RHEL 10, lets a local attacker with an unprivileged shell account redirect privileged file-ownership or permission changes to arbitrary files. Exploitation requires the attacker to win a narrow, non-deterministic timing window while an administrator concurrently performs a chown or chmod operation through the cockpit-files UI, so the practical result is unauthorized modification of file ownership/permissions affecting system integrity and availability rather than confidentiality. There is no public exploit identified at time of analysis and no confirmed CISA KEV active exploitation; this is a moderate-severity local integrity issue, not an urgent internet-facing threat.
A local time-of-check/time-of-use (TOCTOU) race condition in cockpit-files on Red Hat Enterprise Linux 9 and 10 allows an unprivileged local attacker to redirect a privileged chown operation to an arbitrary file by replacing a newly created directory with a symlink, resulting in potential information disclosure or unauthorized modification of sensitive files. Exploitation requires a privileged operator to trigger directory creation with owner assignment via cockpit-files inside an attacker-controlled writable parent directory, and the attacker must win a narrow timing window (CVSS 3.1: AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N, 6.0). No public exploit code or confirmed active exploitation was identified at time of analysis; this is a modest-priority local privilege/integrity issue rather than a mass-exploitation threat.
Out-of-bounds writes in the Triton bincount sampling kernel of vLLM through 0.29.0 let unauthenticated remote clients corrupt a neighboring request's repetition-penalty state by submitting multimodal audio input that contains a token ID equal to the model's vocabulary size. The root cause is an unvalidated array index (CWE-129): prompt and output token IDs are used to index the penalty prompt-presence bitset and output bin counts without any bounds check against vocab_size, so a one-past-the-end token spills into the adjacent request's mask/count rows. Impact is integrity-only and confined to altered repetition-penalty behavior for concurrently served requests - there is no code execution, data disclosure, or denial of service - and exploitation requires a CUDA GPU with compute capability >= 8.0, a multimodal model accepting audio tokens, and concurrent traffic in a shared, multi-tenant deployment; no public exploit code and no confirmed active exploitation have been identified at time of analysis.
Sampling-parameter validation in vLLM before 0.29.0 checks the allowed_token_ids allowlist against the tokenizer vocabulary size instead of the model's output logits width, so a remote client calling the OpenAI-compatible inference API can supply token IDs that are valid for the tokenizer but out of range for the model output (the advisory's cited case is a multimodal model with 128257 tokenizer tokens versus 128256 output logits). Those out-of-range IDs pass validation and reach the GPU sampling path, where LogitBiasState's Triton logit-bias kernel indexes past the valid logits row and corrupts shared GPU logits state, causing concurrent victim requests in the same batch to sample tokens outside their own allowlists. The impact is limited to sampling-constraint integrity (no data disclosure, crash, or code execution) in shared or multi-tenant deployments, and it is inert on models whose tokenizer and output vocabularies are the same size; there is no public exploit identified at time of analysis and no confirmed active exploitation (not listed in CISA KEV).
An out-of-bounds write in osmo-ggsn 1.14.0 allows a remote, unauthenticated sender of GTP signalling to corrupt process memory by delivering a PDP context whose GSN-Address sub-field is malformed; the decoder writes length-driven data without adequately bounding it to the destination buffer. The practical impact is availability-oriented - the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) indicates a low-complexity remote trigger that can crash or destabilise the GGSN, with a limited integrity effect, rather than a confirmed confidentiality breach. No public exploit code identified at time of analysis; EPSS is low (0.14%, 4th percentile) and CISA SSVC records Exploitation as 'none', though Automatable is 'yes'. Vendor/reference commit-level fix code is available upstream.
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local user to read plaintext VM credentials - including passwords - that the component passes directly on process command-line arguments during VM creation or installation. Exploitation is timing-dependent: the secret is only readable while a provisioning operation is in flight, and it also requires that /proc process arguments remain visible to other users (i.e., the host is not hardened with a hidepid-style mount option), so risk concentrates on multi-user or shared virtualization hosts. It yields no code execution and no privilege escalation, but a disclosed password compromises access to the affected VM; no public exploit code has been identified at time of analysis and the flaw is not confirmed actively exploited (not in CISA KEV).
Local information disclosure in cockpit-machines on Red Hat Enterprise Linux 9 and 10 allows an authenticated local attacker who can enumerate other users' process arguments to read guest VM installation credentials such as rootPassword and userPassword. The credentials are passed by install_machine.py as a JSON command-line argument during VM creation, so exposure is limited to the window while an administrator's installation workflow is running and depends on the host's process-visibility policy (e.g. /proc without hidepid=2). Publicly available exploit code exists, but there is no confirmed active exploitation; the issue requires local access plus a concurrently active install and cannot be triggered remotely or unauthenticated.
Local information disclosure in the cockpit-machines package on Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 lets an unprivileged local user capture a Red Hat Subscription Management (RHSM) offline token that is passed as a command-line argument to a helper script during token validation. Rated 5.0 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N), the impact is confidentiality-only: a local account that can read other processes' metadata (for example /proc/<pid>/cmdline via ps) must catch the brief window in which a privileged operator runs the validation, and the stolen token can then be exchanged for RHSM access tokens. There is no public exploit code identified at time of analysis and no CISA KEV entry; Red Hat tracks the issue as CVE-2026-92745 (EUVD-2026-83260).
Improper UTF-8 percent-decoding in uri-js through 4.4.1 lets remote, unauthenticated attackers feed crafted percent-encoded URIs that the library converts into ASCII metacharacters such as '/', '\', '.' and CRLF, enabling downstream path traversal or CRLF injection wherever the decoded output is consumed without re-validation. The flaw is remotely triggerable with no authentication or user interaction (CVSS:4.0 base 6.9; independent assessment CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N), but real-world harm is constrained by the consuming application: no code execution, no availability impact, and no effect at all if the downstream code re-validates the decoded string. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is currently a latent input-neutralization weakness for applications that treat uri-js output as already-sanitized rather than a live exploitation campaign.
Denial of service in AnyIO versions prior to 4.14.2: the process-pool implementation behind to_process.run_sync() starts worker processes with stderr wired to a pipe that the parent never drains, so a worker that writes more than the roughly 64 KiB pipe buffer to sys.stderr blocks on write() before it can return its stdout protocol response, leaving the awaiting process-pool call hung indefinitely. Applications are exposed only if they actually use AnyIO's process pool and run worker functions whose stderr volume can be driven by untrusted or faulty input - for example verbose tracebacks or logging produced by attacker-influenced data - while code paths that never touch to_process, or that already close/redirect worker stderr, are unaffected. Impact is limited to availability (hang), with no confidentiality, integrity, or code-execution effect, and per the vendor and independent assessment this is a local, low-privilege-scoped flaw (CVSS:4.0 AV:L/PR:L and CVSS:3.1 AV:L/PR:L, A:H); no public exploit code exists and no active exploitation has been confirmed (no public exploit identified at time of analysis).
Denial of service in Red Hat's cockpit-ws web service lets a remote, unauthenticated attacker crash the process by sending a request to the exact configured WebService.UrlRoot prefix without a trailing slash, taking the Cockpit management interface offline. The flaw is only reachable on installations that have explicitly set the non-default WebService.UrlRoot option; default deployments are unaffected, and impact is availability-only with no data exposure or code execution. There is no public exploit identified at time of analysis, no confirmed active exploitation (not in CISA KEV), and exploitation carries a high-attack-complexity rating (AC:H) because the attacker must know and target the exact URL-root path.
Rendering a crafted PDF through Poppler's Splash backend can pin a CPU core at 100% for an extended attacker-controlled duration. The flaw in SplashOutputDev::tilingPatternFill computes an excessive loop count from tiling-pattern geometry near the int32 limit, without allocating memory. This availability-only issue affects Red Hat Enterprise Linux 6, 7, 8, 9, and 10, and Red Hat Hardened Images, and exploitation requires a victim to open a malicious PDF (UI:R, AV:L, PR:N - no privileges required). No public exploit identified at time of analysis, and no confirmed active exploitation.
CRL revocation-check bypass in rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 can cause revoked X.509 certificates to be accepted when a relying application uses the non-default UnknownStatusPolicy::Allow, because the CRL authority-matching logic compares only a certificate's first distributionPoint against each CRL's IssuingDistributionPoint and ignores any additional distributionPoints. Exploitation requires an attacker who has already compromised a trusted issuing CA (a high-privilege position, consistent with the CVSS PR:H vector) plus a target certificate that carries more than one CRL distributionPoint; the default UnknownStatusPolicy::Deny fails safe by returning Error::UnknownRevocationStatus instead of accepting the certificate. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the mid-range 5.9 CVSS 4.0 score overstates what the vendor and independent analysis both describe as a limited-impact, largely latent issue that would most plausibly let an attacker keep using an already-revoked credential.
Certificate revocation checking in the OCSP client shipped with Red Hat Build of Apache Camel for Spring Boot 4 can be bypassed because the client does not verify the OCSP-signing Extended Key Usage (EKU) on the certificate that signs an OCSP response, allowing a revoked certificate that still chains to a trusted CA to be accepted as valid. The issue is remotely reachable without authentication or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), although exploitation is conditional: the deployment must actually rely on this OCSP client for revocation checking and the attacker must already possess a revoked-but-chainable certificate. No public exploit identified at time of analysis, and this is assessed as a genuine but moderate-priority integrity flaw rather than a high-urgency issue.
A signed/unsigned type mismatch in Netty's Memcache binary protocol codec desynchronizes frame boundaries, allowing an unauthenticated, network-positioned attacker to smuggle responses across a shared or proxied memcache connection (CVSS 3.1 base 6.5, Medium). The flaw is reachable only when the Memcache binary codec is explicitly wired into a network-exposed Netty pipeline - a non-default configuration - and the affected code ships inside Red Hat Fuse 7, JBoss Enterprise Application Platform 7, Single Sign-On 7, and the Red Hat Build of Apache Camel for Spring Boot 4. No public exploit code has been identified at time of analysis, and there is no confirmation of active exploitation (not in CISA KEV); impact is limited to confidentiality and integrity (C:L/I:L) with no availability effect.
Certificate revocation validation performed by Netty's optional netty-handler-ssl-ocsp module can be silently skipped when the OCSP response omits the optional nextUpdate field, causing the application to proceed with a certificate that should have been rejected. The flaw is remote and requires no credentials or user interaction (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9), but exploitation is conditional: the deployment must actually use the opt-in OCSP-stapling component, and the attacker must control or intercept the OCSP response seen by the client, typically through a man-in-the-middle position or by operating the TLS server whose certificate is being validated. There is no public exploit identified at time of analysis and no KEV listing, and the practical impact is confined to acceptance of a revoked or otherwise unvalidated certificate rather than code execution or data disclosure.
Blind server-side request forgery in the Nextcloud Circles (Teams) app lets any unauthenticated remote user force the Nextcloud Server to issue an outbound GET request to an attacker-chosen internal or private address through the public endpoints POST /apps/circles/event/ and POST /apps/circles/incoming/. The flaw sits in remote-instance signature verification, which fetches the attacker-supplied keyId URL before trust in the remote instance is established and explicitly permits local and private address ranges, bypassing Nextcloud's core SSRF protections. Because the internal response body is never returned to the requester, the practical impact is internal-network reconnaissance - an attacker can map which services are reachable - rather than data theft or code execution; no public exploit code has been identified at time of analysis and the issue is not a confirmed actively exploited (CISA KEV) vulnerability. The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, treating it as a moderate-severity reconnaissance primitive.
Cross-origin information disclosure in Google Chrome (through the bundled Skia graphics library) affects versions prior to 153.0.8010.52, where improper state validation lets a crafted HTML page cause the renderer to expose data belonging to another origin. Exploitation requires the victim to load an attacker-controlled page (UI:R) and yields only partial confidentiality impact - no code execution, data modification, or denial of service - which is why the CVSS base score is a modest 4.3. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and the vendor has released a fixed build, so this should be treated as a low-priority, patch-routinely item rather than an emergency.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 153.0.8010.52) lets a remote, unauthenticated attacker misrepresent interface elements to a user who visits a crafted HTML page, but only if the victim is successfully socially engineered into trusting the falsified prompt. Exploitation requires mandatory user interaction (CVSS UI:R) and produces only a limited integrity impact - no code execution, no data exfiltration, and no availability loss - which is why Chromium rates it Low severity. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation and rates the issue non-automatable with partial technical impact, and the vendor has released a patch in Chrome 153.0.8010.52.
Information disclosure in the Paint component of Google Chrome desktop allows unauthenticated remote attackers to obtain sensitive information when a victim renders a crafted HTML page, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5). Exploitation is gated by mandatory user interaction (UI:R), keeping it out of the automatable category under CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit code has been identified at time of analysis. The confidentiality-only impact - no integrity or availability effect, no code execution or sandbox escape reported - makes this a genuine but modest issue rather than an urgent priority; Google has released a fixed build, so exposure ends once Chrome is updated to 153.0.8010.52 or later.
Cross-origin information disclosure in Google Chrome's Permissions implementation allows a remote attacker to leak data across origin boundaries when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.52. Exploitation requires user interaction (the victim must load the page) but no authentication or special privileges, and the impact is limited to low-sensitivity data exposure (CVSS 4.3, Chromium severity Medium). No public exploit code or confirmed active exploitation was identified at time of analysis, and the auto-updating Stable channel sharply narrows the exposure window once 153.0.8010.52 propagates.
Memory disclosure in Google Chrome prior to 153.0.8010.52 allows a local attacker to read out-of-bounds data through the browser's DataTransfer implementation, with the sandbox-crossing scope change (S:C) in the CVSS vector indicating the leaked memory can originate outside the renderer process rather than from within the attacker's own context. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 6.3) exploitation requires the attacker to already be running a local program on the victim's machine and to use social engineering to obtain user interaction, and it produces only confidentiality impact with no integrity or availability effect, so this is an information-disclosure bug rather than a sandbox escape or code-execution primitive. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (it is not in CISA KEV); Google has shipped version 153.0.8010.52, which resolves the flaw.