Suse
Monthly
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
SUSE Observability deployments using the rancher-extension-stackstate extension are susceptible to credential exposure where service tokens are stored insecurely, enabling an attacker with local access and low privileges to obtain them and potentially escalate privileges. This moderate-severity issue (CWE-312) requires pre-existing minimal access to the affected system and has a confidentiality-only impact, with no public exploit identified at time of analysis. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) underscores that exploitation is limited to environments where tokens are improperly stored.
An unspecified defect in an as-yet-unidentified Ubuntu package is tracked as CVE-2026-82373, but the record carries no description, no CVSS vector, no CWE classification, and no patch reference, so the affected component, attack surface, and impact cannot be established. The only confirmed signal is provenance: the entry was reported by the Ubuntu security team through its vendor CVE tracker. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so risk cannot be meaningfully assessed from the provided data.
Risk cannot be meaningfully assessed for CVE-2026-82374 because the published record contains no description, no CVSS score or vector, no CWE classification, no CPE data, and no reference set; the sole available signal is that the record was reported by the vendor Ubuntu. With no affected package, version range, deployment mode, or attack vector specified, it is not possible to state who is affected or what an attacker could achieve, and no public exploit identified at time of analysis. The CVE is not associated with CISA KEV status or an EPSS score in the supplied intelligence, so no conclusion about active exploitation or likelihood can be drawn.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
CPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before version 0.21.0 lets attacker-driven, high-volume log emission pin a process's CPU when the wrapped log exporter is simultaneously slow or backpressured. The poll loop repeatedly retries a non-blocking queue dequeue and a failed non-blocking EnqueueExport without waiting on its ticker, because the failed enqueue leaves the queue length unchanged at or above batchSize, producing a tight busy-spin that degrades or denies service in the embedding application. This is an availability-only flaw (CWE-400) with no confidentiality or integrity impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (not in CISA KEV); the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is unauthenticated but requires the attacker to sustain log volume while the exporter is backpressured, which significantly narrows real-world exploitability.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.
Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's own CVSS 4.0 base of 4.6 aligns with the independent assessment that the reliably demonstrated impact is a crash rather than proven code execution.
DNSSEC validation downgrade in ISC BIND 9 lets a remote, unauthenticated attacker who can inject or spoof responses on the resolution path present a validly signed NSEC3 record taken from an unrelated sibling zone as an insecurity proof, so a securely delegated name is treated as insecure and a forged unsigned answer is accepted. Only resolvers actively performing DNSSEC validation are exposed, and the affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. The issue is integrity-only (no confidentiality or availability impact) and rated 5.9 because exploitation is difficult: the attacker must legitimately obtain a signed NSEC3 from another zone and win the response race, and no public exploit identified at time of analysis, though vendor patches are available.
Memory amplification in ISC BIND 9's negative cache allows remote, unauthenticated attackers to inflate resolver memory usage by supplying crafted authoritative responses. When a query response carries multiple copies of a record that should exist only once (for example an SOA record) with identical RDATA, named appends each copy to the in-memory RDATA set instead of discarding duplicates, so negative-cache entries retain more data than they should; BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus the corresponding -S1 subscription builds, are affected. The assessed impact is limited to gradual memory growth (availability low, no confidentiality or integrity effect, no crash demonstrated) and exploits require the attacker to be positioned to answer the resolver's upstream queries; no public exploit identified at time of analysis, and vendor fixes are available in 9.20.29 and 9.21.26.
Resource exhaustion in ISC BIND 9 recursive resolvers allows a remote, unauthenticated attacker to degrade name-resolution service by causing the resolver to process responses that contain large numbers of a specific class of invalid DNSSEC record, driving excessive CPU and memory consumption (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Affected builds are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus subscription (-S1) equivalents 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; authoritative-only deployments are not the described target. The impact is capped at availability degradation rather than a full outage because BIND's default limits on 'max-records-per-type' and 'max-types-per-name' already throttle the offending inputs, and operators who have raised or disabled those limits carry materially higher exposure. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; vendor-released patches are available as 9.20.29 and 9.21.26.
BIND 9 secondary (slave) servers that restrict zone transfers with TSIG can be tricked into serving attacker-supplied zone contents: an attacker able to occupy or spoof the position of the configured primary can deliver a multi-message TCP IXFR whose final TSIG-signed message never arrives, and named commits and serves the records already received without rolling back to the pre-transfer state. Affected releases are BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25, along with the -S1 builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; no valid TSIG key is required (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, 6.5), but exploitation is conditional on the attacker's network position and the multi-message IXFR condition, so this is an integrity-only, high-complexity issue rather than a broadly reachable critical flaw. No public exploit identified at time of analysis and no CISA KEV listing; vendor patches are downloadable for the 9.20 and 9.21 branches.
A malformed zone loaded into ISC BIND 9 authoritative servers can contain an NS or DNAME node above the zone origin, which named misinterprets as a zone cut, so queries for names inside the configured zone lose authoritative status and return out-of-zone delegations. Exploitation requires high privileges (PR:H) because the attacker must control the zone data delivered to the server, for example by controlling a primary from which the target secondary performs zone transfers; this is not a remotely unauthenticated attack. On servers that also provide recursion, BIND can follow the locally sourced cut and cache attacker-supplied data for names outside the configured zone, and the condition persists as long as the malformed zone remains in the zone database. No public exploit identified at time of analysis.
DNSSEC-validating BIND 9 resolvers can be induced to accept an inapplicable NSEC record as proof that no wildcard exists at a given name, letting an attacker who controls a zone at the same or an upstream level of the victim's name mask the existence of the victim's wildcard record and thereby disrupt resolution of names it should answer. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 subscription branches. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) and is an integrity-only issue confined to wildcard denial-of-existence proofs; no public exploit identified at time of analysis, and no confidentiality or availability impact is claimed by the assessed vector.
Denial of service in ISC BIND 9 recursive resolvers: an attacker who controls (or compromises) an authoritative server for a DNSSEC-signed zone can cause `named` to abort after it encounters a use-after-free when processing a specific crafted sequence of answers. The attacker must first induce the victim resolver to issue multiple queries for that attacker-hosted zone, and the malicious responses must then arrive in a particular order and timing to trip the race, which is why this is rated high complexity (AC:H) despite being remote and unauthenticated (PR:N, no user interaction). Impact is availability-only (C:N/I:N/A:H), and exploitation is limited to `named` running as a recursive resolver on the listed versions; only 9.20.29 and later are fixed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Confused-deputy handling in the PriceTracking component of Google Chrome on iOS lets a remote, unauthenticated attacker reach a privileged in-browser page and bypass system access restrictions on versions prior to 153.0.8010.47. Exploitation is not straightforward - it requires the attacker to pair crafted network traffic with successful social engineering of the user (the independent assessment scores AC:H and UI:R, even though the published NVD vector lists UI:N), and the resulting impact is confined to Low confidentiality and Low integrity inside the browser context with no availability loss and no code execution outside Chrome. There is no evidence of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is only 0.22% (12th percentile), and a vendor fix is already available, making this a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Heap buffer overflow in the NGINX HTTP/3 module (ngx_http_v3_module) can crash NGINX worker processes or corrupt a limited amount of heap data when NGINX Plus or NGINX Open Source serves QUIC traffic while linked against OpenSSL 3.5.0 or earlier under certain configurations. The overflow occurs while processing a TLS handshake and is non-deterministic — triggering it is largely outside the attacker's control — so the realistic outcome is opportunistic denial of service (worker restart) plus limited data corruption rather than reliable remote code execution. There is no control plane exposure (data plane only), no public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided.
Information disclosure in the Networking component of Mozilla Firefox allows a remote, unauthenticated attacker to obtain a limited amount of sensitive data when a victim loads attacker-controlled web content; the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Exploitation demands user interaction (UI:R) - the victim must visit or render malicious content in an unpatched build - and the assessed impact is confined to low confidentiality loss, with no code execution, integrity, or availability effect. Risk signals are low: EPSS is just 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Spoofing in Firefox's DOM Navigation component allows attacker-controlled web content to misrepresent navigation or origin information in the browser UI, deceiving users about where they actually are or where a link leads; the flaw affects Firefox versions before 156 and Firefox ESR versions before 153.3. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to actively load the malicious page (UI:R), and the resulting impact is deception-based rather than code execution or bulk data theft. Rated CVSS 5.4 with an EPSS score of 0.14% (4th percentile), this is a moderate-severity UI-misrepresentation issue with no public exploit identified at time of analysis and no evidence of active exploitation (not listed in CISA KEV).
Site isolation bypass in Mozilla Firefox's Reader Mode component allows attacker-controlled web content to escape its intended origin boundary, producing limited confidentiality and integrity impact; it is fixed in Firefox 156 and Firefox ESR 153.3, so all earlier builds on those channels are affected. Exploitation is neither automatic nor trivial: the victim must first open the crafted page in Firefox and then explicitly activate Reader Mode on it (CVSS UI:R), although no authentication or elevated privileges are required (PR:N) and default configurations are exposed. No public exploit code and no confirmed active exploitation have been identified, EPSS is only 0.14% (4th percentile), and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - this is a moderate-severity, low-urgency browser issue that should be handled through a routine browser patch cycle.
Mitigation bypass in Mozilla Firefox's DOM Notifications component allows remote attackers to defeat browser-enforced protections governing web notifications; it is fixed in Firefox 156 and Firefox ESR 153.3, so any earlier Firefox build or ESR build before 153.3 remains affected. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, 6.3) but requires the victim to visit or interact with attacker-controlled web content, and impact is limited to low confidentiality, integrity, and availability effects within the browser process. No public exploit code is identified at time of analysis, EPSS places likelihood at roughly 0.16% (6th percentile), and CISA KEV does not list this issue, so real-world priority is low-to-moderate.
An information-disclosure weakness in the Graphics: ImageLib component of Mozilla Firefox allows remote attackers to expose sensitive data when a victim loads attacker-controlled image content; because the CVSS vector carries PR:N with UI:R, no authentication or privileges are needed but the victim must open the crafted content. Impact is limited to confidentiality loss (C:H with I:N/A:N), so it is a moderate-severity flaw rather than a code-execution or availability risk. Mozilla fixed it in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3, and EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
A protection-mechanism bypass in Firefox's DOM Copy & Paste and Drag & Drop component lets attacker-controlled web content escape an intended security mitigation (CWE-693), yielding limited confidentiality and integrity impact. All Firefox builds prior to 156, Firefox ESR prior to 140.16, and Firefox ESR prior to 153.3 are affected. Exploitation is unauthenticated (PR:N) but requires the victim to visit attacker-controlled content and then perform a copy-paste or drag-and-drop action (UI:R); there is no public exploit identified at time of analysis and EPSS is a low 0.16% (6th percentile). This is a moderate, low-priority browser bug, not a remote-code-execution issue.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Local denial of service in SSSD's PAM responder occurs when a local process with access to the responder's UNIX socket negotiates legacy PAM protocol v1 and sends an empty or truncated request body. The out-of-bounds read in pam_parse_in_data() can terminate or restart the responder, causing availability loss for local authentication. This is a low-severity issue (CVSS 4.0, EPSS 0.12%, 2nd percentile) with no public exploit identified at time of analysis and no confirmed active exploitation in the provided data; exploitation requires a local foothold that can reach the socket and explicitly negotiate protocol v1.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multipart/form-data uploads, leaving orphaned temporary files that accumulate until the host disk partition is exhausted. The race condition arises when asynchronous disk writes complete after multer's abort cleanup routine has already run, so those files escape deletion entirely. No authentication is required and no special server configuration beyond the default disk storage engine is needed; the issue is fixed in multer 2.4.0.
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. The official CVSS score of 3.7 reflects high attack complexity and an impact limited to partial availability loss, with no confidentiality or integrity consequences confirmed. No public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Out-of-bounds read in PCRE2 before 10.48 can produce a limited availability impact when an attacker supplies invalid UTF-encoded data to an application that JIT-compiled patterns for one match mode but then calls pcre2_match with a different mode, triggering a JIT fallback with inconsistent internal state. The flaw is tracked as GHSA-2p8c-ff85-vh9x and was corrected in the PCRE2 10.48 release alongside four other security fixes. No public exploit code and no active exploitation have been identified at time of analysis; the low CVSS score of 2.9 and high attack complexity reflect the narrow, configuration-dependent preconditions required.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
NoSQL query injection in the GridFS component of the MongoDB Ruby Driver allows an authenticated low-privileged user to exceed their intended file access scope. When an application passes a caller-influenced structured identifier - such as a Ruby Hash containing MongoDB query operators - to GridFS retrieval or deletion operations without coercing it to a literal BSON type, the driver forwards the structure directly to the MongoDB query layer, which interprets it as a query condition. Exploitation can yield unauthorized read access to stored GridFS file chunks belonging to other identifiers, or mass deletion of all chunks within the affected bucket, permanently rendering all stored files unreadable. No public exploit has been identified at time of analysis.
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifier parameters to either access file content beyond their intended authorization or destroy all GridFS file chunks in the affected bucket, rendering stored data permanently unreadable. The root cause (CWE-943) is the driver's failure to distinguish between structured query operators and literal identifier values in GridFS operations, allowing attacker-controlled input to redirect or broaden MongoDB queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability sub-scores in the CVSS 4.0 vector indicate genuinely severe outcomes in vulnerable deployments.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. Fixed in v1.5.7-14; no public exploit identified at time of analysis.
HTTP request smuggling in Netty 4.1.133-4.1.137.Final and 4.2.13-4.2.17.Final allows unauthenticated remote attackers to poison HTTP request queues and bypass intermediary security controls by submitting crafted Transfer-Encoding headers. The HttpObjectDecoder's final-coding validation was flawed: both split multi-line TE headers and comma-separated values like 'chunked, xchunked' bypassed the 'chunked must be last' check, causing Netty to interpret message framing differently from upstream proxies. Fixed releases 4.1.138.Final and 4.2.18.Final enforce RFC 9112-compliant validation across all TE header fields; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key segments to cause rclone to write files outside the configured destination root when a victim performs a copy or sync operation. Thirteen destination backends - including b2, swift, sftp, smb, webdav, ftp, storj, and others - are affected because they apply path.Join(root, remote) on unvalidated object keys before EncodeDot can neutralize parent-directory segments; sftp and smb destinations carry the highest impact since they can reach other filesystem paths or shares accessible under the victim's credential. No public exploit code has been identified and the issue is fixed in v1.75.1.
rclone's HTTP backend (versions 1.49.0-1.75.0) leaks user-configured secret headers - including Authorization, Cookie, and X-Api-Key values - to untrusted redirect destinations because the underlying Go HTTP client follows redirects without a CheckRedirect policy that strips sensitive headers at host boundaries. When a configured HTTP remote issues a cross-host redirect, net/http copies the original headers verbatim to the new destination; a same-host HTTPS-to-HTTP redirect similarly exposes those headers in cleartext. Listing, stat, download, mount, and serve operations can all trigger the leak during normal use. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate private mailboxes belonging to other users and read shared mailbox annotation values. By crafting conditional Sieve filter scripts using `fileinto` branches and observing delivery outcomes during LMTP processing, an attacker can infer the existence of otherwise inaccessible mailboxes or annotation content through a side-channel. No public exploit exists and the vulnerability is not listed in CISA KEV; the EPSS risk is commensurately low, reflecting a medium-severity information disclosure limited to authenticated insiders.
Cyrus IMAP before 3.12.4 permits an authenticated sharee who holds the `maySetKeywords` ACL right on a shared mailbox to overwrite that mailbox's RFC 6154 `specialuse` annotation via a JMAP `Mailbox/set` request, a capability that should be restricted to the mailbox owner. By reassigning the shared mailbox to a system role such as Archive or Snoozed, the sharee can cause the victim's mail client to route messages into the now-shared folder, disclosing content beyond what was originally granted. No public exploit has been identified at time of analysis; vendor-released patches are available across three supported stable branches.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a crafted JMAP blob ID. By issuing a JMAP blob download request using the internal format H<emailid>-<index> with an index value that exceeds the length of the blob_headers array, an attacker triggers an out-of-bounds read (CWE-125) and receives whatever heap memory follows the array in the server's response. The CVSS 3.1 score of 3.1 (Low) reflects the authentication requirement, high attack complexity, and limited confidentiality impact; no public exploit has been identified at time of analysis.
A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. No public exploit code and no CISA KEV entry were identified at time of analysis, EPSS places exploitation probability at roughly 0.15% (5th percentile), and the supplied references do not state an exact fixed build number.
Incorrect authorization in Cyrus IMAP's JMAP snooze feature allows an authenticated low-privileged user to bypass destination-mailbox ACL checks, inserting mail into another user's inbox or any mailbox whose ID is known - even when the attacker holds no insert permissions on that target mailbox. Affected versions are prior to 3.12.4, 3.10.4, and 3.8.8. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal in LF Edge eKuiper's plugin installation endpoint (POST /plugins/*) allows high-privileged management API users to delete arbitrary files and directories on the host by embedding traversal sequences such as `../../` in the plugin `name` parameter. Affected versions are all eKuiper releases prior to 2.4.1 (Go module github.com/lf-edge/ekuiper/v2). A proof-of-concept is published in the GitHub security advisory GHSA-c23q-fw86-9h5x, demonstrating deletion of arbitrary host paths via `os.RemoveAll`; the advisory explicitly confirms exploitation is bounded to file deletion only - no code execution, file creation, or data exfiltration is achievable.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Heap out-of-bounds read in VLC Media Player 3.0.0 through 3.0.23 allows a hostile RTSP server to extract adjacent heap memory from a connecting client. The flaw lies in the realrtsp access module: `RtspReadLine` in `modules/access/rtsp/access.c` uses `strncpy` with the full buffer length into a 4096-byte allocation, omitting the null terminator when the source is at least as long; `rtsp_get` in `modules/access/rtsp/rtsp.c` then passes that unterminated buffer to `strdup`, which walks heap memory until an incidental zero byte. The disclosed bytes are retained as the RTSP Session identifier and echoed back to the server on every subsequent request, giving the server operator a continuous read of arbitrary heap contents from the victim process. No public exploit code has been identified at time of analysis, and the module is disabled in some distribution packages.
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Sensitive information disclosure in Google Chrome's Editing subsystem allows a remote unauthenticated attacker to exfiltrate browser-accessible data by luring a user to a crafted HTML page. All Chrome versions prior to 153.0.8010.36 on desktop are affected. No public exploit has been identified and SSVC assigns no active exploitation, making this a low operational priority despite the CVSS 6.5 score.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer on Windows (prior to 153.0.8010.36) can expose limited memory content outside the Chrome sandbox to a remote attacker via a crafted HTML page. The vulnerability is platform-specific to Windows and requires user interaction to trigger, carrying a Chromium-assigned severity of Low and a CVSS score of 4.7. No public exploit or active exploitation has been identified; EPSS at 0.16% (6th percentile) confirms very low real-world exploitation probability, making this a routine patch priority rather than an emergency.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. No public exploit code exists, EPSS is 0.18% (7th percentile), and Chromium's own severity designation is 'Low', collectively confirming this as a low-priority but real integrity flaw.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Improper certificate validation in Google Chrome's Loader component (prior to 153.0.8010.36) enables remote attackers to bypass the browser's web origin policy via crafted network traffic combined with social engineering. The flaw (CWE-295) permits partial cross-origin data access and integrity impact, rated Low severity by Chromium's own classification despite a CVSS base score of 5.4. No public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating very low exploitation probability at this time.
Incorrect authorization in Chrome's Loader component allows a remote attacker to bypass system access restrictions with limited confidentiality and integrity impact. Affected versions are all Chrome releases prior to 153.0.8010.36, and exploitation requires user interaction via a crafted HTML page combined with social engineering. No public exploit or active exploitation (CISA KEV) has been identified; the EPSS score of 0.17% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a low-priority issue relative to the broader Chrome vulnerability landscape.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Denial of service in the GNU C Library (glibc) DNS stub resolver causes any process that resolves names to abort via an assertion failure when the search list loaded from /etc/resolv.conf or the LOCALDOMAIN environment variable contains a single domain of roughly 200 characters or more; affected versions are 2.26 through 2.44. The weakness is reachable by an unauthenticated attacker on the adjacent network (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H, score 5.3) only where search domains are populated from attacker-influenced DHCP or VPN configuration and the network-configuration software does not reject the over-length value; local exploitation requires the ability to write /etc/resolv.conf or set LOCALDOMAIN. Impact is limited to process termination (no code execution, data disclosure, or integrity impact), and no public exploit code was identified at time of analysis.
SUSE Observability deployments using the rancher-extension-stackstate extension are susceptible to credential exposure where service tokens are stored insecurely, enabling an attacker with local access and low privileges to obtain them and potentially escalate privileges. This moderate-severity issue (CWE-312) requires pre-existing minimal access to the affected system and has a confidentiality-only impact, with no public exploit identified at time of analysis. The assessed CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) underscores that exploitation is limited to environments where tokens are improperly stored.
An unspecified defect in an as-yet-unidentified Ubuntu package is tracked as CVE-2026-82373, but the record carries no description, no CVSS vector, no CWE classification, and no patch reference, so the affected component, attack surface, and impact cannot be established. The only confirmed signal is provenance: the entry was reported by the Ubuntu security team through its vendor CVE tracker. No public exploit code has been identified at time of analysis and there is no CISA KEV confirmation of active exploitation, so risk cannot be meaningfully assessed from the provided data.
Risk cannot be meaningfully assessed for CVE-2026-82374 because the published record contains no description, no CVSS score or vector, no CWE classification, no CPE data, and no reference set; the sole available signal is that the record was reported by the vendor Ubuntu. With no affected package, version range, deployment mode, or attack vector specified, it is not possible to state who is affected or what an attacker could achieve, and no public exploit identified at time of analysis. The CVE is not associated with CISA KEV status or an EPSS score in the supplied intelligence, so no conclusion about active exploitation or likelihood can be drawn.
Log telemetry exported over gRPC by OpenTelemetry-Go versions prior to 0.21.0 can be silently intercepted or modified because the otlploggrpc exporter reads TLS certificate settings from environment variables into its config but never applies them to the gRPC transport credentials. When TLS is configured only through OTEL_EXPORTER_OTLP_LOGS_CERTIFICATE, OTEL_EXPORTER_OTLP_CERTIFICATE, and the related client-certificate/key variables - and the application does not additionally call WithTLSCredentials in code - the client falls back to credentials.NewTLS with system roots and no client certificate, so the intended private-CA pinning and mutual TLS are bypassed. A network attacker in a man-in-the-middle position who can present a certificate chaining to the victim host's system trust store can read or alter exported log data; misconfigured code paths that do pass WithTLSCredentials are unaffected, the system-trusted-certificate prerequisite is a significant limiting factor, and no public exploit was identified at time of analysis. The issue is fixed in otlploggrpc v0.21.0.
CPU exhaustion in the OpenTelemetry-Go sdk/log BatchProcessor (BatchingProcessor built via NewBatchingProcessor) before version 0.21.0 lets attacker-driven, high-volume log emission pin a process's CPU when the wrapped log exporter is simultaneously slow or backpressured. The poll loop repeatedly retries a non-blocking queue dequeue and a failed non-blocking EnqueueExport without waiting on its ticker, because the failed enqueue leaves the queue length unchanged at or above batchSize, producing a tight busy-spin that degrades or denies service in the embedding application. This is an availability-only flaw (CWE-400) with no confidentiality or integrity impact, no public exploit code identified at time of analysis, and no confirmed active exploitation (not in CISA KEV); the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) is unauthenticated but requires the attacker to sustain log volume while the exporter is backpressured, which significantly narrows real-world exploitability.
Blind server-side request forgery in the oras-go library lets a malicious or compromised OCI registry steer pagination requests to arbitrary internal endpoints chosen by the attacker. Affected are all oras-go versions prior to 2.6.2; the parseLink routine in registry/remote/utils.go accepted an absolute URL from the registry-supplied Link 'rel=next' header without checking scheme, host, or port, so Tags, Referrers, or Repositories listing calls could be pointed at internal services such as the cloud metadata endpoint 169.254.169.254. Per the assessed vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N), no attacker credentials are needed and the request originates from the victim's network, but exploitation requires the victim to initiate a pagination-based listing against the attacker's registry, response bodies are not returned to the attacker, and only timing/error differences reveal reachability - except when the victim's credential store already holds an entry for the attacker-chosen host, in which case those credentials may be attached. No public exploit code or confirmed in-the-wild activity was identified at time of analysis; the issue is remediated in 2.6.2, and the maintainer treats this report as a duplicate consolidated under an earlier advisory.
Heap use-after-free in the HDF5 library (The HDF Group, all versions before 2.3.0) is triggered when an application such as h5dump reads a dataset whose compound datatype contains floating-point members, allowing a crafted .h5 file to crash the parsing process and, depending on heap layout and allocator behaviour, potentially corrupt memory further. Exploitation requires the victim to open a malicious file locally (local vector, mandatory user interaction, no authentication needed), so it is not remotely reachable on its own. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the vendor's own CVSS 4.0 base of 4.6 aligns with the independent assessment that the reliably demonstrated impact is a crash rather than proven code execution.
DNSSEC validation downgrade in ISC BIND 9 lets a remote, unauthenticated attacker who can inject or spoof responses on the resolution path present a validly signed NSEC3 record taken from an unrelated sibling zone as an insecurity proof, so a securely delegated name is treated as insecure and a forged unsigned answer is accepted. Only resolvers actively performing DNSSEC validation are exposed, and the affected ranges are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus the subscription builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1. The issue is integrity-only (no confidentiality or availability impact) and rated 5.9 because exploitation is difficult: the attacker must legitimately obtain a signed NSEC3 from another zone and win the response race, and no public exploit identified at time of analysis, though vendor patches are available.
Memory amplification in ISC BIND 9's negative cache allows remote, unauthenticated attackers to inflate resolver memory usage by supplying crafted authoritative responses. When a query response carries multiple copies of a record that should exist only once (for example an SOA record) with identical RDATA, named appends each copy to the in-memory RDATA set instead of discarding duplicates, so negative-cache entries retain more data than they should; BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus the corresponding -S1 subscription builds, are affected. The assessed impact is limited to gradual memory growth (availability low, no confidentiality or integrity effect, no crash demonstrated) and exploits require the attacker to be positioned to answer the resolver's upstream queries; no public exploit identified at time of analysis, and vendor fixes are available in 9.20.29 and 9.21.26.
Resource exhaustion in ISC BIND 9 recursive resolvers allows a remote, unauthenticated attacker to degrade name-resolution service by causing the resolver to process responses that contain large numbers of a specific class of invalid DNSSEC record, driving excessive CPU and memory consumption (CVSS 3.1 base 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Affected builds are 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, plus subscription (-S1) equivalents 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; authoritative-only deployments are not the described target. The impact is capped at availability degradation rather than a full outage because BIND's default limits on 'max-records-per-type' and 'max-types-per-name' already throttle the offending inputs, and operators who have raised or disabled those limits carry materially higher exposure. There is no confirmed active exploitation (no CISA KEV listing) and no public exploit identified at time of analysis; vendor-released patches are available as 9.20.29 and 9.21.26.
BIND 9 secondary (slave) servers that restrict zone transfers with TSIG can be tricked into serving attacker-supplied zone contents: an attacker able to occupy or spoof the position of the configured primary can deliver a multi-message TCP IXFR whose final TSIG-signed message never arrives, and named commits and serves the records already received without rolling back to the pre-transfer state. Affected releases are BIND 9 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25, along with the -S1 builds 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1; no valid TSIG key is required (CVSS 3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L, 6.5), but exploitation is conditional on the attacker's network position and the multi-message IXFR condition, so this is an integrity-only, high-complexity issue rather than a broadly reachable critical flaw. No public exploit identified at time of analysis and no CISA KEV listing; vendor patches are downloadable for the 9.20 and 9.21 branches.
A malformed zone loaded into ISC BIND 9 authoritative servers can contain an NS or DNAME node above the zone origin, which named misinterprets as a zone cut, so queries for names inside the configured zone lose authoritative status and return out-of-zone delegations. Exploitation requires high privileges (PR:H) because the attacker must control the zone data delivered to the server, for example by controlling a primary from which the target secondary performs zone transfers; this is not a remotely unauthenticated attack. On servers that also provide recursion, BIND can follow the locally sourced cut and cache attacker-supplied data for names outside the configured zone, and the condition persists as long as the malformed zone remains in the zone database. No public exploit identified at time of analysis.
DNSSEC-validating BIND 9 resolvers can be induced to accept an inapplicable NSEC record as proof that no wildcard exists at a given name, letting an attacker who controls a zone at the same or an upstream level of the victim's name mask the existence of the victim's wildcard record and thereby disrupt resolution of names it should answer. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and the corresponding 9.11.3-S1 through 9.18.50-S1 and 9.20.9-S1 through 9.20.27-S1 subscription branches. The flaw is rated CVSS 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N) and is an integrity-only issue confined to wildcard denial-of-existence proofs; no public exploit identified at time of analysis, and no confidentiality or availability impact is claimed by the assessed vector.
Denial of service in ISC BIND 9 recursive resolvers: an attacker who controls (or compromises) an authoritative server for a DNSSEC-signed zone can cause `named` to abort after it encounters a use-after-free when processing a specific crafted sequence of answers. The attacker must first induce the victim resolver to issue multiple queries for that attacker-hosted zone, and the malicious responses must then arrive in a particular order and timing to trip the race, which is why this is rated high complexity (AC:H) despite being remote and unauthenticated (PR:N, no user interaction). Impact is availability-only (C:N/I:N/A:H), and exploitation is limited to `named` running as a recursive resolver on the listed versions; only 9.20.29 and later are fixed, and no public exploit code or confirmed active exploitation was identified at time of analysis.
CPU exhaustion denial of service in jwcrypto's JWK.import_key() allows a remote unauthenticated attacker to supply a crafted JWK with an arbitrarily large key_ops array and trigger O(n²) duplicate-detection work, consuming CPU proportional to the square of the array length. Any Python application that passes externally-supplied JWK material to this API - via ECDH-ES key agreement, OIDC dynamic client registration, DPoP proof parsing, or ACME account key registration - is vulnerable. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; CVSS rates this at 5.9 (Medium) with AC:H reflecting the requirement that attacker-controlled key material must reach the vulnerable code path.
Unbounded buffering of unacknowledged KV-transfer acknowledgements in the MoRIIO connector of vLLM 0.26.0 and 0.27.0 allows a remote, unauthenticated client to grow worker memory indefinitely and degrade or crash LLM inference serving. The root cause is CWE-400 uncontrolled resource consumption in moriio_connector.py, where acknowledgements whose transfer mapping is not yet populated are appended to _pending_unmapped_acks with no TTL or size cap across request_finished, get_finished and _handle_release_message. Impact is availability-only (CVSS 4.0 base 6.9, AV:N/AC:L/PR:N/UI:N/VA:L); no public exploit code and no CISA KEV
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Confused-deputy handling in the PriceTracking component of Google Chrome on iOS lets a remote, unauthenticated attacker reach a privileged in-browser page and bypass system access restrictions on versions prior to 153.0.8010.47. Exploitation is not straightforward - it requires the attacker to pair crafted network traffic with successful social engineering of the user (the independent assessment scores AC:H and UI:R, even though the published NVD vector lists UI:N), and the resulting impact is confined to Low confidentiality and Low integrity inside the browser context with no availability loss and no code execution outside Chrome. There is no evidence of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is only 0.22% (12th percentile), and a vendor fix is already available, making this a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Improper permission preservation during archive decompression in the HashiCorp go-getter library (1.8.x up to 1.8.8 and 2.x up to 2.2.3) lets a crafted archive cause extracted files to be created with attacker-influenced, elevated permission bits. When the extraction is performed by a privileged process — for example a root-run provisioning, CI, or orchestrator agent — a local actor can leverage the resulting files to gain the privileges of that extracting process, escalating from a low-privileged position to root or service-level access. HashiCorp has released fixes in go-getter 1.8.9 and 2.2.4; the issue is not listed in CISA KEV and no public exploit code has been identified at time of analysis.
Heap buffer overflow in the NGINX HTTP/3 module (ngx_http_v3_module) can crash NGINX worker processes or corrupt a limited amount of heap data when NGINX Plus or NGINX Open Source serves QUIC traffic while linked against OpenSSL 3.5.0 or earlier under certain configurations. The overflow occurs while processing a TLS handshake and is non-deterministic — triggering it is largely outside the attacker's control — so the realistic outcome is opportunistic denial of service (worker restart) plus limited data corruption rather than reliable remote code execution. There is no control plane exposure (data plane only), no public exploit identified at time of analysis, and no CISA KEV listing; EPSS data was not provided.
Information disclosure in the Networking component of Mozilla Firefox allows a remote, unauthenticated attacker to obtain a limited amount of sensitive data when a victim loads attacker-controlled web content; the flaw is fixed in Firefox 156 and Firefox ESR 153.3. Exploitation demands user interaction (UI:R) - the victim must visit or render malicious content in an unpatched build - and the assessed impact is confined to low confidentiality loss, with no code execution, integrity, or availability effect. Risk signals are low: EPSS is just 0.14% (4th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Spoofing in Firefox's DOM Navigation component allows attacker-controlled web content to misrepresent navigation or origin information in the browser UI, deceiving users about where they actually are or where a link leads; the flaw affects Firefox versions before 156 and Firefox ESR versions before 153.3. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N) but requires the victim to actively load the malicious page (UI:R), and the resulting impact is deception-based rather than code execution or bulk data theft. Rated CVSS 5.4 with an EPSS score of 0.14% (4th percentile), this is a moderate-severity UI-misrepresentation issue with no public exploit identified at time of analysis and no evidence of active exploitation (not listed in CISA KEV).
Site isolation bypass in Mozilla Firefox's Reader Mode component allows attacker-controlled web content to escape its intended origin boundary, producing limited confidentiality and integrity impact; it is fixed in Firefox 156 and Firefox ESR 153.3, so all earlier builds on those channels are affected. Exploitation is neither automatic nor trivial: the victim must first open the crafted page in Firefox and then explicitly activate Reader Mode on it (CVSS UI:R), although no authentication or elevated privileges are required (PR:N) and default configurations are exposed. No public exploit code and no confirmed active exploitation have been identified, EPSS is only 0.14% (4th percentile), and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N - this is a moderate-severity, low-urgency browser issue that should be handled through a routine browser patch cycle.
Mitigation bypass in Mozilla Firefox's DOM Notifications component allows remote attackers to defeat browser-enforced protections governing web notifications; it is fixed in Firefox 156 and Firefox ESR 153.3, so any earlier Firefox build or ESR build before 153.3 remains affected. Exploitation is remote and unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, 6.3) but requires the victim to visit or interact with attacker-controlled web content, and impact is limited to low confidentiality, integrity, and availability effects within the browser process. No public exploit code is identified at time of analysis, EPSS places likelihood at roughly 0.16% (6th percentile), and CISA KEV does not list this issue, so real-world priority is low-to-moderate.
An information-disclosure weakness in the Graphics: ImageLib component of Mozilla Firefox allows remote attackers to expose sensitive data when a victim loads attacker-controlled image content; because the CVSS vector carries PR:N with UI:R, no authentication or privileges are needed but the victim must open the crafted content. Impact is limited to confidentiality loss (C:H with I:N/A:N), so it is a moderate-severity flaw rather than a code-execution or availability risk. Mozilla fixed it in Firefox 156, Firefox ESR 140.16, and Firefox ESR 153.3, and EPSS is low at 0.16% (5th percentile) with no public exploit identified at time of analysis and no CISA KEV listing.
A protection-mechanism bypass in Firefox's DOM Copy & Paste and Drag & Drop component lets attacker-controlled web content escape an intended security mitigation (CWE-693), yielding limited confidentiality and integrity impact. All Firefox builds prior to 156, Firefox ESR prior to 140.16, and Firefox ESR prior to 153.3 are affected. Exploitation is unauthenticated (PR:N) but requires the victim to visit attacker-controlled content and then perform a copy-paste or drag-and-drop action (UI:R); there is no public exploit identified at time of analysis and EPSS is a low 0.16% (6th percentile). This is a moderate, low-priority browser bug, not a remote-code-execution issue.
GNOME Shell fails to validate the declared dimensions of icons returned by a remote search provider over D-Bus against the actual icon data buffer, producing an out-of-bounds read when an oversized size is supplied. A malicious or compromised search provider registered in a user's session can crash the shell — terminating the desktop session — and may leak fragments of adjacent shell memory. Rated CVSS 6.1 (AV:L/UI:R/C:L/A:H) by Red Hat; no public exploit code or CISA KEV entry was identified at time of analysis, so exploitation currently requires a locally present hostile search provider rather than remote access.
The mailto scheme parser added to fast-uri 4.1.3 (and still present in 4.1.4) compares query field names against the reserved names 'to', 'subject' and 'body' while they are still percent-encoded, then decodes them only when storing them as generic headers — so a percent-encoded spelling of a reserved field is invisible to that check but is written back out as the literal field name during serialization. Any application built on Fastify, ajv or similar Node.js stacks that parses a mailto URI, validates, logs or displays the recipient list, and then re-serializes it with fast-uri before sending can be tricked into delivering mail to an attacker-chosen address, with subject and body content smuggled across the same roundtrip. The flaw is rated 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N, CWE-172 Encoding Error) and is fixed in fast-uri 4.1.5.
Host allowlist and denylist bypass in fast-uri, the dependency-free RFC 3986 URI parser used by Fastify and ajv, affects releases before 2.4.7, 3.0.0 through 3.1.7, and 4.0.0 through 4.1.4. Because the library lowercases the host before percent-decoding it, an encoded uppercase octet such as %41 survives as a literal 'A', and in scheme-relative references like //host the canonicalization pass that would normally repair this never runs, so parse, normalize, and equal disagree about the same hostname. Any application that makes a case-sensitive host decision on fast-uri output — a host allowlist or denylist comparing the parsed host, or code relying on equal — can be steered past that check while the evading spelling still resolves to the gated host in DNS and HTTP. Exploitation status: no public exploit identified at time of analysis.
Path-traversal guard bypass in moment.js 2.29.2-2.30.1 allows a remote unauthenticated attacker (in server-side Node.js contexts) to supply a crafted non-string object to moment.locale() that satisfies the string-assuming guard via a custom match() method while its toString() returns a traversal path - delivering attacker-controlled path segments to an internal require() call. This is an incomplete fix for CVE-2022-24785 and is resolved in version 2.31.0; no public exploit has been identified at time of analysis.
Use-after-free in zstd-jni's Dictionary Sharing component allows remote attackers to corrupt native heap memory through the ZstdCompressCtx.loadDict() and ZstdDecompressCtx.loadDict() APIs in versions up to 1.5.7-13. The defect is a logic inversion in shared-lock accounting: the code releases the reference count on the incoming dictionary parameter rather than on the previously held dictionary reference, causing the old native buffer to remain referenced after it can be freed by another thread. A public proof-of-concept exists via GitHub issue #404, and vendor released a confirmed fix in version 1.5.7-14.
ZITADEL 4.0.0 through 4.15.3 (and EOL 3.0.0 through 3.4.12) fails to fully revoke role assignments on Project Grants when an administrator deletes two or more project roles at the same time, letting affected users keep permissions that were supposed to be removed. The flaw is an off-by-one style error (CWE-193) in the cross-organization cascade cleanup that iterates a user's role list for User Grants on Granted Projects, so one or more deletions can be skipped and, if the retained role was administrative, the user may keep elevated rights inside that shared project. Publicly available exploit code exists (a public gist referencing the issue), but there is no CISA KEV listing; vendor patch 4.16.0 ships a database migration that automatically repairs residue left in the eventstore.
Loading maliciously crafted web content in Apple's WebKit engine can crash the renderer or host process on Safari, iOS/iPadOS, macOS, tvOS, visionOS and watchOS builds earlier than the version 27 releases, producing a denial-of-service condition rather than code execution or data exposure. The flaw is a state-management logic error in the type-confusion class (CWE-843), and it is reachable from a remote web-content delivery path, so exploitation hinges on getting a victim to open a hostile page or embed WebKit content. No public exploit code has been identified at time of analysis and there is no CISA KEV listing; EPSS is only 0.14% (4th percentile), and Apple has shipped fixed '27' releases across all affected platforms, so the practical risk is moderate and availability-only. Note that Apple's published vector lists PR:L/UI:N while our assessment uses PR:N/UI:R, a contradiction worth confirming with the vendor.
Processing maliciously crafted web content in Apple's WebKit-based browser stack can disclose sensitive user information across Safari 27, iOS/iPadOS 27, macOS Golden Gate 27, tvOS 27, visionOS 27, and watchOS 27 and earlier. Apple classifies the root cause as an improper privilege management (permissions) issue and fixed it by removing the vulnerable code rather than adding a check, per the vendor advisories referenced for CVE-2026-64753. Real-world urgency is currently low: EPSS is 0.14% (4th percentile), there is no CISA KEV listing or public exploit identified at time of analysis, and CISA's SSVC assessment is exploitation:none / automatable:no / technical impact:partial, while a vendor patch is already available.
Improper resource handling in FFmpeg 8.0.x's HLS playlist parser allows remote attackers to cause denial of service by supplying a crafted HLS playlist containing malformed `duration` or `target_duration` field values. The flaw resides in `parse_playlist()` within `libavformat/hlsproto.c` and requires passive user interaction - the target application must process the attacker-controlled `.m3u8` playlist. No public exploit code or active exploitation (CISA KEV) is known; vendor-confirmed fixes are available in FFmpeg 8.1 and 9.0.
Local denial of service in SSSD's PAM responder occurs when a local process with access to the responder's UNIX socket negotiates legacy PAM protocol v1 and sends an empty or truncated request body. The out-of-bounds read in pam_parse_in_data() can terminate or restart the responder, causing availability loss for local authentication. This is a low-severity issue (CVSS 4.0, EPSS 0.12%, 2nd percentile) with no public exploit identified at time of analysis and no confirmed active exploitation in the provided data; exploitation requires a local foothold that can reach the socket and explicitly negotiate protocol v1.
An out-of-bounds read in the SSSD NSS responder allows any local user who can reach the responder's UNIX socket to crash the process by sending a specially crafted service lookup request, degrading local name/service resolution on the host. Only SSSD deployments shipped with Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 nodes are listed as affected by the vendor CPE data, and the flaw requires local socket access rather than network reach. There is no public exploit code and no CISA KEV listing; SSVC records exploitation as 'none' and the issue carries a modest CVSS 3.1 base score of 4.0 (availability impact only).
Disk space exhaustion in multer 2.2.0-2.3.0 allows a remote unauthenticated attacker to repeatedly start and abort multipart/form-data uploads, leaving orphaned temporary files that accumulate until the host disk partition is exhausted. The race condition arises when asynchronous disk writes complete after multer's abort cleanup routine has already run, so those files escape deletion entirely. No authentication is required and no special server configuration beyond the default disk storage engine is needed; the issue is fixed in multer 2.4.0.
Denial of service in multipathd allows a local attacker with access to the UNIX control socket to permanently block the daemon's listener thread by sending valid commands and then refusing to read the replies. This renders legitimate IPC operations - such as multipath path queries and storage management commands - unable to complete until the daemon is restarted. Red Hat, the reporting source, explicitly confirms the issue is bounded to availability impact only: no privilege escalation, no code execution, and no confidentiality or integrity loss. No public exploit code has been identified at time of analysis.
Symlink-following in libvirt's qemuTPMEmulatorPrepareHost() allows a local attacker with access to the swtpm service account to redirect a path-based chown() call - executed by libvirtd running as root - to transfer ownership of any arbitrary file on the system to the swtpm user. This affects libvirt on Red Hat Enterprise Linux 6 through 10. With ownership of a sensitive file such as /etc/shadow or a cron directory transferred to swtpm, the attacker gains a privilege escalation primitive beyond the swtpm account boundary. No public exploit or active exploitation has been identified at time of analysis.
Log field injection in morgan, the Node.js HTTP request logger middleware, before version 1.12.1 allows unauthenticated remote attackers to manipulate parsed log records by embedding unescaped double quotes in HTTP headers such as User-Agent or Referer. The escapeLogField() function failed to escape the double-quote character, which serves as a field delimiter in the Apache combined log format that morgan emits by default, enabling a downstream log consumer that parses by field position to read attacker-supplied text as a subsequent field. In custom log formats that quote an attacker-controlled token before a server-controlled one, an attacker can forge field values including the HTTP response status code as seen by SIEMs, audit pipelines, or compliance tooling. No public exploit has been identified at time of analysis.
Out-of-bounds read in PCRE2 before version 10.48 can be triggered in pcre2_match() when the PCRE2_MATCH_INVALID_UTF option is active and a subject string containing invalid UTF sequences is matched. The flaw occurs during backward scanning through invalid UTF data, where the lower buffer bound is not enforced, potentially crashing the calling application. The official CVSS score of 3.7 reflects high attack complexity and an impact limited to partial availability loss, with no confidentiality or integrity consequences confirmed. No public exploit has been identified at time of analysis.
Integer overflow in pcre2_compile_32 on 32-bit platforms allows network-reachable attackers to trigger an out-of-bounds heap write when a PCRE2-consuming application compiles attacker-supplied regex patterns. Affected versions are all PCRE2 releases prior to 10.48. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the widespread use of PCRE2 as a dependency in web servers, databases, and language runtimes means the actual attack surface is broader than PCRE2's own footprint might suggest.
Out-of-bounds read in PCRE2 before 10.48 can produce a limited availability impact when an attacker supplies invalid UTF-encoded data to an application that JIT-compiled patterns for one match mode but then calls pcre2_match with a different mode, triggering a JIT fallback with inconsistent internal state. The flaw is tracked as GHSA-2p8c-ff85-vh9x and was corrected in the PCRE2 10.48 release alongside four other security fixes. No public exploit code and no active exploitation have been identified at time of analysis; the low CVSS score of 2.9 and high attack complexity reflect the narrow, configuration-dependent preconditions required.
Integer overflow in GStreamer's gst-plugins-good isomp4 plugin exposes adjacent heap memory when parsing CEA-608 closed-caption data embedded in specially crafted MP4 or MOV files. The 32-bit unsigned arithmetic wraparound bypasses a bounds check, enabling an out-of-bounds heap read of up to 244 bytes that is forwarded into downstream caption output - leaking process memory to an attacker who controls caption rendering output. Affected platforms include Red Hat Enterprise Linux 6 through 10; no public exploit has been identified at time of analysis, and no active exploitation is confirmed.
Stack overflow in glibc's nscd (Name Service Cache Daemon) service, versions 2.3.4 and later, can be triggered by a malicious DNS server returning an oversized DNS response, causing the daemon to crash and degrading DNS resolution performance for the affected host. There is a remote theoretical possibility of nscd cache corruption if an attacker achieves precise heap-pointer control during the overflow, introducing a limited integrity impact on cached DNS data. nscd's isolated execution context (unprivileged user, no shell) constrains any post-crash impact, and no active exploitation has been identified.
NoSQL query injection in the GridFS component of the MongoDB Ruby Driver allows an authenticated low-privileged user to exceed their intended file access scope. When an application passes a caller-influenced structured identifier - such as a Ruby Hash containing MongoDB query operators - to GridFS retrieval or deletion operations without coercing it to a literal BSON type, the driver forwards the structure directly to the MongoDB query layer, which interprets it as a query condition. Exploitation can yield unauthorized read access to stored GridFS file chunks belonging to other identifiers, or mass deletion of all chunks within the affected bucket, permanently rendering all stored files unreadable. No public exploit has been identified at time of analysis.
GridFS NoSQL injection in the MongoDB C Driver (libmongoc) enables authenticated users with influence over file identifier parameters to either access file content beyond their intended authorization or destroy all GridFS file chunks in the affected bucket, rendering stored data permanently unreadable. The root cause (CWE-943) is the driver's failure to distinguish between structured query operators and literal identifier values in GridFS operations, allowing attacker-controlled input to redirect or broaden MongoDB queries. No public exploit code or CISA KEV listing has been identified at time of analysis, but the high integrity and availability sub-scores in the CVSS 4.0 vector indicate genuinely severe outcomes in vulnerable deployments.
Integer overflow in the MongoDB C Driver's SASL authentication path allows an abnormally large username to bypass a size check via arithmetic wrap-around, writing past the end of a fixed-size buffer and crashing the embedding application. Only applications compiled with the optional external SASL backend and configured to use it are reachable; the impact is limited to availability with no confidentiality or integrity consequence per CVSS VC:N/VI:N. No public exploit has been identified at time of analysis.
Denial of service in Tesseract OCR Engine 5.5.3 and earlier allows a local attacker to crash any process that loads a crafted .traineddata model file. The deserialization path in Plumbing::DeSerialize fails to reject a zero-length network stack for NT_SERIES, NT_PARALLEL, or NT_REVERSED layer types; subsequent initialization in Series::CacheXScaleFactor unconditionally dereferences stack_[0] on the now-empty vector, producing a deterministic crash via an invalid virtual method call through a dangling Network pointer. No public exploit is identified at time of analysis, and no fixed release has been issued - only an upstream commit fix is available.
Infinite-loop denial of service in zstd-jni versions 1.4.8-4 through 1.5.7-13 allows thread starvation by passing negative length values to ZstdInputStreamNoFinalizer.read(). Because the method is declared synchronized, the spinning loop holds the stream monitor indefinitely, blocking every other thread that attempts to call any synchronized method on the same stream object. Fixed in v1.5.7-14; no public exploit identified at time of analysis.
HTTP request smuggling in Netty 4.1.133-4.1.137.Final and 4.2.13-4.2.17.Final allows unauthenticated remote attackers to poison HTTP request queues and bypass intermediary security controls by submitting crafted Transfer-Encoding headers. The HttpObjectDecoder's final-coding validation was flawed: both split multi-line TE headers and comma-separated values like 'chunked, xchunked' bypassed the 'chunked must be last' check, causing Netty to interpret message framing differently from upstream proxies. Fixed releases 4.1.138.Final and 4.2.18.Final enforce RFC 9112-compliant validation across all TE header fields; no public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds write in Tesseract OCR engine version 5.5.3 and earlier allows an attacker who can supply a crafted `.traineddata` file to crash the LSTM OCR pipeline through a wild-address bit write into a size-zero vector. The flaw lies in `RecodedCharID::DeSerialize`, which validates array length but silently accepts negative `code_` values; this causes `ComputeCodeRange` to produce a zero `code_range_`, after which `SetupDecoder` indexes `is_valid_start_` out of bounds, reliably producing a crash or heap allocation failure. No fixed release is available; an upstream fix commit exists but has not been tagged into a release.
Path traversal in rclone prior to 1.75.1 allows an attacker who can populate a source object store with raw `..` key segments to cause rclone to write files outside the configured destination root when a victim performs a copy or sync operation. Thirteen destination backends - including b2, swift, sftp, smb, webdav, ftp, storj, and others - are affected because they apply path.Join(root, remote) on unvalidated object keys before EncodeDot can neutralize parent-directory segments; sftp and smb destinations carry the highest impact since they can reach other filesystem paths or shares accessible under the victim's credential. No public exploit code has been identified and the issue is fixed in v1.75.1.
rclone's HTTP backend (versions 1.49.0-1.75.0) leaks user-configured secret headers - including Authorization, Cookie, and X-Api-Key values - to untrusted redirect destinations because the underlying Go HTTP client follows redirects without a CheckRedirect policy that strips sensitive headers at host boundaries. When a configured HTTP remote issues a cross-host redirect, net/http copies the original headers verbatim to the new destination; a same-host HTTPS-to-HTTP redirect similarly exposes those headers in cleartext. Listing, stat, download, mount, and serve operations can all trigger the leak during normal use. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV.
HTTP/3 read timeout non-enforcement in Traefik allows unauthenticated remote attackers to exhaust upstream backend connection pools by trickling request body data indefinitely over QUIC streams. Versions 2.8.2 through 2.11.55 and 3.x through 3.7.11 fail to apply the configured `readTimeout` to HTTP/3 entrypoints because that timeout is enforced at the TCP connection layer and QUIC streams have no corresponding deadline. Attackers with access to an exposed HTTP/3 endpoint can hold upstream connections open without triggering any server-side timeout, progressively exhausting backends with bounded connection pools. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.
ForwardAuth identity spoofing in Traefik allows authenticated network users to impersonate arbitrary identities on normalization-prone backends by sending dot-form HTTP headers (e.g., X.Authenticated.User) that Go's net/http layer treats as distinct from their dash-form equivalents (X-Authenticated-User), while CGI, WSGI, PHP, and NGINX backends collapse both into the same environment variable. Affected deployments span the 2.x branch below v2.11.56 and the 3.x branch from 3.0.0 through 3.7.12; the protective aliasHeadersStrategy option defaults to keep, meaning all unpatched deployments with ForwardAuth and normalization-prone backends are exposed without any additional misconfiguration. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Set-Cookie attribute injection in the `cookies` Node.js library (versions before 0.9.2) enables an attacker to override cookie security attributes - SameSite, Secure, HttpOnly, or Domain - by embedding semicolons in the `domain` or `path` option when those options are populated from untrusted or request-derived data. Applications built on Koa (which delegates cookie handling to this library via `ctx.cookies`) represent the primary at-risk population. No public exploit or active exploitation has been identified; real-world impact is gated on an application-level antipattern of passing user-controlled data to these options.
JavaScript injection in Evolution email client allows a remote, unauthenticated attacker to execute arbitrary JavaScript within the mail-viewing context by sending a specially crafted HTML email containing a spoofed vCard control. When the victim clicks the vCard control, Evolution's trusted JavaScript handler incorrectly places an attacker-controlled javascript: URL into an iframe's src attribute, bypassing Evolution's own script-execution protections for email content. The vulnerability is classified CWE-84 (improper neutralization of encoded URI schemes), and exploitation requires one user interaction gesture - clicking the vCard element - making it realistic against any Evolution user on a RHEL or GNOME desktop. No public exploit code or CISA KEV listing has been identified at time of analysis.
Header injection in webhookd prior to v1.22.0 allows unauthenticated remote attackers to impersonate authenticated users by supplying forged HTTP authentication headers when the Basic Auth middleware is disabled. The server blindly forwarded all incoming HTTP headers as shell variables to webhook script execution environments; without the Basic Auth (`htpasswd`) middleware active to sanitize the `X-WebAuthn-User` header, scripts relying on that variable for identity or privilege decisions could be manipulated. No public exploit identified at time of analysis; vendor-released patch available at v1.22.0.
Cyrus IMAP before 3.12.4 exposes a Sieve-based mailbox existence oracle that allows authenticated users to enumerate private mailboxes belonging to other users and read shared mailbox annotation values. By crafting conditional Sieve filter scripts using `fileinto` branches and observing delivery outcomes during LMTP processing, an attacker can infer the existence of otherwise inaccessible mailboxes or annotation content through a side-channel. No public exploit exists and the vulnerability is not listed in CISA KEV; the EPSS risk is commensurately low, reflecting a medium-severity information disclosure limited to authenticated insiders.
Cyrus IMAP before 3.12.4 permits an authenticated sharee who holds the `maySetKeywords` ACL right on a shared mailbox to overwrite that mailbox's RFC 6154 `specialuse` annotation via a JMAP `Mailbox/set` request, a capability that should be restricted to the mailbox owner. By reassigning the shared mailbox to a system role such as Archive or Snoozed, the sharee can cause the victim's mail client to route messages into the now-shared folder, disclosing content beyond what was originally granted. No public exploit has been identified at time of analysis; vendor-released patches are available across three supported stable branches.
Cyrus IMAP before 3.12.4 exposes private calendar events and contacts to partially-privileged authenticated users through a broken ACL enforcement path in the CalDAV/CardDAV multiget REPORT handler. An attacker who already holds some shared DAV access to a target user's calendar or address book can include hrefs of unshared resources in a calendar-multiget or addressbook-multiget REPORT request, causing the server to return those resources without enforcing per-href access controls. The vulnerability is fixed across the 3.8, 3.10, and 3.12 release branches; no public exploit or CISA KEV listing has been identified.
Heap memory disclosure in Cyrus IMAP before 3.12.4 allows authenticated users to leak adjacent heap contents via a crafted JMAP blob ID. By issuing a JMAP blob download request using the internal format H<emailid>-<index> with an index value that exceeds the length of the blob_headers array, an attacker triggers an out-of-bounds read (CWE-125) and receives whatever heap memory follows the array in the server's response. The CVSS 3.1 score of 3.1 (Low) reflects the authentication requirement, high attack complexity, and limited confidentiality impact; no public exploit has been identified at time of analysis.
A crafted series of RTSP and HTTP requests sent to LIVE555 Streaming Media 2026.02.26 triggers a use-after-free in SocketDescriptor::tcpReadHandler1 (liveMedia/RTPInterface.cpp), crashing the media server and terminating all active streams. The flaw is reachable over the network without credentials, and because LIVE555 is embedded in IP cameras, streaming appliances and media servers, one crash can disrupt many downstream viewers at once. No public exploit code and no CISA KEV entry were identified at time of analysis, EPSS places exploitation probability at roughly 0.15% (5th percentile), and the supplied references do not state an exact fixed build number.
Incorrect authorization in Cyrus IMAP's JMAP snooze feature allows an authenticated low-privileged user to bypass destination-mailbox ACL checks, inserting mail into another user's inbox or any mailbox whose ID is known - even when the attacker holds no insert permissions on that target mailbox. Affected versions are prior to 3.12.4, 3.10.4, and 3.8.8. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.
Path traversal in LF Edge eKuiper's plugin installation endpoint (POST /plugins/*) allows high-privileged management API users to delete arbitrary files and directories on the host by embedding traversal sequences such as `../../` in the plugin `name` parameter. Affected versions are all eKuiper releases prior to 2.4.1 (Go module github.com/lf-edge/ekuiper/v2). A proof-of-concept is published in the GitHub security advisory GHSA-c23q-fw86-9h5x, demonstrating deletion of arbitrary host paths via `os.RemoveAll`; the advisory explicitly confirms exploitation is bounded to file deletion only - no code execution, file creation, or data exfiltration is achievable.
Server-Side Request Forgery in LF Edge eKuiper (all versions prior to 2.4.0) allows authenticated high-privilege users with management API access to register external service definitions targeting internal network addresses - including loopback (127.0.0.1), RFC1918 private subnets, and cloud metadata endpoints (169.254.169.254) - and trigger outbound requests to those addresses by executing SQL processing rules. Successful exploitation enables probing internal services, exfiltrating sensitive configuration data such as MQTT credentials exposed via eKuiper's own REST API, and interacting with internal APIs reachable from the eKuiper host. No public exploit or CISA KEV listing exists at time of analysis, but a detailed proof-of-concept is embedded in the GitHub security advisory GHSA-pqqc-8v73-9gg2.
Heap out-of-bounds read in CUPS's cupsUTF32ToUTF8() transcoding function exposes partial daemon heap memory to adjacent-network attackers without authentication. The vulnerable code path is reachable via SNMP supply-description parsing, meaning any attacker who can spoof or inject crafted SNMP responses on the same network segment as a CUPS host can trigger the read and potentially leak heap contents from the printing daemon. No active exploitation has been identified, and the adjacent-network attack vector significantly limits the exposure surface.
Heap out-of-bounds read in VLC Media Player 3.0.0 through 3.0.23 allows a hostile RTSP server to extract adjacent heap memory from a connecting client. The flaw lies in the realrtsp access module: `RtspReadLine` in `modules/access/rtsp/access.c` uses `strncpy` with the full buffer length into a 4096-byte allocation, omitting the null terminator when the source is at least as long; `rtsp_get` in `modules/access/rtsp/rtsp.c` then passes that unterminated buffer to `strdup`, which walks heap memory until an incidental zero byte. The disclosed bytes are retained as the RTSP Session identifier and echoed back to the server on every subsequent request, giving the server operator a continuous read of arbitrary heap contents from the victim process. No public exploit code has been identified at time of analysis, and the module is disabled in some distribution packages.
Sensitive information disclosure in SUSE NeuVector Manager before version 5.4.5 exposes security-critical data by inserting it into the manager container's log files during normal or error-path operation. The scope-changed CVSS vector (S:C) indicates the leaked material - likely credentials, tokens, or API keys - can compromise systems beyond NeuVector itself. No public exploit has been identified at time of analysis, but the low privilege bar and high confidentiality impact make this a meaningful risk for Kubernetes environments where NeuVector is deployed.
Remote denial-of-service in Tor before 0.4.9.12 allows any unauthenticated network peer to crash a Tor relay or client by transmitting a CC_RESPONSE congestion-control extension without a prior CC_REQUEST, corrupting the node's internal congestion-control state. Affected releases span 0.4.9.3-alpha through 0.4.9.11; the Tor Project patched this in 0.4.9.12 (TROVE-2026-032) with a ChangeLog entry and source commit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Sensitive information disclosure in Google Chrome's Editing subsystem allows a remote unauthenticated attacker to exfiltrate browser-accessible data by luring a user to a crafted HTML page. All Chrome versions prior to 153.0.8010.36 on desktop are affected. No public exploit has been identified and SSVC assigns no active exploitation, making this a low operational priority despite the CVSS 6.5 score.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer on Windows (prior to 153.0.8010.36) can expose limited memory content outside the Chrome sandbox to a remote attacker via a crafted HTML page. The vulnerability is platform-specific to Windows and requires user interaction to trigger, carrying a Chromium-assigned severity of Low and a CVSS score of 4.7. No public exploit or active exploitation has been identified; EPSS at 0.16% (6th percentile) confirms very low real-world exploitation probability, making this a routine patch priority rather than an emergency.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. No public exploit code exists, EPSS is 0.18% (7th percentile), and Chromium's own severity designation is 'Low', collectively confirming this as a low-priority but real integrity flaw.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Improper certificate validation in Google Chrome's Loader component (prior to 153.0.8010.36) enables remote attackers to bypass the browser's web origin policy via crafted network traffic combined with social engineering. The flaw (CWE-295) permits partial cross-origin data access and integrity impact, rated Low severity by Chromium's own classification despite a CVSS base score of 5.4. No public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating very low exploitation probability at this time.
Incorrect authorization in Chrome's Loader component allows a remote attacker to bypass system access restrictions with limited confidentiality and integrity impact. Affected versions are all Chrome releases prior to 153.0.8010.36, and exploitation requires user interaction via a crafted HTML page combined with social engineering. No public exploit or active exploitation (CISA KEV) has been identified; the EPSS score of 0.17% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a low-priority issue relative to the broader Chrome vulnerability landscape.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.