Information Disclosure

Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.

UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.

UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.

UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.

Download-limit enforcement in goshs (Go Simple HTTP Server) v2.0.9 and earlier can be bypassed by racing concurrent HTTP requests against a limited-use share token, allowing a single token to be redeemed more times than the operator configured. The TOCTOU flaw in `ShareHandler` means every concurrent goroutine observes the same pre-increment `Downloaded` counter, each passes the limit check, and each is served the file - completely defeating one-shot or low-count share-link controls. A working proof-of-concept is publicly documented in the GitHub security advisory (GHSA-j48m-h7xq-2xpj) with 5/5 consistent reproductions; no active exploitation is confirmed in CISA KEV.

OpenTelemetry Java Instrumentation prior to 2.28.0 leaks clear-text database passwords into distributed trace span attributes when JDBC auto-instrumentation encounters double-quoted passwords in SQL CONNECT statements, bypassing the sanitization logic. These poisoned spans are then exported to any configured observability backend - Jaeger, Zipkin, OTLP collectors, or third-party SaaS monitoring - making database credentials visible to all parties with telemetry read access. No public exploit or confirmed active exploitation exists at time of analysis, but the impact of credential exposure is high given downstream database access risk.

Authorization bypass in Wagtail CMS allows authenticated low-privilege users to create translations for pages beyond their permitted scope. Versions prior to 7.0.8, 7.3.3, and 7.4.2 fail to enforce page-level permission checks when a user submits a translation request, exposing content of restricted pages to anyone holding the 'Can submit translation' permission. No public exploit code or active exploitation (CISA KEV) has been identified, but the low attack complexity and network-accessible vector make this straightforward to abuse for information disclosure.

Missing authorization on the image preview endpoint in Wagtail CMS allows any authenticated admin-panel user to render previews of images they do not have permission to access. Affected across three maintained release branches - all Wagtail versions prior to 7.0.8, 7.3.3, and 7.4.2. No public exploit has been identified at time of analysis, and exploitation is strictly bounded to users holding valid Wagtail admin credentials, making this a privileged-insider or compromised-account risk rather than an external threat.

Wagtail's Documents and Images chooser endpoint leaks asset metadata - including filenames, display names, and URLs - to authenticated admin users who have been explicitly denied collection-level choose permissions. Versions prior to 7.0.8, 7.3.3, and 7.4.2 are affected across the 7.0, 7.3, and 7.4 release branches. An attacker with a valid Wagtail admin account can enumerate restricted media assets across collections beyond their authorized scope, bypassing the collection permission model. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Prototype Pollution in Jodit Editor (versions prior to 4.12.18) allows network-reachable attackers to mutate Object.prototype by supplying crafted configuration payloads to Jodit.configure(), exploiting unfiltered merging in the internal ConfigMerge and ConfigProto helpers. Specifically, keys such as __proto__ or constructor nested inside legitimate option namespaces like controls can propagate to the global JavaScript prototype chain, corrupting runtime behavior for all JavaScript executing in the same environment. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV; however, exploitation is contingent on the host application forwarding user-controlled input into Jodit.configure(), a pattern common in configurable WYSIWYG deployments.

Resource exhaustion in Wasmtime's native WASIp1 implementation allows low-privileged WebAssembly guests to exhaust host-level file descriptors and OS resources by repeatedly invoking fd_renumber in a loop. The affected versions span four distinct release branches - all pre-24.0.10, 25.x-35.x, 37.x-44.x, and 45.0.0-45.0.1 - but only runtimes that both expose fd_renumber and grant guests the ability to open files are vulnerable. No public exploit code exists and the issue is not listed in CISA KEV; however, the attack is mechanically straightforward once the conditions are met, making patching the primary defense.

Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity window checks by controlling the `integratedTime` field in an inclusionProof-only tlog entry. Because the inclusionProof-only code path in `@sigstore/verify` does not cryptographically bind `integratedTime` (unlike the signed inclusionPromise/set path), a low-privileged attacker who can present an untrusted bundle can cause the verifier to accept expired or not-yet-valid signing certificates as currently valid. A publicly available proof-of-concept exists; this vulnerability is not in CISA KEV.

Remote denial of service in pion/dtls (Go's DTLS implementation) versions prior to 3.1.4 allows an unauthenticated network attacker to crash any application built on this library by sending a crafted ECDHE_PSK ServerKeyExchange message during the DTLS handshake. The CWE-125 out-of-bounds read triggers a Go runtime panic, immediately terminating the host process. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch exists in version 3.1.4.

Cross-user attribute structure leakage in API Platform Core's JSON:API and HAL serializers exposes the schema layout of security-gated properties to lower-privileged users through improper cache reuse. Versions from 2.6.0 up to 4.1.29, 4.2.26, and 4.3.12 are affected across the core, hal, and json-api packages. The component structure computed for a higher-privileged user's request can be served from cache to a subsequent lower-privileged user's request, bypassing the per-request evaluation of #[ApiProperty(security: ...)] predicates. No public exploit identified at time of analysis; vendor-released patches are available.

Type confusion in API Platform Core's AbstractItemNormalizer allows authenticated API consumers to corrupt relational data by supplying IRIs pointing to resources of the wrong type during write operations (POST/PUT/PATCH). The root cause is that getResourceFromIri() omits the $operation context when calling IriConverter::getResourceFromIri(), silently bypassing the is_a type guard at IriConverter.php:86. All 4.1.x, 4.2.x, and 4.3.x releases prior to the patched versions are affected; no public exploit or CISA KEV listing has been identified at time of analysis.

Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Repomix 1.14.0's MCP server exposes a file-read safety bypass allowing any MCP-connected client to retrieve arbitrary local `.json`, `.txt`, `.md`, or `.xml` files without triggering the project's `runSecretLint()` secret-scanning guard. The `attach_packed_output` tool accepts arbitrary local paths, validates only by file extension, reads the file without invoking the secret check, and registers the path under an `outputId`; `read_repomix_output` then returns the full file contents-entirely circumventing the boundary enforced by the dedicated `file_system_read_file` tool. No CISA KEV listing or EPSS data is available, but the advisory includes a reproduction harness that confirmed the bypass end-to-end against repomix@1.14.0.

Use-after-free in ImageMagick's 8BIM profile parser crashes the process when a specially crafted image is identified, affecting all releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch). The vulnerability is triggered by a specific format string embedded in the 8BIM metadata profile, causing memory corruption that results in a denial-of-service condition. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the intelligence feed.

Heap memory disclosure in ImageMagick's MNG decoder affects all versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch), allowing remote unauthenticated attackers to obtain partial heap contents by submitting a crafted MNG image file and retrieving the processed output. The root cause (CWE-908) is that pixel buffers are not fully initialized before output is written, leaving residual in-process heap data embedded in the resulting image. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication, network-accessible attack vector makes this a meaningful risk for any image-processing pipeline that accepts untrusted MNG input.

Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).

Policy bypass in ImageMagick's `-concatenate` operation allows local users to read from and write to filesystem paths that the configured security policy explicitly prohibits. All versions prior to 7.1.2-26 are affected. An attacker or unprivileged local user can invoke ImageMagick with `-concatenate` to circumvent path-based access controls defined in ImageMagick's policy.xml, effectively nullifying a primary hardening control relied upon in restricted or multi-tenant deployments. No public exploit code or CISA KEV listing is identified at time of analysis.

### Summary A memory-safety vulnerability in Open Babel's PQS parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's MSI parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

### Summary A memory-safety vulnerability in Open Babel's GRO parser caused an uninitialized pointer dereference when reading a crafted input file. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

Incorrect Authorization (CWE-863) in Elastic Defend exposes response action data to low-privileged authenticated users who should not have access to it. The flaw, classified under CAPEC-1, arises because access controls on specific functionality are not properly enforced, allowing a user with minimal privileges to read security response action data belonging to other users or roles. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the High confidentiality impact (CVSS C:H) means sensitive endpoint response data - such as isolation actions, process kills, or file retrieval outputs - could be disclosed.

Sensitive HTTP request header values are written into Kibana application logs when the optional APM (Application Performance Monitoring) instrumentation feature is enabled, exposing credentials or tokens to anyone with operator-level log access. This affects multiple Kibana release branches (8.18.x, 8.19.x, 9.0.x, and 9.1.x) and is classified as information disclosure under CWE-532. No public exploit or active exploitation has been identified at time of analysis; the exposure is passive and gated behind both a non-default configuration and existing operator privileges.

Arbitrary HDF5 file read in Keras up to 3.13.2 enables information disclosure when a victim loads a crafted model file, representing an incomplete patch for the prior CVE-2026-1669. The flaw lies in two specific code paths - `H5IOStore._verify_dataset()` and `file_editor.py` - which omit the `dataset.is_virtual` check, allowing a malicious HDF5 Virtual Dataset (VDS) to silently redirect reads to attacker-specified paths on the local filesystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the attack surface is realistic in ML supply chain and model-sharing contexts.

The genucenter web interface by genua exposes SNMP authentication and encryption keys in cleartext HTTP responses to any user holding the 'Service' or 'Admin' role, enabling credential theft without any exploitation complexity beyond normal authenticated use. Affected versions are all releases prior to 8.0p11; the fix was disclosed by sba-research via a coordinated advisory in April 2026. No public exploit code or active exploitation has been identified at time of analysis, though the disclosure of SNMP v3 keys - which govern both authentication integrity and traffic encryption - represents a meaningful lateral movement risk if those keys are reused across network devices.

Information disclosure in MediaWiki's core parser component (includes/Parser/Parser.php) allows authenticated low-privilege users, under conditions requiring user interaction, to obtain sensitive information not intended for their access level. All MediaWiki branches are affected up to versions 1.43.9, 1.44.6, 1.45.4, and 1.46.0, covering a broad installation base including self-hosted wikis worldwide. No public exploit code exists and no active exploitation has been confirmed at time of analysis; however, the provided CVSS 4.0 vector contains a contradictory zero-impact scoring that warrants independent verification against the upstream advisory.

Sensitive abuse filter configuration data in Wikimedia Foundation's AbuseFilter MediaWiki extension is exposed to authenticated low-privilege users via the QueryAbuseFilters API endpoint (includes/Api/QueryAbuseFilters.php). Authenticated wiki users on affected installations (all versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9) can retrieve private or restricted filter rule details they should not be authorized to access. No active exploitation has been confirmed (not listed in CISA KEV) and no public proof-of-concept exploit is known at time of analysis, but the moderate CVSS 4.0 score of 5.3 reflects real risk to wikis relying on confidential filter logic for abuse prevention.

Sensitive information exposure in MediaWiki's InfoAction.php allows unauthenticated remote actors to obtain restricted page metadata through the 'Info' action endpoint. All MediaWiki versions before 1.46.0, 1.45.4, 1.44.6, and 1.43.9 are affected across all deployment configurations. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the low attack complexity and lack of authentication requirements make opportunistic discovery straightforward for any actor who can reach the wiki.

Administrative access to the Stormshield Network Security captive-admin portal is bypassed when an attacker presents a revoked client certificate, because the portal does not enforce certificate revocation checks during TLS mutual authentication. Affected versions span three branches: 4.3.0-4.3.41, 4.4.0-4.8.15, and 5.0.2 EA-5.0.5. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, but the threat actor population is meaningfully constrained - exploitation requires prior possession of a certificate that was specifically issued for this portal and then revoked.

Insufficient permission enforcement in MediaWiki's user query API endpoints allows low-privileged authenticated users to access sensitive user information - such as group memberships or account details - that permission controls should restrict. The vulnerability spans four source files: ApiQueryAllUsers.php, ApiQueryUsers.php, PermissionManager.php, and UserGroupManager.php, indicating that the flaw lies in how permission checks are applied (or bypassed) when the API serializes user data. No public exploit code exists and the CVSS 4.0 score of 2.1 reflects the constrained real-world exploitability. No confirmed active exploitation (CISA KEV) has been reported.

Heap memory disclosure in the Perl HTML::Gumbo module before 0.19 lets remote attackers leak bounded chunks of process heap by submitting HTML containing a <template> element. The XS binding's walk_tree function misclassifies the template node as a text node and runs strlen() past the intended buffer, serializing the over-read bytes into parse() output. No public exploit is identified at time of analysis, and EPSS is low (0.66%), but exploitation is automatable and the flaw is trivially triggerable against any service that parses untrusted HTML with the default settings.

Information disclosure in MediaWiki's ApiUserrights.php exposes sensitive user rights data to authenticated actors who should not have access to it. All MediaWiki installations running versions prior to 1.43.9, 1.44.6, 1.45.4, and 1.46.0 are affected. The CVSS 4.0 score of 5.1 with low confidentiality impact (VC:L) reflects a bounded but real data leakage risk; no public exploit identified at time of analysis.

Session fixation in the Wikimedia Foundation OAuth MediaWiki extension (src/Backend/MWOAuthServer.php) allows a network-accessible, low-privileged attacker to manipulate the OAuth authorization handshake so that a victim's authentication binds to an attacker-controlled session identifier. All four actively maintained release branches are affected through versions 1.46.0, 1.45.4, 1.44.6, and 1.43.9. No public exploit or CISA KEV listing exists at time of analysis; however, the 'Information Disclosure' tag applied to this CVE creates tension with the vendor-supplied CVSS 4.0 zero-impact scoring and warrants independent verification.

Improper input validation in Wikimedia Foundation's UrlShortener extension (includes/UrlShortenerUtils.php) exposes a potential information disclosure path accessible to low-privileged authenticated users over the network. The vulnerability is classified under CWE-20 and tagged as an information disclosure issue, though the provided CVSS 4.0 vector records zero impact across all dimensions - a notable contradiction with the 'Information Disclosure' tag that warrants independent verification. No public exploit code exists and no active exploitation has been confirmed.

Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.

Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.

Uninitialized cluster exposure in FatFs R0.16 and earlier allows recovery of residual disk data when f_lseek() extends a file beyond its current EOF without zeroing newly allocated FAT clusters. Any application or device reading the extended region receives raw, previously written sector content instead of zeroed bytes, leaking sensitive residual storage data such as deleted file fragments or cryptographic material. A proof-of-concept exploit exists per SSVC and runZero's GitHub repository; no active exploitation has been confirmed in CISA KEV.

Integer underflow in FatFs R0.16 and earlier corrupts filesystem integrity via a stale dirty-cache skip during interleaved read/write operations on fragmented volumes. The condition `fp->sect - sect < cc` in f_read() and f_write() uses unsigned arithmetic - when `sect` exceeds `fp->sect`, the subtraction wraps to a large unsigned value, bypassing the required cache flush and leaving stale or inconsistent data on disk. A proof-of-concept exists per SSVC assessment, and technical impact is rated Total, though physical access is required per the CVSS vector. No confirmed active exploitation (not in CISA KEV).

Divide-by-zero in FatFs R0.16 and earlier's exFAT sync logic crashes the filesystem when crafted volume metadata causes the expression `n_fatent - 2` to evaluate to zero during write/sync operations, resulting in a hard fault or denial of service on the affected embedded device. The elm-chan FatFs library is widely bundled into microcontroller SDKs and IoT firmware, meaning the vulnerable code exists across a broad range of downstream products compiled with exFAT support. A proof-of-concept exists per SSVC assessment; no confirmed active exploitation (CISA KEV) has been recorded, and the physical attack vector limits mass exploitation, though network-accessible firmware update pipelines can extend effective reach.

Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.

Race condition in the Linux kernel signal subsystem allows a local low-privileged user to trigger a kernel warning and potential system instability by exploiting a timing window between SIGSTOP delivery and a concurrent execve() call in a multi-threaded process. The calling thread in zap_other_threads() retains stale JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME flags after the thread group is torn down, causing task_participate_group_stop() to decrement an already-zero group_stop_count and fire a kernel WARN_ON. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), consistent with a difficult-to-reliably-trigger race.

Core dump handling in the Linux kernel's RISC-V ptrace subsystem emits a kernel warning and disrupts crash reporting due to REGSET_CFI missing USER_REGSET_NOTE_TYPE. Affected kernels (7.0 through pre-patch 7.1 on RISC-V) trigger the warning at fs/binfmt_elf.c:1771 whenever a process core dumps with CFI register state present. Any low-privileged local user on a RISC-V host can trigger this condition; no public exploit exists and EPSS sits at 0.14%, indicating no practical threat beyond the operational disruption of broken core dumps.

Dangling function pointer in the Linux kernel's netfilter connection tracking subsystem (nf_conntrack) causes a kernel oops when a NAT helper module is unloaded while live expectations referencing its text remain in the expectation table. Specifically, NAT helpers such as nf_nat_h323 store raw pointers to module code in exp->expectfn; nf_ct_helper_expectfn_unregister() unlinks the callback descriptor without purging matching expectations, so when the expected connection subsequently arrives, init_conntrack() dereferences freed module text and crashes the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with the local, high-privilege exploitation path required.

Memory leak in the Linux kernel KVM subsystem exposes x86 SEV-ES (Secure Encrypted Virtualization-Encrypted State) guest environments to resource exhaustion when userspace terminates a VM without calling KVM_RUN after a VM-Exit. KVM retains writable page mappings across exits to userspace for certain SEV-ES VM-Exits, and when vCPU destruction must release these mappings, the kernel incorrectly emits a WARN about dirtying memory without a running vCPU - masking the real defect and complicating the fix. No public exploit exists and EPSS is 0.16% (5th percentile), placing this firmly as a low-exploitation-probability availability defect; patches are confirmed across multiple stable kernel branches.

Missing pagetable destructor calls in the ARM64 memory management subsystem cause kernel instability and resource leaks during memory hot-remove operations. Since commit 5e8eb9aeeda3, ARM64 page-table allocation unconditionally invokes pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() teardown was never added to the hot-remove path (free_hotplug_pgtable_page()), leaving PGTY_table type flags set and potentially leaking PTL allocations. No public exploit has been identified and EPSS at 0.15% (5th percentile) reflects the narrow exploitation path, though availability impact on affected ARM64 systems is confirmed by kernel maintainers.

Infinite-loop hang in the Linux kernel's nvmem ONIE TLV layout driver causes a local denial-of-service when the EEPROM contains unknown or vendor-specific entry types. Affected kernels from the 6.4 series through multiple stable branches fail to advance the offset pointer when an unrecognized TLV type is encountered, leaving the parser stuck indefinitely. No public exploit or active exploitation (CISA KEV) has been identified; with an EPSS of 0.16% at the 5th percentile, real-world exploitation risk is very low and limited to systems with specific hardware configurations.

Incorrect guard ordering in the Linux kernel's mincore subsystem causes spurious kernel WARN events and false non-resident page reporting on kernels compiled without CONFIG_SWAP support. Affected are Linux 6.18.x (before 6.18.36) and 7.x (before 7.0.13/7.1) builds where CONFIG_SWAP is disabled but CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled - a configuration typical of embedded or specialized deployments. With EPSS at 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to niche build environments.

Kernel crash in the Linux slimbus qcom-ngd-ctrl driver affects Qualcomm SoC-based systems from kernel 4.19 onward due to a race condition where SSR and PDR callbacks are registered before the NGD platform device is fully initialized. When the remoteproc subsystem starts concurrently with NGD driver probe - or is already running at PDR lookup registration time - callbacks fire on uninitialized kernel memory, producing a NULL pointer dereference in qcom_slim_ngd_ssr_pdr_notify() and crashing the kernel. No public exploit exists and EPSS is 0.17% (6th percentile); this vulnerability is not in CISA KEV.

Deadlock vulnerability in the Linux kernel's Qualcomm SLIMbus NGD controller driver (slimbus/qcom-ngd-ctrl) causes complete system availability loss through an ABBA lock-ordering inversion between tx_lock and ctrl->lock. Systems running affected kernel versions on Qualcomm SLIMbus-equipped hardware are vulnerable to kernel hangs when SSR/PDR (Subsystem Restart/Process Domain Restart) events race with ongoing DMA TX transactions. EPSS is 0.17% (7th percentile), no public exploit has been identified, and this vulnerability is not listed in CISA KEV.

Spurious WARN_ON in the Linux kernel's sched_ext cgroup migration path can trigger a kernel warning - and potentially a system panic when CONFIG_PANIC_ON_WARN is set - when systemd's user manager writes '+cpu +memory +pids' to its own subtree_control while a sched_ext BPF scheduler is loaded. The root cause is a mismatch between cgroup identity (used by scx_cgroup_can_attach) and CSS identity (used to drive migration), allowing scx_cgroup_move_task() to run against a task whose cgrp_moving_from was never initialized. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) confirms negligible exploitation interest.

Denial of service in the Linux kernel's debugobjects subsystem affects RT-enabled (PREEMPT_RT) kernel builds when fill_pool() is called while a task already has pi_blocked_on set. On real-time kernels, fill_pool() invokes rtlock_lock(), which triggers a kernel assertion failure because the priority inheritance chain cannot branch - a task can only be blocked on one lock simultaneously. Exploitation is local-only, requires low privilege, and is constrained to RT kernel configurations; no public exploit exists and EPSS is 0.17% (6th percentile). Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the technical description, which describes a kernel assertion crash - a denial-of-service condition.

Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.

User enumeration in MyComplianceOffice (MCO) version 25.3.3.1 allows unauthenticated remote attackers to identify valid usernames and email addresses by observing distinguishable application responses from the password reset and username reminder endpoints. The CWE-204 Observable Response Discrepancy root cause means account existence is leaked through differential error messages, status codes, or redirect behavior - classic reconnaissance fodder for follow-on credential stuffing or targeted phishing against compliance personnel. No public exploit code has been identified and no CISA KEV listing exists; however, vendor contact was unsuccessful, leaving patch status unresolved and version scope uncertain beyond the confirmed 25.3.3.1 release.

Unauthorized private content disclosure in the Slim SEO WordPress plugin (all versions through 4.9.8) allows authenticated Contributors to read protected content they do not own via the `/wp-json/slim-seo/meta-tags/ai` REST API endpoint. The endpoint's broken object-level authorization - checking only the generic `edit_posts` capability rather than per-post read access - lets any Contributor supply an arbitrary post ID and receive an AI-generated summary of that post's raw content, including private, draft, pending, future, and password-protected posts authored by other users. No public exploit or CISA KEV listing is identified at time of analysis; real-world risk is constrained by the requirement for a pre-existing Contributor-level account.

Weak password hash storage in BMC Control-M/Enterprise Manager exposes account credentials to offline recovery attacks if an attacker gains access to the credential database. Affected are unsupported versions 9.0.20.x and potentially earlier legacy releases, meaning no vendor patch will be issued for these branches - upgrade to a supported release is the only vendor-endorsed remediation. The CVSS 4.0 vector (AV:L/PR:H/AT:P) confirms exploitation requires local, high-privilege access and specific attack conditions, significantly constraining real-world risk; no public exploit code and no CISA KEV listing have been identified at time of analysis.

Subscription cancellation authorization bypass in the Fluent Forms WordPress plugin (all versions before 6.2.1) permits any authenticated low-privilege user to cancel subscriptions belonging to other site members by submitting a crafted request referencing a victim's subscription identifier. The plugin fails to verify that the requesting user owns the referenced subscription before processing the cancellation, a classic Insecure Direct Object Reference (IDOR) pattern. A public proof-of-concept is available via WPScan; no confirmed active exploitation campaign (CISA KEV) has been identified at time of analysis, and the CVSS base score of 3.1 reflects the limited, integrity-only impact.

Missing capability check in WS Form LITE WordPress plugin before 1.11.8 allows any authenticated subscriber-level WordPress user to modify the plugin's settings, an action that should be restricted to administrators. The CVSS vector (PR:L) confirms low-privilege authentication is sufficient, and a publicly available proof-of-concept has been documented by WPScan. No active exploitation has been confirmed by CISA KEV, but the low barrier to exploitation and available POC make this a credible risk on multi-user WordPress installations where untrusted subscribers exist.

Sensitive PII exposure in the Appointment Booking Calendar WordPress plugin (versions up to and including 1.4.02) allows any authenticated user with contributor-level access to retrieve customer booking records - including names, email addresses, phone numbers, and appointment comments - via the unprotected `cpabc_appointments_filter_list` AJAX action. The root cause is CWE-862 (Missing Authorization): the endpoint performs no capability check before returning data, meaning the attacker's only prerequisite is a valid WordPress login at contributor tier or above. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but a source-level fix appears committed in the plugin's SVN repository (changeset 3581633).

UltraVNC through 1.8.2.2 exposes a cryptographically weak VNC authentication challenge generator that an attacker can predict by observing network traffic and enumerating a roughly 31-bit seed space derived from wall-clock time and process ID. Successful seed reconstruction allows the attacker to forge or brute-force valid VNC authentication responses, effectively bypassing the RFB challenge-response mechanism and gaining unauthorized remote desktop access. No public exploit has been identified at time of analysis, and the vulnerability is not currently listed in the CISA KEV catalog; however, the mathematical basis for exploitation is straightforward given the small seed space.

Out-of-bounds read in UltraVNC through version 1.8.2.2 allows network-authenticated attackers to potentially crash the VNC server process or leak adjacent memory content via the vncWc2Mb() wide-string conversion helper in rfb/dh.cpp at line 204. The flaw is triggered when wcslen() is called on a caller-supplied WCHAR pointer without a preceding bounds check, enabling memory over-reads if the buffer lacks proper NUL termination. No public exploit code or active exploitation has been identified at time of analysis; the vendor's CVSS 4.3 (Medium) rating reflects the constrained and largely denial-of-service-oriented impact.

Information disclosure in MediaTek modem firmware across 67+ chipset models enables a network-adjacent attacker operating a rogue cellular base station to extract sensitive data from a victim's User Equipment (UE) without any privileges or user interaction. The root cause is improper input validation (CWE-288) in the modem baseband stack, allowing a fake cell tower to elicit confidential data from connected devices. No active exploitation has been confirmed by CISA KEV, and SSVC assessment rates exploitation as 'none' at time of analysis, though the architecture of the attack closely resembles IMSI-catcher and stingray-type tradecraft used in targeted surveillance operations.

CVE-2026-45383 has no publicly available description, CVSS score, CWE classification, or technical details at time of analysis. The sole intelligence signal is a report attribution to the Ubuntu vendor source, suggesting this may affect a package within the Ubuntu ecosystem. No impact, attack vector, or affected version data can be synthesized without a description - any characterization beyond this would be fabricated.

CVE-2026-45382 is associated with Ubuntu Linux based on the sole reporting source (vendor:ubuntu), but no description, CVSS score, CWE classification, or affected version data was provided in the intelligence feed. The vulnerability's nature, impact, and exploitability are entirely unknown from available data. No assessment of attacker capability or affected user population is possible without a vendor advisory or NVD entry.

UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.

UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.

Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.

Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.

UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.

UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.

Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.

UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.

UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.

UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.

UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.

UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.

UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.

UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.

UI spoofing in Google Chrome's WebXR component (all versions prior to 150.0.7871.47) allows remote attackers to misrepresent browser interface elements when a victim visits a crafted HTML page. The flaw stems from an inappropriate implementation in the WebXR Device API, enabling manipulation of what the user perceives as trusted UI - potentially obscuring origin indicators, security state, or page identity. No public exploit code exists and EPSS stands at 0.18% (8th percentile); CISA SSVC rates exploitation as none with partial technical impact, placing this firmly in the lower-priority tier despite its network-accessible vector.

UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.

UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.

UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.

Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.

UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.

Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.

Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.