A memory corruption flaw (out-of-bounds write) in the V8 JavaScript engine of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. An attacker needs a user to open a crafted HTML page, for example via a phishing link, a malicious advertisement or a compromised website. Code execution is limited to the sandbox; the description does not claim a full system compromise.
Google · Chrome
Improper input validation in Skia, the 2D graphics engine of Google Chrome desktop, is listed in the Chrome release notes as High severity. The supplied description calls it a buffer overflow that requires a compromised renderer process, but the release note and research notes do not confirm this, so the weakness type and preconditions must be verified on NVD. Per the description, an attacker could use a crafted HTML page to potentially execute code outside the sandbox. The CVSS score is 9.6 (critical), but the record should be checked before prioritising.
Google · Chrome
Google Chrome versions before 156.0.8078.79 contain a use-after-free flaw in the Frames component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires a user to visit the malicious page, for example through a link in a phishing email.
Google · Chrome
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
Research and translation in progress – available shortly.
The Delinea Privilege Manager Windows agent contains a flaw that allows a remote, unauthenticated attacker to execute arbitrary code as LocalSystem under certain conditions. Successful exploitation would give the attacker full control over the affected endpoint. The enabling conditions are not publicly described, and the CVSS vector (High privileges required, active user interaction) conflicts with the 'unauthenticated' claim, so the advisory needs to be verified.
Delinea · Privilege Manager
The Collector service of the Veeam Management Pack for Microsoft System Center contains a vulnerability that allows a member of the Veeam Virtualization Extensions Users group to execute code remotely on the server. The attacker must already hold this group membership, so this is a privilege-escalation step rather than an anonymous entry point. Veeam rates the issue High (CVSS v4.0 8.8), and a successful attack could compromise the management server, which may affect backup infrastructure.
Veeam · Management Pack for Microsoft System Center
The Veeam Management Pack for Microsoft System Center Collector service contains a flaw that lets an authenticated domain user execute code remotely as the LocalSystem account. The vulnerability affects version 9.0 up to but not including 13.1.0.334 and is classified as CWE-502 (deserialization of untrusted data) by NVD-mirror data, while VulDB lists CWE-94. An attacker needs valid domain credentials but no user interaction, and a successful attack gives full control over the affected server, which is usually domain-joined and privileged.
Veeam · Management Pack for Microsoft System Center
The Veeam Virtualization Extensions service of the Veeam Management Pack for Microsoft System Center contains a flaw that allows an unauthenticated attacker to execute code remotely on the affected server. No valid credentials are required, and the CVSS v4.0 base score is 9.3 (critical). The component runs with elevated privileges and can reach hypervisor and backup infrastructure, so a compromise may have serious consequences. The vendor has published a fix, but version 9.x will not receive one.
Veeam · Management Pack for Microsoft System Center
WeGIA, a web manager for charitable institutions, contains a stored cross-site scripting flaw in the textoProntuario field of the medical record history page (saude/historico_prontuarios.php). An attacker who can create or access a patient's medical record can store JavaScript that runs in the browser of another user who opens the affected history page. Successful exploitation can lead to session cookie theft and possible account compromise, depending on the victim's privileges.
LabRedesCefetRJ · WeGIA
CoPilot before 0.1.76 renders case-report templates with a non-sandboxed Jinja2 engine. A user with the lowest-privilege customer_user role can upload a manipulated template, and it is executed as Python code when an admin or analyst generates a report. In the reported deployment this allowed command execution as root, exposing data of all tenants and stored connector credentials. The PDF renderer additionally allowed local file reads and requests to internal services.
SOCFortress · CoPilot
WeGIA, a web manager for charitable institutions, is affected by a stored DOM cross-site scripting vulnerability in the memorandum dispatch view listar_despachos.php. An attacker with a low-privilege account that can create memorandum dispatches can store malicious HTML or JavaScript that runs in the browser of another user who opens the memorandum thread. This can lead to theft of administrator session tokens, session hijacking, account takeover and access to privileged functions. User interaction is required.
LabRedesCefetRJ · WeGIA
WeGIA, a web manager for charitable institutions, does not verify record ownership in its Controle classes and processes request parameters through extract($_REQUEST). Any authenticated user can view, change or delete records of other users, including personal identifiers, addresses, medical records, financial data and employee records. Some controllers also lack CSRF validation, so a malicious web page visited by a logged-in user can trigger changes using that user's session.
LabRedesCefetRJ · WeGIA
Lightdash, an open-source business intelligence platform, has a dbt Cloud webhook endpoint that accepts requests without authentication. Attacker-supplied accountId and runId values are inserted into the dbt Cloud API URL without sanitization, so path traversal can redirect the server's request, which carries the project's API key, to another path on cloud.getdbt.com. The attacker must know the project UUID, and the target must be a dbt Cloud IDE project. The advisory's claim of API key theft is not established by the evidence, and the CVSS and CWE ratings conflict between sources.
Lightdash · Lightdash
Docat, a tool for hosting versioned static documentation, does not validate the path or type of files sent to its Upload API. An attacker who can reach the API can overwrite sensitive configuration files or place malicious files on the web server. Depending on the deployment, this can lead to remote code execution or cross-site scripting. Whether an attacker needs a login or API key in a default setup is unknown.
docat-org · docat
OpenAM, an access management solution, exposes a logged-in user's raw session token through its Cross-Domain Single Sign-On (CDSSO) servlet. An attacker who gets an authenticated victim to visit a crafted URL can receive the token and may hijack the session. Exploitation requires CDSSO to be enabled, which is common in multi-domain deployments, and a non-default configuration that the sources do not name.
Open Identity Platform · OpenAM
Research and translation in progress – available shortly.
graphql-core, a Python port of the GraphQL.js reference implementation, leaks memory when a GraphQL document produces more than 100 validation errors. Each aborted validation adds frames to a shared exception object, so documents and validation contexts stay in memory for the lifetime of the process. An unauthenticated attacker can repeatedly send a small query to exhaust worker memory before execution, causing a denial of service, without disclosing or modifying data.
graphql-python · graphql-core
Research and translation in progress – available shortly.
joserfc, a Python library for JOSE standards such as JWS and JWE, allocates memory for copies of the header, payload and signature segments before its size limit rejects oversized compact tokens. An unauthenticated attacker can send very large tokens to services that parse them before verifying the signature, which can exhaust process memory and cause a denial of service. Confidentiality and integrity are not affected, and no code execution is possible.
Authlib · joserfc
joserfc is a Python library for JOSE standards. Before version 1.7.5, decrypt_json() processed every entry of a JWE General JSON recipients array without a count limit, performing one RSA private-key decryption per entry. An unauthenticated attacker who can submit JWE General JSON to an endpoint using an RSA key-management algorithm can choose the amount of CPU work per request and exhaust the service's CPU. The verify_all_recipients option does not limit this work, and there is no impact on confidentiality or integrity.
Authlib · joserfc
The project-graph analyzers of the Nx plugins @nx/maven and @nx/gradle start processes through a shell and insert plugin options from nx.json into command arguments without sanitizing them. An attacker who can get a user or CI job to run nx in a hostile repository or pull request can execute arbitrary commands with that user's privileges. Workspaces that do not register either plugin are not exposed.
Nrwl · Nx
