A vulnerability in Google Chrome on Android prior to version 155.0.8059.39 allows a remote attacker to read memory outside the sandbox via a crafted HTML page due to an uninitialized GPU resource. The issue has a medium severity rating with a CVSS score of 4.7.
A vulnerability in the Dawn component of Google Chrome on Mac versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox via a crafted HTML page. This issue is due to an uninitialized resource and is classified with medium severity.
A vulnerability in ANGLE component of Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. The issue is due to an uninitialized resource. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A vulnerability in ANGLE component of Google Chrome on Windows prior to version 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. The issue is due to an uninitialized resource. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A missing authorization vulnerability in the global vault component of Devolutions Server versions 2026.3.7.0 and earlier allows authenticated users with only view permissions to modify and delete global contact and folder entries.
An out-of-bounds read vulnerability exists in the Skia component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a local attacker, using social engineering and a crafted file, to potentially read memory. The vulnerability has a low severity rating and does not impact integrity or availability.
A vulnerability in Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox via a crafted HTML page due to an uninitialized GPU resource. The issue has a low security severity rating from Chromium but a medium CVSS score of 4.7. No known exploits are reported in the wild.
An uninitialized resource vulnerability in the Dawn component of Google Chrome on Android versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. This vulnerability has a medium severity rating and does not impact integrity or availability.
An out-of-bounds read vulnerability exists in the printing component of Google Chrome on Windows versions prior to 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process and used social engineering to read memory outside the sandbox via a crafted HTML page. The vulnerability has a medium severity rating.
An information leak vulnerability exists in the audio component of Google Chrome versions prior to 155.0.8059.39. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a crafted Chrome extension. The vulnerability has a medium severity rating.
A vulnerability in Google Chrome on Android prior to version 155.0.8059.39 involves an uninitialized GPU resource. This flaw allows a remote attacker who has compromised the renderer process to read memory outside the sandbox by delivering a crafted HTML page. The issue is rated as medium severity with a CVSS score of 4.7.
An uninitialized resource vulnerability in the Video component of Google Chrome versions prior to 155.0.8059.39 allows a remote attacker who has compromised the renderer process to read memory outside the sandbox via a crafted HTML page. The vulnerability has a CVSS score of 4.7 (medium severity) and is classified under CWE-908.
A vulnerability in ANGLE component of Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by using a crafted HTML page. The issue is due to an uninitialized resource. The vulnerability has a medium severity rating with a CVSS score of 4.7.
An uninitialized resource vulnerability in ANGLE within Google Chrome on Windows versions prior to 155.0.8059.39 allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The issue has a medium severity rating with a CVSS score of 4.7. This vulnerability could potentially expose sensitive information but does not impact integrity or availability.
Attackers who obtain AWS credentials are actively validating them to determine their usefulness for accessing Amazon Bedrock services. Credential harvesting platforms, including KMON_NOC, test stolen AWS keys by calling GetCallerIdentity, then verifying Bedrock access through ListFoundationModels and Converse API calls. This validation enables attackers to assess the value of credentials for resale in token-jacking markets, where stolen AI model access is sold below retail price. The testing targets Anthropic Claude models and enumerates promotional credits to estimate financial worth. This behavior represents an evolution in credential validation techniques similar to those previously observed with AWS SES and SNS services.
This entry provides Indicators of Compromise (IOCs) related to malware activity collected on 2026-10-06 from the ThreatFox MISP Feed. It is categorized as OSINT related to payload delivery and network activity. No specific technical details, affected software versions, or exploits in the wild are provided.
Multiple vulnerabilities have been addressed in WatchGuard Fireware OS as reported by the Nationaal Cyber Security Centrum. The specific vulnerabilities cover a wide range of common weakness enumerations (CWEs) including issues such as improper input validation, buffer overflows, and access control weaknesses. No CVSS score is provided, and no known exploits in the wild have been reported. Patch availability is not explicitly stated, and no affected versions are detailed in the available information.
vm2 NodeVM versions prior to 3.12.1 have a critical sandbox escape vulnerability. The vulnerability arises because the denylist of dangerous built-in modules omits child_process, allowing attackers to require this module and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicitly allows child_process.
PraisonAI versions up to 1.6.77 have a server-side request forgery (SSRF) vulnerability in the Crawl4AI/Chromium backend. This flaw allows attackers to bypass SSRF validation by leveraging DNS rebinding and HTTP redirects, enabling access to internal services and sensitive data such as canary values. The advisory is a duplicate and has been withdrawn in favor of GHSA-6g59-gm2v-qhvq. The vulnerability has a high severity score of 8.5 and affects versions up to 1.6.77.
PraisonAI versions up to 4.6.77 have a prompt injection defense misconfiguration where the block threshold is set to block only CRITICAL severity threats. This allows HIGH-level prompt injection attacks to bypass blocking and only be logged. Such attacks can include instruction overrides or financial manipulation, potentially enabling unauthorized extraction of system prompts and tool invocations. The vulnerability has a CVSS score of 7.5, indicating high severity.