CVE Vulnerability Catalog

Race condition in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Severity: High)

Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Race condition in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Severity: Medium)

Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could obtain sensitive information via a crafted Chrome extension.

Memory corruption in the Codecs component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Out of bounds read in the Media component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Race condition in FileAPI in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36. A remote attacker could obtain sensitive information via a crafted Chrome extension.

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted HTML page.

The cjose C library implementing JOSE has a vulnerability in the JWE decryption path for AES Key Wrap algorithms (A128KW, A192KW, A256KW) due to lack of validation of the attacker-supplied encrypted_key length before unwrapping into a fixed-size heap buffer. A remote unauthenticated attacker can trigger an out-of-bounds heap write, leading at least to a crash (DoS) and potentially to further memory corruption. The entry points cjose_jwe_import() and cjose_jwe_decrypt() are pre-authentication and process fully attacker-controlled input.

In Google go-attestation up to version 0.6.1, there is an uncontrolled recursion vulnerability in the Windows SIPA event log parser, allowing an attacker to cause a denial of service (DoS) by submitting a crafted event log with deeply nested elamAggregation headers. This leads to stack overflow and immediate crash of the application.

Maravel prior to version 10.74.0 contains a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. In environments with low cache memory or active Atomic Lazy Eviction model, token blacklist entries (jti) are truncated from 14 days to a maximum of 2 hours, and any tag flush instantly invalidates the entire index, silently resurrecting stolen or logged-out tokens.

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source text by calling the mutable global JSON.stringify while printing synthetic string literals and interpolating timezone data. An expression could replace JSON.stringify and cause later generated source to contain executable attacker-controlled code. The affected code-generation paths include packages/@n8n/expression-runtime/src/bridge/isolated-vm-bridge.ts and packages/@n8n/tournament/src/ExpressionBuilder.ts, and the issue does not affect the vm expression engine. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

In n8n before versions 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-controlled destination path against the default N8N_BLOCK_FILE_PATTERNS regular expression. The pattern ^(./).git(/.)$ allowed catastrophic backtracking and ran synchronously in the main n8n process. An authenticated workflow editor could freeze the instance with one workflow execution.

In n8n before versions 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved through dynamically scoped this and did not reject reserved class member names. A class field named __sanitize could rebind the sanitizer and reach the Function constructor, enabling backend code execution and editor-preview JavaScript execution.

In n8n before versions 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redirect_uris but accepted arbitrarily large client_name and grant_types values. An unauthenticated remote caller could repeatedly persist oversized values in oauth_clients and exhaust database storage.

Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the caller's code-signing certificate chain for equality with its own, rather than validating the caller against a pinned code requirement. A local, authenticated user can execute code within the vendor-signed process, satisfy the helper's client check, and cause the helper to execute a script with root privileges.

The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host system to modify the connector's configuration. When the service restarts, the modified configuration can lead to code execution with the privileges of the service account.

Acrobat Reader is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. A low-privileged attacker could exploit this vulnerability to gain elevated access. Exploitation does not require user interaction. Scope is changed.

Acrobat Reader is affected by an Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') vulnerability that could lead to arbitrary file system read. An attacker could exploit this vulnerability to access sensitive files and directories outside the intended access scope. Exploitation requires user interaction in that a victim must open a malicious file. Scope is changed.