CAI Content Credentials | Improper Verification of Cryptographic Signature (CWE-347)

CAI Content Credentials is affected by an Improper Verification of Cryptographic Signature vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CAI Content Credentials | Improper Certificate Validation (CWE-295)

CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CAI Content Credentials | Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)

CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to exhaust system resources, resulting in an application denial-of-service condition. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploit depends on conditions beyond the attacker's control. Exploitation of this issue does not require user interaction.

CAI Content Credentials | Improper Input Validation (CWE-20)

CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

JVM Options Injection Enables Command Execution in JetBrains Datalore Database Tasks

In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection

Improper Authorization Enables Retrieval of Notebook Owner's File Storage Session Token

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

Unauthorized Download of Private Notebook Files via Published Interactive Reports in JetBrains Datalore

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

Xiaomi Mi Browser < 14.66.0 Path Traversal via ThirdDocViewerActivity

Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability in the exported ThirdDocViewerActivity component, where CopyExternalFile.copyFromUri() copies content provider streams using an unsanitized filename from the _display_name column without basename reduction or canonical-path checks. A zero-permission co-resident malicious application can supply a crafted content provider with a _display_name containing .. sequences to make the browser write attacker-controlled bytes to an arbitrary path within its external storage directory, escaping the intended cache_docs staging location without requiring user interaction.

Improper Authorization in JetBrains Datalore Allowing File Modification by Notebook Viewers

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

In has_booted_successfully of sys_state_setup_otp_ta.c, there is a possible way to trigger a permanent denial of service via premature anti-rollback fuse updates due to a logic error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In get_secure_boot_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In getChppAppState of chpp_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control structures due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In createDataFlowAsync of data_flow_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In CommitToBuffer of hal_override_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure memory due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

In on_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk_decoder_global_state.cpp, there is a possible way to leak host code pointers to a guest virtual machine due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.