# CVEs published 2026-06-04

627 CVEs were published on June 4, 2026: 71 critical, 262 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-50589](https://cve.now/CVE-2026-50589.md): In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or… (CVSS 5.3, OpenStack Ironic · ironic)
- [CVE-2026-10877](https://cve.now/CVE-2026-10877.md): SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection (CVSS 6.9, SourceCodester Ship Ferry Ticket Reservation System)
- [CVE-2026-10876](https://cve.now/CVE-2026-10876.md): SourceCodester Ship Ferry Ticket Reservation System admin improper authorization (CVSS 5.3, SourceCodester Ship Ferry Ticket Reservation System)
- [CVE-2026-10586](https://cve.now/CVE-2026-10586.md): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns \<= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery (CVSS 7.2, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2026-11309](https://cve.now/CVE-2026-11309.md): Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11308](https://cve.now/CVE-2026-11308.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 6.3, Google Chrome)
- [CVE-2026-11307](https://cve.now/CVE-2026-11307.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11306](https://cve.now/CVE-2026-11306.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11305](https://cve.now/CVE-2026-11305.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11304](https://cve.now/CVE-2026-11304.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11303](https://cve.now/CVE-2026-11303.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11302](https://cve.now/CVE-2026-11302.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-11301](https://cve.now/CVE-2026-11301.md): Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out… (CVSS 8.8, Google Chrome)
- [CVE-2026-11300](https://cve.now/CVE-2026-11300.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11299](https://cve.now/CVE-2026-11299.md): Integer overflow in Fonts in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11298](https://cve.now/CVE-2026-11298.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same… (CVSS 4.3, Google Chrome)
- [CVE-2026-11297](https://cve.now/CVE-2026-11297.md): Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to… (CVSS 7.7, Google Chrome)
- [CVE-2026-11296](https://cve.now/CVE-2026-11296.md): Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 7.5, Google Chrome)
- [CVE-2026-11295](https://cve.now/CVE-2026-11295.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege… (CVSS 8.8, Google Chrome)
- [CVE-2026-11294](https://cve.now/CVE-2026-11294.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11293](https://cve.now/CVE-2026-11293.md): Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a… (CVSS 9.6, Google Chrome)
- [CVE-2026-11292](https://cve.now/CVE-2026-11292.md): Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security… (CVSS 4.3, Google Chrome)
- [CVE-2026-11291](https://cve.now/CVE-2026-11291.md): Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-11290](https://cve.now/CVE-2026-11290.md): Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a… (CVSS 5.0, Google Chrome)
- [CVE-2026-11289](https://cve.now/CVE-2026-11289.md): Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11288](https://cve.now/CVE-2026-11288.md): Insufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11287](https://cve.now/CVE-2026-11287.md): Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11286](https://cve.now/CVE-2026-11286.md): Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 4.3, Google Chrome)
- [CVE-2026-11285](https://cve.now/CVE-2026-11285.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI… (CVSS 4.3, Google Chrome)
- [CVE-2026-11284](https://cve.now/CVE-2026-11284.md): Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11283](https://cve.now/CVE-2026-11283.md): Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 6.5, Google Chrome)
- [CVE-2026-11282](https://cve.now/CVE-2026-11282.md): Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-11281](https://cve.now/CVE-2026-11281.md): Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive… (CVSS 5.0, Google Chrome)
- [CVE-2026-11280](https://cve.now/CVE-2026-11280.md): Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via… (CVSS 4.3, Google Chrome)
- [CVE-2026-11279](https://cve.now/CVE-2026-11279.md): Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11278](https://cve.now/CVE-2026-11278.md): Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak… (CVSS 6.5, Google Chrome)
- [CVE-2026-11277](https://cve.now/CVE-2026-11277.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-11276](https://cve.now/CVE-2026-11276.md): Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass… (CVSS 5.1, Google Chrome)
- [CVE-2026-11275](https://cve.now/CVE-2026-11275.md): Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11274](https://cve.now/CVE-2026-11274.md): Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-11273](https://cve.now/CVE-2026-11273.md): Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a… (CVSS 6.1, Google Chrome)
- [CVE-2026-11272](https://cve.now/CVE-2026-11272.md): Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 8.8, Google Chrome)
- [CVE-2026-11271](https://cve.now/CVE-2026-11271.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage… (CVSS 6.5, Google Chrome)
- [CVE-2026-11270](https://cve.now/CVE-2026-11270.md): Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data… (CVSS 6.5, Google Chrome)
- [CVE-2026-11269](https://cve.now/CVE-2026-11269.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to… (CVSS 7.1, Google Chrome)
- [CVE-2026-11268](https://cve.now/CVE-2026-11268.md): Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11267](https://cve.now/CVE-2026-11267.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install… (CVSS 4.3, Google Chrome)
- [CVE-2026-11266](https://cve.now/CVE-2026-11266.md): Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via… (CVSS 4.3, Google Chrome)
- [CVE-2026-11265](https://cve.now/CVE-2026-11265.md): Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 7.5, Google Chrome)
- [CVE-2026-11264](https://cve.now/CVE-2026-11264.md): Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security… (CVSS 4.3, Google Chrome)
- [CVE-2026-11263](https://cve.now/CVE-2026-11263.md): Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11262](https://cve.now/CVE-2026-11262.md): Use after free in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML… (CVSS 8.8, Google Chrome)
- [CVE-2026-11261](https://cve.now/CVE-2026-11261.md): Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 4.3, Google Chrome)
- [CVE-2026-11260](https://cve.now/CVE-2026-11260.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security… (CVSS 4.3, Google Chrome)
- [CVE-2026-11259](https://cve.now/CVE-2026-11259.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin… (CVSS 4.3, Google Chrome)
- [CVE-2026-11258](https://cve.now/CVE-2026-11258.md): Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user… (CVSS 6.5, Google Chrome)
- [CVE-2026-11257](https://cve.now/CVE-2026-11257.md): Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 4.3, Google Chrome)
- [CVE-2026-11256](https://cve.now/CVE-2026-11256.md): Integer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-11255](https://cve.now/CVE-2026-11255.md): Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.5, Google Chrome)
- [CVE-2026-11254](https://cve.now/CVE-2026-11254.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11253](https://cve.now/CVE-2026-11253.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data… (CVSS 4.3, Google Chrome)
- [CVE-2026-11252](https://cve.now/CVE-2026-11252.md): Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 4.3, Google Chrome)
- [CVE-2026-11251](https://cve.now/CVE-2026-11251.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 3.1, Google Chrome)
- [CVE-2026-11250](https://cve.now/CVE-2026-11250.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 9.6, Google Chrome)
- [CVE-2026-11249](https://cve.now/CVE-2026-11249.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 4.7, Google Chrome)
- [CVE-2026-11248](https://cve.now/CVE-2026-11248.md): Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 8.8, Google Chrome)
- [CVE-2026-11247](https://cve.now/CVE-2026-11247.md): Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak… (CVSS 3.1, Google Chrome)
- [CVE-2026-11246](https://cve.now/CVE-2026-11246.md): Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 5.3, Google Chrome)
- [CVE-2026-11245](https://cve.now/CVE-2026-11245.md): Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11244](https://cve.now/CVE-2026-11244.md): Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 3.1, Google Chrome)
- [CVE-2026-11243](https://cve.now/CVE-2026-11243.md): Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 5.4, Google Chrome)
- [CVE-2026-11242](https://cve.now/CVE-2026-11242.md): Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.5, Google Chrome)
- [CVE-2026-11241](https://cve.now/CVE-2026-11241.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network… (CVSS 8.0, Google Chrome)
- [CVE-2026-11240](https://cve.now/CVE-2026-11240.md): Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 3.1, Google Chrome)
- [CVE-2026-11239](https://cve.now/CVE-2026-11239.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 7.5, Google Chrome)
- [CVE-2026-11238](https://cve.now/CVE-2026-11238.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 5.9, Google Chrome)
- [CVE-2026-11237](https://cve.now/CVE-2026-11237.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 8.3, Google Chrome)
- [CVE-2026-11236](https://cve.now/CVE-2026-11236.md): Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 8.3, Google Chrome)
- [CVE-2026-11235](https://cve.now/CVE-2026-11235.md): Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 8.8, Google Chrome)
- [CVE-2026-11234](https://cve.now/CVE-2026-11234.md): Inappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 4.3, Google Chrome)
- [CVE-2026-11233](https://cve.now/CVE-2026-11233.md): Insufficient policy enforcement in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 4.7, Google Chrome)
- [CVE-2026-11232](https://cve.now/CVE-2026-11232.md): Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via… (CVSS 5.4, Google Chrome)
- [CVE-2026-11231](https://cve.now/CVE-2026-11231.md): Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute… (CVSS 8.1, Google Chrome)
- [CVE-2026-11230](https://cve.now/CVE-2026-11230.md): Use after free in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-11229](https://cve.now/CVE-2026-11229.md): Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege… (CVSS 6.1, Google Chrome)
- [CVE-2026-11228](https://cve.now/CVE-2026-11228.md): Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to… (CVSS 4.3, Google Chrome)
- [CVE-2026-11227](https://cve.now/CVE-2026-11227.md): Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11226](https://cve.now/CVE-2026-11226.md): Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11225](https://cve.now/CVE-2026-11225.md): Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11224](https://cve.now/CVE-2026-11224.md): Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via… (CVSS 8.1, Google Chrome)
- [CVE-2026-11223](https://cve.now/CVE-2026-11223.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11222](https://cve.now/CVE-2026-11222.md): Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11221](https://cve.now/CVE-2026-11221.md): Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 4.3, Google Chrome)
- [CVE-2026-11220](https://cve.now/CVE-2026-11220.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11219](https://cve.now/CVE-2026-11219.md): Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 4.3, Google Chrome)
- [CVE-2026-11218](https://cve.now/CVE-2026-11218.md): Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 6.8, Google Chrome)
- [CVE-2026-11217](https://cve.now/CVE-2026-11217.md): Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11216](https://cve.now/CVE-2026-11216.md): Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 4.3, Google Chrome)
- [CVE-2026-11215](https://cve.now/CVE-2026-11215.md): Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain… (CVSS 6.5, Google Chrome)
- [CVE-2026-11214](https://cve.now/CVE-2026-11214.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak… (CVSS 6.5, Google Chrome)
- [CVE-2026-11213](https://cve.now/CVE-2026-11213.md): Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 9.6, Google Chrome)
- [CVE-2026-11212](https://cve.now/CVE-2026-11212.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11211](https://cve.now/CVE-2026-11211.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11210](https://cve.now/CVE-2026-11210.md): Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary… (CVSS 6.5, Google Chrome)
- [CVE-2026-11209](https://cve.now/CVE-2026-11209.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11208](https://cve.now/CVE-2026-11208.md): Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11207](https://cve.now/CVE-2026-11207.md): Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-11206](https://cve.now/CVE-2026-11206.md): Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11205](https://cve.now/CVE-2026-11205.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 6.1, Google Chrome)
- [CVE-2026-11204](https://cve.now/CVE-2026-11204.md): Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 6.5, Google Chrome)
- [CVE-2026-11203](https://cve.now/CVE-2026-11203.md): Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11202](https://cve.now/CVE-2026-11202.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 8.8, Google Chrome)
- [CVE-2026-11201](https://cve.now/CVE-2026-11201.md): Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious… (CVSS 8.8, Google Chrome)
- [CVE-2026-11200](https://cve.now/CVE-2026-11200.md): Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11199](https://cve.now/CVE-2026-11199.md): Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to… (CVSS 5.9, Google Chrome)
- [CVE-2026-11198](https://cve.now/CVE-2026-11198.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-11197](https://cve.now/CVE-2026-11197.md): Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11196](https://cve.now/CVE-2026-11196.md): Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from… (CVSS 6.5, Google Chrome)
- [CVE-2026-11195](https://cve.now/CVE-2026-11195.md): Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 6.5, Google Chrome)
- [CVE-2026-11194](https://cve.now/CVE-2026-11194.md): Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11193](https://cve.now/CVE-2026-11193.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 6.5, Google Chrome)
- [CVE-2026-11192](https://cve.now/CVE-2026-11192.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to… (CVSS 4.3, Google Chrome)
- [CVE-2026-11191](https://cve.now/CVE-2026-11191.md): Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of… (CVSS 8.8, Google Chrome)
- [CVE-2026-11190](https://cve.now/CVE-2026-11190.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11189](https://cve.now/CVE-2026-11189.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11188](https://cve.now/CVE-2026-11188.md): Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 8.8, Google Chrome)
- [CVE-2026-11187](https://cve.now/CVE-2026-11187.md): Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions… (CVSS 6.3, Google Chrome)
- [CVE-2026-11186](https://cve.now/CVE-2026-11186.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML… (CVSS 6.1, Google Chrome)
- [CVE-2026-11185](https://cve.now/CVE-2026-11185.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to… (CVSS 8.1, Google Chrome)
- [CVE-2026-11184](https://cve.now/CVE-2026-11184.md): Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 6.3, Google Chrome)
- [CVE-2026-11183](https://cve.now/CVE-2026-11183.md): Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive… (CVSS 6.5, Google Chrome)
- [CVE-2026-11182](https://cve.now/CVE-2026-11182.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11181](https://cve.now/CVE-2026-11181.md): Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin… (CVSS 6.3, Google Chrome)
- [CVE-2026-11180](https://cve.now/CVE-2026-11180.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11179](https://cve.now/CVE-2026-11179.md): Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11178](https://cve.now/CVE-2026-11178.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak… (CVSS 4.3, Google Chrome)
- [CVE-2026-11177](https://cve.now/CVE-2026-11177.md): Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI… (CVSS 8.8, Google Chrome)
- [CVE-2026-11176](https://cve.now/CVE-2026-11176.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11175](https://cve.now/CVE-2026-11175.md): Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11174](https://cve.now/CVE-2026-11174.md): Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 5.3, Google Chrome)
- [CVE-2026-11173](https://cve.now/CVE-2026-11173.md): Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.8, Google Chrome)
- [CVE-2026-11172](https://cve.now/CVE-2026-11172.md): Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI… (CVSS 8.8, Google Chrome)
- [CVE-2026-11171](https://cve.now/CVE-2026-11171.md): Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11170](https://cve.now/CVE-2026-11170.md): Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level… (CVSS 8.1, Google Chrome)
- [CVE-2026-11169](https://cve.now/CVE-2026-11169.md): Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML… (CVSS 8.1, Google Chrome)
- [CVE-2026-11168](https://cve.now/CVE-2026-11168.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11167](https://cve.now/CVE-2026-11167.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 9.6, Google Chrome)
- [CVE-2026-11166](https://cve.now/CVE-2026-11166.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML… (CVSS 6.8, Google Chrome)
- [CVE-2026-11165](https://cve.now/CVE-2026-11165.md): Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-11164](https://cve.now/CVE-2026-11164.md): Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11163](https://cve.now/CVE-2026-11163.md): Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-11162](https://cve.now/CVE-2026-11162.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11161](https://cve.now/CVE-2026-11161.md): Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data… (CVSS 4.3, Google Chrome)
- [CVE-2026-11160](https://cve.now/CVE-2026-11160.md): Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive… (CVSS 6.5, Google Chrome)
- [CVE-2026-11159](https://cve.now/CVE-2026-11159.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 4.3, Google Chrome)
- [CVE-2026-11158](https://cve.now/CVE-2026-11158.md): Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to… (CVSS 8.6, Google Chrome)
- [CVE-2026-11157](https://cve.now/CVE-2026-11157.md): Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious… (CVSS 5.4, Google Chrome)
- [CVE-2026-11156](https://cve.now/CVE-2026-11156.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11155](https://cve.now/CVE-2026-11155.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11154](https://cve.now/CVE-2026-11154.md): Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 7.5, Google Chrome)
- [CVE-2026-11153](https://cve.now/CVE-2026-11153.md): Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via… (CVSS 9.1, Google Chrome)
- [CVE-2026-11152](https://cve.now/CVE-2026-11152.md): Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-11151](https://cve.now/CVE-2026-11151.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.5, Google Chrome)
- [CVE-2026-11150](https://cve.now/CVE-2026-11150.md): Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML… (CVSS 6.1, Google Chrome)
- [CVE-2026-11149](https://cve.now/CVE-2026-11149.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.5, Google Chrome)
- [CVE-2026-11148](https://cve.now/CVE-2026-11148.md): Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11147](https://cve.now/CVE-2026-11147.md): Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11146](https://cve.now/CVE-2026-11146.md): Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 9.6, Google Chrome)
- [CVE-2026-11145](https://cve.now/CVE-2026-11145.md): Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted… (CVSS 5.3, Google Chrome)
- [CVE-2026-11144](https://cve.now/CVE-2026-11144.md): Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11143](https://cve.now/CVE-2026-11143.md): Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11142](https://cve.now/CVE-2026-11142.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy… (CVSS 6.5, Google Chrome)
- [CVE-2026-11141](https://cve.now/CVE-2026-11141.md): Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11140](https://cve.now/CVE-2026-11140.md): Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 6.5, Google Chrome)
- [CVE-2026-11139](https://cve.now/CVE-2026-11139.md): Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11138](https://cve.now/CVE-2026-11138.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-11137](https://cve.now/CVE-2026-11137.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11136](https://cve.now/CVE-2026-11136.md): Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11135](https://cve.now/CVE-2026-11135.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary… (CVSS 6.5, Google Chrome)
- [CVE-2026-11134](https://cve.now/CVE-2026-11134.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11133](https://cve.now/CVE-2026-11133.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy… (CVSS 6.5, Google Chrome)
- [CVE-2026-11132](https://cve.now/CVE-2026-11132.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy… (CVSS 6.5, Google Chrome)
- [CVE-2026-11131](https://cve.now/CVE-2026-11131.md): Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 9.6, Google Chrome)
- [CVE-2026-11130](https://cve.now/CVE-2026-11130.md): Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11129](https://cve.now/CVE-2026-11129.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11128](https://cve.now/CVE-2026-11128.md): Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage… (CVSS 6.5, Google Chrome)
- [CVE-2026-11127](https://cve.now/CVE-2026-11127.md): Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain… (CVSS 6.5, Google Chrome)
- [CVE-2026-11126](https://cve.now/CVE-2026-11126.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11125](https://cve.now/CVE-2026-11125.md): Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-11124](https://cve.now/CVE-2026-11124.md): Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11123](https://cve.now/CVE-2026-11123.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11122](https://cve.now/CVE-2026-11122.md): Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or… (CVSS 6.1, Google Chrome)
- [CVE-2026-11121](https://cve.now/CVE-2026-11121.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11120](https://cve.now/CVE-2026-11120.md): Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 9.6, Google Chrome)
- [CVE-2026-11119](https://cve.now/CVE-2026-11119.md): Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 9.6, Google Chrome)
- [CVE-2026-11118](https://cve.now/CVE-2026-11118.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11117](https://cve.now/CVE-2026-11117.md): Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11116](https://cve.now/CVE-2026-11116.md): Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious… (CVSS 8.8, Google Chrome)
- [CVE-2026-11115](https://cve.now/CVE-2026-11115.md): Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege… (CVSS 7.3, Google Chrome)
- [CVE-2026-11114](https://cve.now/CVE-2026-11114.md): Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 9.6, Google Chrome)
- [CVE-2026-11113](https://cve.now/CVE-2026-11113.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 9.6, Google Chrome)
- [CVE-2026-11112](https://cve.now/CVE-2026-11112.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 9.6, Google Chrome)
- [CVE-2026-11111](https://cve.now/CVE-2026-11111.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via… (CVSS 8.1, Google Chrome)
- [CVE-2026-11110](https://cve.now/CVE-2026-11110.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-11109](https://cve.now/CVE-2026-11109.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-11108](https://cve.now/CVE-2026-11108.md): Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege… (CVSS 8.8, Google Chrome)
- [CVE-2026-11107](https://cve.now/CVE-2026-11107.md): Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a… (CVSS 4.3, Google Chrome)
- [CVE-2026-11106](https://cve.now/CVE-2026-11106.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11105](https://cve.now/CVE-2026-11105.md): Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11104](https://cve.now/CVE-2026-11104.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11103](https://cve.now/CVE-2026-11103.md): Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level… (CVSS 7.8, Google Chrome)
- [CVE-2026-11102](https://cve.now/CVE-2026-11102.md): Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary… (CVSS 8.8, Google Chrome)
- [CVE-2026-11101](https://cve.now/CVE-2026-11101.md): Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a… (CVSS 6.5, Google Chrome)
- [CVE-2025-8873](https://cve.now/CVE-2025-8873.md): Arista EOS Dataplane Denial of Service via Malformed IPsec Packet (CVSS 7.5, Arista Networks EOS)
- [CVE-2026-11100](https://cve.now/CVE-2026-11100.md): Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 9.6, Google Chrome)
- [CVE-2026-11098](https://cve.now/CVE-2026-11098.md): Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 5.3, Google Chrome)
- [CVE-2026-11097](https://cve.now/CVE-2026-11097.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11096](https://cve.now/CVE-2026-11096.md): Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11095](https://cve.now/CVE-2026-11095.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 9.6, Google Chrome)
- [CVE-2026-11094](https://cve.now/CVE-2026-11094.md): Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 9.6, Google Chrome)
- [CVE-2026-11093](https://cve.now/CVE-2026-11093.md): Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11092](https://cve.now/CVE-2026-11092.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11091](https://cve.now/CVE-2026-11091.md): Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of… (CVSS 8.8, Google Chrome)
- [CVE-2026-11090](https://cve.now/CVE-2026-11090.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-11089](https://cve.now/CVE-2026-11089.md): Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11088](https://cve.now/CVE-2026-11088.md): Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 9.6, Google Chrome)
- [CVE-2026-11087](https://cve.now/CVE-2026-11087.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11086](https://cve.now/CVE-2026-11086.md): Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.8, Google Chrome)
- [CVE-2026-11085](https://cve.now/CVE-2026-11085.md): Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds… (CVSS 8.8, Google Chrome)
- [CVE-2026-11084](https://cve.now/CVE-2026-11084.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11083](https://cve.now/CVE-2026-11083.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11082](https://cve.now/CVE-2026-11082.md): Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 9.6, Google Chrome)
- [CVE-2026-11081](https://cve.now/CVE-2026-11081.md): Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11080](https://cve.now/CVE-2026-11080.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2026-11079](https://cve.now/CVE-2026-11079.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out… (CVSS 8.8, Google Chrome)
- [CVE-2026-11078](https://cve.now/CVE-2026-11078.md): Inappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11077](https://cve.now/CVE-2026-11077.md): Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11076](https://cve.now/CVE-2026-11076.md): Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11075](https://cve.now/CVE-2026-11075.md): Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11074](https://cve.now/CVE-2026-11074.md): Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11073](https://cve.now/CVE-2026-11073.md): Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from… (CVSS 6.5, Google Chrome)
- [CVE-2026-11072](https://cve.now/CVE-2026-11072.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a… (CVSS 7.8, Google Chrome)
- [CVE-2026-11071](https://cve.now/CVE-2026-11071.md): Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… (CVSS 8.8, Google Chrome)
- [CVE-2026-11070](https://cve.now/CVE-2026-11070.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 9.6, Google Chrome)
- [CVE-2026-11069](https://cve.now/CVE-2026-11069.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11068](https://cve.now/CVE-2026-11068.md): Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-11067](https://cve.now/CVE-2026-11067.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-11066](https://cve.now/CVE-2026-11066.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-11065](https://cve.now/CVE-2026-11065.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 9.6, Google Chrome)
- [CVE-2026-11064](https://cve.now/CVE-2026-11064.md): Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak… (CVSS 6.5, Google Chrome)
- [CVE-2026-11063](https://cve.now/CVE-2026-11063.md): Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 9.6, Google Chrome)
- [CVE-2026-11062](https://cve.now/CVE-2026-11062.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install… (CVSS 4.3, Google Chrome)
- [CVE-2026-11061](https://cve.now/CVE-2026-11061.md): Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a… (CVSS 9.6, Google Chrome)
- [CVE-2026-11060](https://cve.now/CVE-2026-11060.md): Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11059](https://cve.now/CVE-2026-11059.md): Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11058](https://cve.now/CVE-2026-11058.md): Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 7.5, Google Chrome)
- [CVE-2026-11057](https://cve.now/CVE-2026-11057.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-11056](https://cve.now/CVE-2026-11056.md): Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker… (CVSS 9.6, Google Chrome)
- [CVE-2026-11055](https://cve.now/CVE-2026-11055.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11054](https://cve.now/CVE-2026-11054.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11052](https://cve.now/CVE-2026-11052.md): Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 9.6, Google Chrome)
- [CVE-2026-11051](https://cve.now/CVE-2026-11051.md): Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive… (CVSS 6.5, Google Chrome)
- [CVE-2026-11050](https://cve.now/CVE-2026-11050.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11049](https://cve.now/CVE-2026-11049.md): Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-11048](https://cve.now/CVE-2026-11048.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11047](https://cve.now/CVE-2026-11047.md): Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 9.6, Google Chrome)
- [CVE-2026-11046](https://cve.now/CVE-2026-11046.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 8.8, Google Chrome)
- [CVE-2026-11045](https://cve.now/CVE-2026-11045.md): Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11044](https://cve.now/CVE-2026-11044.md): Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive… (CVSS 6.5, Google Chrome)
- [CVE-2026-11043](https://cve.now/CVE-2026-11043.md): Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 9.6, Google Chrome)
- [CVE-2026-11042](https://cve.now/CVE-2026-11042.md): Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI… (CVSS 8.8, Google Chrome)
- [CVE-2026-11041](https://cve.now/CVE-2026-11041.md): Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 8.8, Google Chrome)
- [CVE-2026-11040](https://cve.now/CVE-2026-11040.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-11039](https://cve.now/CVE-2026-11039.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-11038](https://cve.now/CVE-2026-11038.md): Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 6.5, Google Chrome)
- [CVE-2026-11037](https://cve.now/CVE-2026-11037.md): Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-11036](https://cve.now/CVE-2026-11036.md): Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11035](https://cve.now/CVE-2026-11035.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform… (CVSS 7.3, Google Chrome)
- [CVE-2026-11034](https://cve.now/CVE-2026-11034.md): Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker… (CVSS 6.1, Google Chrome)
- [CVE-2026-11033](https://cve.now/CVE-2026-11033.md): Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive… (CVSS 6.5, Google Chrome)
- [CVE-2026-11032](https://cve.now/CVE-2026-11032.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-11031](https://cve.now/CVE-2026-11031.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to… (CVSS 4.3, Google Chrome)
- [CVE-2026-11030](https://cve.now/CVE-2026-11030.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11029](https://cve.now/CVE-2026-11029.md): Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker… (CVSS 8.3, Google Chrome)
- [CVE-2026-11028](https://cve.now/CVE-2026-11028.md): Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 8.8, Google Chrome)
- [CVE-2026-11027](https://cve.now/CVE-2026-11027.md): Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11026](https://cve.now/CVE-2026-11026.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11025](https://cve.now/CVE-2026-11025.md): Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass… (CVSS 6.5, Google Chrome)
- [CVE-2026-11024](https://cve.now/CVE-2026-11024.md): Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption… (CVSS 8.8, Google Chrome)
- [CVE-2026-11023](https://cve.now/CVE-2026-11023.md): Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11022](https://cve.now/CVE-2026-11022.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11021](https://cve.now/CVE-2026-11021.md): Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 9.6, Google Chrome)
- [CVE-2026-11020](https://cve.now/CVE-2026-11020.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via… (CVSS 6.5, Google Chrome)
- [CVE-2026-11019](https://cve.now/CVE-2026-11019.md): Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-11018](https://cve.now/CVE-2026-11018.md): Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation… (CVSS 6.5, Google Chrome)
- [CVE-2026-11017](https://cve.now/CVE-2026-11017.md): Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 6.5, Google Chrome)
- [CVE-2026-11016](https://cve.now/CVE-2026-11016.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11015](https://cve.now/CVE-2026-11015.md): Out of bounds read in WebGPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via… (CVSS 8.1, Google Chrome)
- [CVE-2026-11014](https://cve.now/CVE-2026-11014.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install… (CVSS 6.5, Google Chrome)
- [CVE-2026-11013](https://cve.now/CVE-2026-11013.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11012](https://cve.now/CVE-2026-11012.md): Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-11011](https://cve.now/CVE-2026-11011.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 8.1, Google Chrome)
- [CVE-2026-11010](https://cve.now/CVE-2026-11010.md): Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-11009](https://cve.now/CVE-2026-11009.md): Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-11008](https://cve.now/CVE-2026-11008.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11007](https://cve.now/CVE-2026-11007.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-11006](https://cve.now/CVE-2026-11006.md): Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a… (CVSS 6.5, Google Chrome)
- [CVE-2026-11005](https://cve.now/CVE-2026-11005.md): Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 5.3, Google Chrome)
- [CVE-2026-11004](https://cve.now/CVE-2026-11004.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 5.3, Google Chrome)
- [CVE-2026-11003](https://cve.now/CVE-2026-11003.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-11002](https://cve.now/CVE-2026-11002.md): Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-11001](https://cve.now/CVE-2026-11001.md): Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage… (CVSS 4.2, Google Chrome)
- [CVE-2026-11000](https://cve.now/CVE-2026-11000.md): Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10999](https://cve.now/CVE-2026-10999.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 5.3, Google Chrome)
- [CVE-2026-10998](https://cve.now/CVE-2026-10998.md): Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of… (CVSS 4.0, Google Chrome)
- [CVE-2026-10997](https://cve.now/CVE-2026-10997.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install… (CVSS 6.5, Google Chrome)
- [CVE-2026-10996](https://cve.now/CVE-2026-10996.md): Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via… (CVSS 6.5, Google Chrome)
- [CVE-2026-10995](https://cve.now/CVE-2026-10995.md): Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 8.8, Google Chrome)
- [CVE-2026-10994](https://cve.now/CVE-2026-10994.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-10993](https://cve.now/CVE-2026-10993.md): Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-10992](https://cve.now/CVE-2026-10992.md): Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially… (CVSS 6.5, Google Chrome)
- [CVE-2026-10991](https://cve.now/CVE-2026-10991.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI… (CVSS 8.8, Google Chrome)
- [CVE-2026-10990](https://cve.now/CVE-2026-10990.md): Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10989](https://cve.now/CVE-2026-10989.md): Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 8.8, Google Chrome)
- [CVE-2026-10988](https://cve.now/CVE-2026-10988.md): Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.8, Google Chrome)
- [CVE-2026-10987](https://cve.now/CVE-2026-10987.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10986](https://cve.now/CVE-2026-10986.md): Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10985](https://cve.now/CVE-2026-10985.md): Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 6.5, Google Chrome)
- [CVE-2026-10984](https://cve.now/CVE-2026-10984.md): Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI… (CVSS 5.4, Google Chrome)
- [CVE-2026-10983](https://cve.now/CVE-2026-10983.md): Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-10982](https://cve.now/CVE-2026-10982.md): Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10981](https://cve.now/CVE-2026-10981.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 6.5, Google Chrome)
- [CVE-2026-10980](https://cve.now/CVE-2026-10980.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-10979](https://cve.now/CVE-2026-10979.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-10978](https://cve.now/CVE-2026-10978.md): Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10977](https://cve.now/CVE-2026-10977.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 6.5, Google Chrome)
- [CVE-2026-10976](https://cve.now/CVE-2026-10976.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information… (CVSS 6.5, Google Chrome)
- [CVE-2026-10975](https://cve.now/CVE-2026-10975.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10974](https://cve.now/CVE-2026-10974.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially… (CVSS 9.6, Google Chrome)
- [CVE-2026-10973](https://cve.now/CVE-2026-10973.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML… (CVSS 7.4, Google Chrome)
- [CVE-2026-10972](https://cve.now/CVE-2026-10972.md): Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape… (CVSS 9.6, Google Chrome)
- [CVE-2026-10971](https://cve.now/CVE-2026-10971.md): Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who… (CVSS 8.3, Google Chrome)
- [CVE-2026-10970](https://cve.now/CVE-2026-10970.md): Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 8.3, Google Chrome)
- [CVE-2026-10969](https://cve.now/CVE-2026-10969.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.5, Google Chrome)
- [CVE-2026-10968](https://cve.now/CVE-2026-10968.md): Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 7.4, Google Chrome)
- [CVE-2026-10967](https://cve.now/CVE-2026-10967.md): Use after free in SurfaceCapture in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 8.3, Google Chrome)
- [CVE-2026-10966](https://cve.now/CVE-2026-10966.md): Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-10965](https://cve.now/CVE-2026-10965.md): Integer overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-10964](https://cve.now/CVE-2026-10964.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10963](https://cve.now/CVE-2026-10963.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10962](https://cve.now/CVE-2026-10962.md): Type Confusion in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10961](https://cve.now/CVE-2026-10961.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10960](https://cve.now/CVE-2026-10960.md): Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10959](https://cve.now/CVE-2026-10959.md): Use after free in Input in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10958](https://cve.now/CVE-2026-10958.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage… (CVSS 8.8, Google Chrome)
- [CVE-2026-10957](https://cve.now/CVE-2026-10957.md): Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10956](https://cve.now/CVE-2026-10956.md): Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10955](https://cve.now/CVE-2026-10955.md): Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds… (CVSS 8.8, Google Chrome)
- [CVE-2026-10954](https://cve.now/CVE-2026-10954.md): Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10953](https://cve.now/CVE-2026-10953.md): Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10952](https://cve.now/CVE-2026-10952.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2026-10951](https://cve.now/CVE-2026-10951.md): Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 8.8, Google Chrome)
- [CVE-2026-10950](https://cve.now/CVE-2026-10950.md): Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-10949](https://cve.now/CVE-2026-10949.md): Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… (CVSS 8.3, Google Chrome)
- [CVE-2026-10948](https://cve.now/CVE-2026-10948.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10947](https://cve.now/CVE-2026-10947.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10946](https://cve.now/CVE-2026-10946.md): Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific… (CVSS 7.5, Google Chrome)
- [CVE-2026-10945](https://cve.now/CVE-2026-10945.md): Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI… (CVSS 8.8, Google Chrome)
- [CVE-2026-10944](https://cve.now/CVE-2026-10944.md): Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin… (CVSS 6.5, Google Chrome)
- [CVE-2026-10943](https://cve.now/CVE-2026-10943.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10942](https://cve.now/CVE-2026-10942.md): Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege… (CVSS 7.8, Google Chrome)
- [CVE-2026-10941](https://cve.now/CVE-2026-10941.md): Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10940](https://cve.now/CVE-2026-10940.md): Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10939](https://cve.now/CVE-2026-10939.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10938](https://cve.now/CVE-2026-10938.md): Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.1, Google Chrome)
- [CVE-2026-10937](https://cve.now/CVE-2026-10937.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy… (CVSS 8.1, Google Chrome)
- [CVE-2026-10936](https://cve.now/CVE-2026-10936.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10935](https://cve.now/CVE-2026-10935.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10934](https://cve.now/CVE-2026-10934.md): Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10933](https://cve.now/CVE-2026-10933.md): Use after free in Audio in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10932](https://cve.now/CVE-2026-10932.md): Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption… (CVSS 8.8, Google Chrome)
- [CVE-2026-10931](https://cve.now/CVE-2026-10931.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via… (CVSS 9.6, Google Chrome)
- [CVE-2026-10930](https://cve.now/CVE-2026-10930.md): Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory… (CVSS 8.1, Google Chrome)
- [CVE-2026-10929](https://cve.now/CVE-2026-10929.md): Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the… (CVSS 8.3, Google Chrome)
- [CVE-2026-10928](https://cve.now/CVE-2026-10928.md): Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted… (CVSS 8.8, Google Chrome)
- [CVE-2026-10927](https://cve.now/CVE-2026-10927.md): Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10926](https://cve.now/CVE-2026-10926.md): Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code… (CVSS 8.8, Google Chrome)
- [CVE-2026-10925](https://cve.now/CVE-2026-10925.md): Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10924](https://cve.now/CVE-2026-10924.md): Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… (CVSS 8.3, Google Chrome)
- [CVE-2026-10923](https://cve.now/CVE-2026-10923.md): Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10922](https://cve.now/CVE-2026-10922.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10921](https://cve.now/CVE-2026-10921.md): Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10920](https://cve.now/CVE-2026-10920.md): Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 8.3, Google Chrome)
- [CVE-2026-10919](https://cve.now/CVE-2026-10919.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10918](https://cve.now/CVE-2026-10918.md): Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10917](https://cve.now/CVE-2026-10917.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 8.3, Google Chrome)
- [CVE-2026-10916](https://cve.now/CVE-2026-10916.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.1, Google Chrome)
- [CVE-2026-10915](https://cve.now/CVE-2026-10915.md): Use after free in Core in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process… (CVSS 8.3, Google Chrome)
- [CVE-2026-10914](https://cve.now/CVE-2026-10914.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10913](https://cve.now/CVE-2026-10913.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10912](https://cve.now/CVE-2026-10912.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had… (CVSS 6.5, Google Chrome)
- [CVE-2026-10911](https://cve.now/CVE-2026-10911.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised… (CVSS 8.3, Google Chrome)
- [CVE-2026-10910](https://cve.now/CVE-2026-10910.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10909](https://cve.now/CVE-2026-10909.md): Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10908](https://cve.now/CVE-2026-10908.md): Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10907](https://cve.now/CVE-2026-10907.md): Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10906](https://cve.now/CVE-2026-10906.md): Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 7.5, Google Chrome)
- [CVE-2026-10905](https://cve.now/CVE-2026-10905.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10904](https://cve.now/CVE-2026-10904.md): Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10903](https://cve.now/CVE-2026-10903.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via… (CVSS 8.8, Google Chrome)
- [CVE-2026-10902](https://cve.now/CVE-2026-10902.md): Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-10901](https://cve.now/CVE-2026-10901.md): Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 7.5, Google Chrome)
- [CVE-2026-10900](https://cve.now/CVE-2026-10900.md): Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 7.5, Google Chrome)
- [CVE-2026-10899](https://cve.now/CVE-2026-10899.md): Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in… (CVSS 7.5, Google Chrome)
- [CVE-2026-10898](https://cve.now/CVE-2026-10898.md): Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10897](https://cve.now/CVE-2026-10897.md): Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox… (CVSS 8.8, Google Chrome)
- [CVE-2026-10896](https://cve.now/CVE-2026-10896.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10895](https://cve.now/CVE-2026-10895.md): Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-10894](https://cve.now/CVE-2026-10894.md): Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer… (CVSS 8.3, Google Chrome)
- [CVE-2026-10893](https://cve.now/CVE-2026-10893.md): Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious… (CVSS 8.8, Google Chrome)
- [CVE-2026-10892](https://cve.now/CVE-2026-10892.md): Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-10891](https://cve.now/CVE-2026-10891.md): Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption… (CVSS 8.8, Google Chrome)
- [CVE-2026-10890](https://cve.now/CVE-2026-10890.md): Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit… (CVSS 8.8, Google Chrome)
- [CVE-2026-10889](https://cve.now/CVE-2026-10889.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10888](https://cve.now/CVE-2026-10888.md): Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute… (CVSS 8.8, Google Chrome)
- [CVE-2026-10887](https://cve.now/CVE-2026-10887.md): Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via… (CVSS 8.1, Google Chrome)
- [CVE-2026-10886](https://cve.now/CVE-2026-10886.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via… (CVSS 9.6, Google Chrome)
- [CVE-2026-10885](https://cve.now/CVE-2026-10885.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10884](https://cve.now/CVE-2026-10884.md): Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to… (CVSS 8.3, Google Chrome)
- [CVE-2026-10883](https://cve.now/CVE-2026-10883.md): Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2026-10882](https://cve.now/CVE-2026-10882.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML… (CVSS 8.8, Google Chrome)
- [CVE-2026-10881](https://cve.now/CVE-2026-10881.md): Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox… (CVSS 9.6, Google Chrome)
- [CVE-2026-10875](https://cve.now/CVE-2026-10875.md): projectworlds Online Art Gallery Shop Project adminHome.ph sql injection (CVSS 5.3, projectworlds Online Art Gallery Shop Project)
- [CVE-2026-10874](https://cve.now/CVE-2026-10874.md): projectworlds Online Art Gallery Shop Project adminHome.php sql injection (CVSS 5.3, projectworlds Online Art Gallery Shop Project)
- [CVE-2023-5502](https://cve.now/CVE-2023-5502.md): On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may… (CVSS 8.2, Arista Networks EOS)
- [CVE-2024-27892](https://cve.now/CVE-2024-27892.md): On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL… (CVSS 7.2, Arista Networks EOS)
- [CVE-2026-20245](https://cve.now/CVE-2026-20245.md): Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability (CVSS 7.8, KEV, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-10873](https://cve.now/CVE-2026-10873.md): Shibby Tomato Web UI rstats rstats\_path os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2024-27890](https://cve.now/CVE-2024-27890.md): On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No… (CVSS 7.2, Arista Networks EOS)
- [CVE-2026-10872](https://cve.now/CVE-2026-10872.md): Shibby Tomato Web UI rc start\_vpnserver os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2024-27891](https://cve.now/CVE-2024-27891.md): On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be… (CVSS 6.9, Arista Networks EOS)
- [CVE-2026-48579](https://cve.now/CVE-2026-48579.md): Microsoft Exchange Online Information Disclosure Vulnerability (CVSS 9.1, Microsoft Exchange Online)
- [CVE-2026-47655](https://cve.now/CVE-2026-47655.md): Microsoft Graph Information Disclosure Vulnerability (CVSS 6.5, Microsoft Graph)
- [CVE-2026-47644](https://cve.now/CVE-2026-47644.md): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (CVSS 6.5, Copilot Chat)
- [CVE-2026-45497](https://cve.now/CVE-2026-45497.md): Microsoft M365 Copilot Remote Code Execution Vulnerability (CVSS 7.7, Microsoft 365 Copilot)
- [CVE-2026-42824](https://cve.now/CVE-2026-42824.md): M365 Copilot Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Copilot)
- [CVE-2026-48567](https://cve.now/CVE-2026-48567.md): Azure HorizonDB Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure HorizonDB)
- [CVE-2026-10871](https://cve.now/CVE-2026-10871.md): Shibby Tomato Web UI rc start\_6rd\_tunnel os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-11322](https://cve.now/CVE-2026-11322.md): Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass (CVSS 6.5, nesquena Hermes WebUI)
- [CVE-2024-6858](https://cve.now/CVE-2024-6858.md): In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL… (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-42547](https://cve.now/CVE-2026-42547.md): IRIS Alerts Can be Falsely Attributed to Customers (CVSS 5.4, dfir-iris iris-web)
- [CVE-2026-42543](https://cve.now/CVE-2026-42543.md): IRIS has a Cross-Site Request Forgery (CSRF) issue (CVSS 4.3, dfir-iris iris-web)
- [CVE-2026-42540](https://cve.now/CVE-2026-42540.md): IRIS has a Mass Assignment issue (CVSS 4.3, dfir-iris iris-web)
- [CVE-2026-42539](https://cve.now/CVE-2026-42539.md): IRIS has an Excessive Data Exposure issue (CVSS 6.5, dfir-iris iris-web)
- [CVE-2026-42538](https://cve.now/CVE-2026-42538.md): IRIS has an Insecure File Upload (CVSS 6.3, dfir-iris iris-web)
- [CVE-2026-42329](https://cve.now/CVE-2026-42329.md): Iris has an Open Redirect issue (CVSS 4.7, dfir-iris iris-web)
- [CVE-2026-5066](https://cve.now/CVE-2026-5066.md): net: sockets: tls: Potential out-of-bounds write/read in socket\_op\_vtable::connect function (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2026-10870](https://cve.now/CVE-2026-10870.md): Shibby Tomato Web UI rc start\_dhcpc os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-5589](https://cve.now/CVE-2026-5589.md): Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2026-21404](https://cve.now/CVE-2026-21404.md): NAVTOR NavBox Use of Hard-coded Credentials (CVSS 5.8, NAVTOR NavBox)
- [CVE-2026-41522](https://cve.now/CVE-2026-41522.md): Iris has an Improper Authorization issue (CVSS 7.1, dfir-iris iris-web)
- [CVE-2026-41518](https://cve.now/CVE-2026-41518.md): Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) (CVSS 7.6, chartbrew)
- [CVE-2026-41249](https://cve.now/CVE-2026-41249.md): CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure \`pull\_request\_target\` Configuration (CVSS 8.2, CoreShop · coreshop/core-shop)
- [CVE-2026-41237](https://cve.now/CVE-2026-41237.md): Froxlor has an incomplete fix for CVE-2026-30932 (CVSS 8.6, froxlor · froxlor/froxlor)
- [CVE-2026-41236](https://cve.now/CVE-2026-41236.md): Froxlor has privilege escalation in SSH key synchronization via symlinked \`authorized\_keys\` path (CVSS 8.8, froxlor · froxlor/froxlor)
- [CVE-2026-41235](https://cve.now/CVE-2026-41235.md): Froxlor has an authorization bypass in FTP shell assignment via missing server-side \`available\_shells\` enforcement (CVSS 8.6, froxlor · froxlor/froxlor)
- [CVE-2026-41234](https://cve.now/CVE-2026-41234.md): Froxlor: BIND Zone File Injection via TXT Record Content (CVSS 7.6, froxlor · froxlor/froxlor)
- [CVE-2026-40898](https://cve.now/CVE-2026-40898.md): quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion (CVSS 5.3, quic-go · github.com/quic-go/quic-go)
- [CVE-2026-48480](https://cve.now/CVE-2026-48480.md): netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation (CVSS 6.6, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2025-71316](https://cve.now/CVE-2025-71316.md): SQLite sqldiff remote code execution via argument injection (CVSS 9.8, SQLite sqldiff)
- [CVE-2026-48040](https://cve.now/CVE-2026-48040.md): netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory… (CVSS 6.8, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2026-41207](https://cve.now/CVE-2026-41207.md): netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte\[\] on failures (CVSS 6.9, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2026-25551](https://cve.now/CVE-2026-25551.md): Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service (CVSS 8.5, Seagull Software, LLC. BarTender)
- [CVE-2026-10880](https://cve.now/CVE-2026-10880.md): Unauthenticated SQL Injection in Osnexus Quantastor (CVSS 9.8, Osnexus QuantaStor)
- [CVE-2026-25550](https://cve.now/CVE-2026-25550.md): Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service (CVSS 9.3, Seagull Software, LLC. BarTender)
- [CVE-2026-10796](https://cve.now/CVE-2026-10796.md): nvm executes commands from a malicious Node.js mirror's version strings (CVSS 7.5, nvm-sh nvm)
- [CVE-2026-50292](https://cve.now/CVE-2026-50292.md): In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to… (CVSS 7.4, freedesktop libinput)
- [CVE-2026-50266](https://cve.now/CVE-2026-50266.md): In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set… (CVSS 2.2, OpenStack Neutron · neutron)
- [CVE-2026-50076](https://cve.now/CVE-2026-50076.md): Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass (CVSS 9.1, Apache Software Foundation org.apache.fory:fory-core · org.…)
- [CVE-2026-49942](https://cve.now/CVE-2026-49942.md): Net::CIDR::Set versions through 0.20 for Perl did not validate network masks (CVSS 7.3, RRWO Net::CIDR::Set)
- [CVE-2026-49941](https://cve.now/CVE-2026-49941.md): Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses (CVSS 7.5, RRWO Net::CIDR::Set)
- [CVE-2026-49940](https://cve.now/CVE-2026-49940.md): Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks (CVSS 6.5, RRWO Net::CIDR::Set)
- [CVE-2026-46741](https://cve.now/CVE-2026-46741.md): Etsy::StatsD versions through 1.002002 for Perl allow metric injections (CVSS 7.5, SANBEG Etsy::StatsD)
- [CVE-2026-46739](https://cve.now/CVE-2026-46739.md): Net::Statsd versions before 0.13 for Perl allow metric injections (CVSS 5.3, COSIMO Net::Statsd)
- [CVE-2026-10815](https://cve.now/CVE-2026-10815.md): LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization (CVSS 5.3, LakshayD02 Hostel-Management-System-PHP)
- [CVE-2026-10814](https://cve.now/CVE-2026-10814.md): milvus-io milvus Grantee ID Hash kv\_catalog.go weak hash (CVSS 2.0, milvus-io milvus · github.com/milvus-io/milvus)
- [CVE-2026-45287](https://cve.now/CVE-2026-45287.md): OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse (CVSS 2.1, open-telemetry go.opentelemetry.io/otel/schema/v1.1 · op… +3)
- [CVE-2026-10813](https://cve.now/CVE-2026-10813.md): LMCache KV Cache utils.py hex\_hash\_to\_int16 weak hash (CVSS 2.0, LMCache)
- [CVE-2026-10868](https://cve.now/CVE-2026-10868.md): MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification (CVSS 9.0, misp)
- [CVE-2026-41178](https://cve.now/CVE-2026-41178.md): OpenTelemetry-Go's baggage parsing no longer caps raw header length (CVSS 5.3, open-telemetry go.opentelemetry.io/otel/baggage · open-t… +3)
- [CVE-2026-40930](https://cve.now/CVE-2026-40930.md): LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body (CVSS 5.4, pnggroup libpng · pnggroup libpng-apng)
- [CVE-2026-43986](https://cve.now/CVE-2026-43986.md): Tautulli vulnerable to unauthenticated SSRF in /image/\<hash\> via attacker-seeded image hash replay (CVSS 9.9, Tautulli)
- [CVE-2026-43985](https://cve.now/CVE-2026-43985.md): Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover (CVSS 8.8, Tautulli)
- [CVE-2026-43984](https://cve.now/CVE-2026-43984.md): Tautulli has stored XSS in logFile via guest-controlled log\_js\_errors input (CVSS 8.9, Tautulli)
- [CVE-2026-5228](https://cve.now/CVE-2026-5228.md): Improper Access Control in Kurt Software Studio's WriteUp Mobile App (CVSS 8.8, Kurt Software Studio WriteUp Mobile App)
- [CVE-2026-7774](https://cve.now/CVE-2026-7774.md): tarfile.data\_filter path traversal bypass allows writing outside the extraction directory (CVSS 6.9, Python Software Foundation CPython)
- [CVE-2026-41065](https://cve.now/CVE-2026-41065.md): Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory (CVSS 8.9, Tautulli)
- [CVE-2026-10812](https://cve.now/CVE-2026-10812.md): zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash (CVSS 2.0, zilliztech GPTCache · gptcache)
- [CVE-2026-47707](https://cve.now/CVE-2026-47707.md): Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification (CVSS 5.3, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-45739](https://cve.now/CVE-2026-45739.md): Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs (CVSS 3.1, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-47706](https://cve.now/CVE-2026-47706.md): Strawberry GraphQL has a Circular Fragment Reference DOS (CVSS 5.3, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-28318](https://cve.now/CVE-2026-28318.md): SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability (CVSS 7.5, KEV, SolarWinds Serv-U)
- [CVE-2026-10811](https://cve.now/CVE-2026-10811.md): itsourcecode Fees Management System receipt.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-10864](https://cve.now/CVE-2026-10864.md): MISP Dashboard widget field selection may expose restricted user and organisation data (CVSS 5.3, misp)
- [CVE-2026-10863](https://cve.now/CVE-2026-10863.md): MISP User-controlled order parameter in correlations over-correlation endpoint (CVSS 6.4, misp)
- [CVE-2026-10860](https://cve.now/CVE-2026-10860.md): MISP CRUDComponent delete validation bypass via operator precedence error (CVSS 7.9, misp)
- [CVE-2026-10861](https://cve.now/CVE-2026-10861.md): MISP post-login open redirect via pre\_login\_requested\_url (CVSS 5.1, misp)
- [CVE-2019-25745](https://cve.now/CVE-2019-25745.md): WordPress Plugin Google Review Slider 6.1 SQL Injection via tid (CVSS 8.8, jgwhite33 Google Review Slider)
- [CVE-2019-25744](https://cve.now/CVE-2019-25744.md): WordPress Popup Builder 3.49 Persistent Cross-Site Scripting (CVSS 5.1, Popup-Builder Popup Builder)
- [CVE-2019-25743](https://cve.now/CVE-2019-25743.md): WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting (CVSS 5.1, Soliloquywp Soliloquy Lite)
- [CVE-2019-25742](https://cve.now/CVE-2019-25742.md): WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS (CVSS 5.1, Fruitfulcode Zoner Real Estate)
- [CVE-2019-25741](https://cve.now/CVE-2019-25741.md): Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File (CVSS 9.3, Mobatek MobaXterm)
- [CVE-2019-25740](https://cve.now/CVE-2019-25740.md): Joomla com\_jsjobs 1.2.6 Arbitrary File Deletion (CVSS 7.1, Joomsky JS Jobs)
- [CVE-2019-25739](https://cve.now/CVE-2019-25739.md): GigToDo Freelance Marketplace Script 1.3 Persistent XSS (CVSS 5.1, Gigtodoscript GigToDo)
- [CVE-2019-25738](https://cve.now/CVE-2019-25738.md): WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change (CVSS 9.3, framework-y Hybrid Composer)
- [CVE-2019-25737](https://cve.now/CVE-2019-25737.md): Live Chat Unlimited 2.8.3 Stored Cross-Site Scripting (CVSS 5.3, Screets Live Chat Unlimited)
- [CVE-2019-25736](https://cve.now/CVE-2019-25736.md): LabF nfsAxe 3.7 Ping Client Buffer Overflow (CVSS 8.6, LabF nfsAxe)
- [CVE-2019-25735](https://cve.now/CVE-2019-25735.md): AllPlayer 7.4 Local Buffer Overflow via SEH Unicode (CVSS 8.6, AllPlayer)
- [CVE-2019-25734](https://cve.now/CVE-2019-25734.md): Contact Form by WD 1.13.1 CSRF to Local File Inclusion (CVSS 5.1, Web-Dorado Contact Form Maker)
- [CVE-2019-25733](https://cve.now/CVE-2019-25733.md): NetShareWatcher 1.5.8.0 SEH Buffer Overflow (CVSS 8.6, nsauditor NetShareWatcher)
- [CVE-2019-25732](https://cve.now/CVE-2019-25732.md): PHP EI-Tube Script 3 SQL Injection via search parameter (CVSS 8.8, eitube EI-Tube)
- [CVE-2019-25731](https://cve.now/CVE-2019-25731.md): Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact (CVSS 5.3, Zuz Music)
- [CVE-2019-25730](https://cve.now/CVE-2019-25730.md): Listing Hub CMS 1.0 SQL Injection via pages.php id (CVSS 8.8, Themerig Listing Hub CMS)
- [CVE-2019-25729](https://cve.now/CVE-2019-25729.md): PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie (CVSS 9.3, simcy\_creative PDF Signer)
- [CVE-2019-25728](https://cve.now/CVE-2019-25728.md): Care2x 2.7 Hospital Information System SQL Injection via ck\_config (CVSS 8.8, Care2x)
- [CVE-2019-25727](https://cve.now/CVE-2019-25727.md): WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download (CVSS 9.3, ad-manager-wd Ad Manager WD)
- [CVE-2019-25726](https://cve.now/CVE-2019-25726.md): All in One Video Downloader 1.2 SQL Injection via admin page-edit (CVSS 8.8, Nicheoffice All in One Video Downloader)
- [CVE-2026-10856](https://cve.now/CVE-2026-10856.md): Open redirect in MISP dashboard button widget URL handling (CVSS 5.1, misp)
- [CVE-2026-10810](https://cve.now/CVE-2026-10810.md): itsourcecode Fees Management System navbar.php cross site scripting (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-8037](https://cve.now/CVE-2026-8037.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 9.6, KEV, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-10855](https://cve.now/CVE-2026-10855.md): MISP Event template importer authorization bypass (CVSS 5.1, misp)
- [CVE-2026-10809](https://cve.now/CVE-2026-10809.md): itsourcecode Fees Management System manage\_user.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2025-46638](https://cve.now/CVE-2025-46638.md): Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. (CVSS 7.5, Dell BSAFE SSL-J)
- [CVE-2026-10854](https://cve.now/CVE-2026-10854.md): Unauthorized exposure of private galaxies in MISP event template creation (CVSS 5.3, misp)
- [CVE-2026-40605](https://cve.now/CVE-2026-40605.md): Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API (CVSS 5.7, Tautulli)
- [CVE-2026-43926](https://cve.now/CVE-2026-43926.md): FOSSBilling's password reset confirmation endpoint lacks rate limiting (CVSS 6.3, FOSSBilling)
- [CVE-2026-10808](https://cve.now/CVE-2026-10808.md): itsourcecode Fees Management System manage\_student.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2025-62338](https://cve.now/CVE-2025-62338.md): HCL BigFix Cloud Lifecycle Management is affected by lack of input validation (CVSS 3.3, HCLSoftware BigFix Cloud Lifecycle Management)
- [CVE-2026-10807](https://cve.now/CVE-2026-10807.md): mjperpinosa stumasy change\_profile\_image.php unrestricted upload (CVSS 5.3, mjperpinosa stumasy)
- [CVE-2026-10806](https://cve.now/CVE-2026-10806.md): mjperpinosa stumasy add\_post.php unrestricted upload (CVSS 5.3, mjperpinosa stumasy)
- [CVE-2025-59874](https://cve.now/CVE-2025-59874.md): HCL Hive Telco Observability is affected by a Required directives missing from the CSP . (CVSS 8.1, HCL Hive)
- [CVE-2026-45433](https://cve.now/CVE-2026-45433.md): Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-45432](https://cve.now/CVE-2026-45432.md): Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-10843](https://cve.now/CVE-2026-10843.md): Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws (CVSS 7.2, Red Hat OpenShift Container Platform)
- [CVE-2026-10840](https://cve.now/CVE-2026-10840.md): Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to… (CVSS 7.1, Red Hat OpenShift Builds · Red Hat OpenShift Pipelines)
- [CVE-2025-12694](https://cve.now/CVE-2025-12694.md): Local Privilege Escalation in VPN Client (CVSS 8.5, Forcepoint VPN Client)
- [CVE-2026-45431](https://cve.now/CVE-2026-45431.md): Command Injection Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-10804](https://cve.now/CVE-2026-10804.md): Streamlit Palette hashing.py weak hash (CVSS 2.0, Streamlit)
- [CVE-2025-52606](https://cve.now/CVE-2025-52606.md): HCL iControl was affected by Weak Input Validation vulnerability. . (CVSS 4.3, HCL iControl)
- [CVE-2025-52608](https://cve.now/CVE-2025-52608.md): HCL iControl was affected by Missing Cookie Attributes vulnerability. (CVSS 3.1, HCL iControl)
- [CVE-2026-10803](https://cve.now/CVE-2026-10803.md): MLflow Dataset Digest Computation digest\_utils.py mlflow.data.digest\_utils weak hash (CVSS 2.0, MLflow)
- [CVE-2025-52609](https://cve.now/CVE-2025-52609.md): HCL iControl was affected by Missing Security Headers vulnerability. (CVSS 3.7, HCL iControl)
- [CVE-2025-52611](https://cve.now/CVE-2025-52611.md): HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability (CVSS 3.1, HCL iControl)
- [CVE-2025-52612](https://cve.now/CVE-2025-52612.md): HCL iControl was affected by Export CSV - CSV Injection vulnerability. (CVSS 7.1, HCL iControl)
- [CVE-2026-10802](https://cve.now/CVE-2026-10802.md): keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption (CVSS 5.3, keystonejs keystone · @keystone-6/core)
- [CVE-2026-4104](https://cve.now/CVE-2026-4104.md): SQLi in Akmer Informatics' TeknoPass (CVSS 9.8, Akmer Informatics Automation Industry and Trade Ltd. TeknoP…)
- [CVE-2026-10801](https://cve.now/CVE-2026-10801.md): modelscope ms-swift PIL Image Cache Key base.py Template.\_save\_pil\_image weak hash (CVSS 2.0, modelscope ms-swift · ms-swift)
- [CVE-2026-49077](https://cve.now/CVE-2026-49077.md): WordPress WP eMember plugin \<= v10.2.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Tips and Tricks HQ WP eMember)
- [CVE-2026-49771](https://cve.now/CVE-2026-49771.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.41 - SQL Injection vulnerability (CVSS 7.6, Photo Gallery by 10Web)
- [CVE-2026-10800](https://cve.now/CVE-2026-10800.md): PaddlePaddle FastDeploy MultimodalHasher hasher.py hash\_features weak hash (CVSS 2.0, PaddlePaddle FastDeploy)
- [CVE-2026-8916](https://cve.now/CVE-2026-8916.md): Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47318](https://cve.now/CVE-2026-47318.md): Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47306](https://cve.now/CVE-2026-47306.md): Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-49510](https://cve.now/CVE-2026-49510.md): Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-10305](https://cve.now/CVE-2026-10305.md): Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47319](https://cve.now/CVE-2026-47319.md): Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47320](https://cve.now/CVE-2026-47320.md): Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation… (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-50226](https://cve.now/CVE-2026-50226.md): Firmware Theft & IMEI Spoofing via Connect-OTA (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50225](https://cve.now/CVE-2026-50225.md): Account Creation Exhaustion (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50224](https://cve.now/CVE-2026-50224.md): Unauthenticated IPv6 WAN Management Exposure (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50214](https://cve.now/CVE-2026-50214.md): Shared Secret Quota Inflation (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-4881](https://cve.now/CVE-2026-4881.md): In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make… (CVSS 6.0, Octopus Deploy Octopus Server)
- [CVE-2026-3820](https://cve.now/CVE-2026-3820.md): Supermicro BMC's SMTP service contains a command injection vulnerability (CVSS 7.2, SMCI AS-2115HS-TNR)
- [CVE-2026-50213](https://cve.now/CVE-2026-50213.md): Bulk User Private Data Harvesting (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50212](https://cve.now/CVE-2026-50212.md): Arbitrary Remote Device Unbinding (CVSS 7.1, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50211](https://cve.now/CVE-2026-50211.md): Exposed Factory Testing App Boundaries (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50210](https://cve.now/CVE-2026-50210.md): Weak Static Cryptographic Initialization Vectors (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50209](https://cve.now/CVE-2026-50209.md): MDM Server Registration Overriding (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50208](https://cve.now/CVE-2026-50208.md): Permissive TrustAllCerts TLS Verification (CVSS 9.2, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50207](https://cve.now/CVE-2026-50207.md): Local Modem Manipulation via Binder Interfaces (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50206](https://cve.now/CVE-2026-50206.md): VPN Command Injection Vulnerability (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50205](https://cve.now/CVE-2026-50205.md): Plaintext Log Credential Leakage (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49204](https://cve.now/CVE-2026-49204.md): Hard-coded AWS Cognito Testing Accounts (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49202](https://cve.now/CVE-2026-49202.md): Unverified Meeting Recording Endpoints & Permissive CORS (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49203](https://cve.now/CVE-2026-49203.md): Unauthenticated eSIM Configuration Manipulation (CVSS 7.2, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49194](https://cve.now/CVE-2026-49194.md): SCREEN\_CLICK Authentication Bypass (CVSS 9.4, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49193](https://cve.now/CVE-2026-49193.md): Publicly Readable AWS S3 Telemetry Buckets (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49192](https://cve.now/CVE-2026-49192.md): Summary Service Insecure Direct Object Reference (CVSS 5.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49191](https://cve.now/CVE-2026-49191.md): Exposed Hard-coded M3WebServer Backend API Key (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49190](https://cve.now/CVE-2026-49190.md): Missing Per-Instruction Authorization Checks (CVSS 9.4, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49189](https://cve.now/CVE-2026-49189.md): Broadcast Receiver Privilege Escalation (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-10805](https://cve.now/CVE-2026-10805.md): Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend (CVSS 6.7, Red Hat Enterprise Linux · Red Hat Multicluster Engine f… +3)
- [CVE-2026-50219](https://cve.now/CVE-2026-50219.md): libexpat before 2.8.2 lacks handler call depth tracking for calls to XML\_GetBuffer, XML\_Parse, XML\_ParseBuffer, XML\_ParserFree, or… (CVSS 4.9, libexpat project libexpat)
- [CVE-2026-49188](https://cve.now/CVE-2026-49188.md): Elevated Root Command Execution via ai\_cmd Sockets (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49187](https://cve.now/CVE-2026-49187.md): Hard-coded APK Resource Credentials & Scepters (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49186](https://cve.now/CVE-2026-49186.md): Lack of MQTT Broker Topic Access Control Lists (CVSS 8.6, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49185](https://cve.now/CVE-2026-49185.md): Instruction Injection via FieldX MDM (CVSS 10.0, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-41010](https://cve.now/CVE-2026-41010.md): ReleaseJob#unpack builds job\_dir = File.join(@release\_dir, 'jobs', name) and job\_tgz = File.join(@release\_dir, 'jobs', "#{name}.tgz")… (CVSS 8.7, Cloud Foundry Foundation BOSH Director)
- [CVE-2026-41011](https://cve.now/CVE-2026-41011.md): PackagePersister.validate\_tgz builds "tar -tf #{tgz} 2\>&1" where tgz = File.join(release\_dir, 'packages', "#{name}.tgz") and name =… (CVSS 8.7, Cloud Foundry Foundation BOSH)
- [CVE-2026-10597](https://cve.now/CVE-2026-10597.md): ITPison｜OMICARD EDM - Insecure Direct Object Reference (CVSS 6.9, ITPison OMICARD EDM)
- [CVE-2026-41858](https://cve.now/CVE-2026-41858.md): Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a… (CVSS 6.5, Cloud Foundry Foundation windows-utilities-release)
- [CVE-2026-8829](https://cve.now/CVE-2026-8829.md): HTML::Entities versions before 3.84 for Perl read freed heap memory in \_decode\_entities (CVSS 7.5, OALDERS HTML::Entities)
- [CVE-2026-41859](https://cve.now/CVE-2026-41859.md): A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client… (CVSS 7.1, Cloud Foundry Foundation BOSH)
- [CVE-2026-41860](https://cve.now/CVE-2026-41860.md): CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. (CVSS 7.1, Cloud Foundry Foundation BOSH)
- [CVE-2026-8653](https://cve.now/CVE-2026-8653.md): MasterStudy LMS Pro Plus \<= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter (CVSS 6.5, StylemixThemes MasterStudy LMS Pro)
- [CVE-2026-10737](https://cve.now/CVE-2026-10737.md): SP Project & Document Manager \<= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view\_file()… (CVSS 7.5, smartypants SP Project & Document Manager)
- [CVE-2026-7764](https://cve.now/CVE-2026-7764.md): Out-of-bounds read in morse.ko Vendor IE processing (CVSS 6.8, Morse Micro HaLowLink)
- [CVE-2025-65640](https://cve.now/CVE-2025-65640.md): Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to… (CVSS 6.3)
- [CVE-2025-67446](https://cve.now/CVE-2025-67446.md): Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. (CVSS 9.8)
- [CVE-2025-67447](https://cve.now/CVE-2025-67447.md): The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. (CVSS 9.8)
- [CVE-2025-67448](https://cve.now/CVE-2025-67448.md): The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. (CVSS 7.1)
- [CVE-2025-69755](https://cve.now/CVE-2025-69755.md): An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary… (CVSS 8.2)
- [CVE-2026-35904](https://cve.now/CVE-2026-35904.md): Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03… (CVSS 9.8)
- [CVE-2026-35905](https://cve.now/CVE-2026-35905.md): T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root… (CVSS 9.8)
- [CVE-2026-35906](https://cve.now/CVE-2026-35906.md): An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute… (CVSS 9.6)
- [CVE-2026-36174](https://cve.now/CVE-2026-36174.md): GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial… (CVSS 4.6)
- [CVE-2026-36175](https://cve.now/CVE-2026-36175.md): An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access… (CVSS 6.8)
- [CVE-2026-36176](https://cve.now/CVE-2026-36176.md): GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. (CVSS 7.1)
- [CVE-2026-36178](https://cve.now/CVE-2026-36178.md): The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition… (CVSS 4.6)
- [CVE-2026-36180](https://cve.now/CVE-2026-36180.md): A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and… (CVSS 4.6)
- [CVE-2026-36182](https://cve.now/CVE-2026-36182.md): GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain… (CVSS 9.8)
- [CVE-2026-36499](https://cve.now/CVE-2026-36499.md): A missing upper-bound check in the udpif\_set\_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to… (CVSS 6.5)
- [CVE-2026-38570](https://cve.now/CVE-2026-38570.md): bacnet\_stack 1.3.1 contains an Out-of-bounds Read in bacnet\_tag\_number\_decode which allows attackers to cause a denial of service. (CVSS 7.5)
- [CVE-2026-41283](https://cve.now/CVE-2026-41283.md): OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. (CVSS 9.9, OpenStack Mistral · mistral)
- [CVE-2026-44393](https://cve.now/CVE-2026-44393.md): An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. (CVSS 7.4, oslo-messaging)
- [CVE-2026-44917](https://cve.now/CVE-2026-44917.md): OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a… (CVSS 4.9, OpenStack Ironic)
- [CVE-2026-48681](https://cve.now/CVE-2026-48681.md): OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. (CVSS 5.9, OpenStack Ironic · ironic)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2026-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.