# CVEs published 2026-06-04

627 CVEs were published on June 4, 2026: 71 critical, 262 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-50589](https://cve.now/CVE-2026-50589.md): In OpenStack Ironic 32 before 37.0.0, an unauthenticated malicious user could submit a crafted JSON string to some endpoints on the API or J (CVSS 5.3, OpenStack Ironic · ironic)
- [CVE-2026-10877](https://cve.now/CVE-2026-10877.md): SourceCodester Ship Ferry Ticket Reservation System Admin Login login.php sql injection (CVSS 6.9, SourceCodester Ship Ferry Ticket Reservation System)
- [CVE-2026-10876](https://cve.now/CVE-2026-10876.md): SourceCodester Ship Ferry Ticket Reservation System admin improper authorization (CVSS 5.3, SourceCodester Ship Ferry Ticket Reservation System)
- [CVE-2026-10586](https://cve.now/CVE-2026-10586.md): Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns \<= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery (CVSS 7.2, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2026-11309](https://cve.now/CVE-2026-11309.md): Insufficient policy enforcement in History in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-11308](https://cve.now/CVE-2026-11308.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a mal (CVSS 6.3, Google Chrome)
- [CVE-2026-11307](https://cve.now/CVE-2026-11307.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11306](https://cve.now/CVE-2026-11306.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11305](https://cve.now/CVE-2026-11305.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11304](https://cve.now/CVE-2026-11304.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-11303](https://cve.now/CVE-2026-11303.md): Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11302](https://cve.now/CVE-2026-11302.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discret (CVSS 4.3, Google Chrome)
- [CVE-2026-11301](https://cve.now/CVE-2026-11301.md): Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of (CVSS 8.8, Google Chrome)
- [CVE-2026-11300](https://cve.now/CVE-2026-11300.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-11299](https://cve.now/CVE-2026-11299.md): Integer overflow in Fonts in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-11298](https://cve.now/CVE-2026-11298.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origi (CVSS 4.3, Google Chrome)
- [CVE-2026-11297](https://cve.now/CVE-2026-11297.md): Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to byp (CVSS 7.7, Google Chrome)
- [CVE-2026-11296](https://cve.now/CVE-2026-11296.md): Inappropriate implementation in ImageCapture in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende (CVSS 7.5, Google Chrome)
- [CVE-2026-11295](https://cve.now/CVE-2026-11295.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege es (CVSS 8.8, Google Chrome)
- [CVE-2026-11294](https://cve.now/CVE-2026-11294.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-11293](https://cve.now/CVE-2026-11293.md): Use after free in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-11292](https://cve.now/CVE-2026-11292.md): Insufficient policy enforcement in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy (CVSS 4.3, Google Chrome)
- [CVE-2026-11291](https://cve.now/CVE-2026-11291.md): Inappropriate implementation in Android Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass same (CVSS 4.3, Google Chrome)
- [CVE-2026-11290](https://cve.now/CVE-2026-11290.md): Integer overflow in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to cause a denial of service via a m (CVSS 5.0, Google Chrome)
- [CVE-2026-11289](https://cve.now/CVE-2026-11289.md): Side-channel information leakage in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11288](https://cve.now/CVE-2026-11288.md): Insufficient policy enforcement in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-11287](https://cve.now/CVE-2026-11287.md): Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-11286](https://cve.now/CVE-2026-11286.md): Insufficient validation of untrusted input in Wallet in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t (CVSS 4.3, Google Chrome)
- [CVE-2026-11285](https://cve.now/CVE-2026-11285.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-11284](https://cve.now/CVE-2026-11284.md): Side-channel information leakage in PerformanceAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin d (CVSS 6.5, Google Chrome)
- [CVE-2026-11283](https://cve.now/CVE-2026-11283.md): Insufficient validation of untrusted input in Shortcuts in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to bypass n (CVSS 6.5, Google Chrome)
- [CVE-2026-11282](https://cve.now/CVE-2026-11282.md): Insufficient policy enforcement in Sandbox in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-11281](https://cve.now/CVE-2026-11281.md): Integer overflow in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive i (CVSS 5.0, Google Chrome)
- [CVE-2026-11280](https://cve.now/CVE-2026-11280.md): Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a (CVSS 4.3, Google Chrome)
- [CVE-2026-11279](https://cve.now/CVE-2026-11279.md): Out of bounds read in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-11278](https://cve.now/CVE-2026-11278.md): Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin (CVSS 6.5, Google Chrome)
- [CVE-2026-11277](https://cve.now/CVE-2026-11277.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discret (CVSS 4.3, Google Chrome)
- [CVE-2026-11276](https://cve.now/CVE-2026-11276.md): Inappropriate implementation in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to bypass disc (CVSS 5.1, Google Chrome)
- [CVE-2026-11275](https://cve.now/CVE-2026-11275.md): Inappropriate implementation in Page Info in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised t (CVSS 6.5, Google Chrome)
- [CVE-2026-11274](https://cve.now/CVE-2026-11274.md): Inappropriate implementation in DOM Distiller in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation (CVSS 4.3, Google Chrome)
- [CVE-2026-11273](https://cve.now/CVE-2026-11273.md): Insufficient validation of untrusted input in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user (CVSS 6.1, Google Chrome)
- [CVE-2026-11272](https://cve.now/CVE-2026-11272.md): Insufficient validation of untrusted input in Reading List in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who conv (CVSS 8.8, Google Chrome)
- [CVE-2026-11271](https://cve.now/CVE-2026-11271.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage i (CVSS 6.5, Google Chrome)
- [CVE-2026-11270](https://cve.now/CVE-2026-11270.md): Inappropriate implementation in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data vi (CVSS 6.5, Google Chrome)
- [CVE-2026-11269](https://cve.now/CVE-2026-11269.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to e (CVSS 7.1, Google Chrome)
- [CVE-2026-11268](https://cve.now/CVE-2026-11268.md): Uninitialized Use in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf (CVSS 6.5, Google Chrome)
- [CVE-2026-11267](https://cve.now/CVE-2026-11267.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2026-11266](https://cve.now/CVE-2026-11266.md): Inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a (CVSS 4.3, Google Chrome)
- [CVE-2026-11265](https://cve.now/CVE-2026-11265.md): Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a c (CVSS 7.5, Google Chrome)
- [CVE-2026-11264](https://cve.now/CVE-2026-11264.md): Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy (CVSS 4.3, Google Chrome)
- [CVE-2026-11263](https://cve.now/CVE-2026-11263.md): Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had co (CVSS 6.5, Google Chrome)
- [CVE-2026-11262](https://cve.now/CVE-2026-11262.md): Use after free in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML pa (CVSS 8.8, Google Chrome)
- [CVE-2026-11261](https://cve.now/CVE-2026-11261.md): Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce (CVSS 4.3, Google Chrome)
- [CVE-2026-11260](https://cve.now/CVE-2026-11260.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security pol (CVSS 4.3, Google Chrome)
- [CVE-2026-11259](https://cve.now/CVE-2026-11259.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin p (CVSS 4.3, Google Chrome)
- [CVE-2026-11258](https://cve.now/CVE-2026-11258.md): Inappropriate implementation in File System Access in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to (CVSS 6.5, Google Chrome)
- [CVE-2026-11257](https://cve.now/CVE-2026-11257.md): Inappropriate implementation in Browser in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions (CVSS 4.3, Google Chrome)
- [CVE-2026-11256](https://cve.now/CVE-2026-11256.md): Integer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-11255](https://cve.now/CVE-2026-11255.md): Insufficient validation of untrusted input in Storage Access API in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had c (CVSS 7.5, Google Chrome)
- [CVE-2026-11254](https://cve.now/CVE-2026-11254.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-11253](https://cve.now/CVE-2026-11253.md): Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-11252](https://cve.now/CVE-2026-11252.md): Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionar (CVSS 4.3, Google Chrome)
- [CVE-2026-11251](https://cve.now/CVE-2026-11251.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 3.1, Google Chrome)
- [CVE-2026-11250](https://cve.now/CVE-2026-11250.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer (CVSS 9.6, Google Chrome)
- [CVE-2026-11249](https://cve.now/CVE-2026-11249.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obta (CVSS 4.7, Google Chrome)
- [CVE-2026-11248](https://cve.now/CVE-2026-11248.md): Inappropriate implementation in Google Lens in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restricti (CVSS 8.8, Google Chrome)
- [CVE-2026-11247](https://cve.now/CVE-2026-11247.md): Insufficient policy enforcement in CustomTabs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-ori (CVSS 3.1, Google Chrome)
- [CVE-2026-11246](https://cve.now/CVE-2026-11246.md): Insufficient validation of untrusted input in IndexedDB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromise (CVSS 5.3, Google Chrome)
- [CVE-2026-11245](https://cve.now/CVE-2026-11245.md): Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-11244](https://cve.now/CVE-2026-11244.md): Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had co (CVSS 3.1, Google Chrome)
- [CVE-2026-11243](https://cve.now/CVE-2026-11243.md): Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restriction (CVSS 5.4, Google Chrome)
- [CVE-2026-11242](https://cve.now/CVE-2026-11242.md): Insufficient validation of untrusted input in Plugins in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 7.5, Google Chrome)
- [CVE-2026-11241](https://cve.now/CVE-2026-11241.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment (CVSS 8.0, Google Chrome)
- [CVE-2026-11240](https://cve.now/CVE-2026-11240.md): Insufficient validation of untrusted input in Loader in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t (CVSS 3.1, Google Chrome)
- [CVE-2026-11239](https://cve.now/CVE-2026-11239.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere (CVSS 7.5, Google Chrome)
- [CVE-2026-11238](https://cve.now/CVE-2026-11238.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic (CVSS 5.9, Google Chrome)
- [CVE-2026-11237](https://cve.now/CVE-2026-11237.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 8.3, Google Chrome)
- [CVE-2026-11236](https://cve.now/CVE-2026-11236.md): Insufficient policy enforcement in Web Bluetooth in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the r (CVSS 8.3, Google Chrome)
- [CVE-2026-11235](https://cve.now/CVE-2026-11235.md): Insufficient policy enforcement in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren (CVSS 8.8, Google Chrome)
- [CVE-2026-11234](https://cve.now/CVE-2026-11234.md): Inappropriate implementation in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende (CVSS 4.3, Google Chrome)
- [CVE-2026-11233](https://cve.now/CVE-2026-11233.md): Insufficient policy enforcement in FoldableAPIs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the re (CVSS 4.7, Google Chrome)
- [CVE-2026-11232](https://cve.now/CVE-2026-11232.md): Inappropriate implementation in TabGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malic (CVSS 5.4, Google Chrome)
- [CVE-2026-11231](https://cve.now/CVE-2026-11231.md): Inappropriate implementation in Safe Browsing in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary (CVSS 8.1, Google Chrome)
- [CVE-2026-11230](https://cve.now/CVE-2026-11230.md): Use after free in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-11229](https://cve.now/CVE-2026-11229.md): Inappropriate implementation in Enterprise in Google Chrome prior to 149.0.7827.53 allowed a local attacker to perform privilege escalation (CVSS 6.1, Google Chrome)
- [CVE-2026-11228](https://cve.now/CVE-2026-11228.md): Inappropriate implementation in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage (CVSS 4.3, Google Chrome)
- [CVE-2026-11227](https://cve.now/CVE-2026-11227.md): Incorrect security UI in Tab Hover Cards in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11226](https://cve.now/CVE-2026-11226.md): Insufficient policy enforcement in PreviewTab in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who convinced a u (CVSS 6.5, Google Chrome)
- [CVE-2026-11225](https://cve.now/CVE-2026-11225.md): Inappropriate implementation in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-11224](https://cve.now/CVE-2026-11224.md): Use after free in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malici (CVSS 8.1, Google Chrome)
- [CVE-2026-11223](https://cve.now/CVE-2026-11223.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-11222](https://cve.now/CVE-2026-11222.md): Incorrect security UI in Tab Strip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofing via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-11221](https://cve.now/CVE-2026-11221.md): Insufficient validation of untrusted input in PointerLock in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromi (CVSS 4.3, Google Chrome)
- [CVE-2026-11220](https://cve.now/CVE-2026-11220.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-11219](https://cve.now/CVE-2026-11219.md): Inappropriate implementation in Navigation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictio (CVSS 4.3, Google Chrome)
- [CVE-2026-11218](https://cve.now/CVE-2026-11218.md): Inappropriate implementation in PlatformIntegration in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who convinc (CVSS 6.8, Google Chrome)
- [CVE-2026-11217](https://cve.now/CVE-2026-11217.md): Inappropriate implementation in Fenced Frames in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend (CVSS 6.5, Google Chrome)
- [CVE-2026-11216](https://cve.now/CVE-2026-11216.md): Incorrect security UI in File Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec (CVSS 4.3, Google Chrome)
- [CVE-2026-11215](https://cve.now/CVE-2026-11215.md): Inappropriate implementation in Cronet in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoofi (CVSS 6.5, Google Chrome)
- [CVE-2026-11214](https://cve.now/CVE-2026-11214.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin (CVSS 6.5, Google Chrome)
- [CVE-2026-11213](https://cve.now/CVE-2026-11213.md): Insufficient validation of untrusted input in Reading Mode in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had comprom (CVSS 9.6, Google Chrome)
- [CVE-2026-11212](https://cve.now/CVE-2026-11212.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a ma (CVSS 4.3, Google Chrome)
- [CVE-2026-11211](https://cve.now/CVE-2026-11211.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-11210](https://cve.now/CVE-2026-11210.md): Inappropriate implementation in Safe Browsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary acce (CVSS 6.5, Google Chrome)
- [CVE-2026-11209](https://cve.now/CVE-2026-11209.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-11208](https://cve.now/CVE-2026-11208.md): Use after free in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-11207](https://cve.now/CVE-2026-11207.md): Insufficient validation of untrusted input in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perf (CVSS 9.6, Google Chrome)
- [CVE-2026-11206](https://cve.now/CVE-2026-11206.md): Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data (CVSS 6.5, Google Chrome)
- [CVE-2026-11205](https://cve.now/CVE-2026-11205.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who co (CVSS 6.1, Google Chrome)
- [CVE-2026-11204](https://cve.now/CVE-2026-11204.md): Inappropriate implementation in Signin in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restric (CVSS 6.5, Google Chrome)
- [CVE-2026-11203](https://cve.now/CVE-2026-11203.md): Inappropriate implementation in GPU in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11202](https://cve.now/CVE-2026-11202.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perfo (CVSS 8.8, Google Chrome)
- [CVE-2026-11201](https://cve.now/CVE-2026-11201.md): Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious exte (CVSS 8.8, Google Chrome)
- [CVE-2026-11200](https://cve.now/CVE-2026-11200.md): Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-11199](https://cve.now/CVE-2026-11199.md): Inappropriate implementation in WebRTC in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to leak (CVSS 5.9, Google Chrome)
- [CVE-2026-11198](https://cve.now/CVE-2026-11198.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perfor (CVSS 9.6, Google Chrome)
- [CVE-2026-11197](https://cve.now/CVE-2026-11197.md): Insufficient policy enforcement in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere (CVSS 6.5, Google Chrome)
- [CVE-2026-11196](https://cve.now/CVE-2026-11196.md): Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from pro (CVSS 6.5, Google Chrome)
- [CVE-2026-11195](https://cve.now/CVE-2026-11195.md): Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in sp (CVSS 6.5, Google Chrome)
- [CVE-2026-11194](https://cve.now/CVE-2026-11194.md): Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a cr (CVSS 6.5, Google Chrome)
- [CVE-2026-11193](https://cve.now/CVE-2026-11193.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionar (CVSS 6.5, Google Chrome)
- [CVE-2026-11192](https://cve.now/CVE-2026-11192.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform (CVSS 4.3, Google Chrome)
- [CVE-2026-11191](https://cve.now/CVE-2026-11191.md): Out of bounds memory access in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds (CVSS 8.8, Google Chrome)
- [CVE-2026-11190](https://cve.now/CVE-2026-11190.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a mal (CVSS 6.5, Google Chrome)
- [CVE-2026-11189](https://cve.now/CVE-2026-11189.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to i (CVSS 6.5, Google Chrome)
- [CVE-2026-11188](https://cve.now/CVE-2026-11188.md): Use after free in USB in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v (CVSS 8.8, Google Chrome)
- [CVE-2026-11187](https://cve.now/CVE-2026-11187.md): Inappropriate implementation in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via (CVSS 6.3, Google Chrome)
- [CVE-2026-11186](https://cve.now/CVE-2026-11186.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-11185](https://cve.now/CVE-2026-11185.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to ex (CVSS 8.1, Google Chrome)
- [CVE-2026-11184](https://cve.now/CVE-2026-11184.md): Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions (CVSS 6.3, Google Chrome)
- [CVE-2026-11183](https://cve.now/CVE-2026-11183.md): Out of bounds read in GWP-ASan in Google Chrome prior to 149.0.7827.53 allowed a local attacker to obtain potentially sensitive information (CVSS 6.5, Google Chrome)
- [CVE-2026-11182](https://cve.now/CVE-2026-11182.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-11181](https://cve.now/CVE-2026-11181.md): Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy (CVSS 6.3, Google Chrome)
- [CVE-2026-11180](https://cve.now/CVE-2026-11180.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-11179](https://cve.now/CVE-2026-11179.md): Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-11178](https://cve.now/CVE-2026-11178.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin (CVSS 4.3, Google Chrome)
- [CVE-2026-11177](https://cve.now/CVE-2026-11177.md): Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI ge (CVSS 8.8, Google Chrome)
- [CVE-2026-11176](https://cve.now/CVE-2026-11176.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf (CVSS 6.5, Google Chrome)
- [CVE-2026-11175](https://cve.now/CVE-2026-11175.md): Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11174](https://cve.now/CVE-2026-11174.md): Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren (CVSS 5.3, Google Chrome)
- [CVE-2026-11173](https://cve.now/CVE-2026-11173.md): Out of bounds write in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to exec (CVSS 8.8, Google Chrome)
- [CVE-2026-11172](https://cve.now/CVE-2026-11172.md): Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing (CVSS 8.8, Google Chrome)
- [CVE-2026-11171](https://cve.now/CVE-2026-11171.md): Integer overflow in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11170](https://cve.now/CVE-2026-11170.md): Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level pr (CVSS 8.1, Google Chrome)
- [CVE-2026-11169](https://cve.now/CVE-2026-11169.md): Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 8.1, Google Chrome)
- [CVE-2026-11168](https://cve.now/CVE-2026-11168.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere (CVSS 6.5, Google Chrome)
- [CVE-2026-11167](https://cve.now/CVE-2026-11167.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 9.6, Google Chrome)
- [CVE-2026-11166](https://cve.now/CVE-2026-11166.md): Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.8, Google Chrome)
- [CVE-2026-11165](https://cve.now/CVE-2026-11165.md): Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v (CVSS 9.6, Google Chrome)
- [CVE-2026-11164](https://cve.now/CVE-2026-11164.md): Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-11163](https://cve.now/CVE-2026-11163.md): Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-11162](https://cve.now/CVE-2026-11162.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-11161](https://cve.now/CVE-2026-11161.md): Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-11160](https://cve.now/CVE-2026-11160.md): Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-11159](https://cve.now/CVE-2026-11159.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 4.3, Google Chrome)
- [CVE-2026-11158](https://cve.now/CVE-2026-11158.md): Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potential (CVSS 8.6, Google Chrome)
- [CVE-2026-11157](https://cve.now/CVE-2026-11157.md): Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious ex (CVSS 5.4, Google Chrome)
- [CVE-2026-11156](https://cve.now/CVE-2026-11156.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-11155](https://cve.now/CVE-2026-11155.md): Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-11154](https://cve.now/CVE-2026-11154.md): Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 7.5, Google Chrome)
- [CVE-2026-11153](https://cve.now/CVE-2026-11153.md): Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a (CVSS 9.1, Google Chrome)
- [CVE-2026-11152](https://cve.now/CVE-2026-11152.md): Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 9.6, Google Chrome)
- [CVE-2026-11151](https://cve.now/CVE-2026-11151.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had com (CVSS 7.5, Google Chrome)
- [CVE-2026-11150](https://cve.now/CVE-2026-11150.md): Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-11149](https://cve.now/CVE-2026-11149.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 7.5, Google Chrome)
- [CVE-2026-11148](https://cve.now/CVE-2026-11148.md): Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to leak cross-origin da (CVSS 6.5, Google Chrome)
- [CVE-2026-11147](https://cve.now/CVE-2026-11147.md): Use after free in WebML in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-11146](https://cve.now/CVE-2026-11146.md): Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 9.6, Google Chrome)
- [CVE-2026-11145](https://cve.now/CVE-2026-11145.md): Race in Geolocation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTM (CVSS 5.3, Google Chrome)
- [CVE-2026-11144](https://cve.now/CVE-2026-11144.md): Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-11143](https://cve.now/CVE-2026-11143.md): Out of bounds read in Extensions in Google Chrome on Linux prior to 149.0.7827.53 allowed an attacker who convinced a user to install a mali (CVSS 6.5, Google Chrome)
- [CVE-2026-11142](https://cve.now/CVE-2026-11142.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-11141](https://cve.now/CVE-2026-11141.md): Uninitialized Use in Audio in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obt (CVSS 6.5, Google Chrome)
- [CVE-2026-11140](https://cve.now/CVE-2026-11140.md): Out of bounds read in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process (CVSS 6.5, Google Chrome)
- [CVE-2026-11139](https://cve.now/CVE-2026-11139.md): Inappropriate implementation in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf (CVSS 6.5, Google Chrome)
- [CVE-2026-11138](https://cve.now/CVE-2026-11138.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-11137](https://cve.now/CVE-2026-11137.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-11136](https://cve.now/CVE-2026-11136.md): Use after free in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11135](https://cve.now/CVE-2026-11135.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access (CVSS 6.5, Google Chrome)
- [CVE-2026-11134](https://cve.now/CVE-2026-11134.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf (CVSS 6.5, Google Chrome)
- [CVE-2026-11133](https://cve.now/CVE-2026-11133.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-11132](https://cve.now/CVE-2026-11132.md): Insufficient policy enforcement in Paint in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-11131](https://cve.now/CVE-2026-11131.md): Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, Google Chrome)
- [CVE-2026-11130](https://cve.now/CVE-2026-11130.md): Use after free in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-11129](https://cve.now/CVE-2026-11129.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11128](https://cve.now/CVE-2026-11128.md): Inappropriate implementation in Web Share in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage i (CVSS 6.5, Google Chrome)
- [CVE-2026-11127](https://cve.now/CVE-2026-11127.md): Inappropriate implementation in WebAPKs in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform domain spoof (CVSS 6.5, Google Chrome)
- [CVE-2026-11126](https://cve.now/CVE-2026-11126.md): Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malic (CVSS 4.3, Google Chrome)
- [CVE-2026-11125](https://cve.now/CVE-2026-11125.md): Use after free in Compositing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox v (CVSS 8.8, Google Chrome)
- [CVE-2026-11124](https://cve.now/CVE-2026-11124.md): Integer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-11123](https://cve.now/CVE-2026-11123.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-11122](https://cve.now/CVE-2026-11122.md): Inappropriate implementation in Keyboard in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HT (CVSS 6.1, Google Chrome)
- [CVE-2026-11121](https://cve.now/CVE-2026-11121.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 6.5, Google Chrome)
- [CVE-2026-11120](https://cve.now/CVE-2026-11120.md): Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had (CVSS 9.6, Google Chrome)
- [CVE-2026-11119](https://cve.now/CVE-2026-11119.md): Inappropriate implementation in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren (CVSS 9.6, Google Chrome)
- [CVE-2026-11118](https://cve.now/CVE-2026-11118.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11117](https://cve.now/CVE-2026-11117.md): Use after free in Views in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-11116](https://cve.now/CVE-2026-11116.md): Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwo (CVSS 8.8, Google Chrome)
- [CVE-2026-11115](https://cve.now/CVE-2026-11115.md): Use after free in Updater in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level privilege escalati (CVSS 7.3, Google Chrome)
- [CVE-2026-11114](https://cve.now/CVE-2026-11114.md): Use after free in Device Trust in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, Google Chrome)
- [CVE-2026-11113](https://cve.now/CVE-2026-11113.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 9.6, Google Chrome)
- [CVE-2026-11112](https://cve.now/CVE-2026-11112.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had (CVSS 9.6, Google Chrome)
- [CVE-2026-11111](https://cve.now/CVE-2026-11111.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.1, Google Chrome)
- [CVE-2026-11110](https://cve.now/CVE-2026-11110.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-11109](https://cve.now/CVE-2026-11109.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-11108](https://cve.now/CVE-2026-11108.md): Inappropriate implementation in NFC in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform privilege escala (CVSS 8.8, Google Chrome)
- [CVE-2026-11107](https://cve.now/CVE-2026-11107.md): Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-11106](https://cve.now/CVE-2026-11106.md): Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craf (CVSS 6.5, Google Chrome)
- [CVE-2026-11105](https://cve.now/CVE-2026-11105.md): Insufficient validation of untrusted input in WebUI in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 6.5, Google Chrome)
- [CVE-2026-11104](https://cve.now/CVE-2026-11104.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obt (CVSS 6.5, Google Chrome)
- [CVE-2026-11103](https://cve.now/CVE-2026-11103.md): Inappropriate implementation in Installer in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform OS-level pr (CVSS 7.8, Google Chrome)
- [CVE-2026-11102](https://cve.now/CVE-2026-11102.md): Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary cod (CVSS 8.8, Google Chrome)
- [CVE-2026-11101](https://cve.now/CVE-2026-11101.md): Uninitialized Use in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a craft (CVSS 6.5, Google Chrome)
- [CVE-2025-8873](https://cve.now/CVE-2025-8873.md): Arista EOS Dataplane Denial of Service via Malformed IPsec Packet (CVSS 7.5, Arista Networks EOS)
- [CVE-2026-11100](https://cve.now/CVE-2026-11100.md): Use after free in File Input in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec (CVSS 9.6, Google Chrome)
- [CVE-2026-11098](https://cve.now/CVE-2026-11098.md): Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 5.3, Google Chrome)
- [CVE-2026-11097](https://cve.now/CVE-2026-11097.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin da (CVSS 6.5, Google Chrome)
- [CVE-2026-11096](https://cve.now/CVE-2026-11096.md): Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-11095](https://cve.now/CVE-2026-11095.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t (CVSS 9.6, Google Chrome)
- [CVE-2026-11094](https://cve.now/CVE-2026-11094.md): Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce (CVSS 9.6, Google Chrome)
- [CVE-2026-11093](https://cve.now/CVE-2026-11093.md): Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-11092](https://cve.now/CVE-2026-11092.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a ma (CVSS 8.8, Google Chrome)
- [CVE-2026-11091](https://cve.now/CVE-2026-11091.md): Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds (CVSS 8.8, Google Chrome)
- [CVE-2026-11090](https://cve.now/CVE-2026-11090.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-11089](https://cve.now/CVE-2026-11089.md): Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obt (CVSS 6.5, Google Chrome)
- [CVE-2026-11088](https://cve.now/CVE-2026-11088.md): Integer overflow in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pote (CVSS 9.6, Google Chrome)
- [CVE-2026-11087](https://cve.now/CVE-2026-11087.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to lea (CVSS 6.5, Google Chrome)
- [CVE-2026-11086](https://cve.now/CVE-2026-11086.md): Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proc (CVSS 8.8, Google Chrome)
- [CVE-2026-11085](https://cve.now/CVE-2026-11085.md): Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds me (CVSS 8.8, Google Chrome)
- [CVE-2026-11084](https://cve.now/CVE-2026-11084.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data (CVSS 6.5, Google Chrome)
- [CVE-2026-11083](https://cve.now/CVE-2026-11083.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data (CVSS 6.5, Google Chrome)
- [CVE-2026-11082](https://cve.now/CVE-2026-11082.md): Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 9.6, Google Chrome)
- [CVE-2026-11081](https://cve.now/CVE-2026-11081.md): Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11080](https://cve.now/CVE-2026-11080.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruptio (CVSS 8.8, Google Chrome)
- [CVE-2026-11079](https://cve.now/CVE-2026-11079.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of (CVSS 8.8, Google Chrome)
- [CVE-2026-11078](https://cve.now/CVE-2026-11078.md): Inappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rendere (CVSS 6.5, Google Chrome)
- [CVE-2026-11077](https://cve.now/CVE-2026-11077.md): Bad cast in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-11076](https://cve.now/CVE-2026-11076.md): Type Confusion in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-11075](https://cve.now/CVE-2026-11075.md): Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-11074](https://cve.now/CVE-2026-11074.md): Use after free in WebRTC in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2026-11073](https://cve.now/CVE-2026-11073.md): Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from p (CVSS 6.5, Google Chrome)
- [CVE-2026-11072](https://cve.now/CVE-2026-11072.md): Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a malici (CVSS 7.8, Google Chrome)
- [CVE-2026-11071](https://cve.now/CVE-2026-11071.md): Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process t (CVSS 8.8, Google Chrome)
- [CVE-2026-11070](https://cve.now/CVE-2026-11070.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who ha (CVSS 9.6, Google Chrome)
- [CVE-2026-11069](https://cve.now/CVE-2026-11069.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin p (CVSS 6.5, Google Chrome)
- [CVE-2026-11068](https://cve.now/CVE-2026-11068.md): Use after free in WebSockets in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-11067](https://cve.now/CVE-2026-11067.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-11066](https://cve.now/CVE-2026-11066.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-11065](https://cve.now/CVE-2026-11065.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-11064](https://cve.now/CVE-2026-11064.md): Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cr (CVSS 6.5, Google Chrome)
- [CVE-2026-11063](https://cve.now/CVE-2026-11063.md): Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had com (CVSS 9.6, Google Chrome)
- [CVE-2026-11062](https://cve.now/CVE-2026-11062.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2026-11061](https://cve.now/CVE-2026-11061.md): Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-11060](https://cve.now/CVE-2026-11060.md): Use after free in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-11059](https://cve.now/CVE-2026-11059.md): Use after free in Blink in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-11058](https://cve.now/CVE-2026-11058.md): Integer overflow in CredentialProvider in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 7.5, Google Chrome)
- [CVE-2026-11057](https://cve.now/CVE-2026-11057.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obta (CVSS 6.5, Google Chrome)
- [CVE-2026-11056](https://cve.now/CVE-2026-11056.md): Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who (CVSS 9.6, Google Chrome)
- [CVE-2026-11055](https://cve.now/CVE-2026-11055.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-11054](https://cve.now/CVE-2026-11054.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11052](https://cve.now/CVE-2026-11052.md): Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process (CVSS 9.6, Google Chrome)
- [CVE-2026-11051](https://cve.now/CVE-2026-11051.md): Out of bounds read in ANGLE in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-11050](https://cve.now/CVE-2026-11050.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-11049](https://cve.now/CVE-2026-11049.md): Use after free in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-11048](https://cve.now/CVE-2026-11048.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a mal (CVSS 6.5, Google Chrome)
- [CVE-2026-11047](https://cve.now/CVE-2026-11047.md): Inappropriate implementation in Base in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the re (CVSS 9.6, Google Chrome)
- [CVE-2026-11046](https://cve.now/CVE-2026-11046.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 8.8, Google Chrome)
- [CVE-2026-11045](https://cve.now/CVE-2026-11045.md): Insufficient validation of untrusted input in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 6.5, Google Chrome)
- [CVE-2026-11044](https://cve.now/CVE-2026-11044.md): Integer overflow in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive informati (CVSS 6.5, Google Chrome)
- [CVE-2026-11043](https://cve.now/CVE-2026-11043.md): Out of bounds write in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce (CVSS 9.6, Google Chrome)
- [CVE-2026-11042](https://cve.now/CVE-2026-11042.md): Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 8.8, Google Chrome)
- [CVE-2026-11041](https://cve.now/CVE-2026-11041.md): Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had com (CVSS 8.8, Google Chrome)
- [CVE-2026-11040](https://cve.now/CVE-2026-11040.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-11039](https://cve.now/CVE-2026-11039.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 6.5, Google Chrome)
- [CVE-2026-11038](https://cve.now/CVE-2026-11038.md): Insufficient policy enforcement in Subresource Integrity in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content (CVSS 6.5, Google Chrome)
- [CVE-2026-11037](https://cve.now/CVE-2026-11037.md): Out of bounds write in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via (CVSS 9.6, Google Chrome)
- [CVE-2026-11036](https://cve.now/CVE-2026-11036.md): Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-11035](https://cve.now/CVE-2026-11035.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to perform privilege (CVSS 7.3, Google Chrome)
- [CVE-2026-11034](https://cve.now/CVE-2026-11034.md): Insufficient validation of untrusted input in Tab Group Sync in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to (CVSS 6.1, Google Chrome)
- [CVE-2026-11033](https://cve.now/CVE-2026-11033.md): Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive informat (CVSS 6.5, Google Chrome)
- [CVE-2026-11032](https://cve.now/CVE-2026-11032.md): Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data (CVSS 6.5, Google Chrome)
- [CVE-2026-11031](https://cve.now/CVE-2026-11031.md): Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform (CVSS 4.3, Google Chrome)
- [CVE-2026-11030](https://cve.now/CVE-2026-11030.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via malic (CVSS 8.8, Google Chrome)
- [CVE-2026-11029](https://cve.now/CVE-2026-11029.md): Insufficient validation of untrusted input in Drag and Drop in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who (CVSS 8.3, Google Chrome)
- [CVE-2026-11028](https://cve.now/CVE-2026-11028.md): Use after free in Media in Google Chrome on Linux and ChromeOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the rend (CVSS 8.8, Google Chrome)
- [CVE-2026-11027](https://cve.now/CVE-2026-11027.md): Insufficient validation of untrusted input in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the (CVSS 6.5, Google Chrome)
- [CVE-2026-11026](https://cve.now/CVE-2026-11026.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a mal (CVSS 6.5, Google Chrome)
- [CVE-2026-11025](https://cve.now/CVE-2026-11025.md): Insufficient policy enforcement in Navigation in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to bypass content (CVSS 6.5, Google Chrome)
- [CVE-2026-11024](https://cve.now/CVE-2026-11024.md): Stack buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit stack corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-11023](https://cve.now/CVE-2026-11023.md): Inappropriate implementation in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the ren (CVSS 6.5, Google Chrome)
- [CVE-2026-11022](https://cve.now/CVE-2026-11022.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-11021](https://cve.now/CVE-2026-11021.md): Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compr (CVSS 9.6, Google Chrome)
- [CVE-2026-11020](https://cve.now/CVE-2026-11020.md): Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-11019](https://cve.now/CVE-2026-11019.md): Inappropriate implementation in Payments in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 6.5, Google Chrome)
- [CVE-2026-11018](https://cve.now/CVE-2026-11018.md): Insufficient policy enforcement in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions (CVSS 6.5, Google Chrome)
- [CVE-2026-11017](https://cve.now/CVE-2026-11017.md): Inappropriate implementation in Link Preview in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the rende (CVSS 6.5, Google Chrome)
- [CVE-2026-11016](https://cve.now/CVE-2026-11016.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-11015](https://cve.now/CVE-2026-11015.md): Out of bounds read in WebGPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.1, Google Chrome)
- [CVE-2026-11014](https://cve.now/CVE-2026-11014.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a (CVSS 6.5, Google Chrome)
- [CVE-2026-11013](https://cve.now/CVE-2026-11013.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-11012](https://cve.now/CVE-2026-11012.md): Use after free in Serial in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-11011](https://cve.now/CVE-2026-11011.md): Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 8.1, Google Chrome)
- [CVE-2026-11010](https://cve.now/CVE-2026-11010.md): Use after free in WebShare in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-11009](https://cve.now/CVE-2026-11009.md): Use after free in USB in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v (CVSS 9.6, Google Chrome)
- [CVE-2026-11008](https://cve.now/CVE-2026-11008.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compr (CVSS 6.5, Google Chrome)
- [CVE-2026-11007](https://cve.now/CVE-2026-11007.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had c (CVSS 6.5, Google Chrome)
- [CVE-2026-11006](https://cve.now/CVE-2026-11006.md): Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-11005](https://cve.now/CVE-2026-11005.md): Out of bounds read in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pr (CVSS 5.3, Google Chrome)
- [CVE-2026-11004](https://cve.now/CVE-2026-11004.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to ob (CVSS 5.3, Google Chrome)
- [CVE-2026-11003](https://cve.now/CVE-2026-11003.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-11002](https://cve.now/CVE-2026-11002.md): Use after free in Autofill in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-11001](https://cve.now/CVE-2026-11001.md): Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in (CVSS 4.2, Google Chrome)
- [CVE-2026-11000](https://cve.now/CVE-2026-11000.md): Use after free in Fonts in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbo (CVSS 8.8, Google Chrome)
- [CVE-2026-10999](https://cve.now/CVE-2026-10999.md): Integer overflow in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proc (CVSS 5.3, Google Chrome)
- [CVE-2026-10998](https://cve.now/CVE-2026-10998.md): Out of bounds read in Media in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to perform an out of bo (CVSS 4.0, Google Chrome)
- [CVE-2026-10997](https://cve.now/CVE-2026-10997.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a (CVSS 6.5, Google Chrome)
- [CVE-2026-10996](https://cve.now/CVE-2026-10996.md): Inappropriate implementation in Workers in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a (CVSS 6.5, Google Chrome)
- [CVE-2026-10995](https://cve.now/CVE-2026-10995.md): Heap buffer overflow in TabStrip in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specifi (CVSS 8.8, Google Chrome)
- [CVE-2026-10994](https://cve.now/CVE-2026-10994.md): Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-10993](https://cve.now/CVE-2026-10993.md): Heap buffer overflow in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-10992](https://cve.now/CVE-2026-10992.md): Insufficient data validation in Animation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive (CVSS 6.5, Google Chrome)
- [CVE-2026-10991](https://cve.now/CVE-2026-10991.md): Use after free in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gesture (CVSS 8.8, Google Chrome)
- [CVE-2026-10990](https://cve.now/CVE-2026-10990.md): Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-10989](https://cve.now/CVE-2026-10989.md): Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in speci (CVSS 8.8, Google Chrome)
- [CVE-2026-10988](https://cve.now/CVE-2026-10988.md): Use after free in Views in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.8, Google Chrome)
- [CVE-2026-10987](https://cve.now/CVE-2026-10987.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10986](https://cve.now/CVE-2026-10986.md): Integer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10985](https://cve.now/CVE-2026-10985.md): Out of bounds read in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-10984](https://cve.now/CVE-2026-10984.md): Inappropriate implementation in Accessibility in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spo (CVSS 5.4, Google Chrome)
- [CVE-2026-10983](https://cve.now/CVE-2026-10983.md): Insufficient validation of untrusted input in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-10982](https://cve.now/CVE-2026-10982.md): Use after free in WebXR in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-10981](https://cve.now/CVE-2026-10981.md): Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised t (CVSS 6.5, Google Chrome)
- [CVE-2026-10980](https://cve.now/CVE-2026-10980.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-10979](https://cve.now/CVE-2026-10979.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2026-10978](https://cve.now/CVE-2026-10978.md): Use after free in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via mali (CVSS 8.8, Google Chrome)
- [CVE-2026-10977](https://cve.now/CVE-2026-10977.md): Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak (CVSS 6.5, Google Chrome)
- [CVE-2026-10976](https://cve.now/CVE-2026-10976.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-10975](https://cve.now/CVE-2026-10975.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10974](https://cve.now/CVE-2026-10974.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-10973](https://cve.now/CVE-2026-10973.md): Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 7.4, Google Chrome)
- [CVE-2026-10972](https://cve.now/CVE-2026-10972.md): Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape v (CVSS 9.6, Google Chrome)
- [CVE-2026-10971](https://cve.now/CVE-2026-10971.md): Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had (CVSS 8.3, Google Chrome)
- [CVE-2026-10970](https://cve.now/CVE-2026-10970.md): Insufficient validation of untrusted input in InterestGroups in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compr (CVSS 8.3, Google Chrome)
- [CVE-2026-10969](https://cve.now/CVE-2026-10969.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 7.5, Google Chrome)
- [CVE-2026-10968](https://cve.now/CVE-2026-10968.md): Insufficient validation of untrusted input in Dawn in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had comp (CVSS 7.4, Google Chrome)
- [CVE-2026-10967](https://cve.now/CVE-2026-10967.md): Use after free in SurfaceCapture in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the render (CVSS 8.3, Google Chrome)
- [CVE-2026-10966](https://cve.now/CVE-2026-10966.md): Inappropriate implementation in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox es (CVSS 9.6, Google Chrome)
- [CVE-2026-10965](https://cve.now/CVE-2026-10965.md): Integer overflow in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-10964](https://cve.now/CVE-2026-10964.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10963](https://cve.now/CVE-2026-10963.md): Integer overflow in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10962](https://cve.now/CVE-2026-10962.md): Type Confusion in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-10961](https://cve.now/CVE-2026-10961.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer p (CVSS 8.3, Google Chrome)
- [CVE-2026-10960](https://cve.now/CVE-2026-10960.md): Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-10959](https://cve.now/CVE-2026-10959.md): Use after free in Input in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-10958](https://cve.now/CVE-2026-10958.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2026-10957](https://cve.now/CVE-2026-10957.md): Use after free in Glic in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10956](https://cve.now/CVE-2026-10956.md): Use after free in MimeHandlerView in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-10955](https://cve.now/CVE-2026-10955.md): Type Confusion in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds me (CVSS 8.8, Google Chrome)
- [CVE-2026-10954](https://cve.now/CVE-2026-10954.md): Use after free in Actor in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-10953](https://cve.now/CVE-2026-10953.md): Use after free in Core in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process (CVSS 8.3, Google Chrome)
- [CVE-2026-10952](https://cve.now/CVE-2026-10952.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corrup (CVSS 8.8, Google Chrome)
- [CVE-2026-10951](https://cve.now/CVE-2026-10951.md): Use after free in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specif (CVSS 8.8, Google Chrome)
- [CVE-2026-10950](https://cve.now/CVE-2026-10950.md): Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin da (CVSS 6.5, Google Chrome)
- [CVE-2026-10949](https://cve.now/CVE-2026-10949.md): Heap buffer overflow in Video in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-10948](https://cve.now/CVE-2026-10948.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10947](https://cve.now/CVE-2026-10947.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10946](https://cve.now/CVE-2026-10946.md): Heap buffer overflow in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific U (CVSS 7.5, Google Chrome)
- [CVE-2026-10945](https://cve.now/CVE-2026-10945.md): Use after free in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestur (CVSS 8.8, Google Chrome)
- [CVE-2026-10944](https://cve.now/CVE-2026-10944.md): Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin da (CVSS 6.5, Google Chrome)
- [CVE-2026-10943](https://cve.now/CVE-2026-10943.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10942](https://cve.now/CVE-2026-10942.md): Inappropriate implementation in UI in Google Chrome on Windows prior to 149.0.7827.53 allowed a local attacker to perform privilege escalati (CVSS 7.8, Google Chrome)
- [CVE-2026-10941](https://cve.now/CVE-2026-10941.md): Out of bounds memory access in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a san (CVSS 8.8, Google Chrome)
- [CVE-2026-10940](https://cve.now/CVE-2026-10940.md): Race in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pote (CVSS 8.3, Google Chrome)
- [CVE-2026-10939](https://cve.now/CVE-2026-10939.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10938](https://cve.now/CVE-2026-10938.md): Inappropriate implementation in Input in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro (CVSS 8.1, Google Chrome)
- [CVE-2026-10937](https://cve.now/CVE-2026-10937.md): Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via (CVSS 8.1, Google Chrome)
- [CVE-2026-10936](https://cve.now/CVE-2026-10936.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-10935](https://cve.now/CVE-2026-10935.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-10934](https://cve.now/CVE-2026-10934.md): Use after free in Autofill in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-10933](https://cve.now/CVE-2026-10933.md): Use after free in Audio in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-10932](https://cve.now/CVE-2026-10932.md): Use after free in UI in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-10931](https://cve.now/CVE-2026-10931.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-10930](https://cve.now/CVE-2026-10930.md): Out of bounds read in ANGLE in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory read (CVSS 8.1, Google Chrome)
- [CVE-2026-10929](https://cve.now/CVE-2026-10929.md): Heap buffer overflow in ANGLE in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer (CVSS 8.3, Google Chrome)
- [CVE-2026-10928](https://cve.now/CVE-2026-10928.md): Script injection in Headless in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-10927](https://cve.now/CVE-2026-10927.md): Out of bounds read in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-10926](https://cve.now/CVE-2026-10926.md): Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitrary code vi (CVSS 8.8, Google Chrome)
- [CVE-2026-10925](https://cve.now/CVE-2026-10925.md): Out of bounds write in Skia in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-10924](https://cve.now/CVE-2026-10924.md): Integer overflow in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-10923](https://cve.now/CVE-2026-10923.md): Use after free in WebAppInstalls in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to execute arbitrary code via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10922](https://cve.now/CVE-2026-10922.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a use (CVSS 8.8, Google Chrome)
- [CVE-2026-10921](https://cve.now/CVE-2026-10921.md): Integer overflow in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-10920](https://cve.now/CVE-2026-10920.md): Insufficient validation of untrusted input in WebShare in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who had comp (CVSS 8.3, Google Chrome)
- [CVE-2026-10919](https://cve.now/CVE-2026-10919.md): Use after free in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potent (CVSS 8.3, Google Chrome)
- [CVE-2026-10918](https://cve.now/CVE-2026-10918.md): Use after free in Viz in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 8.3, Google Chrome)
- [CVE-2026-10917](https://cve.now/CVE-2026-10917.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 8.3, Google Chrome)
- [CVE-2026-10916](https://cve.now/CVE-2026-10916.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised (CVSS 6.1, Google Chrome)
- [CVE-2026-10915](https://cve.now/CVE-2026-10915.md): Use after free in Core in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-10914](https://cve.now/CVE-2026-10914.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-10913](https://cve.now/CVE-2026-10913.md): Use after free in ANGLE in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-10912](https://cve.now/CVE-2026-10912.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-10911](https://cve.now/CVE-2026-10911.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised th (CVSS 8.3, Google Chrome)
- [CVE-2026-10910](https://cve.now/CVE-2026-10910.md): Type Confusion in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-10909](https://cve.now/CVE-2026-10909.md): Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-10908](https://cve.now/CVE-2026-10908.md): Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer p (CVSS 8.3, Google Chrome)
- [CVE-2026-10907](https://cve.now/CVE-2026-10907.md): Out of bounds write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10906](https://cve.now/CVE-2026-10906.md): Use after free in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in spec (CVSS 7.5, Google Chrome)
- [CVE-2026-10905](https://cve.now/CVE-2026-10905.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to pote (CVSS 8.3, Google Chrome)
- [CVE-2026-10904](https://cve.now/CVE-2026-10904.md): Inappropriate implementation in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sand (CVSS 8.8, Google Chrome)
- [CVE-2026-10903](https://cve.now/CVE-2026-10903.md): Use after free in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-10902](https://cve.now/CVE-2026-10902.md): Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-10901](https://cve.now/CVE-2026-10901.md): Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in speci (CVSS 7.5, Google Chrome)
- [CVE-2026-10900](https://cve.now/CVE-2026-10900.md): Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in speci (CVSS 7.5, Google Chrome)
- [CVE-2026-10899](https://cve.now/CVE-2026-10899.md): Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specifi (CVSS 7.5, Google Chrome)
- [CVE-2026-10898](https://cve.now/CVE-2026-10898.md): Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-10897](https://cve.now/CVE-2026-10897.md): Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escap (CVSS 8.8, Google Chrome)
- [CVE-2026-10896](https://cve.now/CVE-2026-10896.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10895](https://cve.now/CVE-2026-10895.md): Use after free in Ozone in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-10894](https://cve.now/CVE-2026-10894.md): Use after free in Printing in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-10893](https://cve.now/CVE-2026-10893.md): Use after free in Chromoting in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via malicious netwo (CVSS 8.8, Google Chrome)
- [CVE-2026-10892](https://cve.now/CVE-2026-10892.md): Out of bounds write in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-10891](https://cve.now/CVE-2026-10891.md): Use after free in GFX in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-10890](https://cve.now/CVE-2026-10890.md): Use after free in Cast in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to potentially exploit heap (CVSS 8.8, Google Chrome)
- [CVE-2026-10889](https://cve.now/CVE-2026-10889.md): Out of bounds read in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-10888](https://cve.now/CVE-2026-10888.md): Use after free in Cast Streaming in Google Chrome prior to 149.0.7827.53 allowed an attacker on the local network segment to execute arbitra (CVSS 8.8, Google Chrome)
- [CVE-2026-10887](https://cve.now/CVE-2026-10887.md): Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via maliciou (CVSS 8.1, Google Chrome)
- [CVE-2026-10886](https://cve.now/CVE-2026-10886.md): Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-10885](https://cve.now/CVE-2026-10885.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-10884](https://cve.now/CVE-2026-10884.md): Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-10883](https://cve.now/CVE-2026-10883.md): Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-10882](https://cve.now/CVE-2026-10882.md): Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML pag (CVSS 8.8, Google Chrome)
- [CVE-2026-10881](https://cve.now/CVE-2026-10881.md): Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-10875](https://cve.now/CVE-2026-10875.md): projectworlds Online Art Gallery Shop Project adminHome.ph sql injection (CVSS 5.3, projectworlds Online Art Gallery Shop Project)
- [CVE-2026-10874](https://cve.now/CVE-2026-10874.md): projectworlds Online Art Gallery Shop Project adminHome.php sql injection (CVSS 5.3, projectworlds Online Art Gallery Shop Project)
- [CVE-2023-5502](https://cve.now/CVE-2023-5502.md): On affected platforms running Arista EOS with 802.1x authentication configured on the access/trunk ports, a malicious supplicant may bypass authentication. (CVSS 8.2, Arista Networks EOS)
- [CVE-2024-27892](https://cve.now/CVE-2024-27892.md): On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (SSL Profiles Enabled). (CVSS 7.2, Arista Networks EOS)
- [CVE-2026-20245](https://cve.now/CVE-2026-20245.md): Cisco Catalyst SD-WAN Controller Authenticated Privilege Escalation Vulnerability (CVSS 7.8, KEV, Cisco Catalyst SD-WAN Controller · Cisco Catalyst SD-WAN Ma…)
- [CVE-2026-10873](https://cve.now/CVE-2026-10873.md): Shibby Tomato Web UI rstats rstats\_path os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2024-27890](https://cve.now/CVE-2024-27890.md): On affected platforms running Arista EOS with OpenConfig configured, a gNMI Set request can be run when it should have been rejected (No SSL Profiles Enabled). (CVSS 7.2, Arista Networks EOS)
- [CVE-2026-10872](https://cve.now/CVE-2026-10872.md): Shibby Tomato Web UI rc start\_vpnserver os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2024-27891](https://cve.now/CVE-2024-27891.md): On affected platforms running Arista EOS with MACsec and egress ACLs configured on the same interfaces, the ACL policies may not be enforced for packets egressing on those ports. (CVSS 6.9, Arista Networks EOS)
- [CVE-2026-48579](https://cve.now/CVE-2026-48579.md): Microsoft Exchange Online Information Disclosure Vulnerability (CVSS 9.1, Microsoft Exchange Online)
- [CVE-2026-47655](https://cve.now/CVE-2026-47655.md): Microsoft Graph Information Disclosure Vulnerability (CVSS 6.5, Microsoft Graph)
- [CVE-2026-47644](https://cve.now/CVE-2026-47644.md): Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability (CVSS 6.5, Copilot Chat)
- [CVE-2026-45497](https://cve.now/CVE-2026-45497.md): Microsoft M365 Copilot Remote Code Execution Vulnerability (CVSS 7.7, Microsoft 365 Copilot)
- [CVE-2026-42824](https://cve.now/CVE-2026-42824.md): M365 Copilot Information Disclosure Vulnerability (CVSS 6.5, Microsoft 365 Copilot)
- [CVE-2026-48567](https://cve.now/CVE-2026-48567.md): Azure HorizonDB Elevation of Privilege Vulnerability (CVSS 10.0, Microsoft Azure HorizonDB)
- [CVE-2026-10871](https://cve.now/CVE-2026-10871.md): Shibby Tomato Web UI rc start\_6rd\_tunnel os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-11322](https://cve.now/CVE-2026-11322.md): Hermes WebUI before 0.51.221 Path Traversal via Symlink Workspace Bypass (CVSS 6.5, nesquena Hermes WebUI)
- [CVE-2024-6858](https://cve.now/CVE-2024-6858.md): In Arista’s EOS when in 802.1X mode, multi-auth unauthenticated hosts might be allowed access to a switch port if there exists an EAPOL capable device in the fallback VLAN. (CVSS 6.5, Arista Networks EOS)
- [CVE-2026-42547](https://cve.now/CVE-2026-42547.md): IRIS Alerts Can be Falsely Attributed to Customers (CVSS 5.4, dfir-iris iris-web)
- [CVE-2026-42543](https://cve.now/CVE-2026-42543.md): IRIS has a Cross-Site Request Forgery (CSRF) issue (CVSS 4.3, dfir-iris iris-web)
- [CVE-2026-42540](https://cve.now/CVE-2026-42540.md): IRIS has a Mass Assignment issue (CVSS 4.3, dfir-iris iris-web)
- [CVE-2026-42539](https://cve.now/CVE-2026-42539.md): IRIS has an Excessive Data Exposure issue (CVSS 6.5, dfir-iris iris-web)
- [CVE-2026-42538](https://cve.now/CVE-2026-42538.md): IRIS has an Insecure File Upload (CVSS 6.3, dfir-iris iris-web)
- [CVE-2026-42329](https://cve.now/CVE-2026-42329.md): Iris has an Open Redirect issue (CVSS 4.7, dfir-iris iris-web)
- [CVE-2026-5066](https://cve.now/CVE-2026-5066.md): net: sockets: tls: Potential out-of-bounds write/read in socket\_op\_vtable::connect function (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2026-10870](https://cve.now/CVE-2026-10870.md): Shibby Tomato Web UI rc start\_dhcpc os command injection (CVSS 8.6, Shibby Tomato)
- [CVE-2026-5589](https://cve.now/CVE-2026-5589.md): Out-of-bounds write caused by an integer underflow in the Bluetooth Mesh subsystem. (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2026-21404](https://cve.now/CVE-2026-21404.md): NAVTOR NavBox Use of Hard-coded Credentials (CVSS 5.8, NAVTOR NavBox)
- [CVE-2026-41522](https://cve.now/CVE-2026-41522.md): Iris has an Improper Authorization issue (CVSS 7.1, dfir-iris iris-web)
- [CVE-2026-41518](https://cve.now/CVE-2026-41518.md): Chartbrew has a stored DOM XSS via Chart Tooltip innerHTML (ChartDatasetConfig.legend) (CVSS 7.6, chartbrew)
- [CVE-2026-41249](https://cve.now/CVE-2026-41249.md): CoreShop Vulnerable to Remote Code Execution (RCE) via Insecure \`pull\_request\_target\` Configuration (CVSS 8.2, CoreShop · coreshop/core-shop)
- [CVE-2026-41237](https://cve.now/CVE-2026-41237.md): Froxlor has an incomplete fix for CVE-2026-30932 (CVSS 8.6, froxlor · froxlor/froxlor)
- [CVE-2026-41236](https://cve.now/CVE-2026-41236.md): Froxlor has privilege escalation in SSH key synchronization via symlinked \`authorized\_keys\` path (CVSS 8.8, froxlor · froxlor/froxlor)
- [CVE-2026-41235](https://cve.now/CVE-2026-41235.md): Froxlor has an authorization bypass in FTP shell assignment via missing server-side \`available\_shells\` enforcement (CVSS 8.6, froxlor · froxlor/froxlor)
- [CVE-2026-41234](https://cve.now/CVE-2026-41234.md): Froxlor: BIND Zone File Injection via TXT Record Content (CVSS 7.6, froxlor · froxlor/froxlor)
- [CVE-2026-40898](https://cve.now/CVE-2026-40898.md): quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion (CVSS 5.3, quic-go · github.com/quic-go/quic-go)
- [CVE-2026-48480](https://cve.now/CVE-2026-48480.md): netty-incubator-codec-ohttp OHttpVersionChunkDraft's Missing Final-Chunk Enforcement Leads to Undetected Stream Truncation (CVSS 6.6, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2025-71316](https://cve.now/CVE-2025-71316.md): SQLite sqldiff remote code execution via argument injection (CVSS 9.8, SQLite sqldiff)
- [CVE-2026-48040](https://cve.now/CVE-2026-48040.md): netty-incubator-codec-ohttp's Incorrect Native Pointer Derivation in Pooled Direct ByteBuf Fallback Leads to Out-of-Bounds Native Memory Access (CVSS 6.8, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2026-41207](https://cve.now/CVE-2026-41207.md): netty-incubator-codec-ohttp's HPKEContext operations may produce empty byte\[\] on failures (CVSS 6.9, netty-incubator-codec-ohttp · io.netty.incubator:netty-incu…)
- [CVE-2026-25551](https://cve.now/CVE-2026-25551.md): Seagull Software BarTender Deserialization Privilege Escalation via .NET Remoting Service (CVSS 8.5, Seagull Software, LLC. BarTender)
- [CVE-2026-10880](https://cve.now/CVE-2026-10880.md): Unauthenticated SQL Injection in Osnexus Quantastor (CVSS 9.8, Osnexus QuantaStor)
- [CVE-2026-25550](https://cve.now/CVE-2026-25550.md): Seagull Software BarTender Unauthenticated RCE via .NET Remoting Service (CVSS 9.3, Seagull Software, LLC. BarTender)
- [CVE-2026-10796](https://cve.now/CVE-2026-10796.md): nvm executes commands from a malicious Node.js mirror's version strings (CVSS 7.5, nvm-sh nvm)
- [CVE-2026-50292](https://cve.now/CVE-2026-50292.md): In libinput before 1.30.4 and 1.31.x before 1.31.3, libinput-device-group unescaped phys output can inject udev properties leading to arbitr (CVSS 7.4, freedesktop libinput)
- [CVE-2026-50266](https://cve.now/CVE-2026-50266.md): In OpenStack Neutron before 28.0.1, a project manager can create or update a port on a shared network owned by another project and set devic (CVSS 2.2, OpenStack Neutron · neutron)
- [CVE-2026-50076](https://cve.now/CVE-2026-50076.md): Apache Fory: Java ReplaceResolverSerializer deserialization checks bypass (CVSS 9.1, Apache Software Foundation Apache Fory · org.apache.fory:fo…)
- [CVE-2026-49942](https://cve.now/CVE-2026-49942.md): Net::CIDR::Set versions through 0.20 for Perl did not validate network masks (CVSS 7.3, RRWO Net::CIDR::Set)
- [CVE-2026-49941](https://cve.now/CVE-2026-49941.md): Net::CIDR::Set versions through 0.20 for Perl did not validate IP addresses (CVSS 7.5, RRWO Net::CIDR::Set)
- [CVE-2026-49940](https://cve.now/CVE-2026-49940.md): Net::CIDR::Set versions through 0.20 for Perl accept non-ASCII IP addresses and netmasks (CVSS 6.5, RRWO Net::CIDR::Set)
- [CVE-2026-46741](https://cve.now/CVE-2026-46741.md): Etsy::StatsD versions through 1.002002 for Perl allow metric injections (CVSS 7.5, SANBEG Etsy::StatsD)
- [CVE-2026-46739](https://cve.now/CVE-2026-46739.md): Net::Statsd versions before 0.13 for Perl allow metric injections (CVSS 5.3, COSIMO Net::Statsd)
- [CVE-2026-10815](https://cve.now/CVE-2026-10815.md): LakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization (CVSS 5.3, LakshayD02 Hostel-Management-System-PHP)
- [CVE-2026-10814](https://cve.now/CVE-2026-10814.md): milvus-io milvus Grantee ID Hash kv\_catalog.go weak hash (CVSS 2.0, milvus-io milvus · github.com/milvus-io/milvus)
- [CVE-2026-45287](https://cve.now/CVE-2026-45287.md): OpenTelemetry-Go's Schema ParseFile leaks file descriptors on each parse (CVSS 2.1, open-telemetry go.opentelemetry.io/otel/schema/v1.1 · op… +3)
- [CVE-2026-10813](https://cve.now/CVE-2026-10813.md): LMCache KV Cache utils.py hex\_hash\_to\_int16 weak hash (CVSS 2.0, LMCache)
- [CVE-2026-10868](https://cve.now/CVE-2026-10868.md): MISP user edit endpoint mass assignment vulnerability allows unauthorized user account modification (CVSS 9.0, misp)
- [CVE-2026-41178](https://cve.now/CVE-2026-41178.md): OpenTelemetry-Go's baggage parsing no longer caps raw header length (CVSS 5.3, open-telemetry go.opentelemetry.io/otel/baggage · open-t… +3)
- [CVE-2026-40930](https://cve.now/CVE-2026-40930.md): LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body (CVSS 5.4, pnggroup libpng · pnggroup libpng-apng)
- [CVE-2026-43986](https://cve.now/CVE-2026-43986.md): Tautulli vulnerable to unauthenticated SSRF in /image/\<hash\> via attacker-seeded image hash replay (CVSS 9.9, Tautulli)
- [CVE-2026-43985](https://cve.now/CVE-2026-43985.md): Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover (CVSS 8.8, Tautulli)
- [CVE-2026-43984](https://cve.now/CVE-2026-43984.md): Tautulli has stored XSS in logFile via guest-controlled log\_js\_errors input (CVSS 8.9, Tautulli)
- [CVE-2026-5228](https://cve.now/CVE-2026-5228.md): Improper Access Control in Kurt Software Studio's WriteUp Mobile App (CVSS 8.8, Kurt Software Studio WriteUp Mobile App)
- [CVE-2026-7774](https://cve.now/CVE-2026-7774.md): tarfile.data\_filter path traversal bypass allows writing outside the extraction directory (CVSS 6.9, Python Software Foundation CPython)
- [CVE-2026-41065](https://cve.now/CVE-2026-41065.md): Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory (CVSS 8.9, Tautulli)
- [CVE-2026-10812](https://cve.now/CVE-2026-10812.md): zilliztech GPTCache Cache Key pre.py BufferedReader.peek weak hash (CVSS 2.0, zilliztech GPTCache · gptcache)
- [CVE-2026-47707](https://cve.now/CVE-2026-47707.md): Strawberry GraphQL's Bypass of MaxAliasesLimiter via Fragment Spreads leading to GraphQL Alias Amplification (CVSS 5.3, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-45739](https://cve.now/CVE-2026-45739.md): Strawberry GraphQL: Default GraphiQL may expose HTTP headers in URLs (CVSS 3.1, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-47706](https://cve.now/CVE-2026-47706.md): Strawberry GraphQL has a Circular Fragment Reference DOS (CVSS 5.3, strawberry-graphql strawberry · strawberry-graphql)
- [CVE-2026-28318](https://cve.now/CVE-2026-28318.md): SolarWinds Serv-U Unauthenticated Denial of Service Vulnerability (CVSS 7.5, KEV, SolarWinds Serv-U)
- [CVE-2026-10811](https://cve.now/CVE-2026-10811.md): itsourcecode Fees Management System receipt.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-10864](https://cve.now/CVE-2026-10864.md): MISP Dashboard widget field selection may expose restricted user and organisation data (CVSS 5.3, misp)
- [CVE-2026-10863](https://cve.now/CVE-2026-10863.md): MISP User-controlled order parameter in correlations over-correlation endpoint (CVSS 6.4, misp)
- [CVE-2026-10860](https://cve.now/CVE-2026-10860.md): MISP CRUDComponent delete validation bypass via operator precedence error (CVSS 7.9, misp)
- [CVE-2026-10861](https://cve.now/CVE-2026-10861.md): MISP post-login open redirect via pre\_login\_requested\_url (CVSS 5.1, misp)
- [CVE-2019-25745](https://cve.now/CVE-2019-25745.md): WordPress Plugin Google Review Slider 6.1 SQL Injection via tid (CVSS 8.8, jgwhite33 Google Review Slider)
- [CVE-2019-25744](https://cve.now/CVE-2019-25744.md): WordPress Popup Builder 3.49 Persistent Cross-Site Scripting (CVSS 5.1, Popup-Builder Popup Builder)
- [CVE-2019-25743](https://cve.now/CVE-2019-25743.md): WordPress Soliloquy Lite 2.5.6 Persistent Cross-Site Scripting (CVSS 5.1, Soliloquywp Soliloquy Lite)
- [CVE-2019-25742](https://cve.now/CVE-2019-25742.md): WordPress Theme Zoner Real Estate 4.1.1 Persistent XSS (CVSS 5.1, Fruitfulcode Zoner Real Estate)
- [CVE-2019-25741](https://cve.now/CVE-2019-25741.md): Mobatek MobaXterm 12.1 Buffer Overflow via Sessions File (CVSS 9.3, Mobatek MobaXterm)
- [CVE-2019-25740](https://cve.now/CVE-2019-25740.md): Joomla com\_jsjobs 1.2.6 Arbitrary File Deletion (CVSS 7.1, Joomsky JS Jobs)
- [CVE-2019-25739](https://cve.now/CVE-2019-25739.md): GigToDo Freelance Marketplace Script 1.3 Persistent XSS (CVSS 5.1, Gigtodoscript GigToDo)
- [CVE-2019-25738](https://cve.now/CVE-2019-25738.md): WordPress Hybrid Composer 1.4.6 Unauthenticated Settings Change (CVSS 9.3, framework-y Hybrid Composer)
- [CVE-2019-25737](https://cve.now/CVE-2019-25737.md): Live Chat Unlimited 2.8.3 Stored Cross-Site Scripting (CVSS 5.3, Screets Live Chat Unlimited)
- [CVE-2019-25736](https://cve.now/CVE-2019-25736.md): LabF nfsAxe 3.7 Ping Client Buffer Overflow (CVSS 8.6, LabF nfsAxe)
- [CVE-2019-25735](https://cve.now/CVE-2019-25735.md): AllPlayer 7.4 Local Buffer Overflow via SEH Unicode (CVSS 8.6, AllPlayer)
- [CVE-2019-25734](https://cve.now/CVE-2019-25734.md): Contact Form by WD 1.13.1 CSRF to Local File Inclusion (CVSS 5.1, Web-Dorado Contact Form Maker)
- [CVE-2019-25733](https://cve.now/CVE-2019-25733.md): NetShareWatcher 1.5.8.0 SEH Buffer Overflow (CVSS 8.6, nsauditor NetShareWatcher)
- [CVE-2019-25732](https://cve.now/CVE-2019-25732.md): PHP EI-Tube Script 3 SQL Injection via search parameter (CVSS 8.8, eitube EI-Tube)
- [CVE-2019-25731](https://cve.now/CVE-2019-25731.md): Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact (CVSS 5.3, Zuz Music)
- [CVE-2019-25730](https://cve.now/CVE-2019-25730.md): Listing Hub CMS 1.0 SQL Injection via pages.php id (CVSS 8.8, Themerig Listing Hub CMS)
- [CVE-2019-25729](https://cve.now/CVE-2019-25729.md): PDF Signer 3.0 Server-Side Template Injection RCE via CSRF Cookie (CVSS 9.3, simcy\_creative PDF Signer)
- [CVE-2019-25728](https://cve.now/CVE-2019-25728.md): Care2x 2.7 Hospital Information System SQL Injection via ck\_config (CVSS 8.8, Care2x)
- [CVE-2019-25727](https://cve.now/CVE-2019-25727.md): WordPress Plugin ad manager wd 1.0.11 Arbitrary File Download (CVSS 9.3, ad-manager-wd Ad Manager WD)
- [CVE-2019-25726](https://cve.now/CVE-2019-25726.md): All in One Video Downloader 1.2 SQL Injection via admin page-edit (CVSS 8.8, Nicheoffice All in One Video Downloader)
- [CVE-2026-10856](https://cve.now/CVE-2026-10856.md): Open redirect in MISP dashboard button widget URL handling (CVSS 5.1, misp)
- [CVE-2026-10810](https://cve.now/CVE-2026-10810.md): itsourcecode Fees Management System navbar.php cross site scripting (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2026-8037](https://cve.now/CVE-2026-8037.md): OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF (CVSS 9.6, KEV, Progress Software LoadMaster · Progress Software ECS Con… +2)
- [CVE-2026-10855](https://cve.now/CVE-2026-10855.md): MISP Event template importer authorization bypass (CVSS 5.1, misp)
- [CVE-2026-10809](https://cve.now/CVE-2026-10809.md): itsourcecode Fees Management System manage\_user.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2025-46638](https://cve.now/CVE-2025-46638.md): Dell BSAFE SSL-J contains an allocation of resources without limits or throttling vulnerability. (CVSS 7.5, Dell BSAFE SSL-J)
- [CVE-2026-10854](https://cve.now/CVE-2026-10854.md): Unauthorized exposure of private galaxies in MISP event template creation (CVSS 5.3, misp)
- [CVE-2026-40605](https://cve.now/CVE-2026-40605.md): Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API (CVSS 5.7, Tautulli)
- [CVE-2026-43926](https://cve.now/CVE-2026-43926.md): FOSSBilling's password reset confirmation endpoint lacks rate limiting (CVSS 6.3, FOSSBilling)
- [CVE-2026-10808](https://cve.now/CVE-2026-10808.md): itsourcecode Fees Management System manage\_student.php sql injection (CVSS 5.3, itsourcecode Fees Management System)
- [CVE-2025-62338](https://cve.now/CVE-2025-62338.md): HCL BigFix Cloud Lifecycle Management is affected by lack of input validation (CVSS 3.3, HCLSoftware BigFix Cloud Lifecycle Management)
- [CVE-2026-10807](https://cve.now/CVE-2026-10807.md): mjperpinosa stumasy change\_profile\_image.php unrestricted upload (CVSS 5.3, mjperpinosa stumasy)
- [CVE-2026-10806](https://cve.now/CVE-2026-10806.md): mjperpinosa stumasy add\_post.php unrestricted upload (CVSS 5.3, mjperpinosa stumasy)
- [CVE-2025-59874](https://cve.now/CVE-2025-59874.md): HCL Hive Telco Observability is affected by a Required directives missing from the CSP . (CVSS 8.1, HCL Hive)
- [CVE-2026-45433](https://cve.now/CVE-2026-45433.md): Hardcoded Cryptographic Key Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-45432](https://cve.now/CVE-2026-45432.md): Cleartext Transmission of Credentials Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-10843](https://cve.now/CVE-2026-10843.md): Cloud-credential-operator: cco mint-mode credentialsrequest manifests grant account-wide iam access beyond cluster scope on aws (CVSS 7.2, Red Hat OpenShift Container Platform)
- [CVE-2026-10840](https://cve.now/CVE-2026-10840.md): Openshift-pipelines-operator-rh: openshift-pipelines-operator: tekton-scheduler-rolebinding grants system:authenticated write access to kueue and cert-manager resources (CVSS 7.1, Red Hat OpenShift Builds · Red Hat OpenShift Pipelines)
- [CVE-2025-12694](https://cve.now/CVE-2025-12694.md): Local Privilege Escalation in VPN Client (CVSS 8.5, Forcepoint VPN Client)
- [CVE-2026-45431](https://cve.now/CVE-2026-45431.md): Command Injection Vulnerability in GX Earth ONT Models (CVSS 8.7, GX INDIA GX Earth)
- [CVE-2026-10804](https://cve.now/CVE-2026-10804.md): Streamlit Palette hashing.py weak hash (CVSS 2.0, Streamlit)
- [CVE-2025-52606](https://cve.now/CVE-2025-52606.md): HCL iControl was affected by Weak Input Validation vulnerability. . (CVSS 4.3, HCL iControl)
- [CVE-2025-52608](https://cve.now/CVE-2025-52608.md): HCL iControl was affected by Missing Cookie Attributes vulnerability. (CVSS 3.1, HCL iControl)
- [CVE-2026-10803](https://cve.now/CVE-2026-10803.md): MLflow Dataset Digest Computation digest\_utils.py mlflow.data.digest\_utils weak hash (CVSS 2.0, MLflow)
- [CVE-2025-52609](https://cve.now/CVE-2025-52609.md): HCL iControl was affected by Missing Security Headers vulnerability. (CVSS 3.7, HCL iControl)
- [CVE-2025-52611](https://cve.now/CVE-2025-52611.md): HCL iControl was affected by Unhandled Exception - Stack Trace Disclosure vulnerability (CVSS 3.1, HCL iControl)
- [CVE-2025-52612](https://cve.now/CVE-2025-52612.md): HCL iControl was affected by Export CSV - CSV Injection vulnerability. (CVSS 7.1, HCL iControl)
- [CVE-2026-10802](https://cve.now/CVE-2026-10802.md): keystonejs keystone GraphQL API Endpoint output-field.ts resource consumption (CVSS 5.3, keystonejs keystone · @keystone-6/core)
- [CVE-2026-4104](https://cve.now/CVE-2026-4104.md): SQLi in Akmer Informatics' TeknoPass (CVSS 9.8, Akmer Informatics Automation Industry and Trade Ltd. TeknoP…)
- [CVE-2026-10801](https://cve.now/CVE-2026-10801.md): modelscope ms-swift PIL Image Cache Key base.py Template.\_save\_pil\_image weak hash (CVSS 2.0, modelscope ms-swift · ms-swift)
- [CVE-2026-49077](https://cve.now/CVE-2026-49077.md): WordPress WP eMember plugin \<= v10.2.2 - Sensitive Data Exposure vulnerability (CVSS 5.3, Tips and Tricks HQ WP eMember)
- [CVE-2026-49771](https://cve.now/CVE-2026-49771.md): WordPress Photo Gallery by 10Web plugin \<= 1.8.41 - SQL Injection vulnerability (CVSS 7.6, Photo Gallery by 10Web)
- [CVE-2026-10800](https://cve.now/CVE-2026-10800.md): PaddlePaddle FastDeploy MultimodalHasher hasher.py hash\_features weak hash (CVSS 2.0, PaddlePaddle FastDeploy)
- [CVE-2026-8916](https://cve.now/CVE-2026-8916.md): Out-of-bounds write vulnerability in Samsung Open Source rlottie allows Overflow Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47318](https://cve.now/CVE-2026-47318.md): Stack-based buffer overflow vulnerability in Samsung Open Source rlottie allows Overflow Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47306](https://cve.now/CVE-2026-47306.md): Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Oversized Serialized Data Payloads. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-49510](https://cve.now/CVE-2026-49510.md): Integer overflow or wraparound vulnerability in Samsung Open Source rlottie allows Integer Attacks. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-10305](https://cve.now/CVE-2026-10305.md): Out-of-bounds read vulnerability in Samsung Open Source rlottie allows Overread Buffers. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47319](https://cve.now/CVE-2026-47319.md): Memory allocation with excessive size value vulnerability in Samsung Open Source rlottie allows Excessive Allocation. (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-47320](https://cve.now/CVE-2026-47320.md): Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversized (CVSS 6.1, Samsung Open Source rlottie)
- [CVE-2026-50226](https://cve.now/CVE-2026-50226.md): Firmware Theft & IMEI Spoofing via Connect-OTA (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50225](https://cve.now/CVE-2026-50225.md): Account Creation Exhaustion (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50224](https://cve.now/CVE-2026-50224.md): Unauthenticated IPv6 WAN Management Exposure (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50214](https://cve.now/CVE-2026-50214.md): Shared Secret Quota Inflation (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-4881](https://cve.now/CVE-2026-4881.md): In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server (CVSS 6.0, Octopus Deploy Octopus Server)
- [CVE-2026-3820](https://cve.now/CVE-2026-3820.md): Supermicro BMC's SMTP service contains a command injection vulnerability (CVSS 7.2, SMCI AS-2115HS-TNR)
- [CVE-2026-50213](https://cve.now/CVE-2026-50213.md): Bulk User Private Data Harvesting (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50212](https://cve.now/CVE-2026-50212.md): Arbitrary Remote Device Unbinding (CVSS 7.1, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50211](https://cve.now/CVE-2026-50211.md): Exposed Factory Testing App Boundaries (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50210](https://cve.now/CVE-2026-50210.md): Weak Static Cryptographic Initialization Vectors (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50209](https://cve.now/CVE-2026-50209.md): MDM Server Registration Overriding (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50208](https://cve.now/CVE-2026-50208.md): Permissive TrustAllCerts TLS Verification (CVSS 9.2, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50207](https://cve.now/CVE-2026-50207.md): Local Modem Manipulation via Binder Interfaces (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50206](https://cve.now/CVE-2026-50206.md): VPN Command Injection Vulnerability (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-50205](https://cve.now/CVE-2026-50205.md): Plaintext Log Credential Leakage (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49204](https://cve.now/CVE-2026-49204.md): Hard-coded AWS Cognito Testing Accounts (CVSS 6.9, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49202](https://cve.now/CVE-2026-49202.md): Unverified Meeting Recording Endpoints & Permissive CORS (CVSS 8.8, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49203](https://cve.now/CVE-2026-49203.md): Unauthenticated eSIM Configuration Manipulation (CVSS 7.2, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49194](https://cve.now/CVE-2026-49194.md): SCREEN\_CLICK Authentication Bypass (CVSS 9.4, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49193](https://cve.now/CVE-2026-49193.md): Publicly Readable AWS S3 Telemetry Buckets (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49192](https://cve.now/CVE-2026-49192.md): Summary Service Insecure Direct Object Reference (CVSS 5.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49191](https://cve.now/CVE-2026-49191.md): Exposed Hard-coded M3WebServer Backend API Key (CVSS 9.3, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49190](https://cve.now/CVE-2026-49190.md): Missing Per-Instruction Authorization Checks (CVSS 9.4, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49189](https://cve.now/CVE-2026-49189.md): Broadcast Receiver Privilege Escalation (CVSS 8.5, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-10805](https://cve.now/CVE-2026-10805.md): Networkmanager: networkmanager: local privilege escalation via malformed mud urls in dhclient backend (CVSS 6.7, Red Hat Enterprise Linux · Red Hat Multicluster Engine f… +3)
- [CVE-2026-50219](https://cve.now/CVE-2026-50219.md): libexpat before 2.8.2 lacks handler call depth tracking for calls to XML\_GetBuffer, XML\_Parse, XML\_ParseBuffer, XML\_ParserFree, or XML\_Parse (CVSS 4.9, libexpat project libexpat)
- [CVE-2026-49188](https://cve.now/CVE-2026-49188.md): Elevated Root Command Execution via ai\_cmd Sockets (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49187](https://cve.now/CVE-2026-49187.md): Hard-coded APK Resource Credentials & Scepters (CVSS 8.7, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49186](https://cve.now/CVE-2026-49186.md): Lack of MQTT Broker Topic Access Control Lists (CVSS 8.6, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-49185](https://cve.now/CVE-2026-49185.md): Instruction Injection via FieldX MDM (CVSS 10.0, Acer Connect M6E 5G Portable WiFi Router)
- [CVE-2026-41010](https://cve.now/CVE-2026-41010.md): ReleaseJob#unpack builds job\_dir = File.join(@release\_dir, 'jobs', name) and job\_tgz = File.join(@release\_dir, 'jobs', "#{name}.tgz") where (CVSS 8.7, Cloud Foundry Foundation BOSH Director)
- [CVE-2026-41011](https://cve.now/CVE-2026-41011.md): PackagePersister.validate\_tgz builds "tar -tf #{tgz} 2\>&1" where tgz = File.join(release\_dir, 'packages', "#{name}.tgz") and name = package\_ (CVSS 8.7, Cloud Foundry Foundation BOSH)
- [CVE-2026-10597](https://cve.now/CVE-2026-10597.md): ITPison｜OMICARD EDM - Insecure Direct Object Reference (CVSS 6.9, ITPison OMICARD EDM)
- [CVE-2026-41858](https://cve.now/CVE-2026-41858.md): Weak Randomness / Insecure Cryptographic Primitive (CWE-338) in Get-RandomPassword in BOSH-Ecosystem / windows-utilities-release allows a ne (CVSS 6.5, Cloud Foundry Foundation windows-utilities-release)
- [CVE-2026-8829](https://cve.now/CVE-2026-8829.md): HTML::Entities versions before 3.84 for Perl read freed heap memory in \_decode\_entities (CVSS 7.5, OALDERS HTML::Entities)
- [CVE-2026-41859](https://cve.now/CVE-2026-41859.md): A network man-in-the-middle between nats-sync and the BOSH director can steal the director credentials (Basic auth header or UAA client secr (CVSS 7.1, Cloud Foundry Foundation BOSH)
- [CVE-2026-41860](https://cve.now/CVE-2026-41860.md): CWE-326 in BOSH allows a local attacker to steal Basic-auth credentials or redirect UAA token requests via MITM. (CVSS 7.1, Cloud Foundry Foundation BOSH)
- [CVE-2026-8653](https://cve.now/CVE-2026-8653.md): MasterStudy LMS Pro Plus \<= 4.8.20 - Authenticated (Instructor+) SQL Injection via 'columns' Parameter (CVSS 6.5, StylemixThemes MasterStudy LMS Pro)
- [CVE-2026-10737](https://cve.now/CVE-2026-10737.md): SP Project & Document Manager \<= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view\_file() Function (CVSS 7.5, smartypants SP Project & Document Manager)
- [CVE-2026-7764](https://cve.now/CVE-2026-7764.md): Out-of-bounds read in morse.ko Vendor IE processing (CVSS 6.8, Morse Micro HaLowLink)
- [CVE-2025-65640](https://cve.now/CVE-2025-65640.md): Cross Site Scripting (XSS) vulnerability in the "Task in Progress / Recent" page in Arket Globe Document Intelligence 5.0.0.559 due to impro (CVSS 6.3)
- [CVE-2025-67446](https://cve.now/CVE-2025-67446.md): Improper Authentication (Authentication Bypass) exists in Neterbit NW-431F Router 20241014-IR03 and before. (CVSS 9.8)
- [CVE-2025-67447](https://cve.now/CVE-2025-67447.md): The network diagnosis (ping) module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to OS command injection. (CVSS 9.8)
- [CVE-2025-67448](https://cve.now/CVE-2025-67448.md): The SMS module in Neterbit NW-431F Router 20241014-IR03 and before is vulnerable to stored XSS. (CVSS 7.1)
- [CVE-2025-69755](https://cve.now/CVE-2025-69755.md): An issue in Neterbit NW-431F Router vNW-431F-20241014-IR03 allows a remote attacker to obtain sensitive information and execute arbitrary co (CVSS 8.2)
- [CVE-2026-35904](https://cve.now/CVE-2026-35904.md): Incorrect access control in the web management interface of T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 allo (CVSS 9.8)
- [CVE-2026-35905](https://cve.now/CVE-2026-35905.md): T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03, and T7281 v1.0.03 were discovered to contain a hardcoded password for root access (CVSS 9.8)
- [CVE-2026-35906](https://cve.now/CVE-2026-35906.md): An undocumented debug CGI endpoint in T3 Technology CPE models T625Pro v1.0.07, T6825G v1.0.03 allows unauthenticated attackers to execute a (CVSS 9.6)
- [CVE-2026-36174](https://cve.now/CVE-2026-36174.md): GNCC GP5 v7.1.76 was discovered to store sensitive wireless network information in plaintext during routine operations to the serial console (CVSS 4.6)
- [CVE-2026-36175](https://cve.now/CVE-2026-36175.md): An issue in the U-Boot component of GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass authentication and gain root access via (CVSS 6.8)
- [CVE-2026-36176](https://cve.now/CVE-2026-36176.md): GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console. (CVSS 7.1)
- [CVE-2026-36178](https://cve.now/CVE-2026-36178.md): The factory reset functionality in GNCC GP5 v7.1.76 fails to clear sensitive cryptographic material in the JFFS2 configuration partition, po (CVSS 4.6)
- [CVE-2026-36180](https://cve.now/CVE-2026-36180.md): A lack of runtime integrity in GNCC GP5 v7.1.76 allows physically-proximate attackers to bypass file system read-only protections and modify (CVSS 4.6)
- [CVE-2026-36182](https://cve.now/CVE-2026-36182.md): GNCC GP5 v7.1.76 was discovered to utilize a weak hashing algorithm to protect the root password, possibly allowing attackers to obtain root (CVSS 9.8)
- [CVE-2026-36499](https://cve.now/CVE-2026-36499.md): A missing upper-bound check in the udpif\_set\_threads() function of Open vSwitch v3.6.90 allows an attacker with OVSDB write access to reques (CVSS 6.5)
- [CVE-2026-38570](https://cve.now/CVE-2026-38570.md): bacnet\_stack 1.3.1 contains an Out-of-bounds Read in bacnet\_tag\_number\_decode which allows attackers to cause a denial of service. (CVSS 7.5)
- [CVE-2026-41283](https://cve.now/CVE-2026-41283.md): OpenStack Mistral through 22.0.0 allows Arbitrary Remote Code Execution when the API is exposed. (CVSS 9.9, OpenStack Mistral · mistral)
- [CVE-2026-44393](https://cve.now/CVE-2026-44393.md): An issue was discovered in OpenStack oslo.messaging 1.0.0 through 17.3.0. (CVSS 7.4, oslo-messaging)
- [CVE-2026-44917](https://cve.now/CVE-2026-44917.md): OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a p (CVSS 4.9, OpenStack Ironic)
- [CVE-2026-48681](https://cve.now/CVE-2026-48681.md): OpenStack Ironic through before 35.0.2 allows file overwrite via directory traversal during deployment with a crafted ISO image. (CVSS 5.9, OpenStack Ironic · ironic)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.