CVEs published June 8, 2026
286 CVEs were published on June 8, 2026: 22 critical, 129 high. 2 are now in CISA KEV.
- Published
- 286
- Critical
- 22
- High
- 129
- Medium
- 94
- Low
- 13
- Unrated
- 28
- Now in CISA KEV
- 2
- Fix available
- 147
Most affected products
- Google Chrome
- 74
- Linux
- 41
- FlowiseAI Flowise · flowise
- 14
- Apache Software Foundation Apache HTTP Server
- 13
- SourceCodester Class and Exam Timetabling System
- 7
- Checkmk
- 5
- CodeAstro Leave Management System
- 5
- imvks786 student_management_system
- 5
- openbullet2
- 5
- CodeAstro Student Attendance Management System
- 4
Critical 22
- CVE-2026-11697Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform aGoogle Chrome
- CVE-2026-11671Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via Google Chrome
- CVE-2026-11659Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape vGoogle Chrome
- CVE-2026-11654Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox eGoogle Chrome
- CVE-2026-11651Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-11638Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a Google Chrome
- CVE-2026-11634Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-11393Code injection via improper triple-quote escaping in AgentCore CLI Bedrock Agent importAWS AgentCore CLI · @aws/agentcore
- CVE-2026-52778YesWiki has Unsafe eval() in Formula Calculator - Remote Code Execution (RCE) & Denial of Service (DoS)yeswiki · yeswiki/yeswiki
- CVE-2026-25555OpenBullet2 0.3.2 Authentication Bypass via X-Api-Key Headeropenbullet2
- CVE-2026-41448AdGuard Home Authentication Bypass via Path Traversal in Admin-Token CookieAdguardTeam AdGuardHome
- CVE-2026-46289lib/scatterlist: fix length calculations in extract_kvec_to_sgLinux
- CVE-2026-46442Flowise: Authenticated Host RCE via POST /api/v1/node-custom-function and NodeVM Sandbox EscapeFlowiseAI Flowise · flowise
- CVE-2026-44631Apache HTTP Server: Heap Underflow in `ap_regname` via Signed Char OverflowApache Software Foundation Apache HTTP Server
- CVE-2026-42535Apache HTTP Server: mod_dav_fs protected directory accessApache Software Foundation Apache HTTP Server
- CVE-2026-29167Apache HTTP Server: mod_ldap per-dir use-after-freeApache Software Foundation Apache HTTP Server
- CVE-2026-50751User Authentication Bypass in VPN Remote Access and Mobile Accesscheckpoint Quantum Security Gateway · checkpoint Spark Fire…
- CVE-2026-47430Cordova Plugin InAppBrowser: iOS: Arbitrary Cordova callback IDs can be dispatched without validation from InAppBrowser WebViewsApache Software Foundation Cordova Plugin InAppBrowser · co…
- CVE-2026-11499Tenda HG7/HG9/HG10 formDOMAINBLK stack-based overflowTenda HG7 · Tenda HG9 +1
- CVE-2024-58349WordPress Theme Travelscape 1.0.3 Arbitrary File UploadWP Travel Kit Travelscape
- CVE-2024-58348WordPress Background Image Cropper 1.2 Remote Code Executionbackground-image-cropper Background Image Cropper
- CVE-2023-54352WordPress Seotheme Remote Code Execution UnauthenticatedWP Travel Kit Travelscape
High 129
- CVE-2026-11700Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-11699Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2026-11698Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2026-11694Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-11693Inappropriate implementation in Plugins in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-11692Use after free in Read Anything in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-11690Out of bounds read and write in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-11689Insufficient policy enforcement in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-11688Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a saGoogle Chrome
- CVE-2026-11687Use after free in Dawn in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-11683Use after free in WebCodecs in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-11682Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the reGoogle Chrome
- CVE-2026-11681Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2026-11680Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2026-11679Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-11677Race in Network in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the network process to potentiGoogle Chrome
- CVE-2026-11676Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker Google Chrome
- CVE-2026-11674Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox vGoogle Chrome
- CVE-2026-11673Use after free in InterestGroups in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbGoogle Chrome
- CVE-2026-11672Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-11670Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-11667Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to potenGoogle Chrome
- CVE-2026-11664Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2026-11663Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-11662Type Confusion in Bindings in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox viaGoogle Chrome
- CVE-2026-11661Use after free in Views in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-11660Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-11657Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a craftedGoogle Chrome
- CVE-2026-11656Use after free in ServiceWorker in Google Chrome prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extGoogle Chrome
- CVE-2026-11655Integer overflow in Media in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-11652Use after free in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-11650Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-11649Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-11648Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruGoogle Chrome
- CVE-2026-11647Use after free in Printing in Google Chrome on Android prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-11646Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandGoogle Chrome
- CVE-2026-11645Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sanGoogle Chrome
- CVE-2026-11644Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious exGoogle Chrome
- CVE-2026-11643Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network tGoogle Chrome
- CVE-2026-11642Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-11641Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2026-11640Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-11639Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafGoogle Chrome
- CVE-2026-11637Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTGoogle Chrome
- CVE-2026-11636Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in sGoogle Chrome
- CVE-2026-11635Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-11633Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a maliciGoogle Chrome
- CVE-2026-11632Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2026-11631Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-11630Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2026-11629Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2026-9669bz2.BZ2Decompressor reuse after error can cause a stack buffer overflowPython Software Foundation CPython
- CVE-2026-44541Fides: DOM-based XSS vulnerability in fides.js via fides_description overrideethyca fides · ethyca-fides
- CVE-2026-40519Nginx Proxy Manager Authenticated RCE via setupCertbotPlugins()NginxProxyManager nginx-proxy-manager
- CVE-2026-46484Headplane: Path Traversal + RBAC Bypass in renameNode allows authenticated OIDC users to expire or rename any node/usertale headplane
- CVE-2026-46490samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertionstngan samlify · samlify
- CVE-2026-11557Tenda F451 Web Management Natlimit fromNatlimit stack-based overflowTenda F451
- CVE-2026-11556Tenda F451 Web Management WriteFacMac formWriteFacMac os command injectionTenda F451
- CVE-2026-8913Command Injection in TP-Link's Archer MR600 WireGuard Client ConfigurationTP-Link Systems Archer MR600
- CVE-2026-11553Tenda HG7/HG9/HG10 formPPPEdit stack-based overflowTenda HG7 · Tenda HG9 +1
- CVE-2026-25559OpenBullet2 0.3.2 Path Traversal via Wordlist Endpointopenbullet2
- CVE-2026-46481OpenMetadata: TEST_CONNECTION workflow leaks ingestion-bot JWT and database password to regular usersopen-metadata OpenMetadata · org.open-metadata:openmetadata…
- CVE-2026-25856OpenBullet2 0.3.2 Authenticated RCE via Job Configuration Interfaceopenbullet2
- CVE-2026-25855OpenBullet2 0.3.2 Authenticated RCE via FileProxySource Script Uploadopenbullet2
- CVE-2026-39908OpenBullet2 0.3.2 NTLMv2 Hash Disclosure via UNC Path Proxy Sourceopenbullet2
- CVE-2026-39910STACKIT IaaS API Privilege Escalation via Service Account AttachmentSTACKIT IaaS API
- CVE-2026-46311drm/amdgpu/userq: fix access to stale wptr mappingLinux
- CVE-2026-46309drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madviseLinux
- CVE-2026-46307wifi: ath5k: do not access array OOBLinux
- CVE-2026-46306flow_dissector: do not dissect PPPoE PFC framesLinux
- CVE-2026-46304nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_freeLinux
- CVE-2026-46303isofs: validate Rock Ridge CE continuation extent against volume sizeLinux
- CVE-2026-46299hfsplus: fix held lock freed on hfsplus_fill_super()Linux
- CVE-2026-46288of: unittest: fix use-after-free in of_unittest_changeset()Linux
- CVE-2026-46280lib: test_hmm: evict device pages on file close to avoid use-after-freeLinux
- CVE-2026-46277mm/zone_device: do not touch device folio after calling ->folio_free()Linux
- CVE-2026-48507Snipe-IT: Bulk editing users allowed `ldap_import` and `activated_in` bulk editing usersgrokability snipe-it · snipe/snipe-it
- CVE-2026-46480Flowise: Evaluator create+update mass-assignment allows cross-workspace evaluator takeoverFlowiseAI Flowise · flowise
- CVE-2026-46479Flowise: Evaluation create+update mass-assignment allows cross-workspace evaluation takeoverFlowiseAI Flowise · flowise
- CVE-2026-46478Flowise: DatasetRow create+update mass-assignment allows cross-workspace row takeoverFlowiseAI Flowise · flowise
- CVE-2026-46477Flowise: Dataset create+update mass-assignment allows cross-workspace dataset takeoverFlowiseAI Flowise · flowise
- CVE-2026-46476Flowise: CustomTemplate create+update mass-assignment allows cross-workspace template takeoverFlowiseAI Flowise · flowise
- CVE-2026-46475Flowise: Assistant create+update mass-assignment allows cross-workspace assistant takeoverFlowiseAI Flowise · flowise
- CVE-2026-46443Flowise: Credential Data LeakFlowiseAI Flowise · flowise
- CVE-2026-46441Flowise: Mass Assignment in Assistant Update Endpoint Allows Cross-Workspace Resource ReassignmentFlowiseAI Flowise · flowise
- CVE-2026-46440Flowise: Basic Auth Credentials Exposed via APIFlowiseAI Flowise · flowise
- CVE-2026-42863Flowise: Mass Assignment in Chatflow Update Endpoint Allows Cross-Workspace AgentFlow ReassignmentFlowiseAI Flowise · flowise
- CVE-2026-49975Apache HTTP Server: mod_http2 denial of serviceApache Software Foundation Apache HTTP Server
- CVE-2026-42862Flowise: Mass Assignment in Tool Update Endpoint Allows Cross-Workspace Resource ReassignmentFlowiseAI Flowise · flowise
- CVE-2026-42861Flowise: Mass Assignment in Variable Update Endpoint Allows Cross-Workspace Resource ReassignmentFlowiseAI Flowise · flowise
- CVE-2026-46444Flowise: Vector Store No Permission ChecksFlowiseAI Flowise · flowise
- CVE-2026-48913Apache HTTP Server: mod_http2 memory corruption when file handles exhaustedApache Software Foundation Apache HTTP Server
- CVE-2026-42536Apache HTTP Server: mod_xml2enc heap overflowApache Software Foundation Apache HTTP Server
- CVE-2026-44185Apache HTTP Server: Stack Buffer Over-Read in mod_ssl OCSP `send_request`Apache Software Foundation Apache HTTP Server
- CVE-2026-49755Decompression bomb DoS in Req via auto-decoded archive and compressed response bodieswojtekmach req
- CVE-2026-34355Apache HTTP Server: mod_proxy_html buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2026-11528Tenda AC18 Web Management getRebootStatus sub_45304 stack-based overflowTenda AC18
- CVE-2026-34356Apache HTTP Server: ProxyPassReverseCookieMap buffer overflowApache Software Foundation Apache HTTP Server
- CVE-2026-44186Apache HTTP Server: Loop in `proxy_ftp_handler` in mod_proxy_ftpApache Software Foundation Apache HTTP Server
- CVE-2026-46657Bludit's persistent authentication tokens not revoked upon account disablementbludit
- CVE-2026-11524Tenda W20E Web Management modifyWifiFilterRules stack-based overflowTenda W20E
- CVE-2026-34194GPU DDK - UAF read and/or write to arbitrary physical pages in DevmemIntChangeSparse due to incorrect calculation of the virtual index countImagination Technologies Graphics DDK
- CVE-2026-22164GPU DDK - Kernel heap OOB write in DevmemIntComputeVirtualIndicesFromLogicalImagination Technologies Graphics DDK
- CVE-2026-46656Bludit CMS has improper authorization and mediation failure leading to persistent ghost sessionsbludit
- CVE-2026-11523Tenda W20E Web Management PortalAuth formPortalAuth stack-based overflowTenda W20E
- CVE-2026-46275Bluetooth: hci_uart: fix UAFs and race conditions in close and init pathsLinux
- CVE-2026-46274io-wq: check that the predecessor is hashed in io_wq_remove_pending()Linux
- CVE-2026-11522Tenda W20E setPortMirror formSetPortMirror stack-based overflowTenda W20E
- CVE-2026-43973gun HTTP/1.1 response buffer has no size limit allowing server-controlled memory exhaustionninenines gun
- CVE-2026-43974gun HTTP/1.1 client accepts unsolicited 101 Switching Protocols response allowing server-driven protocol hijack and OOMninenines gun
- CVE-2026-11517UTT HiPER 2610G formConfigDnsFilterGlobal strcpy buffer overflowUTT HiPER
- CVE-2026-49235Routinator crashes on specifically crafted RRDP XML filesNLnet Labs Routinator · routinator
- CVE-2026-49234Routinator crashes on specifically crafted ASN strings in the APINLnet Labs Routinator · routinator
- CVE-2026-49233Routinator cache path traversal using rogue rsync URIsNLnet Labs Routinator · routinator
- CVE-2026-49232Routinator exits when accepting an incoming HTTP or RTR connection failsNLnet Labs Routinator
- CVE-2026-8833XSS in urlsCheckmk
- CVE-2026-7186Fix stored XSS in URL dashboard widget via dangerous URI schemesCheckmk
- CVE-2026-50752Certificate Validation Bypass in VPN Site-to-Site Connections Using IKEv1checkpoint Quantum Security Gateway · checkpoint Spark Fire…
- CVE-2026-11504Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflowTenda CX12L
- CVE-2026-11503Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflowTenda CX12L
- CVE-2026-9506Path Traversal Vulnerability in BagistoWebkul Bagisto
- CVE-2026-3238Samba: denial of service against ad dc wins serverRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-41724VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)VMware VCF operations · VMware Aria Operations +1
- CVE-2026-41723VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)VMware VCF operations · VMware Aria Operations +1
- CVE-2026-41722VMSA-2026-0004: VMware Cloud Foundation Operations updates address multiple vulnerabilities (CVE-2026-41722, CVE-2026-41723 and CVE-2026-41724)VMware VCF operations · VMware Aria Operations +1
- CVE-2026-11498Tenda HG7/HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflowTenda HG7 · Tenda HG9 +1
- CVE-2023-54350WordPress Augmented-Reality Plugin Remote Code Execution Unauthenticatedwebandprint Augmented Reality
- CVE-2026-36786Shenzhen Tenda Technology Co., Ltd Tenda FH451 V1.0.0.9 was discovered to contain a stack overflow in the list1 parameter of the fromDhcpLis
- CVE-2026-36789Shenzhen Tenda Technology Co., Ltd Tenda AC1206 v15.03.06.23 was discovered to contain multiple stack overflows in the fromGstDhcpSetSer fun
Medium, low and unrated 135
- CVE-2026-11701Inappropriate implementation in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2026-11696Uninitialized Use in Video in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-11695Inappropriate implementation in Passwords in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2026-11691Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-11686Insufficient validation of untrusted input in Dawn in Google Chrome on macOS prior to 149.0.7827.103 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-11685Inappropriate implementation in MediaCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin Google Chrome
- CVE-2026-11684Insufficient policy enforcement in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the utilitGoogle Chrome
- CVE-2026-11678Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to obGoogle Chrome
- CVE-2026-11675Out of bounds read in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to leGoogle Chrome
- CVE-2026-11669Out of bounds read in Media in Google Chrome on ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-11668Uninitialized Use in Codecs in Google Chrome on Linux, ChromeOS prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-11666Insufficient validation of untrusted input in Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to perform UI spoofinGoogle Chrome
- CVE-2026-11665Out of bounds read in Dawn in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-11658Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromiGoogle Chrome
- CVE-2026-11653Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-11628Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physicaGoogle Chrome
- CVE-2026-40215A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash orOpenVPN
- CVE-2026-11585CodeAstro Student Attendance Management System createClassArms.php sql injectionCodeAstro Student Attendance Management System
- CVE-2026-11584CodeAstro Student Attendance Management System createClass.php edit sql injectionCodeAstro Student Attendance Management System
- CVE-2026-35058Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows OpenVPN
- CVE-2026-11583CodeAstro Student Attendance Management System createClass.php sql injectionCodeAstro Student Attendance Management System
- CVE-2026-49141WACRM Authorization Bypass via Automation Engine EndpointArnasDon wacrm
- CVE-2026-47345TYPO3 HTML Sanitizer allows Cross-Site ScriptingTYPO3 HTML Sanitizer · typo3/html-sanitizer
- CVE-2026-47344TYPO3 HTML Sanitizer allows Cross-Site ScriptingTYPO3 HTML Sanitizer · typo3/html-sanitizer
- CVE-2026-11582CodeAstro Student Attendance Management System index.php sql injectionCodeAstro Student Attendance Management System
- CVE-2026-11559CodeAstro Payroll System view_account.php sql injectionCodeAstro Payroll System
- CVE-2026-46486Mobile Verification Toolkit (MVT): Path Traversal via unsanitized File identifiers in iOS Backup processingmvt-project mvt · mvt
- CVE-2026-11558CodeAstro Payroll System home_salary.php sql injectionCodeAstro Payroll System
- CVE-2026-10544Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authentDevolutions Server
- CVE-2026-10787Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadataDevolutions Server
- CVE-2026-10786Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain clDevolutions Server
- CVE-2026-11555D-Link DGS-1100-08PD Web boa.conf least privilege violationD-Link DGS-1100-08PD
- CVE-2026-11554TOTOLINK CP450 vsftpd vsftpd.conf least privilege violationTOTOLINK CP450
- CVE-2026-11552SourceCodester Onlne Examination & Learning Management System import_users.php hard-coded passwordSourceCodester Onlne Examination & Learning Management Syst…
- CVE-2026-45581fabric-chaincode-java: TLS Private Key Password Disclosed in INFO Startup Logs in Chaincode-as-a-Service Modehyperledger fabric-chaincode-java · org.hyperledger.fabric-…
- CVE-2026-11534imvks786 student_management_system add.php cross site scriptingimvks786 student_management_system
- CVE-2026-43966HTTP Response Splitting via Non-VCHAR Bytes in cow_http_struct_hd:escape_string/2ninenines cowlib · cowlib +2
- CVE-2026-11533imvks786 student_management_system Student Deletion Endpoint see.php improper authorizationimvks786 student_management_system
- CVE-2026-11611389-ds-base: 389-ds-base: content sync plugin unbounded queue growth and race conditionsRed Hat Directory Server · Red Hat Enterprise Linux
- CVE-2026-11532imvks786 student_management_system Student Record add.php access controlimvks786 student_management_system
- CVE-2026-11531imvks786 student_management_system Administrator Login Endpoint admin_login.php sql injectionimvks786 student_management_system
- CVE-2026-46314drm/v3d: Reject empty multisync extension to prevent infinite loopLinux
- CVE-2026-46313media: intel/ipu6: fix error pointer dereferenceLinux
- CVE-2026-46312media: videobuf2: Set vma_flags in vb2_dma_sg_mmapLinux
- CVE-2026-46310media: renesas: vsp1: Fix NULL pointer deref on module unloadLinux
- CVE-2026-46308pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy()Linux
- CVE-2026-46305staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_allocLinux
- CVE-2026-46302selinux: allow multiple opens of /sys/fs/selinux/policyLinux
- CVE-2026-46301spi: topcliff-pch: fix use-after-free on unbindLinux
- CVE-2026-46298pseries/papr-hvpipe: Fix race with interrupt handlerLinux
- CVE-2026-46297net: libwx: use request_irq for VF misc interruptLinux
- CVE-2026-46296spi: s3c64xx: fix NULL-deref on driver unbindLinux
- CVE-2026-46295KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is emptyLinux
- CVE-2026-46294dm: fix a buffer overflow in ioctl processingLinux
- CVE-2026-46293clk: microchip: mpfs-ccc: fix out of bounds access during output registrationLinux
- CVE-2026-46292pmdomain: core: Fix detach procedure for virtual devices in genpdLinux
- CVE-2026-46291crypto: caam - guard HMAC key hex dumps in hash_digest_keyLinux
- CVE-2026-46290x86/efi: Fix graceful fault handling after FPU softirq changesLinux
- CVE-2026-11530imvks786 student_management_system Login index.ph sql injectionimvks786 student_management_system
- CVE-2026-46287net: txgbe: fix RTNL assertion warning when remove moduleLinux
- CVE-2026-46286leds: qcom-lpg: Check for array overflow when selecting the high resolutionLinux
- CVE-2026-46285mtd: docg3: fix use-after-free in docg3_release()Linux
- CVE-2026-46284mm/hugetlb: fix early boot crash on parameters without '=' separatorLinux
- CVE-2026-46283tpm: Use kfree_sensitive() to free auth session in tpm_dev_release()Linux
- CVE-2026-46282iio: frequency: admv1013: fix NULL pointer dereference on strLinux
- CVE-2026-46281vmalloc: fix buffer overflow in vrealloc_node_align()Linux
- CVE-2026-46279mm/alloc_tag: clear codetag for pages allocated before page_ext initializationLinux
- CVE-2026-46278drm/imagination: Fix segfault when updating ftrace maskLinux
- CVE-2026-46276drm/amdgpu: fix zero-size GDS range init on RDNA4Linux
- CVE-2026-11529designcomputer mysql-mcp-server mysql URI server.py read_resource sql injectiondesigncomputer mysql-mcp-server · mysql-mcp-server
- CVE-2026-49756Multipart form-data header injection in Req via unescaped name/filename/content_typewojtekmach req
- CVE-2026-44119Apache HTTP Server: escalation of privilege through expressions in .htaccess in multiple modulesApache Software Foundation Apache HTTP Server
- CVE-2026-43951Apache HTTP Server: OOB Read in `merge_response_headers` can cause crashApache Software Foundation Apache HTTP Server
- CVE-2026-48488phpMyFAQ has Weak Cryptography - SHA1 for Password Hashingthorsten phpMyFAQ · thorsten/phpmyfaq +1
- CVE-2026-29170Apache HTTP Server: mod_proxy_ftp XSSApache Software Foundation Apache HTTP Server
- CVE-2020-37248OfflineIMAP before 8.0.3 trusts the server with their STARTTLS capability prior to authentication, which allows STRIPTLS/man-in-the-middle aOfflineIMAP
- CVE-2025-71315drm/vkms: Convert to DRM's vblank timerLinux
- CVE-2026-11521Mohammed-eid35 bank-management-system-springboot Transaction Endpoint TransactionController.java improper authorizationMohammed-eid35 bank-management-system-springboot
- CVE-2026-43972gun HTTP/2 PUSH_PROMISE authority not validated against connection origin allows cross-origin cookie injectionninenines gun
- CVE-2026-25558QloApps 1.7.0 Stored XSS via SVG File Upload in Admin File ManagerQloApps
- CVE-2026-11520SourceCodester Inventory System header.php cross site scriptingSourceCodester Inventory System
- CVE-2026-11519SourceCodester Inventory System Account Creation users_handler.php improper authorizationSourceCodester Inventory System
- CVE-2026-11518SourceCodester Inventory System User Management users.php cross site scriptingSourceCodester Inventory System
- CVE-2026-11516UTT HiPER 2610G formNatStaticMap strcpy buffer overflowUTT HiPER
- CVE-2026-11515SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded passwordSourceCodester Barangay Resident Profiling and Information…
- CVE-2026-11514itsourcecode Hospital Management System addpatient.php sql injectionitsourcecode Hospital Management System
- CVE-2026-11513itsourcecode Hospital Management System adminaccount.php sql injectionitsourcecode Hospital Management System
- CVE-2026-9549Fix XSS in service discovery active check outputCheckmk
- CVE-2026-8078Fix stored XSS in global settings change logCheckmk
- CVE-2026-7765User Messages widget leaked issuer messages on shared dashboardsCheckmk
- CVE-2026-11512itsourcecode Hospital Management System billing.php cross site scriptingitsourcecode Hospital Management System
- CVE-2026-11511Bolt CMS HTML Attribute TextType.php HTML injectionBolt CMS
- CVE-2026-11510CodeAstro Leave Management System add_leave.php sql injectionCodeAstro Leave Management System
- CVE-2026-3011Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'wpzoom Recipe Card Blocks Lite
- CVE-2026-11509CodeAstro Leave Management System search_staff_for_updation.php sql injectionCodeAstro Leave Management System
- CVE-2026-11508CodeAstro Leave Management System search_staff_to_assign_pc.php sql injectionCodeAstro Leave Management System
- CVE-2026-11569Quay: quay: stored xss via filedrop svg uploadRed Hat Quay
- CVE-2026-11507CodeAstro Leave Management System delete_leave_type.php sql injectionCodeAstro Leave Management System
- CVE-2026-11506CodeAstro Leave Management System search_staff_for_deletion.php sql injectionCodeAstro Leave Management System
- CVE-2026-11505GL.iNet XE3000 glnassys hard-coded keyGL.iNet A1300 · GL.iNet AX1800 +6
- CVE-2026-11502JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirectJeecgBoot
- CVE-2026-11501SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injectionSourceCodester Hospitals Patient Records Management System
- CVE-2026-11500Weaviate Static API Key client.go validateConfig authorizationWeaviate · github.com/weaviate/weaviate
- CVE-2026-11497D-Link DCS-5615 Boa Webserver boa.conf least privilege violationD-Link DCS-5615
- CVE-2026-11495CodeAstro Ingredients Stock Management System add_stock.php sql injectionCodeAstro Ingredients Stock Management System
- CVE-2026-11494TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violationTOTOLINK AC1200 T8
- CVE-2026-11493Tenda AC15 Samba smb.conf weak passwordTenda AC15
- CVE-2026-11492D-Link DIR-823G vsftpd vsftpd.conf least privilege violationD-Link DIR-823G
- CVE-2026-11491CodeAstro Human Resource Management System Notice Board Management All_notice cross site scriptingCodeAstro Human Resource Management System
- CVE-2026-11490code-projects Online Music Site Search.php sql injectioncode-projects Online Music Site
- CVE-2026-11489code-projects Online Music Site AdminDeleteAlbum.php sql injectioncode-projects Online Music Site
- CVE-2026-11488code-projects Simple Flight Ticket Booking System POST Parameter checkUser.php sql injectioncode-projects Simple Flight Ticket Booking System
- CVE-2026-11487Neovim View Branch secure.lua M.read command injectionNeovim
- CVE-2026-11486SourceCodester Class and Exam Timetabling System archive1.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11485SourceCodester Class and Exam Timetabling System archive2.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11484SourceCodester Class and Exam Timetabling System archive3.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11483SourceCodester Class and Exam Timetabling System archive4.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11482SourceCodester Class and Exam Timetabling System archive5.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11481yoanbernabeu grepai Postgres Embedding Cache chunker.go PostgresStore.LookupByContentHash weak hashyoanbernabeu grepai · github.com/yoanbernabeu/grepai
- CVE-2026-11480Chengdu Everbrite Network Technology BeikeShop Admin Design Builder Endpoint admin.php sql injectionChengdu Everbrite Network Technology BeikeShop
- CVE-2026-11479yoanbernabeu grepai Qdrant Backend chunker.go weak hashyoanbernabeu grepai · github.com/yoanbernabeu/grepai
- CVE-2026-11478kokke tiny-regex-c Pattern re.c matchstar redoskokke tiny-regex-c
- CVE-2023-54351WordPress Sonaar Music Plugin 4.7 Stored XSS via CommentsSonaar Music Plugin
- CVE-2022-50953WordPress Plugin admin-word-count-column 2.2 Local File Readbrooks24 admin-word-count-column
- CVE-2021-47984WordPress Plugin WP24 Domain Check 1.6.2 Stored XSSWP24 Domain Check
- CVE-2021-47983WordPress Plugin Stripe Payments < 2.0.40 Stored XSS via currency_codemra13 Accept Stripe Payments
- CVE-2021-47982WordPress Plugin WP-Paginate 2.1.3 Stored XSS via presetmaxfoundry WP-Paginate
- CVE-2026-11477hs-web hsweb-framework OAuth2 Client OAuth2Client.java OAuth2Client redirecths-web hsweb-framework · org.hswebframework.web:hsweb-autho…
- CVE-2026-11476Kushan2k student-management-system Profile Update Endpoint AdminController.php edit-admin improper authorizationKushan2k student-management-system
- CVE-2026-11475Kushan2k student-management-system Certificate Verification Endpoint GradeController.php getStatus sql injectionKushan2k student-management-system
- CVE-2026-11474Kushan2k student-management-system Registration Endpoint RegisterService.php unrestricted uploadKushan2k student-management-system
- CVE-2026-11473jflyfox jfinal_cms AdvicefeedbackController.java list sql injectionjflyfox jfinal_cms
- CVE-2026-11472SourceCodester Class and Exam Timetabling System index1.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11471SourceCodester Class and Exam Timetabling System index2.php sql injectionSourceCodester Class and Exam Timetabling System
- CVE-2026-11470hs-web hsweb-framework File Upload FileUploadProperties.java denied path traversalhs-web hsweb-framework · org.hswebframework.web:hsweb-syste…