CVEs published June 30, 2026
643 CVEs were published on June 30, 2026: 93 critical, 193 high. 2 are now in CISA KEV.
- Published
- 643
- Critical
- 93
- High
- 193
- Medium
- 340
- Low
- 17
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 575
Most affected products
- Google Chrome
- 382
- Capgo
- 15
- ohler55 oj · oj
- 11
- Adobe ColdFusion
- 10
- IBM Langflow OSS
- 10
- IBM watsonx.data intelligence
- 10
- picklescan
- 7
- coollabsio coolify
- 6
- NetScaler ADC · NetScaler Gateway
- 6
- Apache Software Foundation Apache ActiveMQ
- 5
Critical 93
- CVE-2026-50110Use of Hard-coded Credentials in StoneFly Storage ConcentratorStoneFly Storage Concentrator
- CVE-2026-56413OS Command Injection in StoneFly Storage ConcentratorStoneFly Storage Concentrator
- CVE-2026-56415OS Command Injection in StoneFly Storage ConcentratorStonefly Storage Concentrator
- CVE-2026-14152Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-14121Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via maliciGoogle Chrome
- CVE-2026-14120Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-14113Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-14109Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-14106Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compGoogle Chrome
- CVE-2026-14105Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viaGoogle Chrome
- CVE-2026-14101Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-14097Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-14095Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-14093Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-14090Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker toGoogle Chrome
- CVE-2026-14056Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-14055Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who Google Chrome
- CVE-2026-14044Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-14043Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-14038Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromGoogle Chrome
- CVE-2026-14037Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-14017Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-13934Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compGoogle Chrome
- CVE-2026-13920Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had comGoogle Chrome
- CVE-2026-13909Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-13901Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-13883Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-13882Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perforGoogle Chrome
- CVE-2026-13880Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-13878Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13872Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to Google Chrome
- CVE-2026-13869Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-13861Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-13859Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-13854Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-13853Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-13852Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to Google Chrome
- CVE-2026-13851Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to Google Chrome
- CVE-2026-13846Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-13843Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who haGoogle Chrome
- CVE-2026-13798Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13797Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-13796Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-13792Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape Google Chrome
- CVE-2026-13789Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-13785Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2026-13784Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-13783Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-13782Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2026-13781Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-13780Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-13776Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-13775Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-55721SQL Injection in StoneFly Storage ConcentratorStoneFly Storage Concentrator
- CVE-2026-56700Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command InjectionGrav · getgrav/grav
- CVE-2026-56278Flowise - Session Hijacking via Weak Default Express Session SecretFlowise
- CVE-2026-56264Crawl4AI - Arbitrary JavaScript Execution via /execute_js EndpointCrawl4AI
- CVE-2026-50003OFFIS DCMTK Toolkit Path TraversalOFFIS DICOM DCMTK Toolkit
- CVE-2026-58449txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameterneuml txtai
- CVE-2026-10109IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handlingIBM Db2
- CVE-2026-10134Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public FlowsIBM Langflow OSS
- CVE-2026-10140Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode SubsystemIBM Langflow OSS
- CVE-2026-11708IBM WebSphere Application Server is affected by a cross-site scripting vulnerabilityIBM WebSphere Application Server
- CVE-2026-11712IBM WebSphere Application Server is affected by a cross-site scripting vulnerabilityIBM WebSphere Application Server
- CVE-2026-7663Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization BypassIBM Langflow OSS
- CVE-2026-7803Flow Validation Bypass via Empty Component Type FieldIBM Langflow OSS
- CVE-2026-7871Insecure Deserialization in Redis Cache BackendIBM Langflow OSS
- CVE-2026-7873Code Injection Vulnerability in Code Validation EndpointIBM Langflow OSS · langflow
- CVE-2026-7874Weak Cryptographic Key Derivation Exposed All Stored CredentialsIBM Langflow OSS
- CVE-2026-58138Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluatorsconductor-oss conductor
- CVE-2026-58172Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade RequestsThreeMammals Ocelot
- CVE-2026-58166OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and DeleteOpenBMB ChatDev
- CVE-2026-48315ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-48281ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-48277ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2026-48313ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2026-48276ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe ColdFusion
- CVE-2026-48282ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2026-48283ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434)Adobe ColdFusion
- CVE-2026-48286Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-58116LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Pathhiyouga LlamaFactory
- CVE-2026-6556@fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins@fastify/express
- CVE-2026-44946SAML Authentication Replay in RancherSUSE Rancher
- CVE-2026-8402SQLi in Exagate's SYSGUARD 6001Eksagate Electronic Engineering and Computer Industry Trade…
- CVE-2026-13766DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiersEXODIST DBIx::QuickORM
- CVE-2026-53690SQL Injection in Redeight CMSRedeight CMS
- CVE-2026-14162Advantech｜Hospital Quering Management - Missing AuthenticationAdvantech Hospital Quering Management
- CVE-2026-9711EventON - WordPress Virtual Event Calendar Plugin <= 5.0.11 - Unauthenticated Blind SQL Injection via Search ParameterEventON (Pro) - WordPress Virtual Event Calendar Plugin
- CVE-2026-12076SQL Injection in Raytha CMSRaytha
- CVE-2026-12819DVP-12SE Missing Authentication and Unauthorized Write access Vulnerabilitydeltaww DVP-12SE
- CVE-2026-12818DVP-12SE Exposure of Sensitive Information Vulnerabilitydeltaww DVP-12SE
- CVE-2026-12073ProfileGrid - User Profiles, Groups and Communities <= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwritemetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2026-37106An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php.
High 193
- CVE-2026-54592Oj: Stack Buffer Overflow in Oj::Doc#each_child via Deeply Nested Inputohler55 oj · oj
- CVE-2026-14151Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-14149Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HGoogle Chrome
- CVE-2026-14124Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OSGoogle Chrome
- CVE-2026-14122Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker toGoogle Chrome
- CVE-2026-14115Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-14114Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoGoogle Chrome
- CVE-2026-14111Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2026-14108Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-14107Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-14104Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arGoogle Chrome
- CVE-2026-14102Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2026-14099Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2026-14094Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalaGoogle Chrome
- CVE-2026-14091Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-14087Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-14086Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a craGoogle Chrome
- CVE-2026-14084Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exGoogle Chrome
- CVE-2026-14078Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege Google Chrome
- CVE-2026-14067Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crGoogle Chrome
- CVE-2026-14064Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in spGoogle Chrome
- CVE-2026-14060Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perfGoogle Chrome
- CVE-2026-14041Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation Google Chrome
- CVE-2026-14040Use after free in BrowserTag in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2026-14036Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalatiGoogle Chrome
- CVE-2026-14032Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious eGoogle Chrome
- CVE-2026-14027Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gesGoogle Chrome
- CVE-2026-14025Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2026-14024Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifiGoogle Chrome
- CVE-2026-14018Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalatiGoogle Chrome
- CVE-2026-14011Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory reGoogle Chrome
- CVE-2026-14009Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2026-14006Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML Google Chrome
- CVE-2026-14005Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2026-13974Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictionsGoogle Chrome
- CVE-2026-13968Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a useGoogle Chrome
- CVE-2026-13967Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-13965Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-13951Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-13938Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a cGoogle Chrome
- CVE-2026-13928Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilGoogle Chrome
- CVE-2026-13927Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privGoogle Chrome
- CVE-2026-13925Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user Google Chrome
- CVE-2026-13918Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2026-13915Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2026-13903Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalatiGoogle Chrome
- CVE-2026-13899Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-13898Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandboxGoogle Chrome
- CVE-2026-13897Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalatGoogle Chrome
- CVE-2026-13891Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-13888Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-13885Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbGoogle Chrome
- CVE-2026-13884Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious netwGoogle Chrome
- CVE-2026-13870Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a saGoogle Chrome
- CVE-2026-13864Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a maliGoogle Chrome
- CVE-2026-13863Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perfGoogle Chrome
- CVE-2026-13856Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had coGoogle Chrome
- CVE-2026-13855Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifiGoogle Chrome
- CVE-2026-13850Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execGoogle Chrome
- CVE-2026-13849Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to poteGoogle Chrome
- CVE-2026-13848Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-13845Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-13844Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalatiGoogle Chrome
- CVE-2026-13841Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-13835Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2026-13834Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-13832Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-13831Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-13830Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via maliciGoogle Chrome
- CVE-2026-13829Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had Google Chrome
- CVE-2026-13827Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a maliGoogle Chrome
- CVE-2026-13825Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2026-13824Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-13823Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-13821Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-13819Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13817Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform Google Chrome
- CVE-2026-13815Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-13814Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-13813Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-13811Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-13807Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specificGoogle Chrome
- CVE-2026-13806Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-13805Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML Google Chrome
- CVE-2026-13804Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-13803Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-13802Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestGoogle Chrome
- CVE-2026-13801Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-13800Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privGoogle Chrome
- CVE-2026-13799Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via maliciouGoogle Chrome
- CVE-2026-13794Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker whGoogle Chrome
- CVE-2026-13791Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to Google Chrome
- CVE-2026-13788Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crGoogle Chrome
- CVE-2026-13787Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via maliGoogle Chrome
- CVE-2026-13786Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2026-13779Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malGoogle Chrome
- CVE-2026-13778Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious pGoogle Chrome
- CVE-2026-13777Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentiallyGoogle Chrome
- CVE-2026-13774Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2026-54672electron-updater: Uncontrolled search path elements within `AppImage` built by `app-builder-lib`electron-userland electron-builder · electron-userland a… +1
- CVE-2026-54673electron-updater: Cross-origin redirect leaks `PRIVATE-TOKEN` and mixed-case `Authorization` credentials in `builder-util-runtime`electron-userland electron-builder · electron-userland b… +1
- CVE-2026-57995phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissionsphpMyFAQ · phpmyfaq/phpmyfaq +1
- CVE-2026-56328Capgo - Integrity Issue in Release Routing via Multiple Public ChannelsCapgo
- CVE-2026-56320Capgo - Org/App Scope Mismatch in Device Creation EndpointCapgo
- CVE-2026-56300Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC FunctionsCapgo
- CVE-2026-56286Capgo - Account Deletion Without Password ConfirmationCapgo
- CVE-2026-56249Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name CollisionCapgo
- CVE-2026-56247Capgo - Privilege Escalation via Cross-Scope RBAC Role AssignmentCapgo
- CVE-2026-56233Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload ProxyCapgo
- CVE-2026-56230Capgo - Broken Object Level Authorization via x-limited-key-id HeaderCapgo
- CVE-2026-56219Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get_org_user_access_rbac NULL-auth BypassCapgo
- CVE-2025-71374picklescan - Arbitrary Code Execution via Undetected profile.Profile.runpicklescan
- CVE-2025-71371picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypasspicklescan
- CVE-2025-71368picklescan - Arbitrary Code Execution via Undetected doctest.debug_scriptpicklescan
- CVE-2025-71363picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserializationpicklescan
- CVE-2025-71355Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection BypassPicklescan
- CVE-2025-71352picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Filespicklescan
- CVE-2025-71350picklescan - Undetected Remote Code Execution via torch.utils.collect_env.runpicklescan
- CVE-2025-71349picklescan - Arbitrary Code Execution via Undetected trace.Trace.run in Pickle Filespicklescan
- CVE-2026-57585MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught errormsgpack-python · msgpack
- CVE-2026-50254OFFIS DCMTK Toolkit Missing Release of Memory after Effective LifetimeOFFIS DICOM DCMTK Toolkit
- CVE-2026-35505OFFIS DCMTK Toolkit Missing Release of Memory after Effective LifetimeOFFIS DICOM DCMTK Toolkit
- CVE-2026-52868OFFIS DCMTK Toolkit Path TraversalOFFIS DICOM DCMTK Toolkit
- CVE-2026-11541Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms.IBM CICS Transaction Gateway for Multiplatforms
- CVE-2026-44628OFFIS DCMTK Toolkit Type ConfusionOFFIS DICOM DCMTK Toolkit
- CVE-2026-11594IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-13207Frangoteam FUXA SCADA/HMI Authentication Bypass by SpoofingFrangoteam FUXA SCADA/HMI
- CVE-2025-36359IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability.IBM DevOps Automation · IBM DevOps Loop
- CVE-2026-10129SSRF via HTTP Redirect Following in Langflow API Request ComponentIBM Langflow OSS
- CVE-2026-10546DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL ComponentIBM Langflow OSS
- CVE-2026-10560Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSSIBM Langflow OSS
- CVE-2026-10564SSRF Vulnerability in Langflow OSS Legacy Components Bypasses ProtectionIBM Langflow OSS
- CVE-2026-11546IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-11714IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-11806IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerabilityIBM WebSphere Application Server - Liberty
- CVE-2026-13449XXE attack in IBM Business Automation Manager Open EditionsIBM Business Automation Manager Open Editions
- CVE-2026-13759IBM WebSphere eXtreme Scale is affected by Insecure DeserilizationIBM WebSphere Extreme Scale
- CVE-2026-13772IBM WebSphere eXtreme Scale's OQL is affected by remote code executionIBM WebSphere Extreme Scale
- CVE-2026-10513Webmention <= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Propertiespfefferle Webmention
- CVE-2026-8864HP Fan Control App – Potential Escalation of PrivilegeHP Fan Control App
- CVE-2026-49451Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsingmicrosoft OpenAPI.NET · Microsoft.OpenApi
- CVE-2026-58377JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret KeysJeecgBoot
- CVE-2026-58376Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpointsdolibarr
- CVE-2026-58375JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/exportjeecgboot jimureport
- CVE-2026-58372SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keysseaweedfs · github.com/seaweedfs/seaweedfs
- CVE-2026-58370Woodpecker < 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Namewoodpecker-ci woodpecker
- CVE-2026-58170Vibe-Trading < 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading MandatesHKUDS Vibe-Trading
- CVE-2026-58169Vibe-Trading < 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code ExecutionHKUDS Vibe-Trading
- CVE-2026-58168DeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin UsersHKUDS DeepTutor · deeptutor
- CVE-2026-58165OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creationopenziti ziti
- CVE-2026-48285ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918)Adobe ColdFusion
- CVE-2026-48307ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe ColdFusion
- CVE-2026-44949Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhookSUSE Rancher
- CVE-2026-27957Coolify: Authenticated RCE via command injection in CA certificate management featurecoollabsio coolify
- CVE-2026-14241Memory safety bugs fixed in Firefox 152.0.4Mozilla Firefox
- CVE-2026-13474Denial of service via malformed HTTP/2 requestsNetScaler ADC · NetScaler Gateway
- CVE-2026-58016Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"GNOME GLib · Red Hat Enterprise Linux +6
- CVE-2026-58014Glib: off-by-one error in glib/gkeyfile.c via "g_key_file_get_locale_string_list"GNOME GLib · Red Hat Enterprise Linux +7
- CVE-2026-10816Arbitrary File Read (Unauthenticated)NetScaler ADC · NetScaler Gateway
- CVE-2026-8655Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2026-8452Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of ServiceNetScaler ADC · NetScaler Gateway
- CVE-2026-8451Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2026-41053Over-inclusive team membership expansion in GitHub App authentication provider for RancherSUSE Rancher · github.com/rancher/rancher
- CVE-2026-53691Remote Code Execution in Redeight CMSRedeight CMS
- CVE-2026-57081Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded inputSANKO Net::BitTorrent
- CVE-2026-57080Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefixSANKO Net::BitTorrent
- CVE-2026-14161Advantech｜Hospital Queuing Management - Sensitive Data ExposureAdvantech Hospital Queuing Management
- CVE-2026-49434Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties brokerApache Software Foundation Apache ActiveMQ Broker · Apache…
- CVE-2026-49432Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of serviceApache Software Foundation Apache ActiveMQ
- CVE-2026-49877Apache ActiveMQ: Authenticated web users retain admin access by default in the Web ConsoleApache Software Foundation Apache ActiveMQ
- CVE-2026-50734Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiationApache Software Foundation Apache ActiveMQ Client · Apache…
- CVE-2026-50750Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270Apache Software Foundation Apache ActiveMQ Broker · Apache…
- CVE-2026-53916Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codecApache Software Foundation Apache ActiveMQ
- CVE-2026-53917Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshallingApache Software Foundation Apache ActiveMQ
- CVE-2026-54475Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeoverApache Software Foundation Apache ActiveMQ Broker · Apac… +1
- CVE-2026-10763PROMOD V is using insecure HTTP communication instead of HTTPS.Hitachi Energy PROMOD V
- CVE-2026-8141Ajax Load More - Filters <= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy_include_children' FieldConnekt Media Ajax Load More - Filters
- CVE-2025-7406A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2025-24815An unrestricted file upload vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2026-13149brace-expansion through 5.0.6 is vulnerable to denial of service.juliangruber brace-expansion · brace-expansion
- CVE-2026-12578DTMSoft - Deserialization of Untrusted Data Vulnerabilitydeltaww DTMSoft
- CVE-2026-12240Export User Data <= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display_name Fieldqlstudio Export User Data
- CVE-2026-14164Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()Red Hat Enterprise Linux · Red Hat OpenShift Container P… +6
- CVE-2026-56137RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc.Gotcha Gotcha Games RPG MAKER MV · Gotcha Gotcha Games RPG…
- CVE-2026-56808DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execuAVTECH Security DGM3103SCT
- CVE-2026-11590WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated SQL Injection via filter[elements] Array KeysWP Support Plus Responsive Ticket System
- CVE-2026-11589WP Support Plus Responsive Ticket System <= 9.1.2 - Unauthenticated Stored XSS via File UploadWP Support Plus Responsive Ticket System
- CVE-2026-58302rtapi_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation.LinuxCNC
- CVE-2026-52193Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52195Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52196Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
- CVE-2026-52197An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub_44af70 componen
- CVE-2026-52198Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea
Medium, low and unrated 357
- CVE-2026-54903Oj: Integer Overflow in Oj.load 2GB String Handlingohler55 oj · oj
- CVE-2026-54902Oj: Use-After-Free in Oj::Parser SAJ Long Key Callbackohler55 oj · oj
- CVE-2026-54901Oj: Use-After-Free in Oj::Parser array_class/hash_class GC Markingohler55 oj · oj
- CVE-2026-54900Oj: Negative-Size memcpy in Oj::Parser create_id Attribute Handlingohler55 oj · oj
- CVE-2026-54898Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutationohler55 oj · oj
- CVE-2026-54897Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Closeohler55 oj · oj
- CVE-2026-54896Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indentohler55 oj · oj
- CVE-2026-54502Oj: Stack Buffer Overflow in Oj.dump via Large Indentohler55 oj · oj
- CVE-2026-54500Oj: intern.c form_attr has an uninitialized stack readohler55 oj · oj
- CVE-2026-54899Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggleohler55 oj · oj
- CVE-2026-55223c3p0 exposes a deserialization "sink" via JDBC DataSource bean propertiesswaldman c3p0 · com.mchange:c3p0
- CVE-2026-14156Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-14155Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-14154Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2026-14153Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speGoogle Chrome
- CVE-2026-14150Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-14148Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proGoogle Chrome
- CVE-2026-14147Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-14146Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-14145Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-14144Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2026-14143Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-14142Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-14141Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to performGoogle Chrome
- CVE-2026-14140Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform Google Chrome
- CVE-2026-14139Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-14138Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a Google Chrome
- CVE-2026-14137Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who coGoogle Chrome
- CVE-2026-14136Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perGoogle Chrome
- CVE-2026-14135Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-14134Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofingGoogle Chrome
- CVE-2026-14133Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page.Google Chrome
- CVE-2026-14132Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-14131Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-14130Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTMLGoogle Chrome
- CVE-2026-14129Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-14128Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2026-14127Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-14126Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crGoogle Chrome
- CVE-2026-14125Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information froGoogle Chrome
- CVE-2026-14123Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of thGoogle Chrome
- CVE-2026-14119Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain poGoogle Chrome
- CVE-2026-14118Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-14117Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convGoogle Chrome
- CVE-2026-14116Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a useGoogle Chrome
- CVE-2026-14112Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-14110Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafGoogle Chrome
- CVE-2026-14103Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informatGoogle Chrome
- CVE-2026-14100Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-14098Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-14096Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-14092Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to lGoogle Chrome
- CVE-2026-14089Insufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromGoogle Chrome
- CVE-2026-14088Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-14085Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-14083Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scrGoogle Chrome
- CVE-2026-14082Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google Chrome
- CVE-2026-14081Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2026-14080Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to byGoogle Chrome
- CVE-2026-14079Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy viGoogle Chrome
- CVE-2026-14077Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of theGoogle Chrome
- CVE-2026-14076Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security poliGoogle Chrome
- CVE-2026-14075Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-refeGoogle Chrome
- CVE-2026-14074Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak crossGoogle Chrome
- CVE-2026-14073Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation rGoogle Chrome
- CVE-2026-14072Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-14071Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-14070Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fromGoogle Chrome
- CVE-2026-14069Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fromGoogle Chrome
- CVE-2026-14068Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engGoogle Chrome
- CVE-2026-14066Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypGoogle Chrome
- CVE-2026-14065Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-14063Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive informatioGoogle Chrome
- CVE-2026-14062Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2026-14061Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inforGoogle Chrome
- CVE-2026-14059Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origGoogle Chrome
- CVE-2026-14058Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policGoogle Chrome
- CVE-2026-14057Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a cGoogle Chrome
- CVE-2026-14054Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictioGoogle Chrome
- CVE-2026-14053Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-14052Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary acceGoogle Chrome
- CVE-2026-14051Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-14050Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-14049Inappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-14048Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially Google Chrome
- CVE-2026-14047Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-14046Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origiGoogle Chrome
- CVE-2026-14045Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-14042Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing vGoogle Chrome
- CVE-2026-14039Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin poliGoogle Chrome
- CVE-2026-14035Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitiGoogle Chrome
- CVE-2026-14034Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restGoogle Chrome
- CVE-2026-14033Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolatiGoogle Chrome
- CVE-2026-14031Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crGoogle Chrome
- CVE-2026-14030Inappropriate implementation in SplitView in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2026-14028Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engGoogle Chrome
- CVE-2026-14026Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2026-14023Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same Google Chrome
- CVE-2026-14022Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-14021Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-14020Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-14019Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-14016Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-14015Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pagGoogle Chrome
- CVE-2026-14014Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-14013Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HGoogle Chrome
- CVE-2026-14012Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inGoogle Chrome
- CVE-2026-14010Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-14008Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-14007Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation Google Chrome
- CVE-2026-14004Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-14003Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-14002Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-14001Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTMGoogle Chrome
- CVE-2026-14000Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-13999Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user toGoogle Chrome
- CVE-2026-13998Incorrect security UI in File Input in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2026-13997Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engGoogle Chrome
- CVE-2026-13996Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2026-13995Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perfoGoogle Chrome
- CVE-2026-13994Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perforGoogle Chrome
- CVE-2026-13993Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2026-13992Inappropriate implementation in UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2026-13991Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perGoogle Chrome
- CVE-2026-13990Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who Google Chrome
- CVE-2026-13989Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-13988Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-13987Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crGoogle Chrome
- CVE-2026-13986Inappropriate implementation in Media UI in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user Google Chrome
- CVE-2026-13985Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-13984Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTMGoogle Chrome
- CVE-2026-13983Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-13982Incorrect security UI in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13981Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-13980Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-13979Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-13978Insufficient policy enforcement in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2026-13977Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or Google Chrome
- CVE-2026-13976Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-13975Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13973Inappropriate implementation in UI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speciGoogle Chrome
- CVE-2026-13972Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-13971Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaGoogle Chrome
- CVE-2026-13970Uninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtGoogle Chrome
- CVE-2026-13969Uninitialized Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-13966Inappropriate implementation in History in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craftGoogle Chrome
- CVE-2026-13964Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2026-13963Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-13962Insufficient data validation in PDF in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-13961Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convGoogle Chrome
- CVE-2026-13960Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2026-13959Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin Google Chrome
- CVE-2026-13958Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infGoogle Chrome
- CVE-2026-13957Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious Google Chrome
- CVE-2026-13956Incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifGoogle Chrome
- CVE-2026-13955Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perfGoogle Chrome
- CVE-2026-13954Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially seGoogle Chrome
- CVE-2026-13953Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-13952Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-13950Uninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtaiGoogle Chrome
- CVE-2026-13949Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentialGoogle Chrome
- CVE-2026-13948Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-13947Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtainGoogle Chrome
- CVE-2026-13946Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origGoogle Chrome
- CVE-2026-13945Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to iGoogle Chrome
- CVE-2026-13944Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2026-13943Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informGoogle Chrome
- CVE-2026-13942Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spoGoogle Chrome
- CVE-2026-13941Inappropriate implementation in SiteSettings in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spooGoogle Chrome
- CVE-2026-13940Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially senGoogle Chrome
- CVE-2026-13939Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had Google Chrome
- CVE-2026-13937Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-13936Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentiallyGoogle Chrome
- CVE-2026-13935Side-channel information leakage in ComputePressure in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-13933Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-13932Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-13931Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-13930Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictionsGoogle Chrome
- CVE-2026-13929Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigationGoogle Chrome
- CVE-2026-13926Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-13924Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had cGoogle Chrome
- CVE-2026-13923Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informGoogle Chrome
- CVE-2026-13922Side-channel information leakage in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-13921Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attackeGoogle Chrome
- CVE-2026-13919Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-13917Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who coGoogle Chrome
- CVE-2026-13916Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-13914Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensGoogle Chrome
- CVE-2026-13913Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user toGoogle Chrome
- CVE-2026-13912Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofinGoogle Chrome
- CVE-2026-13911Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-13910Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-13908Insufficient validation of untrusted input in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convincedGoogle Chrome
- CVE-2026-13907Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engaGoogle Chrome
- CVE-2026-13906Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-13905Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-13904Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation Google Chrome
- CVE-2026-13902Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-13900Inappropriate implementation in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-13896Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions Google Chrome
- CVE-2026-13895Inappropriate implementation in Autofill in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-13894Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bGoogle Chrome
- CVE-2026-13893Insufficient validation of untrusted input in WebUI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-13892Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-13890Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-13889Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak crossGoogle Chrome
- CVE-2026-13887Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-13886Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content secGoogle Chrome
- CVE-2026-13881Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policGoogle Chrome
- CVE-2026-13879Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sGoogle Chrome
- CVE-2026-13877Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-13876Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypaGoogle Chrome
- CVE-2026-13875Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-13874Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from procGoogle Chrome
- CVE-2026-13873Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-13871Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-13868Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2026-13867Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cGoogle Chrome
- CVE-2026-13866Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-13865Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoGoogle Chrome
- CVE-2026-13862Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an aGoogle Chrome
- CVE-2026-13860Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engagGoogle Chrome
- CVE-2026-13858Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fGoogle Chrome
- CVE-2026-13857Inappropriate implementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-13847Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leaGoogle Chrome
- CVE-2026-13842Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2026-13840Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-13839Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a craGoogle Chrome
- CVE-2026-13838Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a craGoogle Chrome
- CVE-2026-13837Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HGoogle Chrome
- CVE-2026-13836Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-13833Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted Google Chrome
- CVE-2026-13828Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitiveGoogle Chrome
- CVE-2026-13826Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-13822Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to inGoogle Chrome
- CVE-2026-13820Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2026-13818Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictionGoogle Chrome
- CVE-2026-13816Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leaGoogle Chrome
- CVE-2026-13812Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who coGoogle Chrome
- CVE-2026-13810Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensiGoogle Chrome
- CVE-2026-13809Side-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-13808Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentiallyGoogle Chrome
- CVE-2026-13795Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigatGoogle Chrome
- CVE-2026-13793Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-13790Side-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2026-50040Cross-site Scripting in StoneFly Storage ConcentratorStoneFly Storage Concentrator
- CVE-2026-28322SolarWinds Database Performance Analyzer Stored Cross-Site Scripting VulnerabilitySolarWinds Database Performance Analyzer
- CVE-2026-56777n8n - AST Validator Bypass in Python Code Noden8n
- CVE-2026-56399Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/webopen-webui
- CVE-2026-56377ImageMagick - Policy Bypass via Incorrect Path ValidationImageMagick
- CVE-2026-56369ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImageImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56365ImageMagick - Memory Leak in PNG Encoder via MNG Image WritingImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56364ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XMLImageMagick · Magick.NET-Q8-x64 +18
- CVE-2026-56363ImageMagick - Division by Zero in Binomial Kernel ProcessingImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2026-56361ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology ProcessingImageMagick · Magick.NET-Q16-AnyCPU +17
- CVE-2026-56356n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Fieldn8n
- CVE-2026-56350n8n - SSO Enforcement Bypass via APIn8n
- CVE-2026-56334Capgo - Missing UPDATE RLS Policy for Build Status PersistenceCapgo
- CVE-2026-56333Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings UpdatesCapgo
- CVE-2026-56331Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic StringCapgo
- CVE-2026-56327Capgo - Unauthenticated Organization Existence Oracle via public.invite_user_to_org RPCCapgo
- CVE-2026-56318Capgo - Information Disclosure via /private/validate_password_compliance EndpointCapgo
- CVE-2026-56277Flowise - Hardcoded CORS Wildcard in TTS EndpointFlowise
- CVE-2026-56224Capgo - Login CSRF and Session Fixation via URL Query ParametersCapgo
- CVE-2025-71381Hono - Vary Header Injection in CORS MiddlewareHono
- CVE-2026-54696Ruby JSON: JSON generator heap buffer overflow when streaming to an IOruby json · json
- CVE-2026-57204pypdf: Missing stream length values ignore defined limitspy-pdf pypdf · pypdf
- CVE-2026-10585Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A categoryGitHub Enterprise Server
- CVE-2026-58450Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameterinvoiceninja
- CVE-2026-58448yudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance APIYunaiV yudao-cloud
- CVE-2026-58447Invidious - Cross-User Playlist Video Deletion via Missing Ownership Checkiv-org Invidious
- CVE-2026-58446Presenton < 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpointpresenton
- CVE-2026-10562Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web InterfaceTP-Link Systems Archer AX20
- CVE-2025-12530Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2026-9132Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpointGitHub Enterprise Server
- CVE-2025-36319Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36320Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2026-9106UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screenGitHub Enterprise Server
- CVE-2025-36321Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36323Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36324Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36327Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36328Error Message Containing Sensitive Information found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36333Vulnerabilities found in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36336Cleartext Transmission of Sensitive Information in Watson Data IntelligenceIBM watsonx.data intelligence
- CVE-2025-36372IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tablesIBM Db2
- CVE-2026-11595IBM WebSphere Application Server is affected by a Path Traversal vulnerabilityIBM WebSphere Application Server
- CVE-2026-11906IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated userIBM Db2
- CVE-2026-12084IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsUCD - IBM DevOps Deploy
- CVE-2026-12085IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerabilityUCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy
- CVE-2026-12086IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Insertion of Sensitive Information into Log File VulnerabilityUCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy
- CVE-2026-13773IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport ProtocolIBM WebSphere Extreme Scale
- CVE-2026-3602IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injectionIBM App Connect Enterprise · IBM Integration Bus for z/OS
- CVE-2026-9002IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabledIBM WebSphere Extreme Scale
- CVE-2026-9836IBM DataStage Flow Designer application is affected by an information disclosure vulnerabilityIBM InfoSphere Information Server
- CVE-2026-10655Use-after-free race in SNTP async client when closing the socket while the socket service is still polling itzephyrproject zephyr
- CVE-2026-10654RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classiczephyrproject zephyr
- CVE-2026-10653Non-atomic `net_buf` reference counts cause double-free / free-list corruption under concurrent unrefzephyrproject zephyr
- CVE-2026-9263Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packetszephyrproject zephyr
- CVE-2026-58373CVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existencecvat-ai cvat
- CVE-2026-58371SeaweedFS < 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameterseaweedfs
- CVE-2026-58369Woodpecker < 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Servicewoodpecker-ci woodpecker
- CVE-2026-58176RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpointsdromara RuoYi-Vue-Plus
- CVE-2026-58174Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Importnesquena hermes-webui
- CVE-2026-58173Vibe-Trading < 0.1.10 - Path Traversal via Persistent Memory TypeHKUDS Vibe-Trading
- CVE-2026-58171Vibe-Trading < 0.1.10 - Path Traversal via Swarm Run IdentifierHKUDS Vibe-Trading
- CVE-2026-58167Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Usersccfos nightingale · github.com/ccfos/nightingale/v6 +3
- CVE-2026-10652Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated `rdlength`)zephyrproject zephyr
- CVE-2026-13455PostgreSQL Anonymizer: Unrestricted function can leak the secret saltDALIBO PostgreSQL Anonymizer
- CVE-2026-44948Path Traversal in Rancher Fleet ImageScan GitRepo Path HandlerSUSE Rancher
- CVE-2026-48314ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)Adobe ColdFusion
- CVE-2026-4360Tarfile.extract() doesn't fully respect filter parameterPython Software Foundation CPython
- CVE-2026-27956Coolify: Cross-team application domain enumeration via domains_by_server endpointcoollabsio coolify
- CVE-2026-27955Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()`coollabsio coolify
- CVE-2026-27883Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosurecoollabsio coolify
- CVE-2026-48192A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10.Siemens Mendix Studio Pro
- CVE-2026-27881Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR)coollabsio coolify
- CVE-2026-27882Coolify: Timing Attack in GitLab Webhook Token Validationcoollabsio coolify
- CVE-2026-44947Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in RancherSUSE Rancher
- CVE-2026-14178openGauss存在非法内存访问导致DoS漏洞openGauss-server-7.0.0-RC2 · openGauss-server-7.0.0-RC1 +1
- CVE-2026-35098Improper Restriction of Excessive Authentication Attempts in KTM System e-BOKKTM System e-BOK
- CVE-2026-35097Weak Password Requirements in KTM System e-BOKKTM System e-BOK
- CVE-2026-35096Cross-Site Request Forgery (CSRF) in KTM System e-BOKKTM System e-BOK
- CVE-2026-35095Session fixation in KTM System e-BOKKTM System e-BOK
- CVE-2025-53648Apache Gravitino: SQL misconfiguration can access or truncate filesApache Software Foundation Apache Gravitino
- CVE-2026-58015Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveGNOME GLib · Red Hat Enterprise Linux +7
- CVE-2026-10817Insufficient input validation leading to memory overreadNetScaler ADC · NetScaler Gateway
- CVE-2026-58013Glib: buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"GNOME GLib · Red Hat Enterprise Linux +6
- CVE-2026-58012Glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()GNOME GLib · Red Hat Enterprise Linux +6
- CVE-2026-58011Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetimeGNOME GLib · Red Hat Enterprise Linux +6
- CVE-2026-58010Glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()GNOME GLib · Red Hat Enterprise Linux +6
- CVE-2026-58374In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing w1.fi hostapd
- CVE-2026-53433Denial of Service in fzffzf · github.com/junegunn/fzf
- CVE-2026-53432Integer Overflow in fzffzf
- CVE-2026-12388Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapperRed Hat Build of Keycloak
- CVE-2026-4629Keycloak: keycloak: privilege escalation through hardcoded role mapper injectionRed Hat build of Keycloak
- CVE-2026-14209Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictionsRed Hat build of Keycloak · Red Hat JBoss Enterprise Applic…
- CVE-2026-8403Stored XSS in Exagate's SYSGUARD 6001Eksagate Electronic Engineering and Computer Industry Trade…
- CVE-2026-53692Weak hashing algorithm in Redeight CMSRedeight CMS
- CVE-2026-57082Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNGSANKO Net::BitTorrent
- CVE-2026-57079Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadataSANKO Net::BitTorrent
- CVE-2026-13316Foreman: ssrf to cloud metada service through unvalidated test_url parameters in foreman configRed Hat Satellite
- CVE-2026-52760Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web ConsoleApache Software Foundation Apache ActiveMQ
- CVE-2025-24816An Improper Access Control vulnerability in Nokia MantaRay NMNokia MantaRay NM
- CVE-2026-6954Multiple vulnerabilities in Intermark IT's WebControl CMSIntermark IT WebControl CMS
- CVE-2026-6953Multiple vulnerabilities in Intermark IT's WebControl CMSIntermark IT WebControl CMS
- CVE-2026-12610Sssd: use-after-free crash in sssd' 'sssd_pam' processRed Hat Enterprise Linux · Red Hat Hardened Images +1
- CVE-2026-45822decode-uri-component through 0.4.1 is vulnerable to denial of service.SamVerschueren decode-uri-component · decode-uri-component
- CVE-2026-56809Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vRicoh Company Multiple laser printers and MFPs which implem…
- CVE-2026-9576Fluent Booking < 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee ExportFluent Booking
- CVE-2026-11581Kali Forms < 2.4.13 - Contributor+ Stored XSS via Form Field CaptionKali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2026-11367PixMagix <= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers[].id' Parameterandrasweb PixMagix – WordPress Image Editor
- CVE-2026-12349Premium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actionsoctagonwebstudio Premium Addons for KingComposer
- CVE-2026-12560Editorial Rating <= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Fieldwpqode Editorial Rating – Product Review & Rating System
- CVE-2026-8944Plugin for Google Analytics by IO technologies <= 1.1 - Cross-Site Request Forgery via 'ga_id' Parameterengagementanalytics Plugin for Google Analytics by IO techn…
- CVE-2026-12114Team Members <= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_css' Parameterwpmart Team Members – Multi Language Supported Team Plugin
- CVE-2026-14160Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions.Samsung Open Source Escargot