# CVEs published 2026-06-30

643 CVEs were published on June 30, 2026: 93 critical, 193 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-54903](https://cve.now/CVE-2026-54903.md): Oj: Integer Overflow in Oj.load 2GB String Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54902](https://cve.now/CVE-2026-54902.md): Oj: Use-After-Free in Oj::Parser SAJ Long Key Callback (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54901](https://cve.now/CVE-2026-54901.md): Oj: Use-After-Free in Oj::Parser array\_class/hash\_class GC Marking (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54900](https://cve.now/CVE-2026-54900.md): Oj: Negative-Size memcpy in Oj::Parser create\_id Attribute Handling (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54898](https://cve.now/CVE-2026-54898.md): Oj: Use-After-Free in Oj::Parser SAJ Callback via Input Mutation (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54897](https://cve.now/CVE-2026-54897.md): Oj : Use-After-Free in Oj::Doc Iterators via Reentrant Close (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54896](https://cve.now/CVE-2026-54896.md): Oj: Heap Buffer Overflow in Oj.dump Exception Serialization via Large Indent (CVSS 2.1, ohler55 oj · oj)
- [CVE-2026-54592](https://cve.now/CVE-2026-54592.md): Oj: Stack Buffer Overflow in Oj::Doc#each\_child via Deeply Nested Input (CVSS 7.5, ohler55 oj · oj)
- [CVE-2026-54502](https://cve.now/CVE-2026-54502.md): Oj: Stack Buffer Overflow in Oj.dump via Large Indent (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-54500](https://cve.now/CVE-2026-54500.md): Oj: intern.c form\_attr has an uninitialized stack read (CVSS 5.3, ohler55 oj · oj)
- [CVE-2026-54899](https://cve.now/CVE-2026-54899.md): Oj: Use-After-Free in Oj::Parser Symbol Key Cache Toggle (CVSS 6.3, ohler55 oj · oj)
- [CVE-2026-55223](https://cve.now/CVE-2026-55223.md): c3p0 exposes a deserialization "sink" via JDBC DataSource bean properties (CVSS 6.3, swaldman c3p0 · com.mchange:c3p0)
- [CVE-2026-50110](https://cve.now/CVE-2026-50110.md): Use of Hard-coded Credentials in StoneFly Storage Concentrator (CVSS 9.3, StoneFly Storage Concentrator)
- [CVE-2026-56413](https://cve.now/CVE-2026-56413.md): OS Command Injection in StoneFly Storage Concentrator (CVSS 10.0, StoneFly Storage Concentrator)
- [CVE-2026-56415](https://cve.now/CVE-2026-56415.md): OS Command Injection in StoneFly Storage Concentrator (CVSS 10.0, Stonefly Storage Concentrator)
- [CVE-2026-14156](https://cve.now/CVE-2026-14156.md): Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 6.5, Google Chrome)
- [CVE-2026-14155](https://cve.now/CVE-2026-14155.md): Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin d (CVSS 6.5, Google Chrome)
- [CVE-2026-14154](https://cve.now/CVE-2026-14154.md): Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malic (CVSS 4.8, Google Chrome)
- [CVE-2026-14153](https://cve.now/CVE-2026-14153.md): Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in spe (CVSS 5.3, Google Chrome)
- [CVE-2026-14152](https://cve.now/CVE-2026-14152.md): Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pro (CVSS 9.6, Google Chrome)
- [CVE-2026-14151](https://cve.now/CVE-2026-14151.md): Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-14150](https://cve.now/CVE-2026-14150.md): Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised t (CVSS 4.3, Google Chrome)
- [CVE-2026-14149](https://cve.now/CVE-2026-14149.md): Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted H (CVSS 8.8, Google Chrome)
- [CVE-2026-14148](https://cve.now/CVE-2026-14148.md): Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from pro (CVSS 6.5, Google Chrome)
- [CVE-2026-14147](https://cve.now/CVE-2026-14147.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-14146](https://cve.now/CVE-2026-14146.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-14145](https://cve.now/CVE-2026-14145.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-14144](https://cve.now/CVE-2026-14144.md): Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific (CVSS 4.2, Google Chrome)
- [CVE-2026-14143](https://cve.now/CVE-2026-14143.md): Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-14142](https://cve.now/CVE-2026-14142.md): Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere (CVSS 4.3, Google Chrome)
- [CVE-2026-14141](https://cve.now/CVE-2026-14141.md): Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform (CVSS 4.3, Google Chrome)
- [CVE-2026-14140](https://cve.now/CVE-2026-14140.md): Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform (CVSS 4.3, Google Chrome)
- [CVE-2026-14139](https://cve.now/CVE-2026-14139.md): Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 4.2, Google Chrome)
- [CVE-2026-14138](https://cve.now/CVE-2026-14138.md): Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a (CVSS 4.2, Google Chrome)
- [CVE-2026-14137](https://cve.now/CVE-2026-14137.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who co (CVSS 4.2, Google Chrome)
- [CVE-2026-14136](https://cve.now/CVE-2026-14136.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to per (CVSS 4.3, Google Chrome)
- [CVE-2026-14135](https://cve.now/CVE-2026-14135.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 4.3, Google Chrome)
- [CVE-2026-14134](https://cve.now/CVE-2026-14134.md): Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing (CVSS 4.3, Google Chrome)
- [CVE-2026-14133](https://cve.now/CVE-2026-14133.md): Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-14132](https://cve.now/CVE-2026-14132.md): Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-14131](https://cve.now/CVE-2026-14131.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compr (CVSS 4.3, Google Chrome)
- [CVE-2026-14130](https://cve.now/CVE-2026-14130.md): Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML (CVSS 4.3, Google Chrome)
- [CVE-2026-14129](https://cve.now/CVE-2026-14129.md): Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user (CVSS 4.2, Google Chrome)
- [CVE-2026-14128](https://cve.now/CVE-2026-14128.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the content (CVSS 4.3, Google Chrome)
- [CVE-2026-14127](https://cve.now/CVE-2026-14127.md): Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 4.3, Google Chrome)
- [CVE-2026-14126](https://cve.now/CVE-2026-14126.md): Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-14125](https://cve.now/CVE-2026-14125.md): Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-14124](https://cve.now/CVE-2026-14124.md): Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS (CVSS 7.8, Google Chrome)
- [CVE-2026-14123](https://cve.now/CVE-2026-14123.md): Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of th (CVSS 4.3, Google Chrome)
- [CVE-2026-14122](https://cve.now/CVE-2026-14122.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to (CVSS 8.1, Google Chrome)
- [CVE-2026-14121](https://cve.now/CVE-2026-14121.md): Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malici (CVSS 9.8, Google Chrome)
- [CVE-2026-14120](https://cve.now/CVE-2026-14120.md): Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 9.6, Google Chrome)
- [CVE-2026-14119](https://cve.now/CVE-2026-14119.md): Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain po (CVSS 6.5, Google Chrome)
- [CVE-2026-14118](https://cve.now/CVE-2026-14118.md): Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 6.5, Google Chrome)
- [CVE-2026-14117](https://cve.now/CVE-2026-14117.md): Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who conv (CVSS 5.3, Google Chrome)
- [CVE-2026-14116](https://cve.now/CVE-2026-14116.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a use (CVSS 4.3, Google Chrome)
- [CVE-2026-14115](https://cve.now/CVE-2026-14115.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the (CVSS 7.5, Google Chrome)
- [CVE-2026-14114](https://cve.now/CVE-2026-14114.md): Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spo (CVSS 7.5, Google Chrome)
- [CVE-2026-14113](https://cve.now/CVE-2026-14113.md): Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proc (CVSS 9.6, Google Chrome)
- [CVE-2026-14112](https://cve.now/CVE-2026-14112.md): Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage (CVSS 5.3, Google Chrome)
- [CVE-2026-14111](https://cve.now/CVE-2026-14111.md): Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensi (CVSS 8.1, Google Chrome)
- [CVE-2026-14110](https://cve.now/CVE-2026-14110.md): Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-14109](https://cve.now/CVE-2026-14109.md): Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p (CVSS 9.6, Google Chrome)
- [CVE-2026-14108](https://cve.now/CVE-2026-14108.md): Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-14107](https://cve.now/CVE-2026-14107.md): Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-14106](https://cve.now/CVE-2026-14106.md): Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had comp (CVSS 9.6, Google Chrome)
- [CVE-2026-14105](https://cve.now/CVE-2026-14105.md): Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via (CVSS 9.6, Google Chrome)
- [CVE-2026-14104](https://cve.now/CVE-2026-14104.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute ar (CVSS 8.8, Google Chrome)
- [CVE-2026-14103](https://cve.now/CVE-2026-14103.md): Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive informat (CVSS 6.5, Google Chrome)
- [CVE-2026-14102](https://cve.now/CVE-2026-14102.md): Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-14101](https://cve.now/CVE-2026-14101.md): Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the (CVSS 9.6, Google Chrome)
- [CVE-2026-14100](https://cve.now/CVE-2026-14100.md): Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via (CVSS 6.5, Google Chrome)
- [CVE-2026-14099](https://cve.now/CVE-2026-14099.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2026-14098](https://cve.now/CVE-2026-14098.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-14097](https://cve.now/CVE-2026-14097.md): Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 9.6, Google Chrome)
- [CVE-2026-14096](https://cve.now/CVE-2026-14096.md): Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the r (CVSS 6.5, Google Chrome)
- [CVE-2026-14095](https://cve.now/CVE-2026-14095.md): Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere (CVSS 9.6, Google Chrome)
- [CVE-2026-14094](https://cve.now/CVE-2026-14094.md): Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escala (CVSS 7.8, Google Chrome)
- [CVE-2026-14093](https://cve.now/CVE-2026-14093.md): Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 9.6, Google Chrome)
- [CVE-2026-14092](https://cve.now/CVE-2026-14092.md): Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to l (CVSS 4.3, Google Chrome)
- [CVE-2026-14091](https://cve.now/CVE-2026-14091.md): Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-14090](https://cve.now/CVE-2026-14090.md): Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to (CVSS 9.8, Google Chrome)
- [CVE-2026-14089](https://cve.now/CVE-2026-14089.md): Insufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comprom (CVSS 4.3, Google Chrome)
- [CVE-2026-14088](https://cve.now/CVE-2026-14088.md): Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inf (CVSS 6.5, Google Chrome)
- [CVE-2026-14087](https://cve.now/CVE-2026-14087.md): Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 8.8, Google Chrome)
- [CVE-2026-14086](https://cve.now/CVE-2026-14086.md): Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-14085](https://cve.now/CVE-2026-14085.md): Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cr (CVSS 6.5, Google Chrome)
- [CVE-2026-14084](https://cve.now/CVE-2026-14084.md): Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially ex (CVSS 8.8, Google Chrome)
- [CVE-2026-14083](https://cve.now/CVE-2026-14083.md): Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scr (CVSS 6.1, Google Chrome)
- [CVE-2026-14082](https://cve.now/CVE-2026-14082.md): Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CVSS 6.5, Google Chrome)
- [CVE-2026-14081](https://cve.now/CVE-2026-14081.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a ma (CVSS 6.5, Google Chrome)
- [CVE-2026-14080](https://cve.now/CVE-2026-14080.md): Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to by (CVSS 4.3, Google Chrome)
- [CVE-2026-14079](https://cve.now/CVE-2026-14079.md): Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy vi (CVSS 4.3, Google Chrome)
- [CVE-2026-14078](https://cve.now/CVE-2026-14078.md): Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege (CVSS 8.8, Google Chrome)
- [CVE-2026-14077](https://cve.now/CVE-2026-14077.md): Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the (CVSS 4.3, Google Chrome)
- [CVE-2026-14076](https://cve.now/CVE-2026-14076.md): Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security poli (CVSS 4.3, Google Chrome)
- [CVE-2026-14075](https://cve.now/CVE-2026-14075.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-refe (CVSS 4.3, Google Chrome)
- [CVE-2026-14074](https://cve.now/CVE-2026-14074.md): Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross (CVSS 6.5, Google Chrome)
- [CVE-2026-14073](https://cve.now/CVE-2026-14073.md): Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation r (CVSS 4.3, Google Chrome)
- [CVE-2026-14072](https://cve.now/CVE-2026-14072.md): Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-14071](https://cve.now/CVE-2026-14071.md): Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via (CVSS 6.5, Google Chrome)
- [CVE-2026-14070](https://cve.now/CVE-2026-14070.md): Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-14069](https://cve.now/CVE-2026-14069.md): Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from (CVSS 6.5, Google Chrome)
- [CVE-2026-14068](https://cve.now/CVE-2026-14068.md): Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng (CVSS 6.1, Google Chrome)
- [CVE-2026-14067](https://cve.now/CVE-2026-14067.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-14066](https://cve.now/CVE-2026-14066.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to byp (CVSS 4.3, Google Chrome)
- [CVE-2026-14065](https://cve.now/CVE-2026-14065.md): Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-14064](https://cve.now/CVE-2026-14064.md): Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in sp (CVSS 7.5, Google Chrome)
- [CVE-2026-14063](https://cve.now/CVE-2026-14063.md): Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive informatio (CVSS 5.7, Google Chrome)
- [CVE-2026-14062](https://cve.now/CVE-2026-14062.md): Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to instal (CVSS 5.9, Google Chrome)
- [CVE-2026-14061](https://cve.now/CVE-2026-14061.md): Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-14060](https://cve.now/CVE-2026-14060.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perf (CVSS 7.8, Google Chrome)
- [CVE-2026-14059](https://cve.now/CVE-2026-14059.md): Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig (CVSS 6.5, Google Chrome)
- [CVE-2026-14058](https://cve.now/CVE-2026-14058.md): Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security polic (CVSS 4.3, Google Chrome)
- [CVE-2026-14057](https://cve.now/CVE-2026-14057.md): Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-14056](https://cve.now/CVE-2026-14056.md): Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 9.6, Google Chrome)
- [CVE-2026-14055](https://cve.now/CVE-2026-14055.md): Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who (CVSS 9.6, Google Chrome)
- [CVE-2026-14054](https://cve.now/CVE-2026-14054.md): Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictio (CVSS 4.3, Google Chrome)
- [CVE-2026-14053](https://cve.now/CVE-2026-14053.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend (CVSS 4.3, Google Chrome)
- [CVE-2026-14052](https://cve.now/CVE-2026-14052.md): Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary acce (CVSS 4.3, Google Chrome)
- [CVE-2026-14051](https://cve.now/CVE-2026-14051.md): Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process t (CVSS 6.5, Google Chrome)
- [CVE-2026-14050](https://cve.now/CVE-2026-14050.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via (CVSS 6.5, Google Chrome)
- [CVE-2026-14049](https://cve.now/CVE-2026-14049.md): Inappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proce (CVSS 5.3, Google Chrome)
- [CVE-2026-14048](https://cve.now/CVE-2026-14048.md): Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially (CVSS 6.5, Google Chrome)
- [CVE-2026-14047](https://cve.now/CVE-2026-14047.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2026-14046](https://cve.now/CVE-2026-14046.md): Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origi (CVSS 4.3, Google Chrome)
- [CVE-2026-14045](https://cve.now/CVE-2026-14045.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 4.3, Google Chrome)
- [CVE-2026-14044](https://cve.now/CVE-2026-14044.md): Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-14043](https://cve.now/CVE-2026-14043.md): Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to (CVSS 9.6, Google Chrome)
- [CVE-2026-14042](https://cve.now/CVE-2026-14042.md): Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing v (CVSS 4.3, Google Chrome)
- [CVE-2026-14041](https://cve.now/CVE-2026-14041.md): Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation (CVSS 8.8, Google Chrome)
- [CVE-2026-14040](https://cve.now/CVE-2026-14040.md): Use after free in BrowserTag in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensi (CVSS 8.8, Google Chrome)
- [CVE-2026-14039](https://cve.now/CVE-2026-14039.md): Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin poli (CVSS 4.3, Google Chrome)
- [CVE-2026-14038](https://cve.now/CVE-2026-14038.md): Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had comprom (CVSS 9.3, Google Chrome)
- [CVE-2026-14037](https://cve.now/CVE-2026-14037.md): Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr (CVSS 9.6, Google Chrome)
- [CVE-2026-14036](https://cve.now/CVE-2026-14036.md): Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalati (CVSS 8.8, Google Chrome)
- [CVE-2026-14035](https://cve.now/CVE-2026-14035.md): Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensiti (CVSS 6.5, Google Chrome)
- [CVE-2026-14034](https://cve.now/CVE-2026-14034.md): Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation rest (CVSS 4.3, Google Chrome)
- [CVE-2026-14033](https://cve.now/CVE-2026-14033.md): Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolati (CVSS 6.5, Google Chrome)
- [CVE-2026-14032](https://cve.now/CVE-2026-14032.md): Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious e (CVSS 8.1, Google Chrome)
- [CVE-2026-14031](https://cve.now/CVE-2026-14031.md): Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-14030](https://cve.now/CVE-2026-14030.md): Inappropriate implementation in SplitView in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to (CVSS 4.2, Google Chrome)
- [CVE-2026-14028](https://cve.now/CVE-2026-14028.md): Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng (CVSS 4.2, Google Chrome)
- [CVE-2026-14027](https://cve.now/CVE-2026-14027.md): Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI ges (CVSS 8.8, Google Chrome)
- [CVE-2026-14026](https://cve.now/CVE-2026-14026.md): Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.2, Google Chrome)
- [CVE-2026-14025](https://cve.now/CVE-2026-14025.md): Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific (CVSS 8.8, Google Chrome)
- [CVE-2026-14024](https://cve.now/CVE-2026-14024.md): Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifi (CVSS 8.8, Google Chrome)
- [CVE-2026-14023](https://cve.now/CVE-2026-14023.md): Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same (CVSS 6.5, Google Chrome)
- [CVE-2026-14022](https://cve.now/CVE-2026-14022.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-14021](https://cve.now/CVE-2026-14021.md): Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 6.5, Google Chrome)
- [CVE-2026-14020](https://cve.now/CVE-2026-14020.md): Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 4.3, Google Chrome)
- [CVE-2026-14019](https://cve.now/CVE-2026-14019.md): Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-14018](https://cve.now/CVE-2026-14018.md): Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalati (CVSS 7.8, Google Chrome)
- [CVE-2026-14017](https://cve.now/CVE-2026-14017.md): Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere (CVSS 9.6, Google Chrome)
- [CVE-2026-14016](https://cve.now/CVE-2026-14016.md): Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-14015](https://cve.now/CVE-2026-14015.md): Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 6.5, Google Chrome)
- [CVE-2026-14014](https://cve.now/CVE-2026-14014.md): Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-14013](https://cve.now/CVE-2026-14013.md): Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-14012](https://cve.now/CVE-2026-14012.md): Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive in (CVSS 5.3, Google Chrome)
- [CVE-2026-14011](https://cve.now/CVE-2026-14011.md): Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory re (CVSS 8.1, Google Chrome)
- [CVE-2026-14010](https://cve.now/CVE-2026-14010.md): Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inf (CVSS 6.5, Google Chrome)
- [CVE-2026-14009](https://cve.now/CVE-2026-14009.md): Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corr (CVSS 8.8, Google Chrome)
- [CVE-2026-14008](https://cve.now/CVE-2026-14008.md): Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-14007](https://cve.now/CVE-2026-14007.md): Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation (CVSS 6.5, Google Chrome)
- [CVE-2026-14006](https://cve.now/CVE-2026-14006.md): Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-14005](https://cve.now/CVE-2026-14005.md): Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in spe (CVSS 8.8, Google Chrome)
- [CVE-2026-14004](https://cve.now/CVE-2026-14004.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-14003](https://cve.now/CVE-2026-14003.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2026-14002](https://cve.now/CVE-2026-14002.md): Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the render (CVSS 6.5, Google Chrome)
- [CVE-2026-14001](https://cve.now/CVE-2026-14001.md): Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTM (CVSS 6.1, Google Chrome)
- [CVE-2026-14000](https://cve.now/CVE-2026-14000.md): Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-13999](https://cve.now/CVE-2026-13999.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to (CVSS 4.3, Google Chrome)
- [CVE-2026-13998](https://cve.now/CVE-2026-13998.md): Incorrect security UI in File Input in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage (CVSS 4.2, Google Chrome)
- [CVE-2026-13997](https://cve.now/CVE-2026-13997.md): Incorrect security UI in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to eng (CVSS 4.2, Google Chrome)
- [CVE-2026-13996](https://cve.now/CVE-2026-13996.md): Inappropriate implementation in Permissions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-13995](https://cve.now/CVE-2026-13995.md): Insufficient validation of untrusted input in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perfo (CVSS 4.3, Google Chrome)
- [CVE-2026-13994](https://cve.now/CVE-2026-13994.md): Inappropriate implementation in Credential Management in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perfor (CVSS 4.3, Google Chrome)
- [CVE-2026-13993](https://cve.now/CVE-2026-13993.md): Incorrect security UI in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 4.2, Google Chrome)
- [CVE-2026-13992](https://cve.now/CVE-2026-13992.md): Inappropriate implementation in UI in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage i (CVSS 4.2, Google Chrome)
- [CVE-2026-13991](https://cve.now/CVE-2026-13991.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to per (CVSS 4.3, Google Chrome)
- [CVE-2026-13990](https://cve.now/CVE-2026-13990.md): Insufficient validation of untrusted input in DataTransfer in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who (CVSS 6.5, Google Chrome)
- [CVE-2026-13989](https://cve.now/CVE-2026-13989.md): Inappropriate implementation in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-13988](https://cve.now/CVE-2026-13988.md): Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-13987](https://cve.now/CVE-2026-13987.md): Incorrect security UI in Mobile in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-13986](https://cve.now/CVE-2026-13986.md): Inappropriate implementation in Media UI in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user (CVSS 4.2, Google Chrome)
- [CVE-2026-13985](https://cve.now/CVE-2026-13985.md): Inappropriate implementation in MediaCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende (CVSS 6.5, Google Chrome)
- [CVE-2026-13984](https://cve.now/CVE-2026-13984.md): Incorrect security UI in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTM (CVSS 4.3, Google Chrome)
- [CVE-2026-13983](https://cve.now/CVE-2026-13983.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user (CVSS 4.2, Google Chrome)
- [CVE-2026-13982](https://cve.now/CVE-2026-13982.md): Incorrect security UI in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 3.1, Google Chrome)
- [CVE-2026-13981](https://cve.now/CVE-2026-13981.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-13980](https://cve.now/CVE-2026-13980.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-13979](https://cve.now/CVE-2026-13979.md): Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-13978](https://cve.now/CVE-2026-13978.md): Insufficient policy enforcement in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-13977](https://cve.now/CVE-2026-13977.md): Inappropriate implementation in HTMLParser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or (CVSS 5.4, Google Chrome)
- [CVE-2026-13976](https://cve.now/CVE-2026-13976.md): Insufficient data validation in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p (CVSS 5.8, Google Chrome)
- [CVE-2026-13975](https://cve.now/CVE-2026-13975.md): Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 5.3, Google Chrome)
- [CVE-2026-13974](https://cve.now/CVE-2026-13974.md): Integer overflow in Safe Browsing in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions (CVSS 8.1, Google Chrome)
- [CVE-2026-13973](https://cve.now/CVE-2026-13973.md): Inappropriate implementation in UI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speci (CVSS 4.2, Google Chrome)
- [CVE-2026-13972](https://cve.now/CVE-2026-13972.md): Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-13971](https://cve.now/CVE-2026-13971.md): Uninitialized Use in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obta (CVSS 5.3, Google Chrome)
- [CVE-2026-13970](https://cve.now/CVE-2026-13970.md): Uninitialized Use in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obt (CVSS 5.3, Google Chrome)
- [CVE-2026-13969](https://cve.now/CVE-2026-13969.md): Uninitialized Use in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 5.3, Google Chrome)
- [CVE-2026-13968](https://cve.now/CVE-2026-13968.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a use (CVSS 7.5, Google Chrome)
- [CVE-2026-13967](https://cve.now/CVE-2026-13967.md): Heap buffer overflow in V8 in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-13966](https://cve.now/CVE-2026-13966.md): Inappropriate implementation in History in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-13965](https://cve.now/CVE-2026-13965.md): Use after free in Oilpan in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-13964](https://cve.now/CVE-2026-13964.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation (CVSS 6.5, Google Chrome)
- [CVE-2026-13963](https://cve.now/CVE-2026-13963.md): Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 3.1, Google Chrome)
- [CVE-2026-13962](https://cve.now/CVE-2026-13962.md): Insufficient data validation in PDF in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proce (CVSS 6.5, Google Chrome)
- [CVE-2026-13961](https://cve.now/CVE-2026-13961.md): Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who conv (CVSS 5.3, Google Chrome)
- [CVE-2026-13960](https://cve.now/CVE-2026-13960.md): Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-13959](https://cve.now/CVE-2026-13959.md): Insufficient validation of untrusted input in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin (CVSS 4.3, Google Chrome)
- [CVE-2026-13958](https://cve.now/CVE-2026-13958.md): Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inf (CVSS 6.5, Google Chrome)
- [CVE-2026-13957](https://cve.now/CVE-2026-13957.md): Incorrect security UI in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious (CVSS 4.2, Google Chrome)
- [CVE-2026-13956](https://cve.now/CVE-2026-13956.md): Incorrect security UI in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specif (CVSS 4.2, Google Chrome)
- [CVE-2026-13955](https://cve.now/CVE-2026-13955.md): Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perf (CVSS 3.3, Google Chrome)
- [CVE-2026-13954](https://cve.now/CVE-2026-13954.md): Insufficient policy enforcement in XML in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially se (CVSS 6.5, Google Chrome)
- [CVE-2026-13953](https://cve.now/CVE-2026-13953.md): Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-13952](https://cve.now/CVE-2026-13952.md): Inappropriate implementation in PerformanceAPIs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data (CVSS 4.3, Google Chrome)
- [CVE-2026-13951](https://cve.now/CVE-2026-13951.md): Insufficient policy enforcement in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer pr (CVSS 8.3, Google Chrome)
- [CVE-2026-13950](https://cve.now/CVE-2026-13950.md): Uninitialized Use in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtai (CVSS 5.3, Google Chrome)
- [CVE-2026-13949](https://cve.now/CVE-2026-13949.md): Insufficient policy enforcement in Payments in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potential (CVSS 6.5, Google Chrome)
- [CVE-2026-13948](https://cve.now/CVE-2026-13948.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a (CVSS 3.1, Google Chrome)
- [CVE-2026-13947](https://cve.now/CVE-2026-13947.md): Uninitialized Use in XR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain (CVSS 5.3, Google Chrome)
- [CVE-2026-13946](https://cve.now/CVE-2026-13946.md): Inappropriate implementation in ScriptInjections in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-orig (CVSS 4.3, Google Chrome)
- [CVE-2026-13945](https://cve.now/CVE-2026-13945.md): Insufficient policy enforcement in Extensions in Google Chrome on Linux prior to 150.0.7871.47 allowed an attacker who convinced a user to i (CVSS 3.1, Google Chrome)
- [CVE-2026-13944](https://cve.now/CVE-2026-13944.md): Inappropriate implementation in DataTransfer in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user t (CVSS 3.1, Google Chrome)
- [CVE-2026-13943](https://cve.now/CVE-2026-13943.md): Uninitialized Use in CSS in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inform (CVSS 6.5, Google Chrome)
- [CVE-2026-13942](https://cve.now/CVE-2026-13942.md): Inappropriate implementation in Video Capture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a local attacker to perform UI spo (CVSS 3.3, Google Chrome)
- [CVE-2026-13941](https://cve.now/CVE-2026-13941.md): Inappropriate implementation in SiteSettings in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoo (CVSS 4.3, Google Chrome)
- [CVE-2026-13940](https://cve.now/CVE-2026-13940.md): Uninitialized Use in Cast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sen (CVSS 6.5, Google Chrome)
- [CVE-2026-13939](https://cve.now/CVE-2026-13939.md): Insufficient validation of untrusted input in WebShare in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had (CVSS 3.1, Google Chrome)
- [CVE-2026-13938](https://cve.now/CVE-2026-13938.md): Integer overflow in Fonts in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory write via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-13937](https://cve.now/CVE-2026-13937.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende (CVSS 6.5, Google Chrome)
- [CVE-2026-13936](https://cve.now/CVE-2026-13936.md): Inappropriate implementation in Passwords in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially (CVSS 6.5, Google Chrome)
- [CVE-2026-13935](https://cve.now/CVE-2026-13935.md): Side-channel information leakage in ComputePressure in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin d (CVSS 6.5, Google Chrome)
- [CVE-2026-13934](https://cve.now/CVE-2026-13934.md): Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had comp (CVSS 9.6, Google Chrome)
- [CVE-2026-13933](https://cve.now/CVE-2026-13933.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende (CVSS 5.3, Google Chrome)
- [CVE-2026-13932](https://cve.now/CVE-2026-13932.md): Inappropriate implementation in Sharing in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the (CVSS 6.5, Google Chrome)
- [CVE-2026-13931](https://cve.now/CVE-2026-13931.md): Inappropriate implementation in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the r (CVSS 6.5, Google Chrome)
- [CVE-2026-13930](https://cve.now/CVE-2026-13930.md): Insufficient policy enforcement in Actor in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions (CVSS 6.5, Google Chrome)
- [CVE-2026-13929](https://cve.now/CVE-2026-13929.md): Insufficient policy enforcement in DevTools in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass navigation (CVSS 5.5, Google Chrome)
- [CVE-2026-13928](https://cve.now/CVE-2026-13928.md): Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privil (CVSS 8.8, Google Chrome)
- [CVE-2026-13927](https://cve.now/CVE-2026-13927.md): Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform priv (CVSS 7.8, Google Chrome)
- [CVE-2026-13926](https://cve.now/CVE-2026-13926.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-13925](https://cve.now/CVE-2026-13925.md): Inappropriate implementation in Downloads in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user (CVSS 7.5, Google Chrome)
- [CVE-2026-13924](https://cve.now/CVE-2026-13924.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had c (CVSS 6.5, Google Chrome)
- [CVE-2026-13923](https://cve.now/CVE-2026-13923.md): Uninitialized Use in GPU in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive inform (CVSS 6.5, Google Chrome)
- [CVE-2026-13922](https://cve.now/CVE-2026-13922.md): Side-channel information leakage in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-13921](https://cve.now/CVE-2026-13921.md): Insufficient validation of untrusted input in DeviceBoundSessionCredentials in Google Chrome prior to 150.0.7871.47 allowed a remote attacke (CVSS 6.5, Google Chrome)
- [CVE-2026-13920](https://cve.now/CVE-2026-13920.md): Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had com (CVSS 9.6, Google Chrome)
- [CVE-2026-13919](https://cve.now/CVE-2026-13919.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend (CVSS 6.5, Google Chrome)
- [CVE-2026-13918](https://cve.now/CVE-2026-13918.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corrup (CVSS 8.8, Google Chrome)
- [CVE-2026-13917](https://cve.now/CVE-2026-13917.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who co (CVSS 6.5, Google Chrome)
- [CVE-2026-13916](https://cve.now/CVE-2026-13916.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-13915](https://cve.now/CVE-2026-13915.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2026-13914](https://cve.now/CVE-2026-13914.md): Inappropriate implementation in Passwords in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to obtain potentially sens (CVSS 5.5, Google Chrome)
- [CVE-2026-13913](https://cve.now/CVE-2026-13913.md): Insufficient policy enforcement in Autofill in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to (CVSS 6.5, Google Chrome)
- [CVE-2026-13912](https://cve.now/CVE-2026-13912.md): Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofin (CVSS 4.3, Google Chrome)
- [CVE-2026-13911](https://cve.now/CVE-2026-13911.md): Insufficient policy enforcement in Spellcheck in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend (CVSS 5.3, Google Chrome)
- [CVE-2026-13910](https://cve.now/CVE-2026-13910.md): Insufficient policy enforcement in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin d (CVSS 6.5, Google Chrome)
- [CVE-2026-13909](https://cve.now/CVE-2026-13909.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the render (CVSS 9.6, Google Chrome)
- [CVE-2026-13908](https://cve.now/CVE-2026-13908.md): Insufficient validation of untrusted input in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced (CVSS 6.5, Google Chrome)
- [CVE-2026-13907](https://cve.now/CVE-2026-13907.md): Inappropriate implementation in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to enga (CVSS 4.2, Google Chrome)
- [CVE-2026-13906](https://cve.now/CVE-2026-13906.md): Out of bounds read in Codecs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-13905](https://cve.now/CVE-2026-13905.md): Race in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information f (CVSS 4.2, Google Chrome)
- [CVE-2026-13904](https://cve.now/CVE-2026-13904.md): Inappropriate implementation in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation (CVSS 6.5, Google Chrome)
- [CVE-2026-13903](https://cve.now/CVE-2026-13903.md): Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalati (CVSS 8.8, Google Chrome)
- [CVE-2026-13902](https://cve.now/CVE-2026-13902.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-13901](https://cve.now/CVE-2026-13901.md): Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer (CVSS 9.6, Google Chrome)
- [CVE-2026-13900](https://cve.now/CVE-2026-13900.md): Inappropriate implementation in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere (CVSS 6.5, Google Chrome)
- [CVE-2026-13899](https://cve.now/CVE-2026-13899.md): Use after free in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-13898](https://cve.now/CVE-2026-13898.md): Use after free in Cast Receiver in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-13897](https://cve.now/CVE-2026-13897.md): Insufficient policy enforcement in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalat (CVSS 8.8, Google Chrome)
- [CVE-2026-13896](https://cve.now/CVE-2026-13896.md): Insufficient policy enforcement in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions (CVSS 6.5, Google Chrome)
- [CVE-2026-13895](https://cve.now/CVE-2026-13895.md): Inappropriate implementation in Autofill in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 4.2, Google Chrome)
- [CVE-2026-13894](https://cve.now/CVE-2026-13894.md): Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to b (CVSS 6.5, Google Chrome)
- [CVE-2026-13893](https://cve.now/CVE-2026-13893.md): Insufficient validation of untrusted input in WebUI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin d (CVSS 6.5, Google Chrome)
- [CVE-2026-13892](https://cve.now/CVE-2026-13892.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user (CVSS 6.5, Google Chrome)
- [CVE-2026-13891](https://cve.now/CVE-2026-13891.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromis (CVSS 7.5, Google Chrome)
- [CVE-2026-13890](https://cve.now/CVE-2026-13890.md): Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process (CVSS 5.3, Google Chrome)
- [CVE-2026-13889](https://cve.now/CVE-2026-13889.md): Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross (CVSS 6.5, Google Chrome)
- [CVE-2026-13888](https://cve.now/CVE-2026-13888.md): Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-13887](https://cve.now/CVE-2026-13887.md): Inappropriate implementation in NFC in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren (CVSS 6.5, Google Chrome)
- [CVE-2026-13886](https://cve.now/CVE-2026-13886.md): Insufficient policy enforcement in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content sec (CVSS 6.5, Google Chrome)
- [CVE-2026-13885](https://cve.now/CVE-2026-13885.md): Use after free in Skia in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandb (CVSS 8.8, Google Chrome)
- [CVE-2026-13884](https://cve.now/CVE-2026-13884.md): Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via malicious netw (CVSS 8.8, Google Chrome)
- [CVE-2026-13883](https://cve.now/CVE-2026-13883.md): Type Confusion in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-13882](https://cve.now/CVE-2026-13882.md): Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perfor (CVSS 9.6, Google Chrome)
- [CVE-2026-13881](https://cve.now/CVE-2026-13881.md): Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin polic (CVSS 6.5, Google Chrome)
- [CVE-2026-13880](https://cve.now/CVE-2026-13880.md): Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to p (CVSS 9.6, Google Chrome)
- [CVE-2026-13879](https://cve.now/CVE-2026-13879.md): Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially s (CVSS 6.5, Google Chrome)
- [CVE-2026-13878](https://cve.now/CVE-2026-13878.md): Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 9.6, Google Chrome)
- [CVE-2026-13877](https://cve.now/CVE-2026-13877.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 5.3, Google Chrome)
- [CVE-2026-13876](https://cve.now/CVE-2026-13876.md): Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypa (CVSS 6.5, Google Chrome)
- [CVE-2026-13875](https://cve.now/CVE-2026-13875.md): Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compr (CVSS 5.3, Google Chrome)
- [CVE-2026-13874](https://cve.now/CVE-2026-13874.md): Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from proc (CVSS 5.3, Google Chrome)
- [CVE-2026-13873](https://cve.now/CVE-2026-13873.md): Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-13872](https://cve.now/CVE-2026-13872.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to (CVSS 9.1, Google Chrome)
- [CVE-2026-13871](https://cve.now/CVE-2026-13871.md): Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rende (CVSS 6.5, Google Chrome)
- [CVE-2026-13870](https://cve.now/CVE-2026-13870.md): Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sa (CVSS 8.8, Google Chrome)
- [CVE-2026-13869](https://cve.now/CVE-2026-13869.md): Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proce (CVSS 9.6, Google Chrome)
- [CVE-2026-13868](https://cve.now/CVE-2026-13868.md): Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the (CVSS 6.5, Google Chrome)
- [CVE-2026-13867](https://cve.now/CVE-2026-13867.md): Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-13866](https://cve.now/CVE-2026-13866.md): Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the r (CVSS 6.5, Google Chrome)
- [CVE-2026-13865](https://cve.now/CVE-2026-13865.md): Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spo (CVSS 4.3, Google Chrome)
- [CVE-2026-13864](https://cve.now/CVE-2026-13864.md): Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a mali (CVSS 8.1, Google Chrome)
- [CVE-2026-13863](https://cve.now/CVE-2026-13863.md): Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perf (CVSS 7.8, Google Chrome)
- [CVE-2026-13862](https://cve.now/CVE-2026-13862.md): Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an a (CVSS 6.5, Google Chrome)
- [CVE-2026-13861](https://cve.now/CVE-2026-13861.md): Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 9.6, Google Chrome)
- [CVE-2026-13860](https://cve.now/CVE-2026-13860.md): Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engag (CVSS 4.2, Google Chrome)
- [CVE-2026-13859](https://cve.now/CVE-2026-13859.md): Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-13858](https://cve.now/CVE-2026-13858.md): Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information f (CVSS 6.5, Google Chrome)
- [CVE-2026-13857](https://cve.now/CVE-2026-13857.md): Inappropriate implementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in (CVSS 4.2, Google Chrome)
- [CVE-2026-13856](https://cve.now/CVE-2026-13856.md): Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had co (CVSS 7.5, Google Chrome)
- [CVE-2026-13855](https://cve.now/CVE-2026-13855.md): Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specifi (CVSS 7.5, Google Chrome)
- [CVE-2026-13854](https://cve.now/CVE-2026-13854.md): Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process (CVSS 9.6, Google Chrome)
- [CVE-2026-13853](https://cve.now/CVE-2026-13853.md): Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pot (CVSS 9.6, Google Chrome)
- [CVE-2026-13852](https://cve.now/CVE-2026-13852.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to (CVSS 9.1, Google Chrome)
- [CVE-2026-13851](https://cve.now/CVE-2026-13851.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to (CVSS 9.1, Google Chrome)
- [CVE-2026-13850](https://cve.now/CVE-2026-13850.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to exec (CVSS 8.8, Google Chrome)
- [CVE-2026-13849](https://cve.now/CVE-2026-13849.md): Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to pote (CVSS 8.6, Google Chrome)
- [CVE-2026-13848](https://cve.now/CVE-2026-13848.md): Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-13847](https://cve.now/CVE-2026-13847.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to lea (CVSS 6.5, Google Chrome)
- [CVE-2026-13846](https://cve.now/CVE-2026-13846.md): Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to p (CVSS 9.6, Google Chrome)
- [CVE-2026-13845](https://cve.now/CVE-2026-13845.md): Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-13844](https://cve.now/CVE-2026-13844.md): Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalati (CVSS 7.8, Google Chrome)
- [CVE-2026-13843](https://cve.now/CVE-2026-13843.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who ha (CVSS 9.6, Google Chrome)
- [CVE-2026-13842](https://cve.now/CVE-2026-13842.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the content (CVSS 4.3, Google Chrome)
- [CVE-2026-13841](https://cve.now/CVE-2026-13841.md): Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.3, Google Chrome)
- [CVE-2026-13840](https://cve.now/CVE-2026-13840.md): Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-13839](https://cve.now/CVE-2026-13839.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-13838](https://cve.now/CVE-2026-13838.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-13837](https://cve.now/CVE-2026-13837.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-13836](https://cve.now/CVE-2026-13836.md): Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-13835](https://cve.now/CVE-2026-13835.md): Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2026-13834](https://cve.now/CVE-2026-13834.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 8.3, Google Chrome)
- [CVE-2026-13833](https://cve.now/CVE-2026-13833.md): Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-13832](https://cve.now/CVE-2026-13832.md): Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-13831](https://cve.now/CVE-2026-13831.md): Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proce (CVSS 7.5, Google Chrome)
- [CVE-2026-13830](https://cve.now/CVE-2026-13830.md): Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malici (CVSS 8.8, Google Chrome)
- [CVE-2026-13829](https://cve.now/CVE-2026-13829.md): Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had (CVSS 8.3, Google Chrome)
- [CVE-2026-13828](https://cve.now/CVE-2026-13828.md): Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive (CVSS 6.5, Google Chrome)
- [CVE-2026-13827](https://cve.now/CVE-2026-13827.md): Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a mali (CVSS 7.8, Google Chrome)
- [CVE-2026-13826](https://cve.now/CVE-2026-13826.md): Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 6.5, Google Chrome)
- [CVE-2026-13825](https://cve.now/CVE-2026-13825.md): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-13824](https://cve.now/CVE-2026-13824.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rend (CVSS 7.5, Google Chrome)
- [CVE-2026-13823](https://cve.now/CVE-2026-13823.md): Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-13822](https://cve.now/CVE-2026-13822.md): Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to in (CVSS 6.5, Google Chrome)
- [CVE-2026-13821](https://cve.now/CVE-2026-13821.md): Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-13820](https://cve.now/CVE-2026-13820.md): Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process (CVSS 6.5, Google Chrome)
- [CVE-2026-13819](https://cve.now/CVE-2026-13819.md): Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 8.1, Google Chrome)
- [CVE-2026-13818](https://cve.now/CVE-2026-13818.md): Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restriction (CVSS 6.5, Google Chrome)
- [CVE-2026-13817](https://cve.now/CVE-2026-13817.md): Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform (CVSS 8.8, Google Chrome)
- [CVE-2026-13816](https://cve.now/CVE-2026-13816.md): Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to lea (CVSS 6.5, Google Chrome)
- [CVE-2026-13815](https://cve.now/CVE-2026-13815.md): Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-13814](https://cve.now/CVE-2026-13814.md): Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 7.5, Google Chrome)
- [CVE-2026-13813](https://cve.now/CVE-2026-13813.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromis (CVSS 8.3, Google Chrome)
- [CVE-2026-13812](https://cve.now/CVE-2026-13812.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who co (CVSS 4.7, Google Chrome)
- [CVE-2026-13811](https://cve.now/CVE-2026-13811.md): Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-13810](https://cve.now/CVE-2026-13810.md): Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensi (CVSS 6.5, Google Chrome)
- [CVE-2026-13809](https://cve.now/CVE-2026-13809.md): Side-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-13808](https://cve.now/CVE-2026-13808.md): Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially (CVSS 4.6, Google Chrome)
- [CVE-2026-13807](https://cve.now/CVE-2026-13807.md): Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific (CVSS 7.5, Google Chrome)
- [CVE-2026-13806](https://cve.now/CVE-2026-13806.md): Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compro (CVSS 8.1, Google Chrome)
- [CVE-2026-13805](https://cve.now/CVE-2026-13805.md): Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2026-13804](https://cve.now/CVE-2026-13804.md): Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-13803](https://cve.now/CVE-2026-13803.md): Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-13802](https://cve.now/CVE-2026-13802.md): Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 7.5, Google Chrome)
- [CVE-2026-13801](https://cve.now/CVE-2026-13801.md): Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-13800](https://cve.now/CVE-2026-13800.md): Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level priv (CVSS 7.8, Google Chrome)
- [CVE-2026-13799](https://cve.now/CVE-2026-13799.md): Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via maliciou (CVSS 8.1, Google Chrome)
- [CVE-2026-13798](https://cve.now/CVE-2026-13798.md): Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer proces (CVSS 9.6, Google Chrome)
- [CVE-2026-13797](https://cve.now/CVE-2026-13797.md): Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromis (CVSS 9.6, Google Chrome)
- [CVE-2026-13796](https://cve.now/CVE-2026-13796.md): Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to (CVSS 9.6, Google Chrome)
- [CVE-2026-13795](https://cve.now/CVE-2026-13795.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigat (CVSS 6.5, Google Chrome)
- [CVE-2026-13794](https://cve.now/CVE-2026-13794.md): Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker wh (CVSS 7.5, Google Chrome)
- [CVE-2026-13793](https://cve.now/CVE-2026-13793.md): Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-13792](https://cve.now/CVE-2026-13792.md): Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape (CVSS 9.6, Google Chrome)
- [CVE-2026-13791](https://cve.now/CVE-2026-13791.md): Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to (CVSS 8.1, Google Chrome)
- [CVE-2026-13790](https://cve.now/CVE-2026-13790.md): Side-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a (CVSS 6.5, Google Chrome)
- [CVE-2026-13789](https://cve.now/CVE-2026-13789.md): Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 9.6, Google Chrome)
- [CVE-2026-13788](https://cve.now/CVE-2026-13788.md): Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-13787](https://cve.now/CVE-2026-13787.md): Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via mali (CVSS 8.1, Google Chrome)
- [CVE-2026-13786](https://cve.now/CVE-2026-13786.md): Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (CVSS 8.8, Google Chrome)
- [CVE-2026-13785](https://cve.now/CVE-2026-13785.md): Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speci (CVSS 9.6, Google Chrome)
- [CVE-2026-13784](https://cve.now/CVE-2026-13784.md): Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 9.6, Google Chrome)
- [CVE-2026-13783](https://cve.now/CVE-2026-13783.md): Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gest (CVSS 9.6, Google Chrome)
- [CVE-2026-13782](https://cve.now/CVE-2026-13782.md): Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pote (CVSS 9.6, Google Chrome)
- [CVE-2026-13781](https://cve.now/CVE-2026-13781.md): Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the (CVSS 9.6, Google Chrome)
- [CVE-2026-13780](https://cve.now/CVE-2026-13780.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th (CVSS 9.6, Google Chrome)
- [CVE-2026-13779](https://cve.now/CVE-2026-13779.md): Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via mal (CVSS 8.1, Google Chrome)
- [CVE-2026-13778](https://cve.now/CVE-2026-13778.md): Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious p (CVSS 7.8, Google Chrome)
- [CVE-2026-13777](https://cve.now/CVE-2026-13777.md): Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially (CVSS 8.8, Google Chrome)
- [CVE-2026-13776](https://cve.now/CVE-2026-13776.md): Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 9.6, Google Chrome)
- [CVE-2026-13775](https://cve.now/CVE-2026-13775.md): Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 9.6, Google Chrome)
- [CVE-2026-13774](https://cve.now/CVE-2026-13774.md): Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extensi (CVSS 8.1, Google Chrome)
- [CVE-2026-55721](https://cve.now/CVE-2026-55721.md): SQL Injection in StoneFly Storage Concentrator (CVSS 9.2, StoneFly Storage Concentrator)
- [CVE-2026-50040](https://cve.now/CVE-2026-50040.md): Cross-site Scripting in StoneFly Storage Concentrator (CVSS 5.1, StoneFly Storage Concentrator)
- [CVE-2026-28322](https://cve.now/CVE-2026-28322.md): SolarWinds Database Performance Analyzer Stored Cross-Site Scripting Vulnerability (CVSS 5.6, SolarWinds Database Performance Analyzer)
- [CVE-2026-54672](https://cve.now/CVE-2026-54672.md): electron-updater: Uncontrolled search path elements within \`AppImage\` built by \`app-builder-lib\` (CVSS 7.8, electron-userland electron-builder · electron-userland a… +1)
- [CVE-2026-54673](https://cve.now/CVE-2026-54673.md): electron-updater: Cross-origin redirect leaks \`PRIVATE-TOKEN\` and mixed-case \`Authorization\` credentials in \`builder-util-runtime\` (CVSS 8.2, electron-userland electron-builder · electron-userland b… +1)
- [CVE-2026-57995](https://cve.now/CVE-2026-57995.md): phpMyFAQ - Privilege Escalation via Missing Self-Rights Constraint in GroupController::updatePermissions (CVSS 8.7, phpMyFAQ · phpmyfaq/phpmyfaq +1)
- [CVE-2026-56777](https://cve.now/CVE-2026-56777.md): n8n - AST Validator Bypass in Python Code Node (CVSS 5.3, n8n)
- [CVE-2026-56700](https://cve.now/CVE-2026-56700.md): Grav - Multiple Remote Code Execution Vulnerabilities via Unsafe Unserialize and Command Injection (CVSS 9.3, Grav · getgrav/grav)
- [CVE-2026-56399](https://cve.now/CVE-2026-56399.md): Open WebUI - Server-Side Request Forgery via Location Redirect in /api/v1/retrieval/process/web (CVSS 5.3, open-webui)
- [CVE-2026-56377](https://cve.now/CVE-2026-56377.md): ImageMagick - Policy Bypass via Incorrect Path Validation (CVSS 4.8, ImageMagick)
- [CVE-2026-56369](https://cve.now/CVE-2026-56369.md): ImageMagick - Information Disclosure via AES-CTR Nonce Reuse in PasskeyEncipherImage (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56365](https://cve.now/CVE-2026-56365.md): ImageMagick - Memory Leak in PNG Encoder via MNG Image Writing (CVSS 6.3, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56364](https://cve.now/CVE-2026-56364.md): ImageMagick - Memory Leak in LoadOpenCLDeviceBenchmark() via Malformed XML (CVSS 1.8, ImageMagick · Magick.NET-Q8-x64 +18)
- [CVE-2026-56363](https://cve.now/CVE-2026-56363.md): ImageMagick - Division by Zero in Binomial Kernel Processing (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2026-56361](https://cve.now/CVE-2026-56361.md): ImageMagick - Heap Buffer Overflow via Off-by-One in Morphology Processing (CVSS 4.8, ImageMagick · Magick.NET-Q16-AnyCPU +17)
- [CVE-2026-56356](https://cve.now/CVE-2026-56356.md): n8n - Stored Cross-Site Scripting in Chat Trigger Node Custom CSS Field (CVSS 5.1, n8n)
- [CVE-2026-56350](https://cve.now/CVE-2026-56350.md): n8n - SSO Enforcement Bypass via API (CVSS 6.0, n8n)
- [CVE-2026-56334](https://cve.now/CVE-2026-56334.md): Capgo - Missing UPDATE RLS Policy for Build Status Persistence (CVSS 5.3, Capgo)
- [CVE-2026-56333](https://cve.now/CVE-2026-56333.md): Capgo - Server-Side Validation Bypass via Direct Browser-Side Organization Security Settings Updates (CVSS 5.3, Capgo)
- [CVE-2026-56331](https://cve.now/CVE-2026-56331.md): Capgo - Improper Error Handling in Accept Invitation Endpoint via Invalid Magic String (CVSS 6.9, Capgo)
- [CVE-2026-56328](https://cve.now/CVE-2026-56328.md): Capgo - Integrity Issue in Release Routing via Multiple Public Channels (CVSS 7.1, Capgo)
- [CVE-2026-56327](https://cve.now/CVE-2026-56327.md): Capgo - Unauthenticated Organization Existence Oracle via public.invite\_user\_to\_org RPC (CVSS 6.9, Capgo)
- [CVE-2026-56320](https://cve.now/CVE-2026-56320.md): Capgo - Org/App Scope Mismatch in Device Creation Endpoint (CVSS 7.1, Capgo)
- [CVE-2026-56318](https://cve.now/CVE-2026-56318.md): Capgo - Information Disclosure via /private/validate\_password\_compliance Endpoint (CVSS 6.9, Capgo)
- [CVE-2026-56300](https://cve.now/CVE-2026-56300.md): Capgo - Unauthenticated API Key Validity and Permission Oracle via RPC Functions (CVSS 8.7, Capgo)
- [CVE-2026-56286](https://cve.now/CVE-2026-56286.md): Capgo - Account Deletion Without Password Confirmation (CVSS 7.0, Capgo)
- [CVE-2026-56278](https://cve.now/CVE-2026-56278.md): Flowise - Session Hijacking via Weak Default Express Session Secret (CVSS 9.3, Flowise)
- [CVE-2026-56277](https://cve.now/CVE-2026-56277.md): Flowise - Hardcoded CORS Wildcard in TTS Endpoint (CVSS 6.9, Flowise)
- [CVE-2026-56264](https://cve.now/CVE-2026-56264.md): Crawl4AI - Arbitrary JavaScript Execution via /execute\_js Endpoint (CVSS 9.2, Crawl4AI)
- [CVE-2026-56249](https://cve.now/CVE-2026-56249.md): Capgo - Unauthorized Channel Overwrite and Ownership Takeover via POST /channel Name Collision (CVSS 7.2, Capgo)
- [CVE-2026-56247](https://cve.now/CVE-2026-56247.md): Capgo - Privilege Escalation via Cross-Scope RBAC Role Assignment (CVSS 8.7, Capgo)
- [CVE-2026-56233](https://cve.now/CVE-2026-56233.md): Capgo - SSRF and Privilege Escalation via Path Traversal in Builder Upload Proxy (CVSS 8.7, Capgo)
- [CVE-2026-56230](https://cve.now/CVE-2026-56230.md): Capgo - Broken Object Level Authorization via x-limited-key-id Header (CVSS 8.7, Capgo)
- [CVE-2026-56224](https://cve.now/CVE-2026-56224.md): Capgo - Login CSRF and Session Fixation via URL Query Parameters (CVSS 5.1, Capgo)
- [CVE-2026-56219](https://cve.now/CVE-2026-56219.md): Capgo - Unauthenticated RBAC Bindings and Email Disclosure via get\_org\_user\_access\_rbac NULL-auth Bypass (CVSS 8.7, Capgo)
- [CVE-2025-71381](https://cve.now/CVE-2025-71381.md): Hono - Vary Header Injection in CORS Middleware (CVSS 6.9, Hono)
- [CVE-2025-71374](https://cve.now/CVE-2025-71374.md): picklescan - Arbitrary Code Execution via Undetected profile.Profile.run (CVSS 7.6, picklescan)
- [CVE-2025-71371](https://cve.now/CVE-2025-71371.md): picklescan - Remote Code Execution via code.InteractiveInterpreter Detection Bypass (CVSS 7.6, picklescan)
- [CVE-2025-71368](https://cve.now/CVE-2025-71368.md): picklescan - Arbitrary Code Execution via Undetected doctest.debug\_script (CVSS 7.6, picklescan)
- [CVE-2025-71363](https://cve.now/CVE-2025-71363.md): picklescan - Arbitrary Code Execution via Undetected cProfile.run in Pickle Deserialization (CVSS 7.6, picklescan)
- [CVE-2025-71355](https://cve.now/CVE-2025-71355.md): Picklescan - Arbitrary Code Execution via Unsafe Numpy Function Detection Bypass (CVSS 7.6, Picklescan)
- [CVE-2025-71352](https://cve.now/CVE-2025-71352.md): picklescan - Remote Code Execution via Undetected trace.Trace.runctx in Pickle Files (CVSS 7.6, picklescan)
- [CVE-2025-71350](https://cve.now/CVE-2025-71350.md): picklescan - Undetected Remote Code Execution via torch.utils.collect\_env.run (CVSS 7.6, picklescan)
- [CVE-2025-71349](https://cve.now/CVE-2025-71349.md): picklescan - Arbitrary Code Execution via Undetected trace.Trace.run in Pickle Files (CVSS 7.6, picklescan)
- [CVE-2026-54696](https://cve.now/CVE-2026-54696.md): Ruby JSON: JSON generator heap buffer overflow when streaming to an IO (CVSS 3.7, ruby json · json)
- [CVE-2026-57204](https://cve.now/CVE-2026-57204.md): pypdf: Missing stream length values ignore defined limits (CVSS 6.9, py-pdf pypdf · pypdf)
- [CVE-2026-10585](https://cve.now/CVE-2026-10585.md): Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed arbitrary JavaScript execution via crafted Discussion titles in the Q&A category (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2026-57585](https://cve.now/CVE-2026-57585.md): MessagePack: Out-of-bounds read/crash on Unpacker reuse after caught error (CVSS 7.5, msgpack-python · msgpack)
- [CVE-2026-50003](https://cve.now/CVE-2026-50003.md): OFFIS DCMTK Toolkit Path Traversal (CVSS 9.3, OFFIS DICOM DCMTK Toolkit)
- [CVE-2026-50254](https://cve.now/CVE-2026-50254.md): OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime (CVSS 8.7, OFFIS DICOM DCMTK Toolkit)
- [CVE-2026-35505](https://cve.now/CVE-2026-35505.md): OFFIS DCMTK Toolkit Missing Release of Memory after Effective Lifetime (CVSS 8.7, OFFIS DICOM DCMTK Toolkit)
- [CVE-2026-58450](https://cve.now/CVE-2026-58450.md): Invoice Ninja 5.13.26 - Open Redirect in Client Portal Login via intended Parameter (CVSS 4.3, invoiceninja)
- [CVE-2026-58449](https://cve.now/CVE-2026-58449.md): txtai - Unauthenticated Remote Code Execution via Unsafe Reflection in API /reindex function Parameter (CVSS 9.8, neuml txtai)
- [CVE-2026-52868](https://cve.now/CVE-2026-52868.md): OFFIS DCMTK Toolkit Path Traversal (CVSS 8.8, OFFIS DICOM DCMTK Toolkit)
- [CVE-2026-58448](https://cve.now/CVE-2026-58448.md): yudao-cloud \< 2026.06 - BPM Module Broken Access Control via process-instance API (CVSS 6.5, YunaiV yudao-cloud)
- [CVE-2026-58447](https://cve.now/CVE-2026-58447.md): Invidious - Cross-User Playlist Video Deletion via Missing Ownership Check (CVSS 6.5, iv-org Invidious)
- [CVE-2026-58446](https://cve.now/CVE-2026-58446.md): Presenton \< 0.8.8-beta - Authentication Bypass of Session Auth via Unprotected MCP Endpoint (CVSS 6.5, presenton)
- [CVE-2026-11541](https://cve.now/CVE-2026-11541.md): Inconsistent Interpretation of HTTP Requests in CICS Transaction Gateway for Multiplatforms. (CVSS 7.4, IBM CICS Transaction Gateway for Multiplatforms)
- [CVE-2026-44628](https://cve.now/CVE-2026-44628.md): OFFIS DCMTK Toolkit Type Confusion (CVSS 8.7, OFFIS DICOM DCMTK Toolkit)
- [CVE-2026-11594](https://cve.now/CVE-2026-11594.md): IBM WebSphere Application Server is affected by multiple cross-site scripting vulnerabilities (CVSS 8.5, IBM WebSphere Application Server)
- [CVE-2026-10562](https://cve.now/CVE-2026-10562.md): Unauthenticated Open Redirect Vulnerability on TP-Link Archer AX20 Web Interface (CVSS 5.9, TP-Link Systems Archer AX20)
- [CVE-2025-12530](https://cve.now/CVE-2025-12530.md): Vulnerabilities found in Watson Data Intelligence (CVSS 5.9, IBM watsonx.data intelligence)
- [CVE-2026-13207](https://cve.now/CVE-2026-13207.md): Frangoteam FUXA SCADA/HMI Authentication Bypass by Spoofing (CVSS 8.7, Frangoteam FUXA SCADA/HMI)
- [CVE-2026-9132](https://cve.now/CVE-2026-9132.md): Missing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint (CVSS 6.0, GitHub Enterprise Server)
- [CVE-2025-36319](https://cve.now/CVE-2025-36319.md): Vulnerabilities found in Watson Data Intelligence (CVSS 4.3, IBM watsonx.data intelligence)
- [CVE-2025-36320](https://cve.now/CVE-2025-36320.md): Vulnerabilities found in Watson Data Intelligence (CVSS 6.4, IBM watsonx.data intelligence)
- [CVE-2026-9106](https://cve.now/CVE-2026-9106.md): UI misrepresentation vulnerability in GitHub Enterprise Server allowed unauthorized organization runner management via undisclosed OAuth scope on consent screen (CVSS 4.8, GitHub Enterprise Server)
- [CVE-2025-36321](https://cve.now/CVE-2025-36321.md): Vulnerabilities found in Watson Data Intelligence (CVSS 5.7, IBM watsonx.data intelligence)
- [CVE-2025-36323](https://cve.now/CVE-2025-36323.md): Vulnerabilities found in Watson Data Intelligence (CVSS 5.4, IBM watsonx.data intelligence)
- [CVE-2025-36324](https://cve.now/CVE-2025-36324.md): Vulnerabilities found in Watson Data Intelligence (CVSS 4.3, IBM watsonx.data intelligence)
- [CVE-2025-36327](https://cve.now/CVE-2025-36327.md): Vulnerabilities found in Watson Data Intelligence (CVSS 6.5, IBM watsonx.data intelligence)
- [CVE-2025-36328](https://cve.now/CVE-2025-36328.md): Error Message Containing Sensitive Information found in Watson Data Intelligence (CVSS 4.3, IBM watsonx.data intelligence)
- [CVE-2025-36333](https://cve.now/CVE-2025-36333.md): Vulnerabilities found in Watson Data Intelligence (CVSS 4.3, IBM watsonx.data intelligence)
- [CVE-2025-36336](https://cve.now/CVE-2025-36336.md): Cleartext Transmission of Sensitive Information in Watson Data Intelligence (CVSS 5.9, IBM watsonx.data intelligence)
- [CVE-2025-36359](https://cve.now/CVE-2025-36359.md): IBM DevOps Loop is susceptible to an Insufficient Session Expiration vulnerability. (CVSS 8.1, IBM DevOps Automation · IBM DevOps Loop)
- [CVE-2025-36372](https://cve.now/CVE-2025-36372.md): IBM® Db2® could disclose sensitive information to an authenticated user from the monitoring and event tables (CVSS 5.5, IBM Db2)
- [CVE-2026-10109](https://cve.now/CVE-2026-10109.md): IBM® Db2® is vulnerable to remote code execution due to improper pre-auth DRDA handshake handling (CVSS 9.8, IBM Db2)
- [CVE-2026-10129](https://cve.now/CVE-2026-10129.md): SSRF via HTTP Redirect Following in Langflow API Request Component (CVSS 8.5, IBM Langflow OSS)
- [CVE-2026-10134](https://cve.now/CVE-2026-10134.md): Unauthenticated Server-Side RCE via PythonCodeStructuredTool in Public Flows (CVSS 10.0, IBM Langflow OSS)
- [CVE-2026-10140](https://cve.now/CVE-2026-10140.md): Cross-Tenant API Key Reuse and Billing Fraud in Langflow Voice Mode Subsystem (CVSS 9.6, IBM Langflow OSS)
- [CVE-2026-10546](https://cve.now/CVE-2026-10546.md): DNS Rebinding TOCTOU Bypass of SSRF Protection in Langflow OSS URL Component (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-10560](https://cve.now/CVE-2026-10560.md): Unauthenticated Access to Private Flow Build Events and Cancellation in Langflow OSS (CVSS 8.2, IBM Langflow OSS)
- [CVE-2026-10564](https://cve.now/CVE-2026-10564.md): SSRF Vulnerability in Langflow OSS Legacy Components Bypasses Protection (CVSS 8.2, IBM Langflow OSS)
- [CVE-2026-11546](https://cve.now/CVE-2026-11546.md): IBM WebSphere Application Server Liberty is affected by a server-side request forgery vulnerability (CVSS 7.1, IBM WebSphere Application Server - Liberty)
- [CVE-2026-11595](https://cve.now/CVE-2026-11595.md): IBM WebSphere Application Server is affected by a Path Traversal vulnerability (CVSS 4.3, IBM WebSphere Application Server)
- [CVE-2026-11708](https://cve.now/CVE-2026-11708.md): IBM WebSphere Application Server is affected by a cross-site scripting vulnerability (CVSS 9.3, IBM WebSphere Application Server)
- [CVE-2026-11712](https://cve.now/CVE-2026-11712.md): IBM WebSphere Application Server is affected by a cross-site scripting vulnerability (CVSS 9.3, IBM WebSphere Application Server)
- [CVE-2026-11714](https://cve.now/CVE-2026-11714.md): IBM WebSphere Application Server Liberty is affected by an authorization bypass vulnerability (CVSS 8.5, IBM WebSphere Application Server - Liberty)
- [CVE-2026-11806](https://cve.now/CVE-2026-11806.md): IBM WebSphere Application Server Liberty is affected by a an arbitrary file read vulnerability (CVSS 7.2, IBM WebSphere Application Server - Liberty)
- [CVE-2026-11906](https://cve.now/CVE-2026-11906.md): IBM® Db2® federated server is vulnerable to a denial of service due to improper neutralization of special elements in the data query logic of XMLTable-derived columns by autheticated user (CVSS 6.5, IBM Db2)
- [CVE-2026-12084](https://cve.now/CVE-2026-12084.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted Domains (CVSS 5.4, UCD - IBM DevOps Deploy)
- [CVE-2026-12085](https://cve.now/CVE-2026-12085.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptable to an Insertion of Sensitive Information Into Sent Data vulnerability (CVSS 6.5, UCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy)
- [CVE-2026-12086](https://cve.now/CVE-2026-12086.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Insertion of Sensitive Information into Log File Vulnerability (CVSS 6.2, UCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy)
- [CVE-2026-13449](https://cve.now/CVE-2026-13449.md): XXE attack in IBM Business Automation Manager Open Editions (CVSS 7.6, IBM Business Automation Manager Open Editions)
- [CVE-2026-13759](https://cve.now/CVE-2026-13759.md): IBM WebSphere eXtreme Scale is affected by Insecure Deserilization (CVSS 7.5, IBM WebSphere Extreme Scale)
- [CVE-2026-13772](https://cve.now/CVE-2026-13772.md): IBM WebSphere eXtreme Scale's OQL is affected by remote code execution (CVSS 7.5, IBM WebSphere Extreme Scale)
- [CVE-2026-13773](https://cve.now/CVE-2026-13773.md): IBM WebSphere eXtreme Scale is affected by server side request forgery when ORB is used as Transport Protocol (CVSS 6.0, IBM WebSphere Extreme Scale)
- [CVE-2026-3602](https://cve.now/CVE-2026-3602.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS toolkit is vulnerable to an sql injection (CVSS 4.7, IBM App Connect Enterprise · IBM Integration Bus for z/OS)
- [CVE-2026-7663](https://cve.now/CVE-2026-7663.md): Unauthenticated Cross-User MCP Resource Access and Tool Execution via Streamable Transport Authorization Bypass (CVSS 9.1, IBM Langflow OSS)
- [CVE-2026-7803](https://cve.now/CVE-2026-7803.md): Flow Validation Bypass via Empty Component Type Field (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-7871](https://cve.now/CVE-2026-7871.md): Insecure Deserialization in Redis Cache Backend (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-7873](https://cve.now/CVE-2026-7873.md): Code Injection Vulnerability in Code Validation Endpoint (CVSS 9.9, IBM Langflow OSS · langflow)
- [CVE-2026-7874](https://cve.now/CVE-2026-7874.md): Weak Cryptographic Key Derivation Exposed All Stored Credentials (CVSS 9.1, IBM Langflow OSS)
- [CVE-2026-9002](https://cve.now/CVE-2026-9002.md): IBM WebSphere eXtremes Scale is affected by uncontrolled resource consumption when XDF is enabled (CVSS 6.5, IBM WebSphere Extreme Scale)
- [CVE-2026-9836](https://cve.now/CVE-2026-9836.md): IBM DataStage Flow Designer application is affected by an information disclosure vulnerability (CVSS 3.5, IBM InfoSphere Information Server)
- [CVE-2026-58138](https://cve.now/CVE-2026-58138.md): Orkes Conductor 3.21.21 \< 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators (CVSS 9.3, conductor-oss conductor)
- [CVE-2026-10513](https://cve.now/CVE-2026-10513.md): Webmention \<= 5.8.0 - Unauthenticated Stored Cross-Site Scripting via MF2 'photo'/'url' Author Properties (CVSS 7.2, pfefferle Webmention)
- [CVE-2026-10655](https://cve.now/CVE-2026-10655.md): Use-after-free race in SNTP async client when closing the socket while the socket service is still polling it (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-10654](https://cve.now/CVE-2026-10654.md): RFCOMM session-disconnect race leaks session/L2CAP and denies further RFCOMM service in Zephyr Bluetooth Classic (CVSS 3.1, zephyrproject zephyr)
- [CVE-2026-8864](https://cve.now/CVE-2026-8864.md): HP Fan Control App – Potential Escalation of Privilege (CVSS 7.3, HP Fan Control App)
- [CVE-2026-10653](https://cve.now/CVE-2026-10653.md): Non-atomic \`net\_buf\` reference counts cause double-free / free-list corruption under concurrent unref (CVSS 6.4, zephyrproject zephyr)
- [CVE-2026-9263](https://cve.now/CVE-2026-9263.md): Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets (CVSS 6.5, zephyrproject zephyr)
- [CVE-2026-49451](https://cve.now/CVE-2026-49451.md): Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing (CVSS 7.5, microsoft OpenAPI.NET · Microsoft.OpenApi)
- [CVE-2026-58377](https://cve.now/CVE-2026-58377.md): JeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys (CVSS 8.1, JeecgBoot)
- [CVE-2026-58376](https://cve.now/CVE-2026-58376.md): Dolibarr - SQL Injection via sqlfilters Parameter in Multiple REST API List Endpoints (CVSS 7.6, dolibarr)
- [CVE-2026-58375](https://cve.now/CVE-2026-58375.md): JimuReport 2.5.0 - Unauthenticated Report Export via /jmreport/auto/export (CVSS 7.5, jeecgboot jimureport)
- [CVE-2026-58373](https://cve.now/CVE-2026-58373.md): CVAT \< 2.69.0 - Missing Authorization on Quality Reports parent\_id Filter Leaks Cross-Organization Report Existence (CVSS 4.3, cvat-ai cvat)
- [CVE-2026-58372](https://cve.now/CVE-2026-58372.md): SeaweedFS \< 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys (CVSS 8.1, seaweedfs · github.com/seaweedfs/seaweedfs)
- [CVE-2026-58371](https://cve.now/CVE-2026-58371.md): SeaweedFS \< 4.30 - Cross-Origin Information Disclosure via Unvalidated JSONP callback Parameter (CVSS 3.1, seaweedfs)
- [CVE-2026-58370](https://cve.now/CVE-2026-58370.md): Woodpecker \< 3.15.0 - GitLab Approval Gate Bypass via Spoofable Commit Author Name (CVSS 8.1, woodpecker-ci woodpecker)
- [CVE-2026-58369](https://cve.now/CVE-2026-58369.md): Woodpecker \< 3.15.0 - Unauthenticated NULL Pointer Dereference in /api/orgs/lookup Enables Log-Flooding Denial of Service (CVSS 5.3, woodpecker-ci woodpecker)
- [CVE-2026-58176](https://cve.now/CVE-2026-58176.md): RuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints (CVSS 6.5, dromara RuoYi-Vue-Plus)
- [CVE-2026-58174](https://cve.now/CVE-2026-58174.md): Hermes WebUI \< 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on Import (CVSS 6.5, nesquena hermes-webui)
- [CVE-2026-58173](https://cve.now/CVE-2026-58173.md): Vibe-Trading \< 0.1.10 - Path Traversal via Persistent Memory Type (CVSS 6.5, HKUDS Vibe-Trading)
- [CVE-2026-58172](https://cve.now/CVE-2026-58172.md): Ocelot - IP Allow/Block List Bypass for WebSocket Upgrade Requests (CVSS 9.1, ThreeMammals Ocelot)
- [CVE-2026-58171](https://cve.now/CVE-2026-58171.md): Vibe-Trading \< 0.1.10 - Path Traversal via Swarm Run Identifier (CVSS 4.2, HKUDS Vibe-Trading)
- [CVE-2026-58170](https://cve.now/CVE-2026-58170.md): Vibe-Trading \< 0.1.10 - Path Traversal in Proposal Identifier Allows Forging Live Trading Mandates (CVSS 8.3, HKUDS Vibe-Trading)
- [CVE-2026-58169](https://cve.now/CVE-2026-58169.md): Vibe-Trading \< 0.1.10 - Loopback Trust and Missing Host Validation Enable DNS-Rebinding Authentication Bypass and Remote Code Execution (CVSS 7.5, HKUDS Vibe-Trading)
- [CVE-2026-58168](https://cve.now/CVE-2026-58168.md): DeepTutor \< 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users (CVSS 8.8, HKUDS DeepTutor · deeptutor)
- [CVE-2026-58167](https://cve.now/CVE-2026-58167.md): Nightingale \< 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users (CVSS 6.5, ccfos nightingale · github.com/ccfos/nightingale/v6 +3)
- [CVE-2026-58166](https://cve.now/CVE-2026-58166.md): OpenBMB ChatDev - Unauthenticated Path Traversal in Upload Handler Allows Arbitrary File Write and Delete (CVSS 9.1, OpenBMB ChatDev)
- [CVE-2026-10652](https://cve.now/CVE-2026-10652.md): Out-of-bounds read in Zephyr DNS resolver TXT/SRV record parsing (unvalidated \`rdlength\`) (CVSS 4.8, zephyrproject zephyr)
- [CVE-2026-58165](https://cve.now/CVE-2026-58165.md): OpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation (CVSS 8.8, openziti ziti)
- [CVE-2026-13455](https://cve.now/CVE-2026-13455.md): PostgreSQL Anonymizer: Unrestricted function can leak the secret salt (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-44948](https://cve.now/CVE-2026-44948.md): Path Traversal in Rancher Fleet ImageScan GitRepo Path Handler (CVSS 5.3, SUSE Rancher)
- [CVE-2026-48315](https://cve.now/CVE-2026-48315.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 9.3, Adobe ColdFusion)
- [CVE-2026-48281](https://cve.now/CVE-2026-48281.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-48277](https://cve.now/CVE-2026-48277.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-48285](https://cve.now/CVE-2026-48285.md): ColdFusion | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 8.6, Adobe ColdFusion)
- [CVE-2026-48313](https://cve.now/CVE-2026-48313.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 9.3, Adobe ColdFusion)
- [CVE-2026-48307](https://cve.now/CVE-2026-48307.md): ColdFusion | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 8.8, Adobe ColdFusion)
- [CVE-2026-48314](https://cve.now/CVE-2026-48314.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 6.5, Adobe ColdFusion)
- [CVE-2026-48276](https://cve.now/CVE-2026-48276.md): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-48282](https://cve.now/CVE-2026-48282.md): ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) (CVSS 10.0, KEV, Adobe ColdFusion)
- [CVE-2026-48283](https://cve.now/CVE-2026-48283.md): ColdFusion | Unrestricted Upload of File with Dangerous Type (CWE-434) (CVSS 10.0, Adobe ColdFusion)
- [CVE-2026-48286](https://cve.now/CVE-2026-48286.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-4360](https://cve.now/CVE-2026-4360.md): Tarfile.extract() doesn't fully respect filter parameter (CVSS 2.0, Python Software Foundation CPython)
- [CVE-2026-44949](https://cve.now/CVE-2026-44949.md): Unauthenticated namespace creation and RBAC injection via rancher-webhook FleetWorkspace mutating webhook (CVSS 7.0, SUSE Rancher)
- [CVE-2026-27957](https://cve.now/CVE-2026-27957.md): Coolify: Authenticated RCE via command injection in CA certificate management feature (CVSS 8.8, coollabsio coolify)
- [CVE-2026-27956](https://cve.now/CVE-2026-27956.md): Coolify: Cross-team application domain enumeration via domains\_by\_server endpoint (CVSS 4.3, coollabsio coolify)
- [CVE-2026-27955](https://cve.now/CVE-2026-27955.md): Coolify: Command Injection via Single-Quote Breakout in \`executeInDocker()\` (CVSS 6.6, coollabsio coolify)
- [CVE-2026-27883](https://cve.now/CVE-2026-27883.md): Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure (CVSS 5.0, coollabsio coolify)
- [CVE-2026-48192](https://cve.now/CVE-2026-48192.md): A vulnerability has been identified in Mendix Studio Pro 10.11 (All versions), Mendix Studio Pro 10.12 (All versions), Mendix Studio Pro 10. (CVSS 5.4, Siemens Mendix Studio Pro)
- [CVE-2026-27881](https://cve.now/CVE-2026-27881.md): Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) (CVSS 5.0, coollabsio coolify)
- [CVE-2026-27882](https://cve.now/CVE-2026-27882.md): Coolify: Timing Attack in GitLab Webhook Token Validation (CVSS 4.8, coollabsio coolify)
- [CVE-2026-44947](https://cve.now/CVE-2026-44947.md): Stale PSA ClusterRoleBinding Persists After RoleTemplate Downgrade in Rancher (CVSS 6.9, SUSE Rancher)
- [CVE-2026-14178](https://cve.now/CVE-2026-14178.md): openGauss存在非法内存访问导致DoS漏洞 (CVSS 5.9, openGauss-server-7.0.0-RC2 · openGauss-server-7.0.0-RC1 +1)
- [CVE-2026-35098](https://cve.now/CVE-2026-35098.md): Improper Restriction of Excessive Authentication Attempts in KTM System e-BOK (CVSS 6.9, KTM System e-BOK)
- [CVE-2026-35097](https://cve.now/CVE-2026-35097.md): Weak Password Requirements in KTM System e-BOK (CVSS 6.9, KTM System e-BOK)
- [CVE-2026-35096](https://cve.now/CVE-2026-35096.md): Cross-Site Request Forgery (CSRF) in KTM System e-BOK (CVSS 5.1, KTM System e-BOK)
- [CVE-2026-35095](https://cve.now/CVE-2026-35095.md): Session fixation in KTM System e-BOK (CVSS 4.8, KTM System e-BOK)
- [CVE-2025-53648](https://cve.now/CVE-2025-53648.md): Apache Gravitino: SQL misconfiguration can access or truncate files (CVSS 5.4, Apache Software Foundation Apache Gravitino)
- [CVE-2026-14241](https://cve.now/CVE-2026-14241.md): Memory safety bugs fixed in Firefox 152.0.4 (CVSS 7.5, Mozilla Firefox)
- [CVE-2026-13474](https://cve.now/CVE-2026-13474.md): Denial of service via malformed HTTP/2 requests (CVSS 8.7, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-58016](https://cve.now/CVE-2026-58016.md): Glib: integer underflow in gio/gdbusintrospection.c via "g\_dbus\_node\_info\_new\_for\_xml" (CVSS 7.5, GNOME GLib · Red Hat Enterprise Linux +6)
- [CVE-2026-58015](https://cve.now/CVE-2026-58015.md): Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring\_lookup\_entry and mechanism\_client\_data\_receive (CVSS 5.9, GNOME GLib · Red Hat Enterprise Linux +7)
- [CVE-2026-10817](https://cve.now/CVE-2026-10817.md): Insufficient input validation leading to memory overread (CVSS 6.9, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-58014](https://cve.now/CVE-2026-58014.md): Glib: off-by-one error in glib/gkeyfile.c via "g\_key\_file\_get\_locale\_string\_list" (CVSS 7.3, GNOME GLib · Red Hat Enterprise Linux +7)
- [CVE-2026-58013](https://cve.now/CVE-2026-58013.md): Glib: buffer over-read in glib/giochannel.c via "g\_io\_channel\_read\_line\_backend" (CVSS 6.5, GNOME GLib · Red Hat Enterprise Linux +6)
- [CVE-2026-58012](https://cve.now/CVE-2026-58012.md): Glib: buffer over-read in g\_regex\_replace() via glib/gregex.c:string\_append() and g\_utf8\_next\_char() (CVSS 6.5, GNOME GLib · Red Hat Enterprise Linux +6)
- [CVE-2026-58011](https://cve.now/CVE-2026-58011.md): Glib: out-of-bounds read in glib/gdatetime.c:g\_date\_time\_get\_ymd via invalid gdatetime (CVSS 6.5, GNOME GLib · Red Hat Enterprise Linux +6)
- [CVE-2026-58010](https://cve.now/CVE-2026-58010.md): Glib: buffer over-read in glib/gvariant-serialiser.c via gvs\_tuple\_is\_normal() (CVSS 6.5, GNOME GLib · Red Hat Enterprise Linux +6)
- [CVE-2026-58116](https://cve.now/CVE-2026-58116.md): LLaMA-Factory 0.9.5 Remote Code Execution via WebUI Model Path (CVSS 9.3, hiyouga LlamaFactory)
- [CVE-2026-10816](https://cve.now/CVE-2026-10816.md): Arbitrary File Read (Unauthenticated) (CVSS 7.1, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-6556](https://cve.now/CVE-2026-6556.md): @fastify/express vulnerable to middleware bypass via non-string mount paths in prefixed plugins (CVSS 9.1, @fastify/express)
- [CVE-2026-8655](https://cve.now/CVE-2026-8655.md): Multiple Memory overflow vulnerabilities leading to unpredictable or erroneous behavior and Denial of Service (CVSS 8.8, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-8452](https://cve.now/CVE-2026-8452.md): Memory overflow vulnerability leading to unpredictable or erroneous behavior and Denial of Service (CVSS 8.8, KEV, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-58374](https://cve.now/CVE-2026-58374.md): In hostapd before 2.12, a missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing (CVSS 6.5, w1.fi hostapd)
- [CVE-2026-8451](https://cve.now/CVE-2026-8451.md): Insufficient input validation leading to memory overread (CVSS 8.8, NetScaler ADC · NetScaler Gateway)
- [CVE-2026-44946](https://cve.now/CVE-2026-44946.md): SAML Authentication Replay in Rancher (CVSS 9.5, SUSE Rancher)
- [CVE-2026-53433](https://cve.now/CVE-2026-53433.md): Denial of Service in fzf (CVSS 5.7, fzf · github.com/junegunn/fzf)
- [CVE-2026-53432](https://cve.now/CVE-2026-53432.md): Integer Overflow in fzf (CVSS 5.6, fzf)
- [CVE-2026-12388](https://cve.now/CVE-2026-12388.md): Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper (CVSS 6.5, Red Hat Build of Keycloak)
- [CVE-2026-4629](https://cve.now/CVE-2026-4629.md): Keycloak: keycloak: privilege escalation through hardcoded role mapper injection (CVSS 6.5, Red Hat build of Keycloak)
- [CVE-2026-14209](https://cve.now/CVE-2026-14209.md): Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions (CVSS 4.3, Red Hat build of Keycloak · Red Hat JBoss Enterprise Applic…)
- [CVE-2026-8403](https://cve.now/CVE-2026-8403.md): Stored XSS in Exagate's SYSGUARD 6001 (CVSS 6.1, Eksagate Electronic Engineering and Computer Industry Trade…)
- [CVE-2026-41053](https://cve.now/CVE-2026-41053.md): Over-inclusive team membership expansion in GitHub App authentication provider for Rancher (CVSS 8.8, SUSE Rancher · github.com/rancher/rancher)
- [CVE-2026-8402](https://cve.now/CVE-2026-8402.md): SQLi in Exagate's SYSGUARD 6001 (CVSS 9.8, Eksagate Electronic Engineering and Computer Industry Trade…)
- [CVE-2026-13766](https://cve.now/CVE-2026-13766.md): DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers (CVSS 9.8, EXODIST DBIx::QuickORM)
- [CVE-2026-53692](https://cve.now/CVE-2026-53692.md): Weak hashing algorithm in Redeight CMS (CVSS 5.9, Redeight CMS)
- [CVE-2026-53691](https://cve.now/CVE-2026-53691.md): Remote Code Execution in Redeight CMS (CVSS 8.6, Redeight CMS)
- [CVE-2026-53690](https://cve.now/CVE-2026-53690.md): SQL Injection in Redeight CMS (CVSS 9.3, Redeight CMS)
- [CVE-2026-57082](https://cve.now/CVE-2026-57082.md): Net::BitTorrent versions before 2.1.0 for Perl generate the MSE Diffie-Hellman private key with a non-cryptographic PRNG (CVSS 5.9, SANKO Net::BitTorrent)
- [CVE-2026-57081](https://cve.now/CVE-2026-57081.md): Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via deeply nested bencoded input (CVSS 7.5, SANKO Net::BitTorrent)
- [CVE-2026-57080](https://cve.now/CVE-2026-57080.md): Net::BitTorrent versions through 2.1.0 for Perl allow remote memory exhaustion via an uncapped peer-wire message-length prefix (CVSS 7.5, SANKO Net::BitTorrent)
- [CVE-2026-57079](https://cve.now/CVE-2026-57079.md): Net::BitTorrent versions before 2.1.0 for Perl write files outside the download directory via path traversal in peer-supplied metadata (CVSS 5.3, SANKO Net::BitTorrent)
- [CVE-2026-14162](https://cve.now/CVE-2026-14162.md): Advantech｜Hospital Quering Management - Missing Authentication (CVSS 9.3, Advantech Hospital Quering Management)
- [CVE-2026-14161](https://cve.now/CVE-2026-14161.md): Advantech｜Hospital Queuing Management - Sensitive Data Exposure (CVSS 8.7, Advantech Hospital Queuing Management)
- [CVE-2026-49434](https://cve.now/CVE-2026-49434.md): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: LdapNetworkConnector instantiates denied transports and a remote-properties broker (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Broker · Apache…)
- [CVE-2026-49432](https://cve.now/CVE-2026-49432.md): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: STOMP negative content-length enables denial of service (CVSS 7.5, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-49877](https://cve.now/CVE-2026-49877.md): Apache ActiveMQ: Authenticated web users retain admin access by default in the Web Console (CVSS 8.1, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-50734](https://cve.now/CVE-2026-50734.md): Apache ActiveMQ Client, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire memory-allocation DoS during wire format negotiation (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Client · Apache…)
- [CVE-2026-13316](https://cve.now/CVE-2026-13316.md): Foreman: ssrf to cloud metada service through unvalidated test\_url parameters in foreman config (CVSS 4.4, Red Hat Satellite)
- [CVE-2026-50750](https://cve.now/CVE-2026-50750.md): Apache ActiveMQ Broker, Apache ActiveMQ, Apache ActiveMQ All: Pre-authentication OpenWire DoS following fix for CVE-2026-49270 (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Broker · Apache…)
- [CVE-2026-52760](https://cve.now/CVE-2026-52760.md): Apache ActiveMQ, Apache ActiveMQ Web Console: Stored XSS via Unescaped values in ActiveMQ Web Console (CVSS 6.1, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-53916](https://cve.now/CVE-2026-53916.md): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Stomp: Unbounded header buffer in STOMP NIO codec (CVSS 7.5, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-53917](https://cve.now/CVE-2026-53917.md): Apache ActiveMQ, Apache ActiveMQ All, Apache ActiveMQ Client, Apache ActiveMQ Broker: Unbounded memory allocation in OpenWire property unmarshalling (CVSS 7.5, Apache Software Foundation Apache ActiveMQ)
- [CVE-2026-54475](https://cve.now/CVE-2026-54475.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Broker · Apac… +1)
- [CVE-2026-10763](https://cve.now/CVE-2026-10763.md): PROMOD V is using insecure HTTP communication instead of HTTPS. (CVSS 7.0, Hitachi Energy PROMOD V)
- [CVE-2026-8141](https://cve.now/CVE-2026-8141.md): Ajax Load More - Filters \<= 3.4.1 - Unauthenticated Stored Cross-Site Scripting via 'taxonomy\_include\_children' Field (CVSS 7.2, Connekt Media Ajax Load More - Filters)
- [CVE-2026-9711](https://cve.now/CVE-2026-9711.md): EventON - WordPress Virtual Event Calendar Plugin \<= 5.0.11 - Unauthenticated Blind SQL Injection via Search Parameter (CVSS 9.8, EventON (Pro) - WordPress Virtual Event Calendar Plugin)
- [CVE-2026-12076](https://cve.now/CVE-2026-12076.md): SQL Injection in Raytha CMS (CVSS 9.3, Raytha)
- [CVE-2025-7406](https://cve.now/CVE-2025-7406.md): A Sudo Privilege Escalation Vulnerability in Nokia MantaRay NM (CVSS 7.8, Nokia MantaRay NM)
- [CVE-2025-24816](https://cve.now/CVE-2025-24816.md): An Improper Access Control vulnerability in Nokia MantaRay NM (CVSS 6.5, Nokia MantaRay NM)
- [CVE-2025-24815](https://cve.now/CVE-2025-24815.md): An unrestricted file upload vulnerability in Nokia MantaRay NM (CVSS 7.8, Nokia MantaRay NM)
- [CVE-2026-6954](https://cve.now/CVE-2026-6954.md): Multiple vulnerabilities in Intermark IT's WebControl CMS (CVSS 5.1, Intermark IT WebControl CMS)
- [CVE-2026-6953](https://cve.now/CVE-2026-6953.md): Multiple vulnerabilities in Intermark IT's WebControl CMS (CVSS 5.1, Intermark IT WebControl CMS)
- [CVE-2026-13149](https://cve.now/CVE-2026-13149.md): brace-expansion through 5.0.6 is vulnerable to denial of service. (CVSS 7.7, juliangruber brace-expansion · brace-expansion)
- [CVE-2026-12610](https://cve.now/CVE-2026-12610.md): Sssd: use-after-free crash in sssd' 'sssd\_pam' process (CVSS 6.4, Red Hat Enterprise Linux · Red Hat Hardened Images +1)
- [CVE-2026-45822](https://cve.now/CVE-2026-45822.md): decode-uri-component through 0.4.1 is vulnerable to denial of service. (CVSS 6.6, SamVerschueren decode-uri-component · decode-uri-component)
- [CVE-2026-12578](https://cve.now/CVE-2026-12578.md): DTMSoft - Deserialization of Untrusted Data Vulnerability (CVSS 8.4, deltaww DTMSoft)
- [CVE-2026-12240](https://cve.now/CVE-2026-12240.md): Export User Data \<= 2.2.6 - Authenticated (Subscriber+) PHP Object Injection to Arbitrary File Deletion via display\_name Field (CVSS 8.0, qlstudio Export User Data)
- [CVE-2026-14164](https://cve.now/CVE-2026-14164.md): Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered\_buf pointer in init\_unpack() (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container P… +6)
- [CVE-2026-12819](https://cve.now/CVE-2026-12819.md): DVP-12SE Missing Authentication and Unauthorized Write access Vulnerability (CVSS 9.3, deltaww DVP-12SE)
- [CVE-2026-12818](https://cve.now/CVE-2026-12818.md): DVP-12SE Exposure of Sensitive Information Vulnerability (CVSS 9.3, deltaww DVP-12SE)
- [CVE-2026-56137](https://cve.now/CVE-2026-56137.md): RPG MAKER MV and MZ provided by Gotcha Gotcha Games Inc. (CVSS 7.8, Gotcha Gotcha Games RPG MAKER MV · Gotcha Gotcha Games RPG…)
- [CVE-2026-56809](https://cve.now/CVE-2026-56809.md): Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting v (CVSS 6.1, Ricoh Company Multiple laser printers and MFPs which implem…)
- [CVE-2026-56808](https://cve.now/CVE-2026-56808.md): DGM3103SCT provided by AVTECH Security Corporation contains an OS command injection vulnerability, which may lead to arbitrary command execu (CVSS 7.2, AVTECH Security DGM3103SCT)
- [CVE-2026-9576](https://cve.now/CVE-2026-9576.md): Fluent Booking \< 2.1.2 - Calendar Manager+ Sensitive Information Disclosure via Attendee Export (CVSS 4.9, Fluent Booking)
- [CVE-2026-11590](https://cve.now/CVE-2026-11590.md): WP Support Plus Responsive Ticket System \<= 9.1.2 - Unauthenticated SQL Injection via filter\[elements\] Array Keys (CVSS 8.6, WP Support Plus Responsive Ticket System)
- [CVE-2026-11589](https://cve.now/CVE-2026-11589.md): WP Support Plus Responsive Ticket System \<= 9.1.2 - Unauthenticated Stored XSS via File Upload (CVSS 8.8, WP Support Plus Responsive Ticket System)
- [CVE-2026-11581](https://cve.now/CVE-2026-11581.md): Kali Forms \< 2.4.13 - Contributor+ Stored XSS via Form Field Caption (CVSS 5.9, Kali Forms — Contact Form & Drag-and-Drop Builder)
- [CVE-2026-12073](https://cve.now/CVE-2026-12073.md): ProfileGrid - User Profiles, Groups and Communities \<= 5.9.9.5 - Unauthenticated Privilege Escalation via Email Overwrite (CVSS 9.8, metagauss ProfileGrid – User Profiles, Groups and Communiti…)
- [CVE-2026-11367](https://cve.now/CVE-2026-11367.md): PixMagix \<= 1.7.2 - Authenticated (Author+) Path Traversal in 'layers\[\].id' Parameter (CVSS 6.5, andrasweb PixMagix – WordPress Image Editor)
- [CVE-2026-12349](https://cve.now/CVE-2026-12349.md): Premium Addons for KingComposer \<= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add\_custom\_sidebar' and 'remove\_custom\_sidebar' AJAX actions (CVSS 5.3, octagonwebstudio Premium Addons for KingComposer)
- [CVE-2026-12560](https://cve.now/CVE-2026-12560.md): Editorial Rating \<= 4.0.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Link URL' Field (CVSS 4.4, wpqode Editorial Rating – Product Review & Rating System)
- [CVE-2026-8944](https://cve.now/CVE-2026-8944.md): Plugin for Google Analytics by IO technologies \<= 1.1 - Cross-Site Request Forgery via 'ga\_id' Parameter (CVSS 4.3, engagementanalytics Plugin for Google Analytics by IO techn…)
- [CVE-2026-12114](https://cve.now/CVE-2026-12114.md): Team Members \<= 8.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom\_css' Parameter (CVSS 4.4, wpmart Team Members – Multi Language Supported Team Plugin)
- [CVE-2026-14160](https://cve.now/CVE-2026-14160.md): Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. (CVSS 5.9, Samsung Open Source Escargot)
- [CVE-2026-58302](https://cve.now/CVE-2026-58302.md): rtapi\_app in linuxcnc-uspace in LinuxCNC before 2.9.9 allows privilege escalation. (CVSS 8.4, LinuxCNC)
- [CVE-2026-37106](https://cve.now/CVE-2026-37106.md): An issue in DokuWiki 2025-05-14b "Librarian" 56.2 allows a remote attacker to create an account via the register function in inc/auth.php. (CVSS 9.8)
- [CVE-2026-52193](https://cve.now/CVE-2026-52193.md): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (CVSS 7.5)
- [CVE-2026-52195](https://cve.now/CVE-2026-52195.md): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (CVSS 7.5)
- [CVE-2026-52196](https://cve.now/CVE-2026-52196.md): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (CVSS 7.5)
- [CVE-2026-52197](https://cve.now/CVE-2026-52197.md): An issue in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohead/sub\_44af70 componen (CVSS 7.5)
- [CVE-2026-52198](https://cve.now/CVE-2026-52198.md): Buffer Overflow vulnerability in UTT nv518G nv518GV3v3.2.7-210919-161313 allows a remote attacker to cause a denial of service via the gohea (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-06-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.