CVEs published July 30, 2026
662 CVEs were published on July 30, 2026: 110 critical, 194 high. 2 are now in CISA KEV.
- Published
- 662
- Critical
- 110
- High
- 194
- Medium
- 335
- Low
- 22
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 550
Most affected products
- Google Chrome
- 370
- Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- 20
- Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- 9
- ASUSTOR ADM
- 8
- MZ Automation libiec61850
- 8
- IBM Langflow OSS
- 7
- dfir-iris iris-web
- 6
- Gladinet CentreStack
- 6
- SGLang
- 6
- Apache Software Foundation Apache JSPWiki
- 5
Critical 110
- CVE-2026-66418OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Fieldtugcantopaloglu openclaw-dashboard
- CVE-2026-68503LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboardgrisuno LazyOwn
- CVE-2026-68502LazyOwn: Unauthenticated Socket.IO `input` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCEgrisuno LazyOwn
- CVE-2026-66803Azure Cosmos DB Remote Code Execution VulnerabilityMicrosoft Azure Cosmos DB
- CVE-2026-67208Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Consolesomta Juggle
- CVE-2026-67594Spikster Missing Authentication via API Route Groupyolanmees Spikster
- CVE-2026-12946Remote Code Execution in CUGA Component CodeAgentIBM Langflow OSS
- CVE-2026-66066Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingrails · activestorage
- CVE-2026-18245Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-reactAWS Amplify Codegen UI
- CVE-2026-15969CVE-2026-15969SGLang
- CVE-2026-15976CVE-2026-15976SGLang
- CVE-2026-15971CVE-2026-15971SGLang
- CVE-2026-12943This Power Hardware Management Console update is being released to addressIBM HMC
- CVE-2026-48499Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cacheactivepieces
- CVE-2026-12118IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted dataIBM webMethods Integration
- CVE-2026-13435Python Interpreter Sandbox Bypass Leading to Sensitive Data ExposureIBM Langflow OSS
- CVE-2026-12940Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpointsIBM Langflow OSS
- CVE-2026-52680Apache Kyuubi: REST batch multipart upload path traversal allows controlled file writeApache Software Foundation Apache Kyuubi
- CVE-2026-28323SolarWinds Web Help Desk SAML Authentication Bypass VulnerabilitySolarWinds Web Help Desk
- CVE-2026-28812Apache JSPWiki: UserManager does not sanity-check user database at startupApache Software Foundation Apache JSPWiki
- CVE-2026-4978SQLi in UMAI Vision's Traffic Analysis SystemUMAI Vision Traffic Analysis System
- CVE-2026-53431Boruta accepts expired JWT client assertions due to missing exp claim validationmalach-it boruta
- CVE-2026-11707Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application ManagerIBM Tivoli System Automation Application Manager
- CVE-2026-15435IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerabilityIBM App Connect Enterprise
- CVE-2026-47876VMXNET3 out-of-bounds write vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +2
- CVE-2026-54363CentreStack < 17.5 Hardcoded Key Token Forgery RCEGladinet CentreStack
- CVE-2026-59309vCenter authentication-bypass vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +3
- CVE-2026-59310vCenter directory-traversal vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +3
- CVE-2026-18363Weak password recovery mechanism in osTicket by Enhancesoft LLCEnhancesoft osTicket
- CVE-2026-7849Command Injection in SCM (idledisconnect parameter)Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44108Firewall bypass during shutdownPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44104ControllerAgent does not perform validation of firmwarePhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44101OCPP reconfiguration vulnerabilityPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44090Missing authentication for MQTT BrokerPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-58066Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did nRocket.Chat
- CVE-2026-58046Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitraWebPros Plesk
- CVE-2026-14602Remote API <= 0.2 - Unauthenticated PHP Object Injection via remote-api Query ParameterRemote API
- CVE-2026-16610Admin and Site Enhancements (ASE) Pro <= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup[input] Repeater Row KeyAdmin and Site Enhancements (ASE) Pro
- CVE-2026-48449Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)Adobe Campaign Classic
- CVE-2026-18015Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbGoogle Chrome
- CVE-2026-18002Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromiGoogle Chrome
- CVE-2026-17991Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-17990Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-17987Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-17947Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via aGoogle Chrome
- CVE-2026-17940Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attackeGoogle Chrome
- CVE-2026-17924Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-17865Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-17856Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-17855Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17848Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cGoogle Chrome
- CVE-2026-17847Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially performGoogle Chrome
- CVE-2026-17837Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-17834Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-17832Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17804Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17803Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-17801Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escGoogle Chrome
- CVE-2026-17768Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17749Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user toGoogle Chrome
- CVE-2026-17738Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-17758Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via aGoogle Chrome
- CVE-2026-17727Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox eGoogle Chrome
- CVE-2026-17726Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escaGoogle Chrome
- CVE-2026-17721Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via aGoogle Chrome
- CVE-2026-17718Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-17717Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crGoogle Chrome
- CVE-2026-17713Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker whoGoogle Chrome
- CVE-2026-17711Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-17710Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17709Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-17708Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17704Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17701Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromGoogle Chrome
- CVE-2026-17697Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-17695Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandGoogle Chrome
- CVE-2026-17692Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-17691Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox eGoogle Chrome
- CVE-2026-17688Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17687Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17684Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who haGoogle Chrome
- CVE-2026-17682Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2026-17681Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attackeGoogle Chrome
- CVE-2026-17680Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-17676Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-17675Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-17673Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-17672Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17671Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-17670Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17669Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perfoGoogle Chrome
- CVE-2026-17666Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass discGoogle Chrome
- CVE-2026-17656Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-17655Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially performGoogle Chrome
- CVE-2026-17652Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2026-17651Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentialGoogle Chrome
- CVE-2025-65336Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show_price_by_pdtId.php.
- CVE-2025-69930CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print_membership_card.php?id=1.
- CVE-2025-69931CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_membership.php?id=1.
- CVE-2025-69933CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1.
- CVE-2025-69934CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete_members.php?id=1.
- CVE-2025-69935CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue_report.php via the fromDate parameter
- CVE-2025-69936CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit_member.php?id=1.
- CVE-2025-69937CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit_type.php endpoint via the Parameter id.
- CVE-2025-69938CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType.
- CVE-2025-69941SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1.
- CVE-2025-69947SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1.
- CVE-2026-35847An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file
- CVE-2026-38709TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2
- CVE-2026-52539Outstatic CMS <= 2.1.9 contains a hardcoded JWT signing secret.
High 194
- CVE-2026-66360MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-66421OpenClaw Dashboard Stored XSS via lastMessage Session Fieldtugcantopaloglu openclaw-dashboard
- CVE-2026-65423o6 Automation open62541 Integer Overflow or Wraparoundo6 Automation open62541
- CVE-2026-63035o6 Automation open62541 Use After Freeo6 Automation open62541
- CVE-2026-66420MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate DeploymentsYlianst MeshCentral
- CVE-2026-63559o6 Automation open62541 Integer Overflow or Wraparoundo6 Automation open62541
- CVE-2026-18064NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer DereferenceNASA Core Flight System (cFS) Health & Safety (HS) Applicat…
- CVE-2026-64816RapidRAW < 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPathCyberTimon RapidRAW
- CVE-2026-12562Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical FunctionToptech Systems RCU II+ · Toptech Systems Multiload II+
- CVE-2026-62246Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolationclastix kamaji
- CVE-2026-55768GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of serviceallinurl goaccess
- CVE-2026-54715GoAccess: Heap Out-of-Bounds Write in parse_browser()allinurl goaccess
- CVE-2026-68500Sylius Mollie Plugin: Payment status forgery via the payment webhookSylius MolliePlugin · sylius/mollie-plugin
- CVE-2026-67207Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreControllerwolfcms
- CVE-2026-67206Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Uploadwolfcms
- CVE-2026-67527OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"opf openproject
- CVE-2026-11536IBM WebSphere Application Server is affected by a remote code execution vulnerabilityIBM WebSphere Application Server
- CVE-2026-13444Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpointsIBM Langflow OSS
- CVE-2026-18140Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated serversaws-smithy-json
- CVE-2024-25039IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilitiesIBM Engineering Requirements Management DOORS and DOORS Web…
- CVE-2026-15978CVE-2026-15978SGLang
- CVE-2026-15977CVE-2026-15977SGLang
- CVE-2026-10545IBM Planning Analytics Local is affected by Open RedirectIBM Planning Analytics Local
- CVE-2026-12733IBM DataPower Gateway affected by denial of serviceIBM DataPower Gateway 10.6CD · IBM DataPower Gateway
- CVE-2026-66416Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken MiddlewareLeantime
- CVE-2026-10535IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shellIBM Db2
- CVE-2026-61536Banks: Unsafe importlib.import_module of attacker-controlled Tool.import_path in CompletionExtension allows RCEmasci banks
- CVE-2026-66415Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import()Leantime
- CVE-2026-12942Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpointsIBM Langflow OSS
- CVE-2026-12945Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpointsIBM Langflow OSS
- CVE-2026-12932A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackersOpenVPN
- CVE-2026-11885Power System update in Buffer CopyIBM PowerVM Hypervisor
- CVE-2026-11771OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentiOpenVPN
- CVE-2026-54722dssrf: there a critical security bug with remove_at_symbol_in_stringHackingRepo dssrf-js · dssrf
- CVE-2026-62663Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document)masci banks
- CVE-2026-9322IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilitiesIBM WebSphere Application Server
- CVE-2026-10842IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerabilityIBM WebSphere Application Server
- CVE-2026-28814Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup RenderingApache Software Foundation Apache JSPWiki
- CVE-2026-28813Apache JSPWiki: JSPWiki vulnerable to JSON hijackingApache Software Foundation Apache JSPWiki
- CVE-2026-28811Apache JSPWiki: Error Handling - Reveals Error DetailsApache Software Foundation Apache JSPWiki
- CVE-2026-57862Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP NotationKanboard
- CVE-2026-15658foreUP customer REST API allows unauthenticated endpoint accessforeUP
- CVE-2026-58222Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributesRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-6540L7 policy bypass via unnormalized HTTP path matchingTigera Calico
- CVE-2026-67349OpenCost < 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypassopencost
- CVE-2026-67348Julep Insecure Direct Object Reference via GET /executions/{execution_id}julep-ai julep
- CVE-2026-67346Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypasskyegomez swarms
- CVE-2026-67345MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theftdromara MaxKey
- CVE-2026-11897IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2IBM WebSphere Application Server - Liberty
- CVE-2026-12947IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodesIBM App Connect Enterprise
- CVE-2026-65635Boruta dynamic client registration allows creation of over-privileged OAuth clientsmalach-it boruta
- CVE-2026-11980Code execution in IBM Desktop AppIBM Aspera Desktop App
- CVE-2026-14980IBM WebSphere Application Server Liberty is affected by a cross-site request forgeryIBM WebSphere Application Server - Liberty
- CVE-2026-14522IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settingsIBM App Connect Enterprise
- CVE-2026-14519IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settingsIBM App Connect Enterprise
- CVE-2026-16308IBM Enterprise Build of Quarkus is affected by a DoS vulnerabilityIBM Enterprise Build of Quarkus
- CVE-2026-67351Serendipity < 2.6.1 Authentication Bypass via Username Collisions9y Serendipity
- CVE-2026-5219CSRF in Softtr's E-Commerce PackSofttr Information Technology Trade Ltd. E-Commerce Pack
- CVE-2026-60075Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_timeDate-Manip
- CVE-2026-60074Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in checkDate-Manip
- CVE-2026-57859e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()e107inc e107
- CVE-2026-12722Authentication Bypass in FTC Software's E-Commerce Management PanelFTC Software IT Services FTC E-Commerce Management Panel
- CVE-2026-56428The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default conBosch BSH ELP (Electronic Platform) Modules
- CVE-2026-41703Out-of-bounds read vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +4
- CVE-2026-54368CentreStack < 17.4 SQL Injection via x-glad-filter HeaderGladinet CentreStack
- CVE-2026-54367CentreStack < 17.2 Unauthenticated API Authorization BypassGladinet CentreStack
- CVE-2026-54366CentreStack < 17.4 XXE via SharePoint Storage ConfigurationGladinet CentreStack
- CVE-2026-54365CentreStack < 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dllGladinet CentreStack
- CVE-2026-18378Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api_url (ssrf / confused deputy)Red Hat Cost Management
- CVE-2026-18381Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service_addressRed Hat Cost Management
- CVE-2026-17544Out-of-bounds write in bccomp() via crafted operand and scalePHP Group PHP
- CVE-2026-17543SQL injection in ext-pgsql via E'...' backslash breakoutPHP Group PHP
- CVE-2026-15397Subscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Actionwpswings Subscriptions for WooCommerce
- CVE-2026-22622Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticatedEaton PADM
- CVE-2026-22621Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticatedEaton PADM
- CVE-2026-22620Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote aEaton PADM
- CVE-2026-18361DFIR-IRIS Stored XSS in Datastore Uploaddfir-iris iris-web
- CVE-2026-18360DFIR-IRIS Stored XSS in Custom Attributesdfir-iris iris-web
- CVE-2026-16969DFIR-IRIS Stored XSS in Assetsdfir-iris iris-web
- CVE-2026-18353Unauthenticated SSRF in PIA via OIDC issuer allowlist bypassEclipse Foundation Eclipse CSI - PIA
- CVE-2026-44107Exposed Reboot via ModbusPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44106Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website filePhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44100JupiCore charging point reconfiguration without authPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44099Local Privilege Escalation via pppd password injectionPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44098OS Command Injection in OCPP Agent via charge_box_idPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44096udhcpc Privilege EscalationPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44095Local Privilege Escalation via Network scriptsPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44094Fallback to second RAUC slot with default credentialsPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44093Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start scriptPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44092Missing input validation / stripping of CRLF characters in SystemConfigManagerPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44091Creation of a new configuration by posting a malicious ID to MQTTPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-13584Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocolMitsubishi Electric MELSEC MX Controller MX-R model MX… +118
- CVE-2026-58043A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries.nodejs node
- CVE-2026-14239Tourmaster < 5.4.8 - Stored XSS via CSRFtourmaster
- CVE-2026-13395Bookly < 27.8 - Unauthenticated SQL Injection via staff_idOnline Scheduling and Appointment Booking System
- CVE-2026-13178Eventin < 4.1.16 - Unauthenticated Payment Bypass via Order Status ManipulationEventin
- CVE-2026-12500WP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option UpdateWP Travel Engine
- CVE-2026-15240Customer Switching for WooCommerce < 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator ResolutionCustomer Switching
- CVE-2026-12687ProfileGrid < 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group IDProfileGrid
- CVE-2026-16529Pcp: pcp: denial of service due to signed integer overflowRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-16527Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rulesRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-47882Spring Boot DevTools remote secret generated with a non-cryptographic PRNGSpring Tools for Eclipse
- CVE-2026-47873Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfacesSpring Tools for Eclipse
- CVE-2026-16526Pcp: pcp: privilege escalation to root via linux_sockets pmda vulnerabilityRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-47858live information startup mode is vulnerable for remote code executionSpring Tools for Eclipse · Spring Tools for VSCode / Cursor…
- CVE-2026-16524Pcp: pcp linux_sockets pmda: arbitrary command execution via command injectionRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-1360BuddyPress <= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field DataBuddyPress
- CVE-2026-14356FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST EndpointFleekDash
- CVE-2026-67248A stack-based buffer overflow vulnerability was found in the File Explorer on the ADMASUSTOR ADM
- CVE-2026-67247A path traversal vulnerability was found in the IHM Log handling of ADMASUSTOR ADM
- CVE-2026-67245A path traversal vulnerability was found in the VPN Clients on the ADMASUSTOR ADM
- CVE-2026-67244A format string vulnerability was found in the Notification OAuth settings of ADMASUSTOR ADM
- CVE-2026-18188A format string vulnerability was found in the Rsync Backup on the ADMASUSTOR ADM
- CVE-2026-18187A format string vulnerability was found in the Internal Backup on the ADMASUSTOR ADM
- CVE-2026-48448Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Campaign Classic
- CVE-2026-18186A stored format string vulnerability was found in the FTP Backup on the ADMASUSTOR ADM
- CVE-2026-16727Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exeASUS Armoury Crate
- CVE-2026-15929Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL ILG Electronics SmartShare
- CVE-2026-18017Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-18012Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-17995Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a cGoogle Chrome
- CVE-2026-17993Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious Google Chrome
- CVE-2026-17989Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17979Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML pGoogle Chrome
- CVE-2026-17971Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of boundsGoogle Chrome
- CVE-2026-17969Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code insideGoogle Chrome
- CVE-2026-17967Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corrupGoogle Chrome
- CVE-2026-17956Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code insidGoogle Chrome
- CVE-2026-17952Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious eGoogle Chrome
- CVE-2026-17951Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read viaGoogle Chrome
- CVE-2026-17950Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary cGoogle Chrome
- CVE-2026-17948Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to exGoogle Chrome
- CVE-2026-17935Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox Google Chrome
- CVE-2026-17930Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17922Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via aGoogle Chrome
- CVE-2026-17920Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to exGoogle Chrome
- CVE-2026-17918Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crGoogle Chrome
- CVE-2026-17916Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-17899Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2026-17898Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extensionGoogle Chrome
- CVE-2026-17896Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-17894Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2026-17888Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially performGoogle Chrome
- CVE-2026-17887Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gGoogle Chrome
- CVE-2026-17886Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a Google Chrome
- CVE-2026-17884Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2026-17881Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via aGoogle Chrome
- CVE-2026-17877Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level priGoogle Chrome
- CVE-2026-17875Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-17869Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a Google Chrome
- CVE-2026-17868Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation viaGoogle Chrome
- CVE-2026-17867Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform Google Chrome
- CVE-2026-17864Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilegGoogle Chrome
- CVE-2026-17863Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escGoogle Chrome
- CVE-2026-17862Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalatiGoogle Chrome
- CVE-2026-17861Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level pGoogle Chrome
- CVE-2026-17836Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17816Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-17811Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escapeGoogle Chrome
- CVE-2026-17807Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17786Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to iGoogle Chrome
- CVE-2026-17784Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-17778Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox viGoogle Chrome
- CVE-2026-17774Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged networkGoogle Chrome
- CVE-2026-17752Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2026-17751Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside Google Chrome
- CVE-2026-17750Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafGoogle Chrome
- CVE-2026-17744Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially performGoogle Chrome
- CVE-2026-17741Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentGoogle Chrome
- CVE-2026-17735Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-17729Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentialGoogle Chrome
- CVE-2026-17725Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17723Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-17722Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17719Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cGoogle Chrome
- CVE-2026-17716Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via maliciGoogle Chrome
- CVE-2026-17712Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craftGoogle Chrome
- CVE-2026-17705Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-17699Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malicGoogle Chrome
- CVE-2026-17698Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-oGoogle Chrome
- CVE-2026-17694Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craGoogle Chrome
- CVE-2026-17686Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-17685Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via Google Chrome
- CVE-2026-17678Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poGoogle Chrome
- CVE-2026-17677Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a Google Chrome
- CVE-2026-17665Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17663Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-17661Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a Google Chrome
- CVE-2026-17660Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-17658Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafGoogle Chrome
- CVE-2026-17657Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-17654Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicGoogle Chrome
- CVE-2026-17653Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2026-17650Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to Google Chrome
Medium, low and unrated 358
- CVE-2026-61893MZ Automation lib60870 Out-of-bounds ReadMZ Automation lib60870
- CVE-2026-63033MZ Automation lib60870 Out-of-bounds ReadMZ Automation lib60870
- CVE-2026-10031SFTPGo < 2.7.4 Permission Bypass via Symbolic Link Creationdrakkan SFTPGo
- CVE-2026-66720MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-66369MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-63550MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-65421MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-66364MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-66349MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-56758MZ Automation libiec61850 Out-of-bounds ReadMZ Automation libiec61850
- CVE-2026-63362o6 Automation open62541 Integer Underflowo6 Automation open62541
- CVE-2026-68563Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissionsRed Hat Enterprise Linux
- CVE-2026-68562Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tamperingRed Hat Enterprise Linux
- CVE-2026-5846Hard-coded Cryptographic Key in Watchfire ControllersWatchfire BC550 · Watchfire BC750 +2
- CVE-2026-62845Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL driversclastix kamaji
- CVE-2026-61526AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handleradonisjs http-server
- CVE-2026-55777GoAccess: Out-of-bounds heap read in parse_ios() via crafted User-Agent leads to remote crash/DoSallinurl goaccess
- CVE-2026-68501Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PIISylius MolliePlugin · sylius/mollie-plugin
- CVE-2026-68499re2: Global `String.prototype.match` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS)uhop node-re2 · re2
- CVE-2026-67550re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex` on a non-ASCII subject → uncatchable process crash (DoS)uhop node-re2 · re2
- CVE-2026-65835Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation)projectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2026-65834Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requestsprojectcapsule capsule · github.com/projectcapsule/capsule
- CVE-2026-67530WACRM: SSRF via the automation `send_webhook` actionArnasDon wacrm
- CVE-2026-67529OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)opf openproject
- CVE-2026-67528OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposureopf openproject
- CVE-2026-66756Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=falseApache Software Foundation Apache Tika
- CVE-2026-66755Apache Tika: Arbitrary Local File Read in ISArchiveParserApache Software Foundation Apache Tika
- CVE-2026-10569IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information VulnerabilityUCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy
- CVE-2024-40683IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password changeIBM Operations Analytics - Log Analysis
- CVE-2026-15974CVE-2026-15974SGLang
- CVE-2025-36374IBM DataPower Gateway affected by XML external entity injectionIBM DataPower Gateway 10.6CD · IBM DataPower Gateway
- CVE-2026-14227Insufficient session expiration in MikroTik RouterOSMikroTik RouterOS
- CVE-2026-59881AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflateaio-libs aiohttp · aiohttp
- CVE-2026-64870MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation1Panel-dev MaxKB
- CVE-2025-0152IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilitiesIBM Engineering Requirements Management DOORS and DOORS Web…
- CVE-2026-10695IBM® Db2® is vulnerable to a denial of service when running non fenced federated queriesIBM Db2
- CVE-2026-11904Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify AccessIBM Verify Identity Access · IBM Security Verify Access
- CVE-2026-10700Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User FilesIBM Langflow OSS
- CVE-2026-12996A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a deniaOpenVPN
- CVE-2026-66414Leantime Open Redirect in Login Controller via redirectUrl ParameterLeantime
- CVE-2026-54522MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosuremsgpack-ruby · msgpack
- CVE-2026-13117An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-frOpenVPN
- CVE-2026-13379The Windows interactive service in OpenVPN 2.7_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a serOpenVPN
- CVE-2026-23985Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserApache Software Foundation Apache Superset
- CVE-2026-23981Apache Superset: Improper Authorization in Chart Update allowing Dashboard ModificationApache Software Foundation Apache Superset
- CVE-2026-48910Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processingApache Software Foundation Apache JSPWiki
- CVE-2026-58216Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crashRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-15657foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentialsforeUP
- CVE-2026-44617Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867Apache Software Foundation Apache Zeppelin
- CVE-2026-44616Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter constructionApache Software Foundation Apache Zeppelin
- CVE-2026-44613Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handlingApache Software Foundation Apache Zeppelin
- CVE-2026-67596CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfgCSL Mobile Limited CSL 1010 M2M 3G WiFi Module
- CVE-2026-41186Unauthenticated Go pprof exposure in Calico debug serverTigera Calico
- CVE-2026-41187Calico Tier Authorization Bypass via DeleteCollectionTigera Calico
- CVE-2026-67347Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Updatevendurehq vendure
- CVE-2025-36431XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2025-36298Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File GatewayIBM Sterling B2B Integrator · IBM Sterling File Gateway
- CVE-2026-54885Server-side request forgery in Boruta OAuth request_uri and OpenID jwks_uri fetchingmalach-it boruta
- CVE-2026-11383Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application ManagerIBM Tivoli System Automation Application Manager
- CVE-2026-58218Samba: dns signing dos via tkey name cache exhaustionRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-41709ESX insufficient logging vulnerabilityVMware Cloud Foundation · VMware vSphere Foundation +2
- CVE-2026-54364CentreStack < 17.4 Session Injection via SelectProvider.aspxGladinet CentreStack
- CVE-2026-5582FuseWP <= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status ToggleFuseWP – WordPress User Sync to Email List & Marketing Auto…
- CVE-2026-18382Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token_urlRed Hat Cost Management
- CVE-2026-7260Stack overflow in phar with circular symlinksPHP Group PHP
- CVE-2026-18369Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirectsRed Hat Certificate System 10.4 EUS for RHEL-8 · Red Hat… +1
- CVE-2026-16970DFIR-IRIS Insufficient Logout Implementationdfir-iris iris-web
- CVE-2026-18362DFIR-IRIS Missing Brute Force Protection in User Authenticationdfir-iris iris-web
- CVE-2026-16971DFIR-IRIS Missing Brute Force Protection in OTP Validationdfir-iris iris-web
- CVE-2022-4994KVM: x86: wean fast IN from emulator_pio_inLinux
- CVE-2026-44105Cleartext password in logsPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44103JupiCore does not perform validation of firmwarePhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44102OCPP Firmware download is not properly lockedPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-44097File Upload vulnerabilityPhoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2
- CVE-2026-56847A flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`.nodejs node
- CVE-2026-56850A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to benodejs node
- CVE-2026-64635Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated attVeeam Service Provider Console
- CVE-2026-58040An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incompnodejs node
- CVE-2026-14310Tutor LMS < 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply InjectionTutor LMS
- CVE-2026-14305WP Delicious < 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe_likesWP Delicious
- CVE-2026-13345Essential Addons for Elementor - Lite < 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare TableEssential Addons for Elementor
- CVE-2026-13344Essential Addons for Elementor - Lite < 6.6.10 - Contributor+ Stored XSS via Pricing Table Title TagEssential Addons for Elementor
- CVE-2026-13330Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG UploadAnimation Addons for Elementor
- CVE-2026-13145WP Travel < 11.8.1 - Subscriber+ Booking PII Disclosure via IDORWP Travel
- CVE-2026-13143WP Travel < 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPNWP Travel
- CVE-2026-11881Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time FieldFluent Forms
- CVE-2026-11870Hide My WP Ghost < 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism BypassWP Ghost
- CVE-2026-11867Frontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing AuthorizationFrontend Admin by DynamiApps
- CVE-2026-11782Points and Rewards for WooCommerce < 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDORPoints and Rewards for WooCommerce
- CVE-2026-15382Ultimate Addons for WPBakery Page Builder < 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fontsUltimate Addons for WPBakery Page Builder
- CVE-2026-15257RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission and User Profile ModificationRegistrationMagic
- CVE-2026-15255RegistrationMagic < 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDORRegistrationMagic
- CVE-2026-15252Search Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API AccessSearch Atlas SEO
- CVE-2026-15250LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking FunnelAppointment Booking Plugin
- CVE-2026-14318GiveWP < 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template SettingsGiveWP
- CVE-2026-14231LifterLMS < 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2_query_postsLifterLMS
- CVE-2026-14207LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing InformationLifterLMS
- CVE-2026-15235Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX ActionMotoPress Hotel Booking
- CVE-2026-15153WP Hotel Booking < 2.3.2 - Hotel Manager+ SQL Injection via Booking List SearchWP Hotel Booking
- CVE-2026-15054Bit Form < 3.1.2 - Unauthenticated Inactive Form SubmissionBit Form
- CVE-2026-14923Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/ModificationSync Post With Other Site
- CVE-2026-14592WP Real IP-based Access Control <= 1.3.1 - Unauthenticated Stored XSS via acl_ctrl_addrWP Real IP-based Access Control
- CVE-2026-14226Easy Appointments < 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments ListingEasy Appointments
- CVE-2026-14223Easy Appointments < 3.12.28 - Subscriber+ Customer PII Disclosure via IDOREasy Appointments
- CVE-2026-14222Easy Appointments < 3.12.28 - Contributor+ Connection Deletion via Missing AuthorizationEasy Appointments
- CVE-2026-14221Easy Appointments <= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing AuthorizationEasy Appointments
- CVE-2026-14188Easy Appointments < 3.12.28 - Contributor+ Customer Data DisclosureEasy Appointments
- CVE-2026-16531Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servletRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-59326HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language ServerSpring Tools for Eclipse · Spring Tools for VSCode / Cursor…
- CVE-2026-16530Pcp: pcp: remote denial of service and information leakageRed Hat Enterprise Linux · Red Hat OpenShift Container Plat…
- CVE-2026-59328Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency TooltipsSpring Tools for Eclipse
- CVE-2026-59327Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch ConfigurationsSpring Tools for Eclipse
- CVE-2026-67246A path traversal vulnerability was found in the Wallpaper component of ADMASUSTOR ADM
- CVE-2026-1982Persian Elementor (المنتور فارسی) <= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widgetmohammadr3z المنتور فارسی
- CVE-2026-16092Improved Save Button <= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta_key' Parameterlabelblanc Improved Save Button
- CVE-2026-18019Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-18018Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing vGoogle Chrome
- CVE-2026-18016Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoGoogle Chrome
- CVE-2026-18014Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioGoogle Chrome
- CVE-2026-18013Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-18011Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentiallyGoogle Chrome
- CVE-2026-18010Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicGoogle Chrome
- CVE-2026-18009Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spooGoogle Chrome
- CVE-2026-18008Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via maliciGoogle Chrome
- CVE-2026-18007Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing viGoogle Chrome
- CVE-2026-18006Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-18005Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-18004Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-18003Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-18001Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-18000Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the Google Chrome
- CVE-2026-17999Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a craftGoogle Chrome
- CVE-2026-17998Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious Google Chrome
- CVE-2026-17997Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendererGoogle Chrome
- CVE-2026-17996Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restricGoogle Chrome
- CVE-2026-17994Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restGoogle Chrome
- CVE-2026-17992Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive inforGoogle Chrome
- CVE-2026-17988Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17986Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17985Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a cGoogle Chrome
- CVE-2026-17984Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin datGoogle Chrome
- CVE-2026-17983Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17982Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pGoogle Chrome
- CVE-2026-17981Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2026-17980Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engaGoogle Chrome
- CVE-2026-17978Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitGoogle Chrome
- CVE-2026-17977Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.Google Chrome
- CVE-2026-17976Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-17975Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitiveGoogle Chrome
- CVE-2026-17974Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictioGoogle Chrome
- CVE-2026-17973Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitivGoogle Chrome
- CVE-2026-17972Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17970Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network Google Chrome
- CVE-2026-17968Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-17966Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitivGoogle Chrome
- CVE-2026-17965Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via Google Chrome
- CVE-2026-17964Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crGoogle Chrome
- CVE-2026-17963Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-17962Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML Google Chrome
- CVE-2026-17961Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation reGoogle Chrome
- CVE-2026-17960Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-refeGoogle Chrome
- CVE-2026-17959Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-17958Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a craftedGoogle Chrome
- CVE-2026-17957Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-17955Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofGoogle Chrome
- CVE-2026-17954Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page.Google Chrome
- CVE-2026-17953Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2026-17949Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-17946Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obtaGoogle Chrome
- CVE-2026-17945Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17944Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2026-17943Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy vGoogle Chrome
- CVE-2026-17942Side-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-17941Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2026-17939Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spooGoogle Chrome
- CVE-2026-17938Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17937Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioGoogle Chrome
- CVE-2026-17936Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage inGoogle Chrome
- CVE-2026-17934Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioGoogle Chrome
- CVE-2026-17933Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via aGoogle Chrome
- CVE-2026-17932Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive iGoogle Chrome
- CVE-2026-17931Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictionsGoogle Chrome
- CVE-2026-17929Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatioGoogle Chrome
- CVE-2026-17928Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-17927Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2026-17926Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a useGoogle Chrome
- CVE-2026-17925Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin poliGoogle Chrome
- CVE-2026-17923Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafteGoogle Chrome
- CVE-2026-17921Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17919Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege eGoogle Chrome
- CVE-2026-17917Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretGoogle Chrome
- CVE-2026-17915Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing Google Chrome
- CVE-2026-17914Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive iGoogle Chrome
- CVE-2026-17913Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17912Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2026-17911Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-17910Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2026-17909Insufficient validation of untrusted input in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak crGoogle Chrome
- CVE-2026-17908Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had Google Chrome
- CVE-2026-17907Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2026-17906Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-17905Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data vGoogle Chrome
- CVE-2026-17904Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin datGoogle Chrome
- CVE-2026-17903Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to inGoogle Chrome
- CVE-2026-17902Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dataGoogle Chrome
- CVE-2026-17901Insufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypassGoogle Chrome
- CVE-2026-17900Inappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-originGoogle Chrome
- CVE-2026-17897Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-17895Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagGoogle Chrome
- CVE-2026-17893Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had comprGoogle Chrome
- CVE-2026-17892Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-17891Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-17890Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-17889Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17885Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2026-17883Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via Google Chrome
- CVE-2026-17882Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extensioGoogle Chrome
- CVE-2026-17880Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17879Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17878Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-17876Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17874Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17873Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discretGoogle Chrome
- CVE-2026-17872Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a saGoogle Chrome
- CVE-2026-17871Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2026-17870Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment Google Chrome
- CVE-2026-17866Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-17860Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof thGoogle Chrome
- CVE-2026-17859Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17858Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2026-17857Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crGoogle Chrome
- CVE-2026-17854Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy viaGoogle Chrome
- CVE-2026-17853Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-17852Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy Google Chrome
- CVE-2026-17851Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17850Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy vGoogle Chrome
- CVE-2026-17849Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contentGoogle Chrome
- CVE-2026-17846Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-17845Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-17844Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment Google Chrome
- CVE-2026-17843Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-17842Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-17841Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paGoogle Chrome
- CVE-2026-17840Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafteGoogle Chrome
- CVE-2026-17839Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17838Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing Google Chrome
- CVE-2026-17835Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17833Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-17831Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromiseGoogle Chrome
- CVE-2026-17830Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2026-17829Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-17828Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17827Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-17826Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a userGoogle Chrome
- CVE-2026-17825Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretiGoogle Chrome
- CVE-2026-17824Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin polGoogle Chrome
- CVE-2026-17823Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via Google Chrome
- CVE-2026-17822Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML paGoogle Chrome
- CVE-2026-17821Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-17820Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2026-17819Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via Google Chrome
- CVE-2026-17818Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTMGoogle Chrome
- CVE-2026-17817Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-17815Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viaGoogle Chrome
- CVE-2026-17814Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypGoogle Chrome
- CVE-2026-17813Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatGoogle Chrome
- CVE-2026-17812Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing Google Chrome
- CVE-2026-17810Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagGoogle Chrome
- CVE-2026-17809Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17808Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2026-17806Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-17805Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation reGoogle Chrome
- CVE-2026-17802Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2026-17800Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensiGoogle Chrome
- CVE-2026-17799Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass discGoogle Chrome
- CVE-2026-17798Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craftGoogle Chrome
- CVE-2026-17797Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UGoogle Chrome
- CVE-2026-17796Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive Google Chrome
- CVE-2026-17795Inappropriate implementation in GetUserMedia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17794Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had coGoogle Chrome
- CVE-2026-17793Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofingGoogle Chrome
- CVE-2026-17792Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofiGoogle Chrome
- CVE-2026-17791Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-17790Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-17789Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypGoogle Chrome
- CVE-2026-17788Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafGoogle Chrome
- CVE-2026-17787Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via Google Chrome
- CVE-2026-17785Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17783Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craGoogle Chrome
- CVE-2026-17782Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of thGoogle Chrome
- CVE-2026-17781Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2026-17780Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation resGoogle Chrome
- CVE-2026-17779Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation viGoogle Chrome
- CVE-2026-17777Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17776Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2026-17775Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-17773Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2026-17772Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a Google Chrome
- CVE-2026-17771Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagGoogle Chrome
- CVE-2026-17770Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-17769Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2026-17767Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had cGoogle Chrome
- CVE-2026-17766Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak Google Chrome
- CVE-2026-17765Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-17764Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a cGoogle Chrome
- CVE-2026-17763Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-17762Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-originGoogle Chrome
- CVE-2026-17761Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to injGoogle Chrome
- CVE-2026-17760Side-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-17759Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information frGoogle Chrome
- CVE-2026-17757Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pagGoogle Chrome
- CVE-2026-17756Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrGoogle Chrome
- CVE-2026-17755Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious Google Chrome
- CVE-2026-17754Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a cGoogle Chrome
- CVE-2026-17753Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2026-17748Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-17747Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had Google Chrome
- CVE-2026-17746Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-17745Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potGoogle Chrome
- CVE-2026-17743Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pGoogle Chrome
- CVE-2026-17742Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2026-17740Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17739Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a Google Chrome
- CVE-2026-17737Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-17736Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had cGoogle Chrome
- CVE-2026-17734Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTGoogle Chrome
- CVE-2026-17733Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data Google Chrome
- CVE-2026-17731Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dGoogle Chrome
- CVE-2026-17730Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engagGoogle Chrome
- CVE-2026-17732Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2026-17728Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or Google Chrome
- CVE-2026-17724Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) vGoogle Chrome
- CVE-2026-17720Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendeGoogle Chrome
- CVE-2026-17715Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage iGoogle Chrome
- CVE-2026-17714Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information froGoogle Chrome
- CVE-2026-17707Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-17706Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had comGoogle Chrome
- CVE-2026-17703Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigatGoogle Chrome
- CVE-2026-17702Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-17700Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised thGoogle Chrome
- CVE-2026-17696Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a Google Chrome
- CVE-2026-17693Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data viGoogle Chrome
- CVE-2026-17690Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-Google Chrome
- CVE-2026-17689Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17683Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infoGoogle Chrome
- CVE-2026-17679Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had comproGoogle Chrome
- CVE-2026-17674Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy viaGoogle Chrome
- CVE-2026-17668Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17667Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-17664Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-17662Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via Google Chrome
- CVE-2026-17659Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-59952Valibot: record() issue paths can make flatten() throw for inherited Object property namesopen-circle valibot · valibot
- CVE-2026-62946ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit buildsImageMagick · Magick.NET-Q16-AnyCPU +5
- CVE-2026-62363ImageMagick: Heap Buffer Over-Write in fx operationImageMagick · Magick.NET-Q16-AnyCPU +16
- CVE-2025-51684CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2025-65341Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit_product.php.
- CVE-2025-65342code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field.