# CVEs published 2026-07-30

662 CVEs were published on July 30, 2026: 110 critical, 194 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-61893](https://cve.now/CVE-2026-61893.md): MZ Automation lib60870 Out-of-bounds Read (CVSS 6.5, MZ Automation lib60870)
- [CVE-2026-63033](https://cve.now/CVE-2026-63033.md): MZ Automation lib60870 Out-of-bounds Read (CVSS 6.5, MZ Automation lib60870)
- [CVE-2026-10031](https://cve.now/CVE-2026-10031.md): SFTPGo \< 2.7.4 Permission Bypass via Symbolic Link Creation (CVSS 5.3, drakkan SFTPGo)
- [CVE-2026-66720](https://cve.now/CVE-2026-66720.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-66369](https://cve.now/CVE-2026-66369.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-63550](https://cve.now/CVE-2026-63550.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-65421](https://cve.now/CVE-2026-65421.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-66364](https://cve.now/CVE-2026-66364.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-66349](https://cve.now/CVE-2026-66349.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-56758](https://cve.now/CVE-2026-56758.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 6.5, MZ Automation libiec61850)
- [CVE-2026-66360](https://cve.now/CVE-2026-66360.md): MZ Automation libiec61850 Out-of-bounds Read (CVSS 7.5, MZ Automation libiec61850)
- [CVE-2026-66421](https://cve.now/CVE-2026-66421.md): OpenClaw Dashboard Stored XSS via lastMessage Session Field (CVSS 8.8, tugcantopaloglu openclaw-dashboard)
- [CVE-2026-63362](https://cve.now/CVE-2026-63362.md): o6 Automation open62541 Integer Underflow (CVSS 5.9, o6 Automation open62541)
- [CVE-2026-65423](https://cve.now/CVE-2026-65423.md): o6 Automation open62541 Integer Overflow or Wraparound (CVSS 8.8, o6 Automation open62541)
- [CVE-2026-63035](https://cve.now/CVE-2026-63035.md): o6 Automation open62541 Use After Free (CVSS 8.1, o6 Automation open62541)
- [CVE-2026-66420](https://cve.now/CVE-2026-66420.md): MeshCentral Cross-Site WebSocket Hijacking via Origin Validation Bypass on Self-Signed Certificate Deployments (CVSS 8.6, Ylianst MeshCentral)
- [CVE-2026-63559](https://cve.now/CVE-2026-63559.md): o6 Automation open62541 Integer Overflow or Wraparound (CVSS 7.5, o6 Automation open62541)
- [CVE-2026-18064](https://cve.now/CVE-2026-18064.md): NASA Core Flight System (cFS) Health & Safety (HS) Application NULL Pointer Dereference (CVSS 7.5, NASA Core Flight System (cFS) Health & Safety (HS) Applicat…)
- [CVE-2026-64816](https://cve.now/CVE-2026-64816.md): RapidRAW \< 1.6.0 NTLMv2 Credential Leak via UNC Path in lutPath (CVSS 7.1, CyberTimon RapidRAW)
- [CVE-2026-12562](https://cve.now/CVE-2026-12562.md): Toptech Systems RCU II+ and Multiload II+ Missing Authentication for Critical Function (CVSS 8.8, Toptech Systems RCU II+ · Toptech Systems Multiload II+)
- [CVE-2026-68563](https://cve.now/CVE-2026-68563.md): Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2026-68562](https://cve.now/CVE-2026-68562.md): Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2026-5846](https://cve.now/CVE-2026-5846.md): Hard-coded Cryptographic Key in Watchfire Controllers (CVSS 5.7, Watchfire BC550 · Watchfire BC750 +2)
- [CVE-2026-62845](https://cve.now/CVE-2026-62845.md): Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers (CVSS 4.7, clastix kamaji)
- [CVE-2026-62246](https://cve.now/CVE-2026-62246.md): Kamaji: TenantControlPlane namespace/name collision binds two tenants to the same SQL datastore schema + DB user, breaking per-tenant isolation (CVSS 8.5, clastix kamaji)
- [CVE-2026-61526](https://cve.now/CVE-2026-61526.md): AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler (CVSS 6.1, adonisjs http-server)
- [CVE-2026-66418](https://cve.now/CVE-2026-66418.md): OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field (CVSS 9.3, tugcantopaloglu openclaw-dashboard)
- [CVE-2026-68503](https://cve.now/CVE-2026-68503.md): LazyOwn: Default C2 Operator Credentials Enable Administrative Access to C2 Dashboard (CVSS 9.8, grisuno LazyOwn)
- [CVE-2026-68502](https://cve.now/CVE-2026-68502.md): LazyOwn: Unauthenticated Socket.IO \`input\` Event Reaches LazyOwn Command Dispatcher — Unauthenticated RCE (CVSS 9.8, grisuno LazyOwn)
- [CVE-2026-55777](https://cve.now/CVE-2026-55777.md): GoAccess: Out-of-bounds heap read in parse\_ios() via crafted User-Agent leads to remote crash/DoS (CVSS 5.3, allinurl goaccess)
- [CVE-2026-55768](https://cve.now/CVE-2026-55768.md): GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service (CVSS 8.7, allinurl goaccess)
- [CVE-2026-66803](https://cve.now/CVE-2026-66803.md): Azure Cosmos DB Remote Code Execution Vulnerability (CVSS 10.0, Microsoft Azure Cosmos DB)
- [CVE-2026-68501](https://cve.now/CVE-2026-68501.md): Sylius Mollie Plugin: Unauthenticated IDOR leaks order token and customer PII (CVSS 6.5, Sylius MolliePlugin · sylius/mollie-plugin)
- [CVE-2026-54715](https://cve.now/CVE-2026-54715.md): GoAccess: Heap Out-of-Bounds Write in parse\_browser() (CVSS 7.1, allinurl goaccess)
- [CVE-2026-68500](https://cve.now/CVE-2026-68500.md): Sylius Mollie Plugin: Payment status forgery via the payment webhook (CVSS 7.5, Sylius MolliePlugin · sylius/mollie-plugin)
- [CVE-2026-68499](https://cve.now/CVE-2026-68499.md): re2: Global \`String.prototype.match\` with an empty-matchable pattern never advances → infinite loop with unbounded native memory growth (DoS) (CVSS 6.2, uhop node-re2 · re2)
- [CVE-2026-67550](https://cve.now/CVE-2026-67550.md): re2: Out-of-bounds heap read in \`exec\`/\`test\`/\`match\` via attacker-influenced \`lastIndex\` on a non-ASCII subject → uncatchable process crash (DoS) (CVSS 5.7, uhop node-re2 · re2)
- [CVE-2026-65835](https://cve.now/CVE-2026-65835.md): Capsule: Incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators still allow cluster-scoped resource creation (cross-tenant privilege escalation) (CVSS 6.6, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-65834](https://cve.now/CVE-2026-65834.md): Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing MustCompile panic on all Node admission requests (CVSS 6.8, projectcapsule capsule · github.com/projectcapsule/capsule)
- [CVE-2026-67530](https://cve.now/CVE-2026-67530.md): WACRM: SSRF via the automation \`send\_webhook\` action (CVSS 6.4, ArnasDon wacrm)
- [CVE-2026-67207](https://cve.now/CVE-2026-67207.md): Wolf CMS 0.8.3.1 Authorization Bypass via BackupRestoreController (CVSS 8.7, wolfcms)
- [CVE-2026-67529](https://cve.now/CVE-2026-67529.md): OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check) (CVSS 4.3, opf openproject)
- [CVE-2026-67206](https://cve.now/CVE-2026-67206.md): Wolf CMS 0.8.3.1 Authenticated RCE via FileManagerController File Upload (CVSS 8.7, wolfcms)
- [CVE-2026-67528](https://cve.now/CVE-2026-67528.md): OpenProject: Improper Access Control through /api/v3/custom\_options/:id via Path "id" leads to Sensitive Data Exposure (CVSS 4.3, opf openproject)
- [CVE-2026-67527](https://cve.now/CVE-2026-67527.md): OpenProject: Improper Access Control through /api/v3/work\_packages/\<X.id\> via PATCH parameter "fileLinks" (CVSS 7.6, opf openproject)
- [CVE-2026-66756](https://cve.now/CVE-2026-66756.md): Apache Tika: unpack endpoint in tika-server allows configuration with unsecureFeatures=false (CVSS 6.9, Apache Software Foundation Apache Tika)
- [CVE-2026-67208](https://cve.now/CVE-2026-67208.md): Juggle 1.6.0 Unauthenticated RCE via Exposed H2 Console (CVSS 9.3, somta Juggle)
- [CVE-2026-66755](https://cve.now/CVE-2026-66755.md): Apache Tika: Arbitrary Local File Read in ISArchiveParser (CVSS 5.9, Apache Software Foundation Apache Tika)
- [CVE-2026-67594](https://cve.now/CVE-2026-67594.md): Spikster Missing Authentication via API Route Group (CVSS 9.3, yolanmees Spikster)
- [CVE-2026-10569](https://cve.now/CVE-2026-10569.md): IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Exposure of Sensitive Information Vulnerability (CVSS 4.3, UCD - IBM UrbanCode Deploy · UCD - IBM DevOps Deploy)
- [CVE-2026-11536](https://cve.now/CVE-2026-11536.md): IBM WebSphere Application Server is affected by a remote code execution vulnerability (CVSS 8.5, IBM WebSphere Application Server)
- [CVE-2026-12946](https://cve.now/CVE-2026-12946.md): Remote Code Execution in CUGA Component CodeAgent (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-13444](https://cve.now/CVE-2026-13444.md): Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 8.1, IBM Langflow OSS)
- [CVE-2026-18140](https://cve.now/CVE-2026-18140.md): Uncontrolled recursion in the aws-smithy-json unknown-key skip path allows unauthenticated remote denial of service in smithy-rs generated servers (CVSS 7.5, aws-smithy-json)
- [CVE-2026-66066](https://cve.now/CVE-2026-66066.md): Action Pack: Possible arbitrary file read and remote code execution in Active Storage variant processing (CVSS 9.5, rails · activestorage)
- [CVE-2024-25039](https://cve.now/CVE-2024-25039.md): IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities (CVSS 7.5, IBM Engineering Requirements Management DOORS and DOORS Web…)
- [CVE-2026-18245](https://cve.now/CVE-2026-18245.md): Incomplete fix for CVE-2025-4318 code injection in Amazon @aws-amplify/codegen-ui-react (CVSS 9.0, AWS Amplify Codegen UI)
- [CVE-2024-40683](https://cve.now/CVE-2024-40683.md): IBM Operations Analytics - Log Analysis is affected by a TOCTOU weakness allowing active sessions to persist beyond a password change (CVSS 6.3, IBM Operations Analytics - Log Analysis)
- [CVE-2026-15969](https://cve.now/CVE-2026-15969.md): CVE-2026-15969 (CVSS 9.8, SGLang)
- [CVE-2026-15978](https://cve.now/CVE-2026-15978.md): CVE-2026-15978 (CVSS 7.5, SGLang)
- [CVE-2026-15977](https://cve.now/CVE-2026-15977.md): CVE-2026-15977 (CVSS 7.5, SGLang)
- [CVE-2026-15976](https://cve.now/CVE-2026-15976.md): CVE-2026-15976 (CVSS 9.8, SGLang)
- [CVE-2026-15974](https://cve.now/CVE-2026-15974.md): CVE-2026-15974 (CVSS 6.5, SGLang)
- [CVE-2026-15971](https://cve.now/CVE-2026-15971.md): CVE-2026-15971 (CVSS 9.8, SGLang)
- [CVE-2026-10545](https://cve.now/CVE-2026-10545.md): IBM Planning Analytics Local is affected by Open Redirect (CVSS 7.5, IBM Planning Analytics Local)
- [CVE-2026-12943](https://cve.now/CVE-2026-12943.md): This Power Hardware Management Console update is being released to address (CVSS 9.8, IBM HMC)
- [CVE-2026-12733](https://cve.now/CVE-2026-12733.md): IBM DataPower Gateway affected by denial of service (CVSS 7.5, IBM DataPower Gateway 10.6CD · IBM DataPower Gateway)
- [CVE-2025-36374](https://cve.now/CVE-2025-36374.md): IBM DataPower Gateway affected by XML external entity injection (CVSS 5.5, IBM DataPower Gateway 10.6CD · IBM DataPower Gateway)
- [CVE-2026-14227](https://cve.now/CVE-2026-14227.md): Insufficient session expiration in MikroTik RouterOS (CVSS 6.9, MikroTik RouterOS)
- [CVE-2026-59881](https://cve.now/CVE-2026-59881.md): AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate (CVSS 6.9, aio-libs aiohttp · aiohttp)
- [CVE-2026-48499](https://cve.now/CVE-2026-48499.md): Activepieces: Cross-tenant data exposure and code injection via the Code piece sandbox cache (CVSS 9.3, activepieces)
- [CVE-2026-64870](https://cve.now/CVE-2026-64870.md): MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation (CVSS 5.3, 1Panel-dev MaxKB)
- [CVE-2026-12118](https://cve.now/CVE-2026-12118.md): IBM webMethods Integration could allow an unauthenticated remote attacker to execute arbitrary code on the system due to the deserialization of untrusted data (CVSS 9.8, IBM webMethods Integration)
- [CVE-2026-66416](https://cve.now/CVE-2026-66416.md): Leantime CSRF Protection Globally Disabled by Omission of Laravel VerifyCsrfToken Middleware (CVSS 8.6, Leantime)
- [CVE-2025-0152](https://cve.now/CVE-2025-0152.md): IBM Engineering Requirements Management DOORS and DOORS Web Access is affected by multiple vulnerabilities (CVSS 6.1, IBM Engineering Requirements Management DOORS and DOORS Web…)
- [CVE-2026-10535](https://cve.now/CVE-2026-10535.md): IBM® Db2® is vulnerable to buffer overflow in setgid helper db2flacc which can lead to privilege escalation and instance compromise from an unprivileged shell (CVSS 8.4, IBM Db2)
- [CVE-2026-10695](https://cve.now/CVE-2026-10695.md): IBM® Db2® is vulnerable to a denial of service when running non fenced federated queries (CVSS 6.2, IBM Db2)
- [CVE-2026-11904](https://cve.now/CVE-2026-11904.md): Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access (CVSS 5.3, IBM Verify Identity Access · IBM Security Verify Access)
- [CVE-2026-10700](https://cve.now/CVE-2026-10700.md): Broken Access Control Vulnerabilities in Langflow 1.0.0 - 1.8.4 File Handling API Allowed Unauthorized Access to User Files (CVSS 6.5, IBM Langflow OSS)
- [CVE-2026-61536](https://cve.now/CVE-2026-61536.md): Banks: Unsafe importlib.import\_module of attacker-controlled Tool.import\_path in CompletionExtension allows RCE (CVSS 7.5, masci banks)
- [CVE-2026-66415](https://cve.now/CVE-2026-66415.md): Leantime Server-Side Request Forgery and Local File Inclusion in Blueprints::import() (CVSS 8.4, Leantime)
- [CVE-2026-13435](https://cve.now/CVE-2026-13435.md): Python Interpreter Sandbox Bypass Leading to Sensitive Data Exposure (CVSS 9.9, IBM Langflow OSS)
- [CVE-2026-12942](https://cve.now/CVE-2026-12942.md): Langflow is affected by path traversal due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 7.5, IBM Langflow OSS)
- [CVE-2026-12945](https://cve.now/CVE-2026-12945.md): Langflow is affected by exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 7.1, IBM Langflow OSS)
- [CVE-2026-12932](https://cve.now/CVE-2026-12932.md): A memory leak in the tls-crypt-v2 client key extraction in OpenVPN 2.5.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote attackers (CVSS 7.1, OpenVPN)
- [CVE-2026-12940](https://cve.now/CVE-2026-12940.md): Langflow is affected by remote code execution due to multiple unauthenticated and insufficiently authorized API endpoints (CVSS 9.8, IBM Langflow OSS)
- [CVE-2026-12996](https://cve.now/CVE-2026-12996.md): A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denia (CVSS 6.0, OpenVPN)
- [CVE-2026-11885](https://cve.now/CVE-2026-11885.md): Power System update in Buffer Copy (CVSS 8.4, IBM PowerVM Hypervisor)
- [CVE-2026-11771](https://cve.now/CVE-2026-11771.md): OpenVPN version 2.1.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authenti (CVSS 7.0, OpenVPN)
- [CVE-2026-66414](https://cve.now/CVE-2026-66414.md): Leantime Open Redirect in Login Controller via redirectUrl Parameter (CVSS 5.1, Leantime)
- [CVE-2026-54522](https://cve.now/CVE-2026-54522.md): MessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure (CVSS 2.1, msgpack-ruby · msgpack)
- [CVE-2026-13117](https://cve.now/CVE-2026-13117.md): An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7\_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-fr (CVSS 6.0, OpenVPN)
- [CVE-2026-13379](https://cve.now/CVE-2026-13379.md): The Windows interactive service in OpenVPN 2.7\_alpha1 through 2.7.4 allows remote attackers to cause persistent DNS state pollution or a ser (CVSS 5.1, OpenVPN)
- [CVE-2026-54722](https://cve.now/CVE-2026-54722.md): dssrf: there a critical security bug with remove\_at\_symbol\_in\_string (CVSS 8.7, HackingRepo dssrf-js · dssrf)
- [CVE-2026-62663](https://cve.now/CVE-2026-62663.md): Banks: Arbitrary File Read via Path Traversal in Media Filters (image/audio/video/document) (CVSS 7.5, masci banks)
- [CVE-2026-9322](https://cve.now/CVE-2026-9322.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by multiple vulnerabilities (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2026-23985](https://cve.now/CVE-2026-23985.md): Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser (CVSS 5.3, Apache Software Foundation Apache Superset)
- [CVE-2026-23981](https://cve.now/CVE-2026-23981.md): Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification (CVSS 5.3, Apache Software Foundation Apache Superset)
- [CVE-2026-52680](https://cve.now/CVE-2026-52680.md): Apache Kyuubi: REST batch multipart upload path traversal allows controlled file write (CVSS 9.8, Apache Software Foundation Apache Kyuubi)
- [CVE-2026-10842](https://cve.now/CVE-2026-10842.md): IBM WebSphere Application Server and WebSphere Application Server Liberty are affected by a security bypass vulnerability (CVSS 7.5, IBM WebSphere Application Server)
- [CVE-2026-48910](https://cve.now/CVE-2026-48910.md): Apache JSPWiki: Markdown parser allows XSS injection in Markdown error processing (CVSS 6.5, Apache Software Foundation Apache JSPWiki)
- [CVE-2026-28323](https://cve.now/CVE-2026-28323.md): SolarWinds Web Help Desk SAML Authentication Bypass Vulnerability (CVSS 9.8, SolarWinds Web Help Desk)
- [CVE-2026-28814](https://cve.now/CVE-2026-28814.md): Apache JSPWiki: Pre-Authentication Arbitrary Wiki Markup Rendering (CVSS 7.5, Apache Software Foundation Apache JSPWiki)
- [CVE-2026-28813](https://cve.now/CVE-2026-28813.md): Apache JSPWiki: JSPWiki vulnerable to JSON hijacking (CVSS 8.8, Apache Software Foundation Apache JSPWiki)
- [CVE-2026-28812](https://cve.now/CVE-2026-28812.md): Apache JSPWiki: UserManager does not sanity-check user database at startup (CVSS 9.8, Apache Software Foundation Apache JSPWiki)
- [CVE-2026-28811](https://cve.now/CVE-2026-28811.md): Apache JSPWiki: Error Handling - Reveals Error Details (CVSS 7.5, Apache Software Foundation Apache JSPWiki)
- [CVE-2026-58216](https://cve.now/CVE-2026-58216.md): Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash (CVSS 5.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-57862](https://cve.now/CVE-2026-57862.md): Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation (CVSS 8.4, Kanboard)
- [CVE-2026-15657](https://cve.now/CVE-2026-15657.md): foreUP customer REST API allows authenticated users to read cleartext payment-processor merchant credentials (CVSS 6.5, foreUP)
- [CVE-2026-44617](https://cve.now/CVE-2026-44617.md): Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 (CVSS 6.5, Apache Software Foundation Apache Zeppelin)
- [CVE-2026-44616](https://cve.now/CVE-2026-44616.md): Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction (CVSS 6.5, Apache Software Foundation Apache Zeppelin)
- [CVE-2026-44613](https://cve.now/CVE-2026-44613.md): Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling (CVSS 6.1, Apache Software Foundation Apache Zeppelin)
- [CVE-2026-15658](https://cve.now/CVE-2026-15658.md): foreUP customer REST API allows unauthenticated endpoint access (CVSS 8.1, foreUP)
- [CVE-2026-58222](https://cve.now/CVE-2026-58222.md): Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes (CVSS 8.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-67596](https://cve.now/CVE-2026-67596.md): CSL 1010 M2M 3G WiFi Module 2.2.1.4 Weak Encryption via Router.cfg (CVSS 6.9, CSL Mobile Limited CSL 1010 M2M 3G WiFi Module)
- [CVE-2026-4978](https://cve.now/CVE-2026-4978.md): SQLi in UMAI Vision's Traffic Analysis System (CVSS 9.8, UMAI Vision Traffic Analysis System)
- [CVE-2026-41186](https://cve.now/CVE-2026-41186.md): Unauthenticated Go pprof exposure in Calico debug server (CVSS 6.0, Tigera Calico)
- [CVE-2026-41187](https://cve.now/CVE-2026-41187.md): Calico Tier Authorization Bypass via DeleteCollection (CVSS 6.2, Tigera Calico)
- [CVE-2026-6540](https://cve.now/CVE-2026-6540.md): L7 policy bypass via unnormalized HTTP path matching (CVSS 7.9, Tigera Calico)
- [CVE-2026-67349](https://cve.now/CVE-2026-67349.md): OpenCost \< 1.121.0 Unauthenticated Helm Values Exposure and Admin Bypass (CVSS 8.7, opencost)
- [CVE-2026-67348](https://cve.now/CVE-2026-67348.md): Julep Insecure Direct Object Reference via GET /executions/{execution\_id} (CVSS 8.6, julep-ai julep)
- [CVE-2026-67347](https://cve.now/CVE-2026-67347.md): Vendure 3.7.1 Cross-Channel Authorization Bypass via StockLocation and Asset Update (CVSS 6.1, vendurehq vendure)
- [CVE-2026-67346](https://cve.now/CVE-2026-67346.md): Swarms 6.8.1 Server-Side Request Forgery via DNS Rebinding Bypass (CVSS 7.7, kyegomez swarms)
- [CVE-2026-67345](https://cve.now/CVE-2026-67345.md): MaxKey 4.1.12 DefaultRedirectResolver OAuth Authorization Code Theft (CVSS 8.5, dromara MaxKey)
- [CVE-2025-36431](https://cve.now/CVE-2025-36431.md): XSS Security Vulnerability in response header affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2025-36298](https://cve.now/CVE-2025-36298.md): Security Vulnerability in Ebics server affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVSS 5.4, IBM Sterling B2B Integrator · IBM Sterling File Gateway)
- [CVE-2026-11897](https://cve.now/CVE-2026-11897.md): IBM WebSphere Application Server Liberty is affected by a denial of service vulnerability with HTTP/2 (CVSS 7.5, IBM WebSphere Application Server - Liberty)
- [CVE-2026-12947](https://cve.now/CVE-2026-12947.md): IBM App Connect Enterprise is vulnerable to Confidentiality disclosure on Discovery Connector nodes (CVSS 7.5, IBM App Connect Enterprise)
- [CVE-2026-53431](https://cve.now/CVE-2026-53431.md): Boruta accepts expired JWT client assertions due to missing exp claim validation (CVSS 9.1, malach-it boruta)
- [CVE-2026-65635](https://cve.now/CVE-2026-65635.md): Boruta dynamic client registration allows creation of over-privileged OAuth clients (CVSS 8.3, malach-it boruta)
- [CVE-2026-54885](https://cve.now/CVE-2026-54885.md): Server-side request forgery in Boruta OAuth request\_uri and OpenID jwks\_uri fetching (CVSS 6.9, malach-it boruta)
- [CVE-2026-11980](https://cve.now/CVE-2026-11980.md): Code execution in IBM Desktop App (CVSS 7.3, IBM Aspera Desktop App)
- [CVE-2026-11707](https://cve.now/CVE-2026-11707.md): Multiple vulnerabilities have been identified in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager (CVSS 9.3, IBM Tivoli System Automation Application Manager)
- [CVE-2026-11383](https://cve.now/CVE-2026-11383.md): Cross-site Scripting in IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager (CVSS 5.4, IBM Tivoli System Automation Application Manager)
- [CVE-2026-14980](https://cve.now/CVE-2026-14980.md): IBM WebSphere Application Server Liberty is affected by a cross-site request forgery (CVSS 8.3, IBM WebSphere Application Server - Liberty)
- [CVE-2026-15435](https://cve.now/CVE-2026-15435.md): IBM App Connect Enterprise is vulnerable to arbitrary file write vulnerability (CVSS 9.8, IBM App Connect Enterprise)
- [CVE-2026-14522](https://cve.now/CVE-2026-14522.md): IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (CVSS 8.8, IBM App Connect Enterprise)
- [CVE-2026-14519](https://cve.now/CVE-2026-14519.md): IBM App Connect Enterprise is vulnerable to an arbitrary file read and arbitrary changes to configuration settings (CVSS 7.5, IBM App Connect Enterprise)
- [CVE-2026-16308](https://cve.now/CVE-2026-16308.md): IBM Enterprise Build of Quarkus is affected by a DoS vulnerability (CVSS 7.5, IBM Enterprise Build of Quarkus)
- [CVE-2026-58218](https://cve.now/CVE-2026-58218.md): Samba: dns signing dos via tkey name cache exhaustion (CVSS 5.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-67351](https://cve.now/CVE-2026-67351.md): Serendipity \< 2.6.1 Authentication Bypass via Username Collision (CVSS 8.7, s9y Serendipity)
- [CVE-2026-5219](https://cve.now/CVE-2026-5219.md): CSRF in Softtr's E-Commerce Pack (CVSS 8.3, Softtr Information Technology Trade Ltd. E-Commerce Pack)
- [CVE-2026-60075](https://cve.now/CVE-2026-60075.md): Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in \_parse\_time (CVSS 7.5, Date-Manip)
- [CVE-2026-60074](https://cve.now/CVE-2026-60074.md): Date::Manip versions through 7.00 for Perl return corrupted dates via non-ASCII decimal digits that pass the numeric range tests in check (CVSS 7.5, Date-Manip)
- [CVE-2026-57859](https://cve.now/CVE-2026-57859.md): e107 Second-Order Code Execution via eval()-Based Deserialization in e\_array::unserialize() (CVSS 7.7, e107inc e107)
- [CVE-2026-12722](https://cve.now/CVE-2026-12722.md): Authentication Bypass in FTC Software's E-Commerce Management Panel (CVSS 8.2, FTC Software IT Services FTC E-Commerce Management Panel)
- [CVE-2026-56428](https://cve.now/CVE-2026-56428.md): The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerability due to an improperly secured default con (CVSS 8.1, Bosch BSH ELP (Electronic Platform) Modules)
- [CVE-2026-41709](https://cve.now/CVE-2026-41709.md): ESX insufficient logging vulnerability (CVSS 2.7, KEV, VMware Cloud Foundation · VMware vSphere Foundation +2)
- [CVE-2026-41703](https://cve.now/CVE-2026-41703.md): Out-of-bounds read vulnerability (CVSS 7.6, VMware Cloud Foundation · VMware vSphere Foundation +4)
- [CVE-2026-47876](https://cve.now/CVE-2026-47876.md): VMXNET3 out-of-bounds write vulnerability (CVSS 9.3, VMware Cloud Foundation · VMware vSphere Foundation +2)
- [CVE-2026-54368](https://cve.now/CVE-2026-54368.md): CentreStack \< 17.4 SQL Injection via x-glad-filter Header (CVSS 8.7, Gladinet CentreStack)
- [CVE-2026-54367](https://cve.now/CVE-2026-54367.md): CentreStack \< 17.2 Unauthenticated API Authorization Bypass (CVSS 8.8, Gladinet CentreStack)
- [CVE-2026-54366](https://cve.now/CVE-2026-54366.md): CentreStack \< 17.4 XXE via SharePoint Storage Configuration (CVSS 8.7, Gladinet CentreStack)
- [CVE-2026-54365](https://cve.now/CVE-2026-54365.md): CentreStack \< 17.3 Unauthenticated User Creation via Deserialization in GSNamespace.dll (CVSS 8.7, Gladinet CentreStack)
- [CVE-2026-54364](https://cve.now/CVE-2026-54364.md): CentreStack \< 17.4 Session Injection via SelectProvider.aspx (CVSS 6.9, Gladinet CentreStack)
- [CVE-2026-54363](https://cve.now/CVE-2026-54363.md): CentreStack \< 17.5 Hardcoded Key Token Forgery RCE (CVSS 9.3, Gladinet CentreStack)
- [CVE-2026-59309](https://cve.now/CVE-2026-59309.md): vCenter authentication-bypass vulnerability (CVSS 9.8, VMware Cloud Foundation · VMware vSphere Foundation +3)
- [CVE-2026-59310](https://cve.now/CVE-2026-59310.md): vCenter directory-traversal vulnerability (CVSS 9.8, KEV, VMware Cloud Foundation · VMware vSphere Foundation +3)
- [CVE-2026-5582](https://cve.now/CVE-2026-5582.md): FuseWP \<= 1.1.24.2 - Cross-Site Request Forgery to Sync Rule Status Toggle (CVSS 4.3, FuseWP – WordPress User Sync to Email List & Marketing Auto…)
- [CVE-2026-18382](https://cve.now/CVE-2026-18382.md): Project-koku/koku-metrics-operator: koku-metrics-operator: service-account client credentials sent to user-controlled token\_url (CVSS 6.8, Red Hat Cost Management)
- [CVE-2026-18378](https://cve.now/CVE-2026-18378.md): Project-koku/koku-metrics-operator: koku-metrics-operator: cluster pull-secret token exfiltration via user-controlled api\_url (ssrf / confused deputy) (CVSS 7.6, Red Hat Cost Management)
- [CVE-2026-18381](https://cve.now/CVE-2026-18381.md): Project-koku/koku-metrics-operator: koku-metrics-operator: operator service-account token exfiltration via user-controlled prometheus service\_address (CVSS 7.6, Red Hat Cost Management)
- [CVE-2026-7260](https://cve.now/CVE-2026-7260.md): Stack overflow in phar with circular symlinks (CVSS 5.4, PHP Group PHP)
- [CVE-2026-17544](https://cve.now/CVE-2026-17544.md): Out-of-bounds write in bccomp() via crafted operand and scale (CVSS 8.1, PHP Group PHP)
- [CVE-2026-17543](https://cve.now/CVE-2026-17543.md): SQL injection in ext-pgsql via E'...' backslash breakout (CVSS 8.1, PHP Group PHP)
- [CVE-2026-15397](https://cve.now/CVE-2026-15397.md): Subscriptions for WooCommerce \<= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps\_sfw\_install\_plugin\_configuration AJAX Action (CVSS 7.2, wpswings Subscriptions for WooCommerce)
- [CVE-2026-18363](https://cve.now/CVE-2026-18363.md): Weak password recovery mechanism in osTicket by Enhancesoft LLC (CVSS 9.1, Enhancesoft osTicket)
- [CVE-2026-18369](https://cve.now/CVE-2026-18369.md): Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects (CVSS 5.8, Red Hat Certificate System 10.4 EUS for RHEL-8 · Red Hat… +1)
- [CVE-2026-22622](https://cve.now/CVE-2026-22622.md): Improper input validation in one of the session management interface of Eaton's Tripp Lite series PADM firmware could allow an authenticated (CVSS 8.8, Eaton PADM)
- [CVE-2026-22621](https://cve.now/CVE-2026-22621.md): Improper input validation in one of the session management interface of Eaton's Tripp Lite Series PADM firmware could allow an authenticated (CVSS 8.3, Eaton PADM)
- [CVE-2026-22620](https://cve.now/CVE-2026-22620.md): Improper input validation in the authentication component of Eaton's Tripp Lite series PADM firmware could allow an unauthenticated remote a (CVSS 8.6, Eaton PADM)
- [CVE-2026-16970](https://cve.now/CVE-2026-16970.md): DFIR-IRIS Insufficient Logout Implementation (CVSS 4.2, dfir-iris iris-web)
- [CVE-2026-18362](https://cve.now/CVE-2026-18362.md): DFIR-IRIS Missing Brute Force Protection in User Authentication (CVSS 5.9, dfir-iris iris-web)
- [CVE-2026-16971](https://cve.now/CVE-2026-16971.md): DFIR-IRIS Missing Brute Force Protection in OTP Validation (CVSS 5.9, dfir-iris iris-web)
- [CVE-2026-18361](https://cve.now/CVE-2026-18361.md): DFIR-IRIS Stored XSS in Datastore Upload (CVSS 7.6, dfir-iris iris-web)
- [CVE-2026-18360](https://cve.now/CVE-2026-18360.md): DFIR-IRIS Stored XSS in Custom Attributes (CVSS 7.6, dfir-iris iris-web)
- [CVE-2026-16969](https://cve.now/CVE-2026-16969.md): DFIR-IRIS Stored XSS in Assets (CVSS 7.6, dfir-iris iris-web)
- [CVE-2022-4994](https://cve.now/CVE-2022-4994.md): KVM: x86: wean fast IN from emulator\_pio\_in (no CVSS, Linux)
- [CVE-2026-18353](https://cve.now/CVE-2026-18353.md): Unauthenticated SSRF in PIA via OIDC issuer allowlist bypass (CVSS 8.8, Eclipse Foundation Eclipse CSI - PIA)
- [CVE-2026-7849](https://cve.now/CVE-2026-7849.md): Command Injection in SCM (idledisconnect parameter) (CVSS 9.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44108](https://cve.now/CVE-2026-44108.md): Firewall bypass during shutdown (CVSS 9.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44107](https://cve.now/CVE-2026-44107.md): Exposed Reboot via Modbus (CVSS 8.7, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44105](https://cve.now/CVE-2026-44105.md): Cleartext password in logs (CVSS 5.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44106](https://cve.now/CVE-2026-44106.md): Local Privilege Escalation vulnerability in /etc/init.d/user-applications via customer website file (CVSS 8.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44104](https://cve.now/CVE-2026-44104.md): ControllerAgent does not perform validation of firmware (CVSS 9.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44103](https://cve.now/CVE-2026-44103.md): JupiCore does not perform validation of firmware (CVSS 6.9, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44102](https://cve.now/CVE-2026-44102.md): OCPP Firmware download is not properly locked (CVSS 6.9, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44101](https://cve.now/CVE-2026-44101.md): OCPP reconfiguration vulnerability (CVSS 9.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44100](https://cve.now/CVE-2026-44100.md): JupiCore charging point reconfiguration without auth (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44099](https://cve.now/CVE-2026-44099.md): Local Privilege Escalation via pppd password injection (CVSS 8.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44098](https://cve.now/CVE-2026-44098.md): OS Command Injection in OCPP Agent via charge\_box\_id (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44097](https://cve.now/CVE-2026-44097.md): File Upload vulnerability (CVSS 5.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44096](https://cve.now/CVE-2026-44096.md): udhcpc Privilege Escalation (CVSS 8.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44095](https://cve.now/CVE-2026-44095.md): Local Privilege Escalation via Network scripts (CVSS 8.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44094](https://cve.now/CVE-2026-44094.md): Fallback to second RAUC slot with default credentials (CVSS 8.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44093](https://cve.now/CVE-2026-44093.md): Local Privilege Escalation vulnerability in /etc/init.d/user-applications via user-application start script (CVSS 8.5, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44092](https://cve.now/CVE-2026-44092.md): Missing input validation / stripping of CRLF characters in SystemConfigManager (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44091](https://cve.now/CVE-2026-44091.md): Creation of a new configuration by posting a malicious ID to MQTT (CVSS 8.8, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-44090](https://cve.now/CVE-2026-44090.md): Missing authentication for MQTT Broker (CVSS 9.3, Phoenix Contact CHARX SEC-3150 · Phoenix Contact CHARX S… +2)
- [CVE-2026-13584](https://cve.now/CVE-2026-13584.md): Information tampering and Denial-of-service (DoS) vulnerability in CC-Link IE TSN communication protocol (CVSS 7.1, Mitsubishi Electric MELSEC MX Controller MX-R model MX… +118)
- [CVE-2026-58066](https://cve.now/CVE-2026-58066.md): Rocket.Chat's SAML SSO before versions 8.7.0, 8.6.1, 8.5.2, 8.4.5, 8.3.7, 8.2.7, 8.1.7, 8.0.8, and 7.10.14 verified XML signatures but did n (CVSS 9.8, Rocket.Chat)
- [CVE-2026-56847](https://cve.now/CVE-2026-56847.md): A flaw in Node.js Permission Model enforcement allows \`trace\_events.createTracing().enable()\` Writes Trace Logs Outside \`--allow-fs-write\`. (CVSS 3.3, nodejs node)
- [CVE-2026-58043](https://cve.now/CVE-2026-58043.md): A flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. (CVSS 7.5, nodejs node)
- [CVE-2026-56850](https://cve.now/CVE-2026-56850.md): A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be (CVSS 4.1, nodejs node)
- [CVE-2026-58046](https://cve.now/CVE-2026-58046.md): Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitra (CVSS 9.9, WebPros Plesk)
- [CVE-2026-64635](https://cve.now/CVE-2026-64635.md): Improper handling of the returnUrl parameter in the Forgot Password function of Veeam Service Provider Console allows an unauthenticated att (CVSS 5.3, Veeam Service Provider Console)
- [CVE-2026-58040](https://cve.now/CVE-2026-58040.md): An incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomp (CVSS 6.3, nodejs node)
- [CVE-2026-14310](https://cve.now/CVE-2026-14310.md): Tutor LMS \< 4.0.0 - Subscriber+ Cross-Course Q&A Content Disclosure and Reply Injection (CVSS 5.4, Tutor LMS)
- [CVE-2026-14305](https://cve.now/CVE-2026-14305.md): WP Delicious \< 1.10.2 - Unauthenticated Arbitrary Post Meta Update via recipe\_likes (CVSS 5.3, WP Delicious)
- [CVE-2026-14239](https://cve.now/CVE-2026-14239.md): Tourmaster \< 5.4.8 - Stored XSS via CSRF (CVSS 7.1, tourmaster)
- [CVE-2026-13395](https://cve.now/CVE-2026-13395.md): Bookly \< 27.8 - Unauthenticated SQL Injection via staff\_id (CVSS 8.6, Online Scheduling and Appointment Booking System)
- [CVE-2026-13345](https://cve.now/CVE-2026-13345.md): Essential Addons for Elementor - Lite \< 6.6.10 - Unauthenticated Draft/Private WooCommerce Product Disclosure via Compare Table (CVSS 5.3, Essential Addons for Elementor)
- [CVE-2026-13344](https://cve.now/CVE-2026-13344.md): Essential Addons for Elementor - Lite \< 6.6.10 - Contributor+ Stored XSS via Pricing Table Title Tag (CVSS 4.8, Essential Addons for Elementor)
- [CVE-2026-13330](https://cve.now/CVE-2026-13330.md): Animation Addons for Elementor \< 2.7.0 - Author+ Stored XSS via SVG Upload (CVSS 6.1, Animation Addons for Elementor)
- [CVE-2026-13178](https://cve.now/CVE-2026-13178.md): Eventin \< 4.1.16 - Unauthenticated Payment Bypass via Order Status Manipulation (CVSS 7.5, Eventin)
- [CVE-2026-13145](https://cve.now/CVE-2026-13145.md): WP Travel \< 11.8.1 - Subscriber+ Booking PII Disclosure via IDOR (CVSS 4.3, WP Travel)
- [CVE-2026-13143](https://cve.now/CVE-2026-13143.md): WP Travel \< 11.8.1 - Unauthenticated Payment Bypass via Forged PayPal IPN (CVSS 5.3, WP Travel)
- [CVE-2026-12500](https://cve.now/CVE-2026-12500.md): WP Travel Engine \< 6.8.2 - Unauthenticated Trip Difficulty Level Option Update (CVSS 7.5, WP Travel Engine)
- [CVE-2026-11881](https://cve.now/CVE-2026-11881.md): Fluent Forms \< 6.2.6 - Contributor+ Stored XSS via Date/Time Field (CVSS 6.1, Fluent Forms)
- [CVE-2026-11870](https://cve.now/CVE-2026-11870.md): Hide My WP Ghost \< 7.0.05 - IP Address Spoofing via Trusted Proxy Headers Leading to Protection Mechanism Bypass (CVSS 5.4, WP Ghost)
- [CVE-2026-11867](https://cve.now/CVE-2026-11867.md): Frontend Admin by DynamiApps \< 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization (CVSS 6.5, Frontend Admin by DynamiApps)
- [CVE-2026-11782](https://cve.now/CVE-2026-11782.md): Points and Rewards for WooCommerce \< 2.10.1 - Unauthenticated Arbitrary User Wallet & Points Manipulation via IDOR (CVSS 5.9, Points and Rewards for WooCommerce)
- [CVE-2026-15382](https://cve.now/CVE-2026-15382.md): Ultimate Addons for WPBakery Page Builder \< 3.21.4 - Unauthenticated Custom Icon Font Deletion via delete-bsf-fonts (CVSS 6.5, Ultimate Addons for WPBakery Page Builder)
- [CVE-2026-15257](https://cve.now/CVE-2026-15257.md): RegistrationMagic \< 6.0.9.4 - Unauthenticated Form Submission and User Profile Modification (CVSS 5.3, RegistrationMagic)
- [CVE-2026-15255](https://cve.now/CVE-2026-15255.md): RegistrationMagic \< 6.0.9.4 - Unauthenticated Form Submission Disclosure via IDOR (CVSS 5.3, RegistrationMagic)
- [CVE-2026-15252](https://cve.now/CVE-2026-15252.md): Search Atlas SEO \< 2.6.12 - Subscriber+ Google Indexing API Access (CVSS 5.4, Search Atlas SEO)
- [CVE-2026-15250](https://cve.now/CVE-2026-15250.md): LatePoint \< 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel (CVSS 5.3, Appointment Booking Plugin)
- [CVE-2026-15240](https://cve.now/CVE-2026-15240.md): Customer Switching for WooCommerce \< 2.1.3 - Customer+ Privilege Escalation to Administrator via Insecure Operator Resolution (CVSS 7.5, Customer Switching)
- [CVE-2026-14318](https://cve.now/CVE-2026-14318.md): GiveWP \< 4.16.3 - GiveWP Worker+ Stored XSS via Donation Form Template Settings (CVSS 6.8, GiveWP)
- [CVE-2026-14231](https://cve.now/CVE-2026-14231.md): LifterLMS \< 10.0.10 - Subscriber+ Sensitive Information Disclosure via select2\_query\_posts (CVSS 4.3, LifterLMS)
- [CVE-2026-14207](https://cve.now/CVE-2026-14207.md): LifterLMS \< 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information (CVSS 6.1, LifterLMS)
- [CVE-2026-12687](https://cve.now/CVE-2026-12687.md): ProfileGrid \< 5.9.9.8 - Unauthenticated Privilege Escalation via Unrestricted Group ID (CVSS 7.5, ProfileGrid)
- [CVE-2026-15235](https://cve.now/CVE-2026-15235.md): Hotel Booking Lite \< 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action (CVSS 4.3, MotoPress Hotel Booking)
- [CVE-2026-15153](https://cve.now/CVE-2026-15153.md): WP Hotel Booking \< 2.3.2 - Hotel Manager+ SQL Injection via Booking List Search (CVSS 6.8, WP Hotel Booking)
- [CVE-2026-15054](https://cve.now/CVE-2026-15054.md): Bit Form \< 3.1.2 - Unauthenticated Inactive Form Submission (CVSS 3.7, Bit Form)
- [CVE-2026-14923](https://cve.now/CVE-2026-14923.md): Sync Post With Other Site \< 1.9.3 - Contributor+ Arbitrary Page Creation/Modification (CVSS 6.5, Sync Post With Other Site)
- [CVE-2026-14602](https://cve.now/CVE-2026-14602.md): Remote API \<= 0.2 - Unauthenticated PHP Object Injection via remote-api Query Parameter (CVSS 9.0, Remote API)
- [CVE-2026-14592](https://cve.now/CVE-2026-14592.md): WP Real IP-based Access Control \<= 1.3.1 - Unauthenticated Stored XSS via acl\_ctrl\_addr (CVSS 6.1, WP Real IP-based Access Control)
- [CVE-2026-14226](https://cve.now/CVE-2026-14226.md): Easy Appointments \< 3.12.28 - Subscriber+ Sensitive Information Disclosure via REST Appointments Listing (CVSS 4.3, Easy Appointments)
- [CVE-2026-14223](https://cve.now/CVE-2026-14223.md): Easy Appointments \< 3.12.28 - Subscriber+ Customer PII Disclosure via IDOR (CVSS 4.3, Easy Appointments)
- [CVE-2026-14222](https://cve.now/CVE-2026-14222.md): Easy Appointments \< 3.12.28 - Contributor+ Connection Deletion via Missing Authorization (CVSS 3.8, Easy Appointments)
- [CVE-2026-14221](https://cve.now/CVE-2026-14221.md): Easy Appointments \<= 4.0 - Contributor+ Appointment Data Disclosure & Modification via Missing Authorization (CVSS 3.8, Easy Appointments)
- [CVE-2026-14188](https://cve.now/CVE-2026-14188.md): Easy Appointments \< 3.12.28 - Contributor+ Customer Data Disclosure (CVSS 2.7, Easy Appointments)
- [CVE-2026-16531](https://cve.now/CVE-2026-16531.md): Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet (CVSS 5.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-59326](https://cve.now/CVE-2026-59326.md): HTTP Proxy Credentials Logged in Plaintext by the Spring Boot Language Server (CVSS 3.3, Spring Tools for Eclipse · Spring Tools for VSCode / Cursor…)
- [CVE-2026-16530](https://cve.now/CVE-2026-16530.md): Pcp: pcp: remote denial of service and information leakage (CVSS 6.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16529](https://cve.now/CVE-2026-16529.md): Pcp: pcp: denial of service due to signed integer overflow (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-16527](https://cve.now/CVE-2026-16527.md): Pcp: pcp pmproxy: unauthenticated access to /store endpoint allows bypassing pmcd access rules (CVSS 7.3, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-59328](https://cve.now/CVE-2026-59328.md): Cross-Site Scripting in Eclipse Spring Boot Starter Wizard Dependency Tooltips (CVSS 4.2, Spring Tools for Eclipse)
- [CVE-2026-59327](https://cve.now/CVE-2026-59327.md): Cleartext Storage of Spring Boot DevTools Remote Secret in Eclipse Launch Configurations (CVSS 4.4, Spring Tools for Eclipse)
- [CVE-2026-47882](https://cve.now/CVE-2026-47882.md): Spring Boot DevTools remote secret generated with a non-cryptographic PRNG (CVSS 8.3, Spring Tools for Eclipse)
- [CVE-2026-47873](https://cve.now/CVE-2026-47873.md): Spring Tools Docker integration publishes unauthenticated debug (JDWP) and JMX ports on all network interfaces (CVSS 8.0, Spring Tools for Eclipse)
- [CVE-2026-16526](https://cve.now/CVE-2026-16526.md): Pcp: pcp: privilege escalation to root via linux\_sockets pmda vulnerability (CVSS 8.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-47858](https://cve.now/CVE-2026-47858.md): live information startup mode is vulnerable for remote code execution (CVSS 8.0, Spring Tools for Eclipse · Spring Tools for VSCode / Cursor…)
- [CVE-2026-16524](https://cve.now/CVE-2026-16524.md): Pcp: pcp linux\_sockets pmda: arbitrary command execution via command injection (CVSS 7.8, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-1360](https://cve.now/CVE-2026-1360.md): BuddyPress \<= 14.5.0 - Authenticated (Subscriber+) PHP Object Injection via XProfile Field Data (CVSS 7.5, BuddyPress)
- [CVE-2026-16610](https://cve.now/CVE-2026-16610.md): Admin and Site Enhancements (ASE) Pro \<= 8.9.0 - Unauthenticated Remote Code Execution via PHP Code Injection via cfgroup\[input\] Repeater Row Key (CVSS 9.8, Admin and Site Enhancements (ASE) Pro)
- [CVE-2026-14356](https://cve.now/CVE-2026-14356.md): FleekDash V2 \<= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint (CVSS 8.8, FleekDash)
- [CVE-2026-67248](https://cve.now/CVE-2026-67248.md): A stack-based buffer overflow vulnerability was found in the File Explorer on the ADM (CVSS 8.7, ASUSTOR ADM)
- [CVE-2026-67247](https://cve.now/CVE-2026-67247.md): A path traversal vulnerability was found in the IHM Log handling of ADM (CVSS 7.1, ASUSTOR ADM)
- [CVE-2026-67246](https://cve.now/CVE-2026-67246.md): A path traversal vulnerability was found in the Wallpaper component of ADM (CVSS 6.9, ASUSTOR ADM)
- [CVE-2026-67245](https://cve.now/CVE-2026-67245.md): A path traversal vulnerability was found in the VPN Clients on the ADM (CVSS 7.0, ASUSTOR ADM)
- [CVE-2026-67244](https://cve.now/CVE-2026-67244.md): A format string vulnerability was found in the Notification OAuth settings of ADM (CVSS 8.6, ASUSTOR ADM)
- [CVE-2026-1982](https://cve.now/CVE-2026-1982.md): Persian Elementor (المنتور فارسی) \<= 2.8.1 - Unauthenticated Price Manipulation via ZarinPal Widget (CVSS 5.3, mohammadr3z المنتور فارسی)
- [CVE-2026-16092](https://cve.now/CVE-2026-16092.md): Improved Save Button \<= 1.2.1 - Authenticated (Author+) Second-Order SQL Injection via 'meta\_key' Parameter (CVSS 6.5, labelblanc Improved Save Button)
- [CVE-2026-18188](https://cve.now/CVE-2026-18188.md): A format string vulnerability was found in the Rsync Backup on the ADM (CVSS 7.1, ASUSTOR ADM)
- [CVE-2026-18187](https://cve.now/CVE-2026-18187.md): A format string vulnerability was found in the Internal Backup on the ADM (CVSS 7.1, ASUSTOR ADM)
- [CVE-2026-48449](https://cve.now/CVE-2026-48449.md): Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863) (CVSS 10.0, Adobe Campaign Classic)
- [CVE-2026-48448](https://cve.now/CVE-2026-48448.md): Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 8.6, Adobe Campaign Classic)
- [CVE-2026-18186](https://cve.now/CVE-2026-18186.md): A stored format string vulnerability was found in the FTP Backup on the ADM (CVSS 7.1, ASUSTOR ADM)
- [CVE-2026-16727](https://cve.now/CVE-2026-16727.md): Concurrent Execution using Shared Resource with Improper Synchronization (“Race Condition”) in ASUS Armoury Crate allows a local user to exe (CVSS 7.3, ASUS Armoury Crate)
- [CVE-2026-15929](https://cve.now/CVE-2026-15929.md): Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in LG Electronics SmartShare allows SQL I (CVSS 7.1, LG Electronics SmartShare)
- [CVE-2026-18019](https://cve.now/CVE-2026-18019.md): Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a (CVSS 4.3, Google Chrome)
- [CVE-2026-18018](https://cve.now/CVE-2026-18018.md): Inappropriate implementation in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform UI spoofing v (CVSS 4.0, Google Chrome)
- [CVE-2026-18017](https://cve.now/CVE-2026-18017.md): Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-18016](https://cve.now/CVE-2026-18016.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spo (CVSS 4.3, Google Chrome)
- [CVE-2026-18015](https://cve.now/CVE-2026-18015.md): Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandb (CVSS 9.6, Google Chrome)
- [CVE-2026-18014](https://cve.now/CVE-2026-18014.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio (CVSS 6.5, Google Chrome)
- [CVE-2026-18013](https://cve.now/CVE-2026-18013.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-18012](https://cve.now/CVE-2026-18012.md): Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-18011](https://cve.now/CVE-2026-18011.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a local attacker to obtain potentially (CVSS 2.4, Google Chrome)
- [CVE-2026-18010](https://cve.now/CVE-2026-18010.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malic (CVSS 4.3, Google Chrome)
- [CVE-2026-18009](https://cve.now/CVE-2026-18009.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoo (CVSS 4.3, Google Chrome)
- [CVE-2026-18008](https://cve.now/CVE-2026-18008.md): Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malici (CVSS 4.3, Google Chrome)
- [CVE-2026-18007](https://cve.now/CVE-2026-18007.md): Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing vi (CVSS 4.3, Google Chrome)
- [CVE-2026-18006](https://cve.now/CVE-2026-18006.md): Inappropriate implementation in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the render (CVSS 4.3, Google Chrome)
- [CVE-2026-18005](https://cve.now/CVE-2026-18005.md): Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-18004](https://cve.now/CVE-2026-18004.md): Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer (CVSS 4.3, Google Chrome)
- [CVE-2026-18003](https://cve.now/CVE-2026-18003.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-18002](https://cve.now/CVE-2026-18002.md): Insufficient validation of untrusted input in Google Lens in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromi (CVSS 9.6, Google Chrome)
- [CVE-2026-18001](https://cve.now/CVE-2026-18001.md): Inappropriate implementation in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-18000](https://cve.now/CVE-2026-18000.md): Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the (CVSS 3.1, Google Chrome)
- [CVE-2026-17999](https://cve.now/CVE-2026-17999.md): Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a craft (CVSS 6.5, Google Chrome)
- [CVE-2026-17998](https://cve.now/CVE-2026-17998.md): Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious (CVSS 4.3, Google Chrome)
- [CVE-2026-17997](https://cve.now/CVE-2026-17997.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer (CVSS 3.1, Google Chrome)
- [CVE-2026-17996](https://cve.now/CVE-2026-17996.md): Inappropriate implementation in Browser in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to bypass navigation restric (CVSS 6.2, Google Chrome)
- [CVE-2026-17995](https://cve.now/CVE-2026-17995.md): Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a c (CVSS 8.1, Google Chrome)
- [CVE-2026-17994](https://cve.now/CVE-2026-17994.md): Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation rest (CVSS 4.3, Google Chrome)
- [CVE-2026-17993](https://cve.now/CVE-2026-17993.md): Race in Updater in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious (CVSS 7.0, Google Chrome)
- [CVE-2026-17992](https://cve.now/CVE-2026-17992.md): Uninitialized Use in Skia in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive infor (CVSS 6.5, Google Chrome)
- [CVE-2026-17991](https://cve.now/CVE-2026-17991.md): Insufficient validation of untrusted input in AI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the r (CVSS 9.6, Google Chrome)
- [CVE-2026-17990](https://cve.now/CVE-2026-17990.md): Insufficient validation of untrusted input in WebAuthn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 9.6, Google Chrome)
- [CVE-2026-17989](https://cve.now/CVE-2026-17989.md): Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17988](https://cve.now/CVE-2026-17988.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-17987](https://cve.now/CVE-2026-17987.md): Insufficient validation of untrusted input in Notifications in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compro (CVSS 9.6, Google Chrome)
- [CVE-2026-17986](https://cve.now/CVE-2026-17986.md): Insufficient policy enforcement in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 6.5, Google Chrome)
- [CVE-2026-17985](https://cve.now/CVE-2026-17985.md): Insufficient policy enforcement in Speech in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-17984](https://cve.now/CVE-2026-17984.md): Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin dat (CVSS 3.3, Google Chrome)
- [CVE-2026-17983](https://cve.now/CVE-2026-17983.md): Inappropriate implementation in Global Media Controls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-17982](https://cve.now/CVE-2026-17982.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin p (CVSS 4.3, Google Chrome)
- [CVE-2026-17981](https://cve.now/CVE-2026-17981.md): Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-17980](https://cve.now/CVE-2026-17980.md): Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who convinced a user to enga (CVSS 3.1, Google Chrome)
- [CVE-2026-17979](https://cve.now/CVE-2026-17979.md): Race in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML p (CVSS 7.5, Google Chrome)
- [CVE-2026-17978](https://cve.now/CVE-2026-17978.md): Side-channel information leakage in WebCodecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensit (CVSS 5.3, Google Chrome)
- [CVE-2026-17977](https://cve.now/CVE-2026-17977.md): Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-17976](https://cve.now/CVE-2026-17976.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2026-17975](https://cve.now/CVE-2026-17975.md): Inappropriate implementation in IME in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive (CVSS 6.5, Google Chrome)
- [CVE-2026-17974](https://cve.now/CVE-2026-17974.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed a local attacker to bypass navigation restrictio (CVSS 6.5, Google Chrome)
- [CVE-2026-17973](https://cve.now/CVE-2026-17973.md): Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitiv (CVSS 5.5, Google Chrome)
- [CVE-2026-17972](https://cve.now/CVE-2026-17972.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-17971](https://cve.now/CVE-2026-17971.md): Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds (CVSS 8.8, Google Chrome)
- [CVE-2026-17970](https://cve.now/CVE-2026-17970.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network (CVSS 4.3, Google Chrome)
- [CVE-2026-17969](https://cve.now/CVE-2026-17969.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside (CVSS 8.8, Google Chrome)
- [CVE-2026-17968](https://cve.now/CVE-2026-17968.md): Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-17967](https://cve.now/CVE-2026-17967.md): Use after free in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corrup (CVSS 8.8, Google Chrome)
- [CVE-2026-17966](https://cve.now/CVE-2026-17966.md): Inappropriate implementation in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitiv (CVSS 6.2, Google Chrome)
- [CVE-2026-17965](https://cve.now/CVE-2026-17965.md): Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via (CVSS 4.3, Google Chrome)
- [CVE-2026-17964](https://cve.now/CVE-2026-17964.md): Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-17963](https://cve.now/CVE-2026-17963.md): Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-17962](https://cve.now/CVE-2026-17962.md): Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (CVSS 6.1, Google Chrome)
- [CVE-2026-17961](https://cve.now/CVE-2026-17961.md): Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation re (CVSS 4.3, Google Chrome)
- [CVE-2026-17960](https://cve.now/CVE-2026-17960.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass no-refe (CVSS 4.3, Google Chrome)
- [CVE-2026-17959](https://cve.now/CVE-2026-17959.md): Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-17958](https://cve.now/CVE-2026-17958.md): Inappropriate implementation in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-17957](https://cve.now/CVE-2026-17957.md): Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proc (CVSS 3.1, Google Chrome)
- [CVE-2026-17956](https://cve.now/CVE-2026-17956.md): Inappropriate implementation in Scheduling in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code insid (CVSS 8.8, Google Chrome)
- [CVE-2026-17955](https://cve.now/CVE-2026-17955.md): Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoof (CVSS 4.3, Google Chrome)
- [CVE-2026-17954](https://cve.now/CVE-2026-17954.md): Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page. (CVSS 4.3, Google Chrome)
- [CVE-2026-17953](https://cve.now/CVE-2026-17953.md): Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation (CVSS 6.5, Google Chrome)
- [CVE-2026-17952](https://cve.now/CVE-2026-17952.md): Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious e (CVSS 7.5, Google Chrome)
- [CVE-2026-17951](https://cve.now/CVE-2026-17951.md): Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via (CVSS 8.8, Google Chrome)
- [CVE-2026-17950](https://cve.now/CVE-2026-17950.md): Inappropriate implementation in Safebrowsing in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary c (CVSS 8.8, Google Chrome)
- [CVE-2026-17949](https://cve.now/CVE-2026-17949.md): Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-17948](https://cve.now/CVE-2026-17948.md): Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to ex (CVSS 7.5, Google Chrome)
- [CVE-2026-17947](https://cve.now/CVE-2026-17947.md): Use after free in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-17946](https://cve.now/CVE-2026-17946.md): Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to obta (CVSS 6.5, Google Chrome)
- [CVE-2026-17945](https://cve.now/CVE-2026-17945.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 4.3, Google Chrome)
- [CVE-2026-17944](https://cve.now/CVE-2026-17944.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation (CVSS 4.3, Google Chrome)
- [CVE-2026-17943](https://cve.now/CVE-2026-17943.md): Inappropriate implementation in Parser in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy v (CVSS 4.3, Google Chrome)
- [CVE-2026-17942](https://cve.now/CVE-2026-17942.md): Side-channel information leakage in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-17941](https://cve.now/CVE-2026-17941.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the content (CVSS 4.3, Google Chrome)
- [CVE-2026-17940](https://cve.now/CVE-2026-17940.md): Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacke (CVSS 9.6, Google Chrome)
- [CVE-2026-17939](https://cve.now/CVE-2026-17939.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoo (CVSS 4.3, Google Chrome)
- [CVE-2026-17938](https://cve.now/CVE-2026-17938.md): Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 4.3, Google Chrome)
- [CVE-2026-17937](https://cve.now/CVE-2026-17937.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio (CVSS 4.3, Google Chrome)
- [CVE-2026-17936](https://cve.now/CVE-2026-17936.md): Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in (CVSS 6.5, Google Chrome)
- [CVE-2026-17935](https://cve.now/CVE-2026-17935.md): Heap buffer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-17934](https://cve.now/CVE-2026-17934.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio (CVSS 4.3, Google Chrome)
- [CVE-2026-17933](https://cve.now/CVE-2026-17933.md): Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a (CVSS 4.3, Google Chrome)
- [CVE-2026-17932](https://cve.now/CVE-2026-17932.md): Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to obtain potentially sensitive i (CVSS 5.5, Google Chrome)
- [CVE-2026-17931](https://cve.now/CVE-2026-17931.md): Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions (CVSS 6.5, Google Chrome)
- [CVE-2026-17930](https://cve.now/CVE-2026-17930.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 7.5, Google Chrome)
- [CVE-2026-17929](https://cve.now/CVE-2026-17929.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigatio (CVSS 6.5, Google Chrome)
- [CVE-2026-17928](https://cve.now/CVE-2026-17928.md): Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17927](https://cve.now/CVE-2026-17927.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a ma (CVSS 4.3, Google Chrome)
- [CVE-2026-17926](https://cve.now/CVE-2026-17926.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a use (CVSS 6.5, Google Chrome)
- [CVE-2026-17925](https://cve.now/CVE-2026-17925.md): Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin poli (CVSS 4.3, Google Chrome)
- [CVE-2026-17924](https://cve.now/CVE-2026-17924.md): Use after free in DNS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 9.6, Google Chrome)
- [CVE-2026-17923](https://cve.now/CVE-2026-17923.md): Policy bypass in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-17922](https://cve.now/CVE-2026-17922.md): Inappropriate implementation in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code via a (CVSS 8.8, Google Chrome)
- [CVE-2026-17921](https://cve.now/CVE-2026-17921.md): Insufficient validation of untrusted input in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 6.5, Google Chrome)
- [CVE-2026-17920](https://cve.now/CVE-2026-17920.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to ex (CVSS 8.8, Google Chrome)
- [CVE-2026-17919](https://cve.now/CVE-2026-17919.md): Insufficient policy enforcement in Enterprise in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege e (CVSS 6.8, Google Chrome)
- [CVE-2026-17918](https://cve.now/CVE-2026-17918.md): Use after free in Sync in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-17917](https://cve.now/CVE-2026-17917.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discret (CVSS 6.5, Google Chrome)
- [CVE-2026-17916](https://cve.now/CVE-2026-17916.md): Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the render (CVSS 7.5, Google Chrome)
- [CVE-2026-17915](https://cve.now/CVE-2026-17915.md): Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing (CVSS 5.4, Google Chrome)
- [CVE-2026-17914](https://cve.now/CVE-2026-17914.md): Side-channel information leakage in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive i (CVSS 5.3, Google Chrome)
- [CVE-2026-17913](https://cve.now/CVE-2026-17913.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 5.4, Google Chrome)
- [CVE-2026-17912](https://cve.now/CVE-2026-17912.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation (CVSS 4.3, Google Chrome)
- [CVE-2026-17911](https://cve.now/CVE-2026-17911.md): Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-17910](https://cve.now/CVE-2026-17910.md): Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dat (CVSS 4.3, Google Chrome)
- [CVE-2026-17909](https://cve.now/CVE-2026-17909.md): Insufficient validation of untrusted input in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cr (CVSS 5.3, Google Chrome)
- [CVE-2026-17908](https://cve.now/CVE-2026-17908.md): Insufficient validation of untrusted input in Printing in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had (CVSS 5.8, Google Chrome)
- [CVE-2026-17907](https://cve.now/CVE-2026-17907.md): Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17906](https://cve.now/CVE-2026-17906.md): Insufficient validation of untrusted input in Bluetooth in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise (CVSS 5.8, Google Chrome)
- [CVE-2026-17905](https://cve.now/CVE-2026-17905.md): Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data v (CVSS 4.3, Google Chrome)
- [CVE-2026-17904](https://cve.now/CVE-2026-17904.md): Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin dat (CVSS 4.3, Google Chrome)
- [CVE-2026-17903](https://cve.now/CVE-2026-17903.md): Insufficient policy enforcement in Chromecast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment to in (CVSS 5.4, Google Chrome)
- [CVE-2026-17902](https://cve.now/CVE-2026-17902.md): Inappropriate implementation in Editing in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data (CVSS 3.5, Google Chrome)
- [CVE-2026-17901](https://cve.now/CVE-2026-17901.md): Insufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass (CVSS 4.3, Google Chrome)
- [CVE-2026-17900](https://cve.now/CVE-2026-17900.md): Inappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin (CVSS 4.3, Google Chrome)
- [CVE-2026-17899](https://cve.now/CVE-2026-17899.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a ma (CVSS 8.8, Google Chrome)
- [CVE-2026-17898](https://cve.now/CVE-2026-17898.md): Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension (CVSS 7.5, Google Chrome)
- [CVE-2026-17897](https://cve.now/CVE-2026-17897.md): Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-17896](https://cve.now/CVE-2026-17896.md): Use after free in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 7.5, Google Chrome)
- [CVE-2026-17895](https://cve.now/CVE-2026-17895.md): Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engag (CVSS 4.3, Google Chrome)
- [CVE-2026-17894](https://cve.now/CVE-2026-17894.md): Use after free in Views in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 8.8, Google Chrome)
- [CVE-2026-17893](https://cve.now/CVE-2026-17893.md): Insufficient validation of untrusted input in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compr (CVSS 5.8, Google Chrome)
- [CVE-2026-17892](https://cve.now/CVE-2026-17892.md): Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-17891](https://cve.now/CVE-2026-17891.md): Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proces (CVSS 5.8, Google Chrome)
- [CVE-2026-17890](https://cve.now/CVE-2026-17890.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 5.8, Google Chrome)
- [CVE-2026-17889](https://cve.now/CVE-2026-17889.md): Uninitialized Use in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-17888](https://cve.now/CVE-2026-17888.md): Insufficient validation of untrusted input in WebUI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform (CVSS 7.1, Google Chrome)
- [CVE-2026-17887](https://cve.now/CVE-2026-17887.md): Use after free in TabStrip in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI g (CVSS 7.5, Google Chrome)
- [CVE-2026-17886](https://cve.now/CVE-2026-17886.md): Use after free in Enterprise in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2026-17885](https://cve.now/CVE-2026-17885.md): Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-17884](https://cve.now/CVE-2026-17884.md): Object lifecycle issue in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 8.8, Google Chrome)
- [CVE-2026-17883](https://cve.now/CVE-2026-17883.md): Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-17882](https://cve.now/CVE-2026-17882.md): Policy bypass in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extensio (CVSS 6.5, Google Chrome)
- [CVE-2026-17881](https://cve.now/CVE-2026-17881.md): Integer overflow in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-17880](https://cve.now/CVE-2026-17880.md): Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17879](https://cve.now/CVE-2026-17879.md): Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17878](https://cve.now/CVE-2026-17878.md): Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-17877](https://cve.now/CVE-2026-17877.md): Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 151.0.7922.72 allowed a local attacker to perform OS-level pri (CVSS 8.4, Google Chrome)
- [CVE-2026-17876](https://cve.now/CVE-2026-17876.md): Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17875](https://cve.now/CVE-2026-17875.md): Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-17874](https://cve.now/CVE-2026-17874.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 5.4, Google Chrome)
- [CVE-2026-17873](https://cve.now/CVE-2026-17873.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass discret (CVSS 6.5, Google Chrome)
- [CVE-2026-17872](https://cve.now/CVE-2026-17872.md): Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to potentially perform a sa (CVSS 6.1, Google Chrome)
- [CVE-2026-17871](https://cve.now/CVE-2026-17871.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage i (CVSS 4.3, Google Chrome)
- [CVE-2026-17870](https://cve.now/CVE-2026-17870.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment (CVSS 4.3, Google Chrome)
- [CVE-2026-17869](https://cve.now/CVE-2026-17869.md): Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 8.1, Google Chrome)
- [CVE-2026-17868](https://cve.now/CVE-2026-17868.md): Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform privilege escalation via (CVSS 8.8, Google Chrome)
- [CVE-2026-17867](https://cve.now/CVE-2026-17867.md): Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform (CVSS 7.1, Google Chrome)
- [CVE-2026-17866](https://cve.now/CVE-2026-17866.md): Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process (CVSS 5.8, Google Chrome)
- [CVE-2026-17865](https://cve.now/CVE-2026-17865.md): Inappropriate implementation in Crypto in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rend (CVSS 9.6, Google Chrome)
- [CVE-2026-17864](https://cve.now/CVE-2026-17864.md): Inappropriate implementation in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privileg (CVSS 7.8, Google Chrome)
- [CVE-2026-17863](https://cve.now/CVE-2026-17863.md): Inappropriate implementation in Browser in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege esc (CVSS 7.8, Google Chrome)
- [CVE-2026-17862](https://cve.now/CVE-2026-17862.md): Use after free in Tracing in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalati (CVSS 7.8, Google Chrome)
- [CVE-2026-17861](https://cve.now/CVE-2026-17861.md): Insufficient validation of untrusted input in Updater in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level p (CVSS 7.8, Google Chrome)
- [CVE-2026-17860](https://cve.now/CVE-2026-17860.md): Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof th (CVSS 3.3, Google Chrome)
- [CVE-2026-17859](https://cve.now/CVE-2026-17859.md): Inappropriate implementation in Favicons in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17858](https://cve.now/CVE-2026-17858.md): Uninitialized Use in WebNN in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-17857](https://cve.now/CVE-2026-17857.md): Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2026-17856](https://cve.now/CVE-2026-17856.md): Inappropriate implementation in Network in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the ren (CVSS 9.6, Google Chrome)
- [CVE-2026-17855](https://cve.now/CVE-2026-17855.md): Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17854](https://cve.now/CVE-2026-17854.md): Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-17853](https://cve.now/CVE-2026-17853.md): Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer (CVSS 6.1, Google Chrome)
- [CVE-2026-17852](https://cve.now/CVE-2026-17852.md): Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy (CVSS 6.5, Google Chrome)
- [CVE-2026-17851](https://cve.now/CVE-2026-17851.md): Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 4.3, Google Chrome)
- [CVE-2026-17850](https://cve.now/CVE-2026-17850.md): Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy v (CVSS 6.5, Google Chrome)
- [CVE-2026-17849](https://cve.now/CVE-2026-17849.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the content (CVSS 4.3, Google Chrome)
- [CVE-2026-17848](https://cve.now/CVE-2026-17848.md): Integer overflow in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a c (CVSS 9.6, Google Chrome)
- [CVE-2026-17847](https://cve.now/CVE-2026-17847.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-17846](https://cve.now/CVE-2026-17846.md): Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the r (CVSS 6.5, Google Chrome)
- [CVE-2026-17845](https://cve.now/CVE-2026-17845.md): Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-17844](https://cve.now/CVE-2026-17844.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed an attacker on the local network segment (CVSS 4.3, Google Chrome)
- [CVE-2026-17843](https://cve.now/CVE-2026-17843.md): Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-17842](https://cve.now/CVE-2026-17842.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user (CVSS 6.5, Google Chrome)
- [CVE-2026-17841](https://cve.now/CVE-2026-17841.md): Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-17840](https://cve.now/CVE-2026-17840.md): Incorrect security UI in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-17839](https://cve.now/CVE-2026-17839.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2026-17838](https://cve.now/CVE-2026-17838.md): Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform domain spoofing (CVSS 6.5, Google Chrome)
- [CVE-2026-17837](https://cve.now/CVE-2026-17837.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 9.6, Google Chrome)
- [CVE-2026-17836](https://cve.now/CVE-2026-17836.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17835](https://cve.now/CVE-2026-17835.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2026-17834](https://cve.now/CVE-2026-17834.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise (CVSS 9.6, Google Chrome)
- [CVE-2026-17833](https://cve.now/CVE-2026-17833.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a (CVSS 4.3, Google Chrome)
- [CVE-2026-17832](https://cve.now/CVE-2026-17832.md): Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17831](https://cve.now/CVE-2026-17831.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise (CVSS 6.5, Google Chrome)
- [CVE-2026-17830](https://cve.now/CVE-2026-17830.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation (CVSS 6.5, Google Chrome)
- [CVE-2026-17829](https://cve.now/CVE-2026-17829.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17828](https://cve.now/CVE-2026-17828.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2026-17827](https://cve.now/CVE-2026-17827.md): Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-17826](https://cve.now/CVE-2026-17826.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user (CVSS 3.1, Google Chrome)
- [CVE-2026-17825](https://cve.now/CVE-2026-17825.md): Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discreti (CVSS 6.5, Google Chrome)
- [CVE-2026-17824](https://cve.now/CVE-2026-17824.md): Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin pol (CVSS 6.5, Google Chrome)
- [CVE-2026-17823](https://cve.now/CVE-2026-17823.md): Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-17822](https://cve.now/CVE-2026-17822.md): Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-17821](https://cve.now/CVE-2026-17821.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a (CVSS 6.5, Google Chrome)
- [CVE-2026-17820](https://cve.now/CVE-2026-17820.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17819](https://cve.now/CVE-2026-17819.md): Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via (CVSS 6.5, Google Chrome)
- [CVE-2026-17818](https://cve.now/CVE-2026-17818.md): Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTM (CVSS 6.1, Google Chrome)
- [CVE-2026-17817](https://cve.now/CVE-2026-17817.md): Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data (CVSS 4.3, Google Chrome)
- [CVE-2026-17816](https://cve.now/CVE-2026-17816.md): Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised t (CVSS 7.5, Google Chrome)
- [CVE-2026-17815](https://cve.now/CVE-2026-17815.md): Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17814](https://cve.now/CVE-2026-17814.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to byp (CVSS 6.5, Google Chrome)
- [CVE-2026-17813](https://cve.now/CVE-2026-17813.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigat (CVSS 6.5, Google Chrome)
- [CVE-2026-17812](https://cve.now/CVE-2026-17812.md): Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing (CVSS 5.4, Google Chrome)
- [CVE-2026-17811](https://cve.now/CVE-2026-17811.md): Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape (CVSS 7.1, Google Chrome)
- [CVE-2026-17810](https://cve.now/CVE-2026-17810.md): Uninitialized Use in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 4.3, Google Chrome)
- [CVE-2026-17809](https://cve.now/CVE-2026-17809.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 5.8, Google Chrome)
- [CVE-2026-17808](https://cve.now/CVE-2026-17808.md): Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-17807](https://cve.now/CVE-2026-17807.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17806](https://cve.now/CVE-2026-17806.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 5.8, Google Chrome)
- [CVE-2026-17805](https://cve.now/CVE-2026-17805.md): Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass navigation re (CVSS 6.5, Google Chrome)
- [CVE-2026-17804](https://cve.now/CVE-2026-17804.md): Use after free in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17803](https://cve.now/CVE-2026-17803.md): Insufficient validation of untrusted input in Save to Drive in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compro (CVSS 9.6, Google Chrome)
- [CVE-2026-17802](https://cve.now/CVE-2026-17802.md): Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin da (CVSS 4.3, Google Chrome)
- [CVE-2026-17801](https://cve.now/CVE-2026-17801.md): Out of bounds read and write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox esc (CVSS 9.6, Google Chrome)
- [CVE-2026-17800](https://cve.now/CVE-2026-17800.md): Inappropriate implementation in MediaRecording in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensi (CVSS 6.5, Google Chrome)
- [CVE-2026-17799](https://cve.now/CVE-2026-17799.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass disc (CVSS 5.4, Google Chrome)
- [CVE-2026-17798](https://cve.now/CVE-2026-17798.md): Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-17797](https://cve.now/CVE-2026-17797.md): Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (U (CVSS 6.1, Google Chrome)
- [CVE-2026-17796](https://cve.now/CVE-2026-17796.md): Side-channel information leakage in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive (CVSS 6.5, Google Chrome)
- [CVE-2026-17795](https://cve.now/CVE-2026-17795.md): Inappropriate implementation in GetUserMedia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 4.3, Google Chrome)
- [CVE-2026-17794](https://cve.now/CVE-2026-17794.md): Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had co (CVSS 4.3, Google Chrome)
- [CVE-2026-17793](https://cve.now/CVE-2026-17793.md): Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing (CVSS 6.5, Google Chrome)
- [CVE-2026-17792](https://cve.now/CVE-2026-17792.md): Inappropriate implementation in Credential Management in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofi (CVSS 6.5, Google Chrome)
- [CVE-2026-17791](https://cve.now/CVE-2026-17791.md): Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 6.5, Google Chrome)
- [CVE-2026-17790](https://cve.now/CVE-2026-17790.md): Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 4.3, Google Chrome)
- [CVE-2026-17789](https://cve.now/CVE-2026-17789.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to byp (CVSS 6.5, Google Chrome)
- [CVE-2026-17788](https://cve.now/CVE-2026-17788.md): Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a craf (CVSS 4.3, Google Chrome)
- [CVE-2026-17787](https://cve.now/CVE-2026-17787.md): Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-17786](https://cve.now/CVE-2026-17786.md): Insufficient validation of untrusted input in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to i (CVSS 8.8, Google Chrome)
- [CVE-2026-17785](https://cve.now/CVE-2026-17785.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-17784](https://cve.now/CVE-2026-17784.md): Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to (CVSS 8.8, Google Chrome)
- [CVE-2026-17783](https://cve.now/CVE-2026-17783.md): Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-17782](https://cve.now/CVE-2026-17782.md): Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to spoof the contents of th (CVSS 4.3, Google Chrome)
- [CVE-2026-17781](https://cve.now/CVE-2026-17781.md): Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a mal (CVSS 4.3, Google Chrome)
- [CVE-2026-17780](https://cve.now/CVE-2026-17780.md): Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation res (CVSS 6.3, Google Chrome)
- [CVE-2026-17779](https://cve.now/CVE-2026-17779.md): Inappropriate implementation in Site Isolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass site isolation vi (CVSS 5.4, Google Chrome)
- [CVE-2026-17778](https://cve.now/CVE-2026-17778.md): Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-17777](https://cve.now/CVE-2026-17777.md): Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17776](https://cve.now/CVE-2026-17776.md): Policy bypass in Receiver in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pote (CVSS 5.8, Google Chrome)
- [CVE-2026-17775](https://cve.now/CVE-2026-17775.md): Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data (CVSS 4.3, Google Chrome)
- [CVE-2026-17774](https://cve.now/CVE-2026-17774.md): Insufficient validation of untrusted input in Variations in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network (CVSS 7.5, Google Chrome)
- [CVE-2026-17773](https://cve.now/CVE-2026-17773.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin da (CVSS 4.3, Google Chrome)
- [CVE-2026-17772](https://cve.now/CVE-2026-17772.md): Out of bounds read in WebGL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a (CVSS 4.3, Google Chrome)
- [CVE-2026-17771](https://cve.now/CVE-2026-17771.md): Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 4.3, Google Chrome)
- [CVE-2026-17770](https://cve.now/CVE-2026-17770.md): Out of bounds read in Media in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proces (CVSS 5.8, Google Chrome)
- [CVE-2026-17769](https://cve.now/CVE-2026-17769.md): Insufficient validation of untrusted input in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin da (CVSS 4.3, Google Chrome)
- [CVE-2026-17768](https://cve.now/CVE-2026-17768.md): Insufficient validation of untrusted input in WebSockets in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 9.6, Google Chrome)
- [CVE-2026-17767](https://cve.now/CVE-2026-17767.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had c (CVSS 4.3, Google Chrome)
- [CVE-2026-17766](https://cve.now/CVE-2026-17766.md): Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak (CVSS 3.3, Google Chrome)
- [CVE-2026-17765](https://cve.now/CVE-2026-17765.md): Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendere (CVSS 4.3, Google Chrome)
- [CVE-2026-17764](https://cve.now/CVE-2026-17764.md): Inappropriate implementation in FedCM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-17763](https://cve.now/CVE-2026-17763.md): Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proce (CVSS 4.3, Google Chrome)
- [CVE-2026-17762](https://cve.now/CVE-2026-17762.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin (CVSS 4.3, Google Chrome)
- [CVE-2026-17761](https://cve.now/CVE-2026-17761.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inj (CVSS 5.4, Google Chrome)
- [CVE-2026-17760](https://cve.now/CVE-2026-17760.md): Side-channel information leakage in NoStatePrefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin d (CVSS 4.3, Google Chrome)
- [CVE-2026-17759](https://cve.now/CVE-2026-17759.md): Uninitialized Use in Codecs in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information fr (CVSS 6.5, Google Chrome)
- [CVE-2026-17757](https://cve.now/CVE-2026-17757.md): Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pag (CVSS 4.3, Google Chrome)
- [CVE-2026-17756](https://cve.now/CVE-2026-17756.md): Insufficient policy enforcement in Presentation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restr (CVSS 6.5, Google Chrome)
- [CVE-2026-17755](https://cve.now/CVE-2026-17755.md): Incorrect security UI in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious (CVSS 4.3, Google Chrome)
- [CVE-2026-17754](https://cve.now/CVE-2026-17754.md): Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-17753](https://cve.now/CVE-2026-17753.md): Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-17752](https://cve.now/CVE-2026-17752.md): Use after free in Views in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2026-17751](https://cve.now/CVE-2026-17751.md): Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside (CVSS 8.8, Google Chrome)
- [CVE-2026-17750](https://cve.now/CVE-2026-17750.md): Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 7.1, Google Chrome)
- [CVE-2026-17749](https://cve.now/CVE-2026-17749.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to (CVSS 9.6, Google Chrome)
- [CVE-2026-17748](https://cve.now/CVE-2026-17748.md): Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rendere (CVSS 6.5, Google Chrome)
- [CVE-2026-17747](https://cve.now/CVE-2026-17747.md): Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had (CVSS 4.2, Google Chrome)
- [CVE-2026-17746](https://cve.now/CVE-2026-17746.md): Use after free in GPU in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to p (CVSS 5.8, Google Chrome)
- [CVE-2026-17745](https://cve.now/CVE-2026-17745.md): Out of bounds read in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pot (CVSS 5.8, Google Chrome)
- [CVE-2026-17744](https://cve.now/CVE-2026-17744.md): Inappropriate implementation in File Input in Google Chrome on Linux prior to 151.0.7922.72 allowed a remote attacker to potentially perform (CVSS 7.1, Google Chrome)
- [CVE-2026-17743](https://cve.now/CVE-2026-17743.md): Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin p (CVSS 6.5, Google Chrome)
- [CVE-2026-17742](https://cve.now/CVE-2026-17742.md): Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17741](https://cve.now/CVE-2026-17741.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potent (CVSS 7.1, Google Chrome)
- [CVE-2026-17740](https://cve.now/CVE-2026-17740.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-17739](https://cve.now/CVE-2026-17739.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a (CVSS 4.2, Google Chrome)
- [CVE-2026-17738](https://cve.now/CVE-2026-17738.md): Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 9.6, Google Chrome)
- [CVE-2026-17737](https://cve.now/CVE-2026-17737.md): Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pr (CVSS 5.0, Google Chrome)
- [CVE-2026-17736](https://cve.now/CVE-2026-17736.md): Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had c (CVSS 5.8, Google Chrome)
- [CVE-2026-17735](https://cve.now/CVE-2026-17735.md): Insufficient validation of untrusted input in BFCache in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 8.7, Google Chrome)
- [CVE-2026-17734](https://cve.now/CVE-2026-17734.md): Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HT (CVSS 5.4, Google Chrome)
- [CVE-2026-17733](https://cve.now/CVE-2026-17733.md): Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data (CVSS 4.3, Google Chrome)
- [CVE-2026-17731](https://cve.now/CVE-2026-17731.md): Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin d (CVSS 4.3, Google Chrome)
- [CVE-2026-17730](https://cve.now/CVE-2026-17730.md): Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engag (CVSS 4.3, Google Chrome)
- [CVE-2026-17729](https://cve.now/CVE-2026-17729.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potential (CVSS 8.8, Google Chrome)
- [CVE-2026-17732](https://cve.now/CVE-2026-17732.md): Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 3.1, Google Chrome)
- [CVE-2026-17758](https://cve.now/CVE-2026-17758.md): Heap buffer overflow in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-17728](https://cve.now/CVE-2026-17728.md): Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or (CVSS 5.4, Google Chrome)
- [CVE-2026-17727](https://cve.now/CVE-2026-17727.md): Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox e (CVSS 9.6, Google Chrome)
- [CVE-2026-17726](https://cve.now/CVE-2026-17726.md): Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox esca (CVSS 9.6, Google Chrome)
- [CVE-2026-17725](https://cve.now/CVE-2026-17725.md): Type Confusion in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17724](https://cve.now/CVE-2026-17724.md): Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) v (CVSS 4.2, Google Chrome)
- [CVE-2026-17723](https://cve.now/CVE-2026-17723.md): Use after free in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proces (CVSS 8.3, Google Chrome)
- [CVE-2026-17722](https://cve.now/CVE-2026-17722.md): Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 8.3, Google Chrome)
- [CVE-2026-17721](https://cve.now/CVE-2026-17721.md): Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a (CVSS 9.6, Google Chrome)
- [CVE-2026-17720](https://cve.now/CVE-2026-17720.md): Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 3.1, Google Chrome)
- [CVE-2026-17719](https://cve.now/CVE-2026-17719.md): Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a c (CVSS 8.8, Google Chrome)
- [CVE-2026-17718](https://cve.now/CVE-2026-17718.md): Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-17717](https://cve.now/CVE-2026-17717.md): Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a cr (CVSS 9.6, Google Chrome)
- [CVE-2026-17716](https://cve.now/CVE-2026-17716.md): Use after free in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via malici (CVSS 8.4, Google Chrome)
- [CVE-2026-17715](https://cve.now/CVE-2026-17715.md): Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage i (CVSS 3.1, Google Chrome)
- [CVE-2026-17714](https://cve.now/CVE-2026-17714.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information fro (CVSS 6.5, Google Chrome)
- [CVE-2026-17713](https://cve.now/CVE-2026-17713.md): Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who (CVSS 9.6, Google Chrome)
- [CVE-2026-17712](https://cve.now/CVE-2026-17712.md): Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craft (CVSS 8.8, Google Chrome)
- [CVE-2026-17711](https://cve.now/CVE-2026-17711.md): Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poten (CVSS 9.6, Google Chrome)
- [CVE-2026-17710](https://cve.now/CVE-2026-17710.md): Inappropriate implementation in MHTML in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the rende (CVSS 9.6, Google Chrome)
- [CVE-2026-17709](https://cve.now/CVE-2026-17709.md): Race in Downloads in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poten (CVSS 9.6, Google Chrome)
- [CVE-2026-17708](https://cve.now/CVE-2026-17708.md): Use after free in Audio in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17707](https://cve.now/CVE-2026-17707.md): Uninitialized Use in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer pro (CVSS 6.5, Google Chrome)
- [CVE-2026-17706](https://cve.now/CVE-2026-17706.md): Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had com (CVSS 4.3, Google Chrome)
- [CVE-2026-17705](https://cve.now/CVE-2026-17705.md): Integer overflow in libxml in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-17704](https://cve.now/CVE-2026-17704.md): Use after free in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17703](https://cve.now/CVE-2026-17703.md): Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigat (CVSS 6.5, Google Chrome)
- [CVE-2026-17702](https://cve.now/CVE-2026-17702.md): Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer proc (CVSS 3.1, Google Chrome)
- [CVE-2026-17701](https://cve.now/CVE-2026-17701.md): Insufficient validation of untrusted input in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had comprom (CVSS 9.6, Google Chrome)
- [CVE-2026-17700](https://cve.now/CVE-2026-17700.md): Insufficient validation of untrusted input in Actor in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised th (CVSS 4.3, Google Chrome)
- [CVE-2026-17699](https://cve.now/CVE-2026-17699.md): Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a local attacker to potentially perform a sandbox escape via a malic (CVSS 8.6, Google Chrome)
- [CVE-2026-17698](https://cve.now/CVE-2026-17698.md): Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-o (CVSS 7.5, Google Chrome)
- [CVE-2026-17697](https://cve.now/CVE-2026-17697.md): Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-17696](https://cve.now/CVE-2026-17696.md): Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a (CVSS 4.3, Google Chrome)
- [CVE-2026-17695](https://cve.now/CVE-2026-17695.md): Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sand (CVSS 9.6, Google Chrome)
- [CVE-2026-17694](https://cve.now/CVE-2026-17694.md): Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra (CVSS 8.8, Google Chrome)
- [CVE-2026-17693](https://cve.now/CVE-2026-17693.md): Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data vi (CVSS 4.3, Google Chrome)
- [CVE-2026-17692](https://cve.now/CVE-2026-17692.md): Use after free in DataTransfer in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer (CVSS 9.6, Google Chrome)
- [CVE-2026-17691](https://cve.now/CVE-2026-17691.md): Out of bounds write in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox e (CVSS 9.6, Google Chrome)
- [CVE-2026-17690](https://cve.now/CVE-2026-17690.md): Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross- (CVSS 6.5, Google Chrome)
- [CVE-2026-17689](https://cve.now/CVE-2026-17689.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 4.3, Google Chrome)
- [CVE-2026-17688](https://cve.now/CVE-2026-17688.md): Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17687](https://cve.now/CVE-2026-17687.md): Type Confusion in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17686](https://cve.now/CVE-2026-17686.md): Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromise (CVSS 8.1, Google Chrome)
- [CVE-2026-17685](https://cve.now/CVE-2026-17685.md): Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-17684](https://cve.now/CVE-2026-17684.md): Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who ha (CVSS 9.6, Google Chrome)
- [CVE-2026-17683](https://cve.now/CVE-2026-17683.md): Inappropriate implementation in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive info (CVSS 6.5, Google Chrome)
- [CVE-2026-17682](https://cve.now/CVE-2026-17682.md): Integer overflow in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to pote (CVSS 9.6, Google Chrome)
- [CVE-2026-17681](https://cve.now/CVE-2026-17681.md): Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacke (CVSS 9.6, Google Chrome)
- [CVE-2026-17680](https://cve.now/CVE-2026-17680.md): Heap buffer overflow in Color in Google Chrome on ChromeOS prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer (CVSS 9.6, Google Chrome)
- [CVE-2026-17679](https://cve.now/CVE-2026-17679.md): Insufficient validation of untrusted input in Print Preview in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compro (CVSS 6.5, Google Chrome)
- [CVE-2026-17678](https://cve.now/CVE-2026-17678.md): Out of bounds read in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.8, Google Chrome)
- [CVE-2026-17677](https://cve.now/CVE-2026-17677.md): Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potentially perform a (CVSS 8.8, Google Chrome)
- [CVE-2026-17676](https://cve.now/CVE-2026-17676.md): Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the r (CVSS 9.6, Google Chrome)
- [CVE-2026-17675](https://cve.now/CVE-2026-17675.md): Out of bounds write in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to p (CVSS 9.6, Google Chrome)
- [CVE-2026-17674](https://cve.now/CVE-2026-17674.md): Inappropriate implementation in HTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass content security policy via (CVSS 6.5, Google Chrome)
- [CVE-2026-17673](https://cve.now/CVE-2026-17673.md): Integer overflow in QUIC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to poten (CVSS 9.6, Google Chrome)
- [CVE-2026-17672](https://cve.now/CVE-2026-17672.md): Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromis (CVSS 9.6, Google Chrome)
- [CVE-2026-17671](https://cve.now/CVE-2026-17671.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised th (CVSS 9.6, Google Chrome)
- [CVE-2026-17670](https://cve.now/CVE-2026-17670.md): Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17669](https://cve.now/CVE-2026-17669.md): Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to potentially perfo (CVSS 9.6, Google Chrome)
- [CVE-2026-17668](https://cve.now/CVE-2026-17668.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-17667](https://cve.now/CVE-2026-17667.md): Uninitialized Use in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa (CVSS 6.5, Google Chrome)
- [CVE-2026-17666](https://cve.now/CVE-2026-17666.md): Cryptographic Flaw in Enterprise in Google Chrome prior to 151.0.7922.72 allowed an attacker in a privileged network position to bypass disc (CVSS 9.1, Google Chrome)
- [CVE-2026-17665](https://cve.now/CVE-2026-17665.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17664](https://cve.now/CVE-2026-17664.md): Insufficient validation of untrusted input in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised t (CVSS 6.5, Google Chrome)
- [CVE-2026-17663](https://cve.now/CVE-2026-17663.md): Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compr (CVSS 8.3, Google Chrome)
- [CVE-2026-17662](https://cve.now/CVE-2026-17662.md): Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via (CVSS 4.3, Google Chrome)
- [CVE-2026-17661](https://cve.now/CVE-2026-17661.md): Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-17660](https://cve.now/CVE-2026-17660.md): Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised (CVSS 8.3, Google Chrome)
- [CVE-2026-17659](https://cve.now/CVE-2026-17659.md): Inappropriate implementation in SiteIsolation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the rend (CVSS 4.2, Google Chrome)
- [CVE-2026-17658](https://cve.now/CVE-2026-17658.md): Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a craf (CVSS 8.8, Google Chrome)
- [CVE-2026-17657](https://cve.now/CVE-2026-17657.md): Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-17656](https://cve.now/CVE-2026-17656.md): Use after free in Ozone in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a craf (CVSS 9.6, Google Chrome)
- [CVE-2026-17655](https://cve.now/CVE-2026-17655.md): Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform (CVSS 9.6, Google Chrome)
- [CVE-2026-17654](https://cve.now/CVE-2026-17654.md): Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malic (CVSS 7.8, Google Chrome)
- [CVE-2026-17653](https://cve.now/CVE-2026-17653.md): Use after free in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potenti (CVSS 8.3, Google Chrome)
- [CVE-2026-17652](https://cve.now/CVE-2026-17652.md): Use after free in Views in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potent (CVSS 9.6, Google Chrome)
- [CVE-2026-17651](https://cve.now/CVE-2026-17651.md): Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to potential (CVSS 9.6, Google Chrome)
- [CVE-2026-17650](https://cve.now/CVE-2026-17650.md): Use after free in Compositing in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-59952](https://cve.now/CVE-2026-59952.md): Valibot: record() issue paths can make flatten() throw for inherited Object property names (CVSS 6.9, open-circle valibot · valibot)
- [CVE-2026-62946](https://cve.now/CVE-2026-62946.md): ImageMagick: Integer Overflow in JNX decoder causes heap buffer over-write when processing extremly large files on 32-bit builds (CVSS 5.1, ImageMagick · Magick.NET-Q16-AnyCPU +5)
- [CVE-2026-62363](https://cve.now/CVE-2026-62363.md): ImageMagick: Heap Buffer Over-Write in fx operation (CVSS 5.0, ImageMagick · Magick.NET-Q16-AnyCPU +16)
- [CVE-2025-51684](https://cve.now/CVE-2025-51684.md): CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2025-65336](https://cve.now/CVE-2025-65336.md): Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0 is vulnerable to SQL Injection in /show\_price\_by\_pdtId.php. (CVSS 9.8)
- [CVE-2025-65341](https://cve.now/CVE-2025-65341.md): Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting (XSS) in admin/edit\_product.php. (CVSS 6.1)
- [CVE-2025-65342](https://cve.now/CVE-2025-65342.md): code-projects Blood System 1.0 is vulnerable to Cross Site Scripting (XSS) in /don.php via the city field. (CVSS 6.1)
- [CVE-2025-69930](https://cve.now/CVE-2025-69930.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /print\_membership\_card.php?id=1. (CVSS 9.8)
- [CVE-2025-69931](https://cve.now/CVE-2025-69931.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete\_membership.php?id=1. (CVSS 9.8)
- [CVE-2025-69933](https://cve.now/CVE-2025-69933.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. (CVSS 9.8)
- [CVE-2025-69934](https://cve.now/CVE-2025-69934.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /delete\_members.php?id=1. (CVSS 9.8)
- [CVE-2025-69935](https://cve.now/CVE-2025-69935.md): CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenue\_report.php via the fromDate parameter (CVSS 9.8)
- [CVE-2025-69936](https://cve.now/CVE-2025-69936.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /edit\_member.php?id=1. (CVSS 9.8)
- [CVE-2025-69937](https://cve.now/CVE-2025-69937.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edit\_type.php endpoint via the Parameter id. (CVSS 9.8)
- [CVE-2025-69938](https://cve.now/CVE-2025-69938.md): CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the parameter membershipType. (CVSS 9.8)
- [CVE-2025-69941](https://cve.now/CVE-2025-69941.md): SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in addmeasurement.php?id=1. (CVSS 9.8)
- [CVE-2025-69947](https://cve.now/CVE-2025-69947.md): SourceCodester Tailor Management System 1.0 is vulnerable to SQL Injection in customeredit.php?id=1. (CVSS 9.8)
- [CVE-2026-35847](https://cve.now/CVE-2026-35847.md): An issue in dnsmgr v.2.15 and before allows a local attacker to execute arbitrary code via the ping function of the CheckUils.php file (CVSS 9.8)
- [CVE-2026-38709](https://cve.now/CVE-2026-38709.md): TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2 (CVSS 9.8)
- [CVE-2026-52539](https://cve.now/CVE-2026-52539.md): Outstatic CMS \<= 2.1.9 contains a hardcoded JWT signing secret. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-07-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.