CVEs published August 25, 2026
766 CVEs were published on August 25, 2026: 96 critical, 288 high.
- Published
- 766
- Critical
- 96
- High
- 288
- Medium
- 346
- Low
- 36
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 588
Most affected products
- Google Chrome
- 327
- AcademySoftwareFoundation openexr
- 20
- lin-snow Ech0 · github.com/lin-snow/ech0
- 12
- MervinPraison PraisonAI · praisonai
- 12
- NVIDIA NemoClaw
- 11
- Adobe Substance 3D Sampler
- 10
- vrana adminer
- 10
- Adobe Substance 3D Designer
- 9
- OpenSSL
- 9
- Adobe Substance3D - Painter
- 8
Critical 96
- CVE-2026-80202Kimai before 2.56.0 Authorization Bypass via TimesheetVoterkimai · kimai/kimai
- CVE-2026-16639Internationalization Single Sign-On - Critical - Access bypass - SA-CONTRIB-2026-081Drupal Internationalization Single Sign-On · drupal/i18n_sso
- CVE-2026-16641Commerce Elavon - Critical - Unsupported - SA-CONTRIB-2026-084Drupal Commerce Elavon · drupal/commerce_elavon
- CVE-2026-16644Webform REST - Moderately critical - Access bypass - SA-CONTRIB-2026-087Drupal Webform REST · drupal/webform_rest
- CVE-2026-16645PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-088Drupal PhotoSwipe - Responsive JavaScript Modal Image Galle…
- CVE-2026-79911TOTOLINK N600R CGI cstecgi.cgi setSystemConfig stack-based overflowTOTOLINK N600R
- CVE-2026-80138ClipBucket V5 5.5.1 through 5.5.3-#153 OS Command Injection via Installer php_cli_filepath ParameterMacWarrior clipbucket-v5
- CVE-2026-68525Apache Tomcat: Redirect after FORM auth may bypass method specific constraintsApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-65905Apache Tomcat: Limited replay attack possible with DIGEST authenticationApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-65637Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incompleteApache Software Foundation Apache Tomcat · org.apache.to… +1
- CVE-2026-65182Apache Tomcat: Bypass longest prefix security constraintApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2026-62862TypeBot: Account takeover via brute-forceable 6-digit magic-link codebaptisteArno typebot.io
- CVE-2026-78655Punk::Plugin::TOTP versions before 0.05 for Perl allow the second-factor attempt limit to be reset by replaying an earlier session cookie because the challenge route counts failures in the sessionPunk-TOTP
- CVE-2026-78619Punk::Plugin::TOTP versions before 0.05 for Perl accept another account's recovery code at the two-factor challenge because totp_use_recovery compares user identifiers numericallyPunk-TOTP
- CVE-2026-80104DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filenameeosphoros-ai DB-GPT
- CVE-2026-65083NVIDIA OpenShell for Linux contains a vulnerability in its sandbox provisioning API, where an attacker could cause an incomplete list of disNVIDIA OpenShell
- CVE-2026-65093NVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape.NVIDIA OpenShell
- CVE-2026-78964Use after free in Sync in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outGoogle Chrome
- CVE-2026-79152Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin poGoogle Chrome
- CVE-2026-79148Off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially Google Chrome
- CVE-2026-79056Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsGoogle Chrome
- CVE-2026-79058Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-79090Improper privilege management in Actor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to byGoogle Chrome
- CVE-2026-79091Use after free in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to exeGoogle Chrome
- CVE-2026-78951Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandGoogle Chrome
- CVE-2026-79064Use after free in Network in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execuGoogle Chrome
- CVE-2026-79128Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the saGoogle Chrome
- CVE-2026-79140Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the saGoogle Chrome
- CVE-2026-78909Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitraryGoogle Chrome
- CVE-2026-78937Use after free in Search in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to poGoogle Chrome
- CVE-2026-79129Use after free in Sessions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to Google Chrome
- CVE-2026-78985Incorrect reference resolution in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeringGoogle Chrome
- CVE-2026-78945Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execuGoogle Chrome
- CVE-2026-79078Use after free in FedCM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitraryGoogle Chrome
- CVE-2026-78904Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the Google Chrome
- CVE-2026-79026Use after free in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially Google Chrome
- CVE-2026-79138Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2026-79275Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-79149Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-79131Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandboxGoogle Chrome
- CVE-2026-79189Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsideGoogle Chrome
- CVE-2026-79188Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsideGoogle Chrome
- CVE-2026-78900Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code oGoogle Chrome
- CVE-2026-79232Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sGoogle Chrome
- CVE-2026-79235Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-79043Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsideGoogle Chrome
- CVE-2026-78948Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox viaGoogle Chrome
- CVE-2026-79111Improper input validation in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code ouGoogle Chrome
- CVE-2026-79130Buffer overflow in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox viaGoogle Chrome
- CVE-2026-79019Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2026-79257Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via Google Chrome
- CVE-2026-79047Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitraryGoogle Chrome
- CVE-2026-78939Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to eGoogle Chrome
- CVE-2026-78989Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitraryGoogle Chrome
- CVE-2026-79200Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via aGoogle Chrome
- CVE-2026-79012Use after free in Safebrowsing in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to Google Chrome
- CVE-2026-78935Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to potentially execute aGoogle Chrome
- CVE-2026-79150Use after free in Views in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the saGoogle Chrome
- CVE-2026-79052Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via aGoogle Chrome
- CVE-2026-79290Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via aGoogle Chrome
- CVE-2026-79282Use after free in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside thGoogle Chrome
- CVE-2026-45018Chainlit: Command injection via MCP stdio transport allows unauthenticated remote code executionchainlit
- CVE-2026-78379Consent bypass in python_repl tool via batch kwargs forwarding in Amazon Strands Agents ToolsAmazon strands-agents-tools
- CVE-2026-79787Alluxio through 2.9.5 S3 REST Proxy Authentication Bypass via Unverified Request Signaturealluxio
- CVE-2026-76195Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe Campaign Classic
- CVE-2026-76197Adobe Campaign Classic (ACC) | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe Campaign Classic
- CVE-2026-76193Adobe Campaign Classic (ACC) | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Campaign Classic
- CVE-2026-19912CVE-2026-19912Kaltura HTML5 Video Player, html5 library
- CVE-2026-55640Nextcloud MCP Server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )cbcoutinho nextcloud-mcp-server · nextcloud-mcp-server
- CVE-2026-55546QWED-MCP: Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression InputQWED-AI qwed-mcp · qwed-mcp
- CVE-2026-55536Browser Server WebSocket origin validation bypass via unanchored regex (patch bypass of CVE-2026-40289 / GHSA-8x8f-54wf-vv92)MervinPraison PraisonAI · praisonai
- CVE-2026-79782rclone before 1.74.4 Security Token Disclosure via HTTPS to HTTP Redirectrclone · github.com/rclone/rclone
- CVE-2026-79774Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicywintercms winter · winter/wn-system-module
- CVE-2026-79675NLTK before 3.10.3 JVM Argument Injection via Per-Call Optionsnltk
- CVE-2026-16286File Upload in TRTEK Software's Software Repository ManagementTRtek Technological Products Computer Software Hardware Ind…
- CVE-2026-75803AEAD Forgeries with Empty Ciphertext When Using EVP_Cipher()OpenSSL
- CVE-2026-63073Untrusted Sender DN Used as Format String in CMP Response ValidationOpenSSL
- CVE-2026-77998Joomla Extension - miniorange.com - Unauthenticated Authentication Bypass via SAMLResponse Parameter in miniOrange SAML SSO < 11.0.2, SAML SP Single Sign On – Login with ADFS < 6.4, SAML SP Single Sign On – SAML SSO login with Google Apps < 6.4miniorange.com SAML SSO Free for Joomla extension for Jo… +5
- CVE-2026-57910WatchGuard Agent improper authentication allows unauthenticated remote code executionWatchGuard Agent
- CVE-2026-57909WatchGuard Agent path traversal allows unauthenticated remote code executionWatchGuard Agent
- CVE-2026-79664Ech0 before 4.7.3 Access Token Revocation Bypasslin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79657NLTK before 3.10.3 Remote Code Execution via Unsafe Pickle Deserializationnltk
- CVE-2026-49845Apache Hive: SQL Injection vulnerability in HiveMetaStore partition-name direct-SQL pathsApache Software Foundation Apache Hive
- CVE-2026-55976Apache Hive: SSRF vulnerability in Hive Avro Serde due to Insufficient input validation on avro.schema.urlApache Software Foundation Apache Hive
- CVE-2026-77136Server-Side Template Injection in extension "powermail" (powermail)TYPO3 Extension "powermail"
- CVE-2026-77138Remote Code Execution in extension "HTML5 Video Player vs. Powermail" (html5videoplayer_powermail)TYPO3 Extension "HTML5 Video Player vs. Powermail"
- CVE-2026-63586Unauthenticated Remote Code Execution via Shell Injection in Web Management InterfaceWeidmueller Interface IE-SR-2TX-WL · Weidmueller Interfa… +1
- CVE-2026-59769FA-50 all versions contain hard-coded credentials.FURUNO ELECTRIC CO. FA-50
- CVE-2026-13214Stack buffer overflow in OCPP GetConfiguration key parsingzephyrproject zephyr
- CVE-2026-78683NLTK before 3.10.0 Remote Code Execution via Unsafe Pickle Deserializationnltk
- CVE-2026-78676GitPython before 3.1.59 Remote Code Execution via Config Injectiongitpython-developers GitPython · gitpython
- CVE-2026-72702Grav CMS before 2.0.16 Origin Validation Bypass via Referergetgrav grav · getgrav/grav
- CVE-2026-72699Grav Login Plugin before 3.9.1 Email Enumeration via Registrationgetgrav grav-plugin-login
- CVE-2026-56710Grav Login Plugin before 1.0.16 Privilege Escalation via Unlockgetgrav grav
- CVE-2026-56705Adminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN Injectionvrana adminer
- CVE-2026-51368An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execut
High 288
- CVE-2026-57171Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)oscal-compass compliance-trestle · compliance-trestle
- CVE-2026-80198Kimai before 2.56.0 Information Disclosure via config() Twig Functionkimai · kimai/kimai
- CVE-2026-80197Kimai before 2.57.0 Improper Authorization via Favorite Endpointskimai · kimai/kimai
- CVE-2026-80196Kimai before 2.58.0 Authentication Bypass via Password Reset Linkkimai · kimai/kimai
- CVE-2026-80195Kimai before 2.63.0 Team Membership Removal via APIkimai
- CVE-2026-80194Kimai before 2.64.0 Missing Authorization via ProjectViewController exportkimai
- CVE-2026-80193Kimai before 2.62.0 Authorization Bypass via QuickEntrykimai
- CVE-2026-80192better-auth SSO before 1.6.27 Domain Ownership Authentication Bypassbetter-auth sso
- CVE-2026-80191GROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated RequestsGROWI
- CVE-2026-80189LeafWiki 0.10.0 through 0.12.0 Uncontrolled Resource Consumption via Unbounded ZIP Extractionperber leafwiki
- CVE-2026-57170Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)oscal-compass compliance-trestle · compliance-trestle
- CVE-2026-52776Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0oscal-compass compliance-trestle · compliance-trestle
- CVE-2026-54757Trestle has Server-Side Template Injection (SSTI) via Recursive Template Re-evaluation of Untrusted Dataoscal-compass compliance-trestle · compliance-trestle
- CVE-2026-41707Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof ReplaySpring Security
- CVE-2026-18259Token Content Access - Moderately critical - Access bypass - SA-CONTRIB-2026-090Drupal Token Content Access · drupal/tca
- CVE-2026-18985Edit in-place field - Moderately critical - Access bypass - SA-CONTRIB-2026-093Drupal Edit in-place field · drupal/edit_in_place_field
- CVE-2026-63403Faktory: Unrecovered panic in command handlers allows full-server denial of servicecontribsys faktory
- CVE-2026-63404Faktory: Insecure predictable /tmp/redis.conf enables local Redis config hijack (network exposure / root RCE primitive)contribsys faktory
- CVE-2026-68763Apache Tomcat: DoS via allocation leak in HTTP/2 backlog tracking when a stream is resetApache Software Foundation Apache Tomcat
- CVE-2026-68569Apache Tomcat: Principal lookup can fail open in some casesApache Software Foundation Apache Tomcat
- CVE-2026-80186Bluez: stack overflow in name2utf8 causes dos and potential code executionRed Hat Enterprise Linux
- CVE-2026-66422Apache Tomcat: Servlet role references can bypass declarative role constraintsApache Software Foundation Apache Tomcat
- CVE-2026-65927Apache Tomcat: RewriteValve [N] restarts at the second rule and may bypass access controlApache Software Foundation Apache Tomcat
- CVE-2026-62865TypeBot: Arbitrary server file read via Send Email block attachment pathbaptisteArno typebot.io
- CVE-2026-65183Apache Tomcat: TOCTOU when setting specific permissions for Unix Domain SocketsApache Software Foundation Apache Tomcat
- CVE-2026-80184In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials,OpenStack Keystone
- CVE-2026-80182In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could cOpenStack Keystone
- CVE-2026-77357Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the servermesop-dev mesop
- CVE-2026-65105NVIDIA NemoClaw for Linux contains a vulnerability in its inference server setup, where a remote attacker may access the inference service wNVIDIA NemoClaw
- CVE-2026-65084NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation.NVIDIA NemoClaw
- CVE-2026-65082NVIDIA NemoClaw for Linux contains a vulnerability in its migration command, where a local attacker could cause code injection.NVIDIA NemoClaw
- CVE-2026-65081NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code.NVIDIA NemoClaw
- CVE-2026-65089NVIDIA NemoClaw for Linux contains a vulnerability in its status and logs plugin commands, where an attacker could cause OS command injectioNVIDIA NemoClaw
- CVE-2026-65090NVIDIA NemoClaw for Linux contains a vulnerability in its NIM management component, where an attacker could cause OS command injection.NVIDIA NemoClaw
- CVE-2026-65099NVIDIA NemoClaw for Linux contains a vulnerability in its command-line interface, where an attacker could cause OS command injection.NVIDIA NemoClaw
- CVE-2026-65098NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.NVIDIA NemoClaw
- CVE-2026-65097NVIDIA NemoClaw for Linux contains a vulnerability in its installation scripts, where an attacker could cause a download of code without intNVIDIA NemoClaw
- CVE-2026-65096NVIDIA NemoClaw for Linux contains a vulnerability in the Telegram bridge component, where an attacker could cause an OS command injection.NVIDIA NemoClaw
- CVE-2026-65092NVIDIA OpenShell Sandbox for Linux contains a vulnerability where an attacker could cause a path traversal bypass of L7 REST network policy.NVIDIA OpenShell
- CVE-2026-65091NVIDIA OpenShell for all platforms contains a vulnerability where a malicious gateway could cause OS command injection.NVIDIA OpenShell
- CVE-2026-78915Race condition in Enterprise in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker to potentially execute arbitGoogle Chrome
- CVE-2026-79197Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-79045Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memory inside tGoogle Chrome
- CVE-2026-79223Integer overflow in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a craftGoogle Chrome
- CVE-2026-79244Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox vGoogle Chrome
- CVE-2026-78956Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary coGoogle Chrome
- CVE-2026-79119Use after free in PDF in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a cGoogle Chrome
- CVE-2026-78950Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside thGoogle Chrome
- CVE-2026-79263Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox Google Chrome
- CVE-2026-79266Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrGoogle Chrome
- CVE-2026-79073Improper state validation in Parser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code Google Chrome
- CVE-2026-79182Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code oGoogle Chrome
- CVE-2026-78963Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code oGoogle Chrome
- CVE-2026-79139Improper input validation in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-79033Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeGoogle Chrome
- CVE-2026-79227Type confusion in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrGoogle Chrome
- CVE-2026-79097Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-78901Race condition in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-78913Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outsideGoogle Chrome
- CVE-2026-79230Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrGoogle Chrome
- CVE-2026-78978Out of bounds read in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitraryGoogle Chrome
- CVE-2026-79245Use after free in UI in Google Chrome prior to 152.0.7977.65 allowed a local attacker who had compromised the renderer process to execute arGoogle Chrome
- CVE-2026-78944Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrGoogle Chrome
- CVE-2026-79083Improper enforcement of behavioral workflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised tGoogle Chrome
- CVE-2026-78983Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to executGoogle Chrome
- CVE-2026-78892Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a local attacker to bypass system accessGoogle Chrome
- CVE-2026-79008Improper input validation in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-78905Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the Google Chrome
- CVE-2026-79127Out of bounds write in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandboxGoogle Chrome
- CVE-2026-79020Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox vGoogle Chrome
- CVE-2026-78906Race condition in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the Google Chrome
- CVE-2026-79132Improper input validation in Input in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-79215Integer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside thGoogle Chrome
- CVE-2026-79226Improper privilege management in Regional Capabilities in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social eGoogle Chrome
- CVE-2026-78910Buffer overflow in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a cGoogle Chrome
- CVE-2026-79057Race condition in Start in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to poteGoogle Chrome
- CVE-2026-79231Buffer overflow in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via Google Chrome
- CVE-2026-78891Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox viaGoogle Chrome
- CVE-2026-78990Use after free in Compositing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandboxGoogle Chrome
- CVE-2026-79210Use after free in Audio in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-79256Externally controlled reference in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromisGoogle Chrome
- CVE-2026-79109Improper input validation in Printing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-78999Improper privilege management in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-79286Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arGoogle Chrome
- CVE-2026-79071Race condition in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentiaGoogle Chrome
- CVE-2026-79216Buffer overflow in Blink in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execuGoogle Chrome
- CVE-2026-79209Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside tGoogle Chrome
- CVE-2026-79236Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-78952Out of bounds write in Crashpad in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-78938Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-78899Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crGoogle Chrome
- CVE-2026-79027Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via Google Chrome
- CVE-2026-79198Use after free in Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox viGoogle Chrome
- CVE-2026-79240Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2026-79048Out of bounds write in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2026-79142Buffer overflow in ANGLE in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside tGoogle Chrome
- CVE-2026-79072Improper state validation in Performance in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insideGoogle Chrome
- CVE-2026-79187Use after free in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via Google Chrome
- CVE-2026-79155Race condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2026-79183Use after free in Accessibility in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute aGoogle Chrome
- CVE-2026-79202Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox Google Chrome
- CVE-2026-78911Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process anGoogle Chrome
- CVE-2026-79011UI misrepresentation in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass syGoogle Chrome
- CVE-2026-78934Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitGoogle Chrome
- CVE-2026-79039Use after free in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sGoogle Chrome
- CVE-2026-79292Integer overflow in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-79219Use after free in Bluetooth in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitGoogle Chrome
- CVE-2026-79247Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2026-79194Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outsiGoogle Chrome
- CVE-2026-79195Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via Google Chrome
- CVE-2026-79218Incorrect authorization in Sandbox in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-79175Type confusion in Accessibility in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-79069Memory corruption in Tint in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code Google Chrome
- CVE-2026-79224Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to eGoogle Chrome
- CVE-2026-79121Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-79054Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to eGoogle Chrome
- CVE-2026-74932WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache PoisoningWP Fastest Cache
- CVE-2026-66153The NEService auto-upgrade process insecurely handles temporary files in SonicWall NetExtender Linux client which allows an attacker to maniSonicWall NetExtender
- CVE-2026-66152A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary fileSonicWall NetExtender
- CVE-2026-59981OpenEXR: Heap OOB read in SampleCountChannel row when using nonzero dataWindowAcademySoftwareFoundation openexr
- CVE-2026-68515OpenEXR: Heap out-of-bounds write in exrmultiview with subsampled channel unionAcademySoftwareFoundation openexr
- CVE-2026-55099icalendar: Algorithmic Complexity in Equalitycollective icalendar · icalendar
- CVE-2026-43670A Content Security Policy bypass was addressed with improved enforcement in AudioWorklet contexts.Apple Safari · Apple iOS and iPadOS +1
- CVE-2026-45019Chainlit: SSRF via MCP SSE and streamable-http transports allows unauthenticated internal network accesschainlit
- CVE-2026-68513OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collisionAcademySoftwareFoundation openexr
- CVE-2026-55609sublinear-time-solver: Arbitrary file write in consciousness-explorer / sublinear-time-solver MCP export_stateruvnet sublinear-time-solver · consciousness-explorer +1
- CVE-2026-55620eml_parser: DoS via deeply nested parens in Received headersGOVCERT-LU eml_parser · eml-parser
- CVE-2026-80050ContiNew Admin through 4.1.0 Missing Authorization and File-Type Allowlist on Multipart Upload Endpointscontinew-org continew-admin
- CVE-2026-80049Airbyte Platform through 2.0.0 Cross-Workspace Authorization Bypass via Caller-Supplied workspaceIdairbytehq airbyte-platform
- CVE-2026-79788Dradis Community Edition 5.1.0 through 5.2.0 Server-Side Request Forgery via Unrestricted AI Provider Addressdradis-ce
- CVE-2026-79786Coroot 1.20.2 through 1.24.5 Unvalidated Redirect URI in MCP OAuth Client Registrationcoroot
- CVE-2026-55637genieacs-mcp: DNS rebinding reaches local GenieACS MCP Streamable HTTP transportGeiserX genieacs-mcp · github.com/geiserx/genieacs-mcp
- CVE-2026-59982OpenEXR: DWAA InputFile AC buffer overflow on ILP32 platformsAcademySoftwareFoundation openexr
- CVE-2026-75750Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Painter
- CVE-2026-75767Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Painter
- CVE-2026-75768Substance3D - Painter | Untrusted Search Path (CWE-426)Adobe Substance3D - Painter
- CVE-2026-75766Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Painter
- CVE-2026-75769Substance3D - Painter | Heap-based Buffer Overflow (CWE-122)Adobe Substance3D - Painter
- CVE-2026-75770Substance3D - Painter | Out-of-bounds Write (CWE-787)Adobe Substance3D - Painter
- CVE-2026-75749Substance3D - Painter | Out-of-bounds Write (CWE-787)Adobe Substance3D - Painter
- CVE-2026-71399Adobe XD | Buffer Overflow (CWE-120)Adobe XD
- CVE-2026-48425Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Sampler
- CVE-2026-48421Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-48423Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Sampler
- CVE-2026-48418Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-71382Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-48420Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-48422Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Sampler
- CVE-2026-48417Substance3D - Sampler | Stack-based Buffer Overflow (CWE-121)Adobe Substance 3D Sampler
- CVE-2026-48424Substance3D - Sampler | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Sampler
- CVE-2026-48419Substance3D - Sampler | Out-of-bounds Write (CWE-787)Adobe Substance 3D Sampler
- CVE-2026-48432Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Designer
- CVE-2026-48430Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Designer
- CVE-2026-71564Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-48426Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-48428Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Designer
- CVE-2026-48427Substance3D - Designer | Out-of-bounds Write (CWE-787)Adobe Substance 3D Designer
- CVE-2026-48431Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Designer
- CVE-2026-48433Substance3D - Designer | Heap-based Buffer Overflow (CWE-122)Adobe Substance 3D Designer
- CVE-2026-71443CAI Content Credentials | Improper Input Validation (CWE-20)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-71442CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-71360CAI Content Credentials | Uncontrolled Resource Consumption (CWE-400)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-79992Emacs: emacs: command injection via crafted filenames in trampRed Hat Enterprise Linux
- CVE-2026-64204Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-59189OpenEXR: Out-of-bounds read in DeepImageChannel::row() for non-zero dataWindow originAcademySoftwareFoundation openexr
- CVE-2026-64203Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-64202Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-64201Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-59187OpenEXR: exrmetrics deep pixelmode heap buffer overflowAcademySoftwareFoundation openexr
- CVE-2026-75498Webkul QloApps SQL injectionWebkul QloApps
- CVE-2026-75497Webkul QloApps SQL injectionWebkul QloApps
- CVE-2026-16234Out-of-Bounds Read Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-75496Webkul QloApps improper file upload validationWebkul QloApps
- CVE-2026-59186OpenEXR: Heap out-of-bounds write in TiledRgbaInputFile via integer overflow on 32-bit (ILP32) buildsAcademySoftwareFoundation openexr
- CVE-2026-59184OpenEXR: OpenEXRUtil FlatImageChannel row nonzero dataWindow heap OOB writeAcademySoftwareFoundation openexr
- CVE-2026-16233Out-of-Bounds Write Vulnerability in NI LabVIEW when loading VINI LabVIEW
- CVE-2026-55557browse-mcp: Arbitrary file write via unconfined download and state pathsThat1Drifter browse-mcp · browse-mcp
- CVE-2026-55585QWED: Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`QWED-AI qwed-verification · qwed
- CVE-2026-19913CVE-2026-19913Kaltura HTML5 Video Player, html5lib library
- CVE-2026-55553urllib: Cross-origin redirects preserve credential-bearing request headers, leading to potential credential leakagenode-modules urllib · urllib
- CVE-2026-24169NVIDIA UFM Enterprise contains a vulnerability in the plugin management API, where an authenticated user with low privileges could inject coNVIDIA Unified Fabric Manager Enterprise - GA · NVIDIA Unif…
- CVE-2026-24170NVIDIA UFM Enterprise contains a vulnerability in the web interface authorization component, where an authenticated user could cause impropeNVIDIA Unified Fabric Manager Enterprise - GA · NVIDIA Unif…
- CVE-2026-24263NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause a NULL pointer derefereNVIDIA DGX Spark
- CVE-2026-47626NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write.NVIDIA DGX Spark
- CVE-2026-24262NVIDIA DGX Spark contains a vulnerability in the system firmware, where a privileged attacker could be able to cause an out-of-bounds write.NVIDIA DGX Spark
- CVE-2026-55571djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler callsdjust-org djust · djust
- CVE-2026-79785X-AnyLabeling before 4.0.0-beta.9 Improper Certificate Validation in Model DownloadsCVHub520 X-AnyLabeling
- CVE-2026-55580mcp-shell — Security Disabled by Default in Bare-Binary Deploy Path + Shell Interpreter in Secure-Mode Allowlistsonirico mcp-shell · github.com/sonirico/mcp-shell
- CVE-2026-55581mcp-shell: Secure Mode Allowlist Bypass via Default `/bin/bash` Executablesonirico mcp-shell · github.com/sonirico/mcp-shell
- CVE-2026-55582mcp-shell: Secure Mode Allowlist Bypass via Git Shell Aliassonirico mcp-shell · github.com/sonirico/mcp-shell
- CVE-2026-55532PraisonAI: Origin-validation bypass (startswith prefix match) enables unauthenticated cross-site request forgery against the PraisonAI MCP HTTP serverMervinPraison PraisonAI · praisonai
- CVE-2026-79784Vocos through 0.1.0 Arbitrary Code Execution via Unrestricted class_path in Model Configurationgemelo-ai vocos
- CVE-2026-79775rclone Archive Backend SquashFS Parser Denial of Servicerclone
- CVE-2026-79770Nokogiri before 1.19.3 ReDoS via CSS selector tokenizersparklemotion nokogiri · nokogiri
- CVE-2026-79769Nokogiri before 1.19.4 Invalid Memory Read via initialize_copy_with_argssparklemotion nokogiri
- CVE-2026-79676NLTK before 3.10.3 Path Traversal via Symlink Bypassnltk
- CVE-2026-79674NLTK 3.10.2 Path Traversal via corpus-reader constructorsnltk
- CVE-2026-55533PraisonAI: Authentication fail-open in Recipe server allows unauthenticated access when API key or JWT auth is configured without a secretMervinPraison PraisonAI · praisonai
- CVE-2026-55539PraisonAI: [Auth Bypass] PraisonAI async Jobs API (`/api/v1/runs`) has no authentication — unauthenticated job execution, result theft, cancel and deleteMervinPraison PraisonAI · praisonai
- CVE-2026-69104Potential unauthorized repository migration in JFrog Artifactoryjfrog artifactory
- CVE-2026-55527PraisonAI: Arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable locationMervinPraison PraisonAI · praisonaiagents
- CVE-2026-70551Server-Side Request Forgery Via VCS remote download in JFrog Artifactoryjfrog artifactory
- CVE-2026-55541PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforcedMervinPraison PraisonAI · praisonai
- CVE-2026-55537PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114MervinPraison PraisonAI · praisonai
- CVE-2026-55538PraisonAI: [Auth Bypass] `praisonai serve agents --api-key` is silently ignored — agent-invocation routes (`POST /agents`, `POST /agents/{agent_name}`) run unauthenticatedMervinPraison PraisonAI · praisonai
- CVE-2026-55540PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinksMervinPraison PraisonAI · praisonai
- CVE-2026-55534PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent executionMervinPraison PraisonAI · praisonai
- CVE-2026-55526PraisonAI: SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)MervinPraison PraisonAI · MervinPraison praisonaiagents +1
- CVE-2026-55528praisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)MervinPraison PraisonAI · MervinPraison praisonaiagents +1
- CVE-2026-55525PraisonAI: SSRF via redirect-following in praisonaiagents web_crawlMervinPraison PraisonAI · MervinPraison praisonaiagents +1
- CVE-2026-79655Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file writeRed Hat Enterprise Linux
- CVE-2026-63076Invalid Pointer Dereference in CMP Server via Crafted protectionAlgOpenSSL
- CVE-2026-63075QUIC ACK-only Packet Retention Can Cause Memory ExhaustionOpenSSL
- CVE-2026-63072Heap Buffer Overflow in CMS Key UnwrappingOpenSSL
- CVE-2026-54874Excessive Memory Use Buffering DTLS Records for a Future EpochOpenSSL
- CVE-2026-18798QUIC Server May Trigger Double Free When Processing INITIAL PacketOpenSSL
- CVE-2026-14457RPK Server Signature Algorithm Selection Can Dereference a Missing CertificateOpenSSL
- CVE-2026-57863Crater Invoice 6.0.6 Path Traversal RCE via update/unzip endpointcrater-invoice-inc crater
- CVE-2026-77996Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41yootheme.com YOOtheme Pro extension for Joomla
- CVE-2026-79673Ech0 before 4.4.3 Scope Bypass via profile:read Tokenlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79672Ech0 before 4.4.3 Authentication Bypass via Comment Panellin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79667Ech0 before 4.4.3 Authentication Bypass via Scope Enforcementlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79666Ech0 before 4.4.3 Missing Authorization via dashboard log endpointslin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79665Ech0 before 4.5.1 Authorization Bypass via Session Tokenslin-snow Ech0
- CVE-2026-79662Ech0 before 4.7.3 OAuth Redirect URI Validation Bypasslin-snow Ech0 · github.com/lin-snow/Ech0
- CVE-2026-79659Ech0 before 4.7.3 Server-Side Request Forgery via fetchPeerConnectInfolin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79658Ech0 before 5.0.1 Denial of Service via Accept-Languagelin-snow Ech0
- CVE-2026-75971ShopEngine Elementor WooCommerce Builder Addon <= 4.9.4 - Authenticated (Shop Manager+) Privilege Escalation to WXR Import '<wp_option>' Nodesroxnor ShopEngine Elementor WooCommerce Builder Addon – All…
- CVE-2026-19949All-in-One WP Migration and Backup <= 7.109 - Unauthenticated Second-Order SQL Injection via Archive Restore to Remote Code Executionservmask All-in-One WP Migration and Backup
- CVE-2026-59335Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseCloud Foundry UAA · Cloud Foundry cf-deployment
- CVE-2026-12600Uncontrolled memory usage in Innodata Labs’ Poppler JPX decoderPoppler Innodata Labs
- CVE-2026-53561Apache Hive: Unauthenticated authentication bypass in HiveServer2 HTTP SAML bearer-token validation allows impersonation of any Hive userApache Software Foundation Apache Hive
- CVE-2026-16231hbs vulnerable to XSS via registerAsyncHelper output-escaping bypasshbs
- CVE-2026-49050Apache DolphinScheduler: General user can mint admin access tokens via /access-tokensApache Software Foundation Apache DolphinScheduler
- CVE-2026-75037Polkit authentication bypass in LACTilya-zlobintsev LACT
- CVE-2026-12878In affected versions of the Codefresh platform an authenticated user can utilize an API endpoint to elevate to Admin permissions.Octopus Deploy Codefresh
- CVE-2026-56092Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Extension "Apache Solr for TYPO3 - Enterprise Search"
- CVE-2026-56095Insecure Deserialization in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Extension "Apache Solr for TYPO3 - Enterprise Search"
- CVE-2026-77129Server-Side Template Injection in extension "Event management and registration" (sf_event_mgt)TYPO3 Extension "Event management and registration"
- CVE-2026-77134Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"
- CVE-2026-77135Information Disclosure in extension "femanager" (femanager)TYPO3 Extension "femanager"
- CVE-2026-77137SQL Injection in extension "Forms Export" (frp_form_answers)TYPO3 Extension "Forms Export"
- CVE-2026-77140Broken Access Control in extension "Telephone Directory" (telephonedirectory)TYPO3 Extension "Telephone Directory"
- CVE-2026-77141Broken Access Control in extension "Club Directory" (clubdirectory)TYPO3 Extension "Club Directory"
- CVE-2026-77142Broken Access Control in extension "Industry Directory" (yellowpages2)TYPO3 Extension "Industry Directory"
- CVE-2026-77143Broken Access Control in extension "Forum" (pforum)TYPO3 Extension "Forum"
- CVE-2026-77144Broken Access Control in extension "Events 2" (events2)TYPO3 Extension "Events 2"
- CVE-2026-77145Broken Access Control in extension "Events 2" (events2)TYPO3 Extension "Events 2"
- CVE-2026-77146Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"
- CVE-2026-63587SMS Password Authorization Bypass via Failed Attempt CounterWeidmueller Interface IE-SR-2TX-WL-4G-EU · Weidmueller Inte…
- CVE-2026-65633Purpose-limited JWT accepted as full bearer authentication in AshAuthenticationteam-alembic ash_authentication
- CVE-2026-19851Use of Default Password vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5Dassault Systèmes Tuleap Enterprise Edition
- CVE-2026-67578FA-50 all versions miss authentication for some configuration.FURUNO ELECTRIC CO. FA-50
- CVE-2026-18328Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameterwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-18323Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)wpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2026-16601CM Map Locations <= 2.1.8 - Authenticated (Subscriber+) Arbitrary File Upload via cmloc_route_image_upload AJAX Actioncreativemindssolutions CM Map Locations – Visualize and sha…
- CVE-2026-68959SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability.Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager
- CVE-2026-68062SKYSEA Client View and SKYMEC IT Manager contain a path traversal vulnerability.Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager
- CVE-2026-66109A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager
- CVE-2026-68960A stack-based buffer overflow vulnerability exists in SKYSEA Client View and SKYMEC IT Manager.Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager
- CVE-2026-69665SKYSEA Client View and SKYMEC IT Manager contain an issue with incorrect default permissions.Sky Co. SKYSEA Client View · Sky Co. SKYMEC IT Manager
- CVE-2026-78478Måne <= 1.7 - Unauthenticated Local File InclusionElated-Themes Mane
- CVE-2026-19892InfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link DisclosureInfused Addons InfusedWoo Pro
- CVE-2026-78685Le-yan｜Medical Practice Management System - Remote Code ExecutionLe-yan Medical Practice Management System
- CVE-2026-78682NLTK before 3.10.3 SSRF Protection Bypass via Proxynltk
- CVE-2026-78681NLTK before 3.10.3 Entity Expansion DoS via ElementTreenltk
- CVE-2026-78680NLTK before 3.10.3 Arbitrary Code Execution via Graphviz dot Binarynltk
- CVE-2026-78679GitPython before 3.1.59 Arbitrary File Read via TagReference.creategitpython-developers GitPython · gitpython
- CVE-2026-78678GitPython before 3.1.59 Arbitrary File Read via Repo.blame()gitpython-developers GitPython · gitpython
- CVE-2026-78677GitPython before 3.1.59 Path Traversal via separate-git-dirgitpython-developers GitPython · gitpython
- CVE-2026-78675GitPython before 3.1.59 Local File Content Disclosure via .gitmodulesgitpython-developers GitPython · gitpython
- CVE-2026-76846Grav before 2.0.16 Information Disclosure via Twig Sandboxgetgrav grav · getgrav/grav
- CVE-2026-76839Grav before 2.0.16 Information Disclosure via offsetGetgetgrav grav · getgrav/grav
- CVE-2026-75574Grav before 4.2.2 Remote Code Execution via Email Twiggetgrav grav
- CVE-2026-72700Grav before 3.9.1 Timing Attack via Non-Constant-Time Token Comparisongetgrav grav
- CVE-2026-72698Grav CMS before 2.0.16 Information Disclosure via Twig Sandbox Bypassgetgrav grav · getgrav/grav
- CVE-2026-72697Grav CMS before 2.0.16 Path Traversal via media_directorygetgrav grav · getgrav/grav
- CVE-2026-72696Grav CMS before 2.0.16 Symlink Following via createLockFilegetgrav grav
- CVE-2026-72695Grav before 2.0.16 Path Traversal via MediaUploadTrait deleteFilegetgrav grav · getgrav/grav
- CVE-2026-56709Grav before 3.9.2 Host Header Injection via sendInvitationEmailgetgrav grav
- CVE-2026-56707Grav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcodegetgrav grav
- CVE-2026-56703Adminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOvrana adminer
- CVE-2026-56702Adminer before 5.4.3 Unrestricted File Upload via AdminerFileUploadvrana adminer
- CVE-2026-34968Adminer before 5.4.3 Arbitrary File Deletion via SQLite Dropvrana adminer
- CVE-2026-66766Denial of Service (DoS) in SAP S/4HANA (Manage Supply Protection)SAP_SE SAP S/4HANA
- CVE-2026-52489Buffer Overflow vulnerability in gpac 31becc9e08b88e525a4a62013a4000de1c0f8fd9 allows an attacker to execute arbitrary code via the svgNameT
- CVE-2026-52491An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c:
- CVE-2026-75465The /api.php/user/get_list endpoint in Maccms v10 v2026.1000.4055 is vulnerable to an Incorrect Access Control issue.
Medium, low and unrated 382
- CVE-2026-80201Kimai before 2.53.0 API Token Leakage via Invoice Templatekimai · kimai/kimai
- CVE-2026-80200Kimai before 2.53.0 Open Redirect via RelayStatekimai · kimai/kimai
- CVE-2026-80199Kimai before 2.54.0 Username Enumeration via Timing Oraclekimai · kimai/kimai
- CVE-2026-44476Doorkeeper OpenID Connect: Dynamic Client Registration feature creates public clients with client_secretdoorkeeper-gem doorkeeper-openid_connect · doorkeeper-openi…
- CVE-2026-79912TOTOLINK N600R cstecgi.cgi getCurrentTime command injectionTOTOLINK N600R
- CVE-2026-15916Drupal core - Moderately critical - Information disclosure - SA-CORE-2026-010Drupal core · drupal/core
- CVE-2026-15917Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-011Drupal core · drupal/core
- CVE-2026-55805Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-012Drupal core · drupal/core
- CVE-2026-16638Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080Drupal Media Folders · drupal/media_folders
- CVE-2026-16640Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082Drupal Search API Autocomplete · drupal/search_api_autocomp…
- CVE-2026-16646PanKM - Critical - Unsupported - SA-CONTRIB-2026-083Drupal PanKM
- CVE-2026-16642Email Login OTP - Critical - Unsupported - SA-CONTRIB-2026-085Drupal Email Login OTP · drupal/email_login_otp
- CVE-2026-16643Lunr exposed filters - Critical - Unsupported - SA-CONTRIB-2026-086Drupal Lunr exposed filters · drupal/lunr_filters
- CVE-2026-15088Development Environment - Critical - Unsupported - SA-CONTRIB-2026-089Drupal Development Environment · drupal/development_environ…
- CVE-2026-18260Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-110Drupal Disable Login Page · drupal/disable_login
- CVE-2026-18261Powerful Surveys - Critical - Unsupported - SA-CONTRIB-2026-092Drupal Powerful Surveys
- CVE-2026-70665Doorkeeper OpenID Connect: DCR endpoint persists unvalidated client-supplied scopesdoorkeeper-gem doorkeeper-openid_connect
- CVE-2026-73180Apache Tomcat: Authenticated WebSocket session survives end of HTTP sessionApache Software Foundation Apache Tomcat
- CVE-2026-79845code-projects Simple Inventory System edit.php sql injectioncode-projects Simple Inventory System
- CVE-2026-80185Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as rootRed Hat Enterprise Linux
- CVE-2026-62861TypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomainbaptisteArno typebot.io
- CVE-2026-79804SililaWijesinghe Food Ordering System search.php sql injectionSililaWijesinghe Food Ordering System
- CVE-2026-32637Velero vulnerable to file path traversal when extracting from backup's tarballvelero-io velero · github.com/vmware-tanzu/velero
- CVE-2026-72924GitHub CLI: `gh codespace ports forward` exposes forwarded services on all network interfaces by defaultcli
- CVE-2026-79793code-projects Online Shopping System sumit_form.php cross site scriptingcode-projects Online Shopping System
- CVE-2026-53965MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of servicemodelcontextprotocol php-sdk · mcp/sdk
- CVE-2026-80101Gimp: multiple heap out-of-bounds reads in xwd loader from unrelated width and bytes-per-line validationGNOME GIMP · Red Hat Enterprise Linux
- CVE-2026-77680Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fixRed Hat Enterprise Linux
- CVE-2026-55588ORAS CLI: Cyclic Referrer Graph Can Cause Unbounded Recursion and Resource Consumptionoras-project oras · oras.land/oras
- CVE-2026-79792zackees transcribe-anything Yt-dlp Download ytldp_download.py ytdlp_download os command injectionzackees transcribe-anything
- CVE-2026-65088NVIDIA NemoClaw contains a vulnerability where an attacker could cause invocation of process using visible sensitive information.NVIDIA NemoClaw
- CVE-2026-65087NVIDIA NemoClaw contains a vulnerability where an attacker could cause insufficiently protected credentials .NVIDIA NemoClaw · uff
- CVE-2026-65086NVIDIA OpenShell for Linux contains a vulnerability in its sandbox exec handler, where an attacker could cause an OS command injection.NVIDIA OpenShell
- CVE-2026-65085NVIDIA OpenShell for Linux contains a vulnerability in its inference proxy, where an attacker could cause an improper encoding or escaping oNVIDIA OpenShell
- CVE-2026-78914Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbGoogle Chrome
- CVE-2026-79254Incorrect reference resolution in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass systeGoogle Chrome
- CVE-2026-79260Improper input validation in Cookies in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-79253Improper input validation in Network in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social enginGoogle Chrome
- CVE-2026-79126Incorrect provision of specified functionality in Proxy in Google Chrome on on Windows prior to 152.0.7977.65 allowed an adjacent attacker tGoogle Chrome
- CVE-2026-78957Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a Google Chrome
- CVE-2026-78981Information leak in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to potentially obtain sensitive informGoogle Chrome
- CVE-2026-79179Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information vGoogle Chrome
- CVE-2026-79133Incorrect authorization in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craGoogle Chrome
- CVE-2026-79021Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-79225Incorrect authorization in Browser in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeGoogle Chrome
- CVE-2026-79105Improper input validation in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restGoogle Chrome
- CVE-2026-79017Race condition in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crGoogle Chrome
- CVE-2026-79207Information leak in Passwords in Google Chrome on on iOS prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information viaGoogle Chrome
- CVE-2026-79125Information leak in XR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML Google Chrome
- CVE-2026-79246Information leak in DataTransfer in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craGoogle Chrome
- CVE-2026-79112Out of bounds read in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to reaGoogle Chrome
- CVE-2026-78947Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass webGoogle Chrome
- CVE-2026-78980Improper input validation in ReaderMode in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bGoogle Chrome
- CVE-2026-79018Information leak in FoldableAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craGoogle Chrome
- CVE-2026-79108UI misrepresentation in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveGoogle Chrome
- CVE-2026-79015Improper input validation in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restricGoogle Chrome
- CVE-2026-79239Out of bounds read in Tint in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insideGoogle Chrome
- CVE-2026-79177Incorrect authorization in Media in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renGoogle Chrome
- CVE-2026-79060Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-79009UI misrepresentation in UI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elemeGoogle Chrome
- CVE-2026-78896Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a craGoogle Chrome
- CVE-2026-79284UI misrepresentation in Core in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-79041Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering tGoogle Chrome
- CVE-2026-78968Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-78946Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafteGoogle Chrome
- CVE-2026-79005Incorrect authorization in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderGoogle Chrome
- CVE-2026-79123Improper input validation in NTP Footer in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-79243Improper input validation in ReadingList in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromisedGoogle Chrome
- CVE-2026-79273Incorrect reference resolution in WebView in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially bypGoogle Chrome
- CVE-2026-79040Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sanGoogle Chrome
- CVE-2026-78977Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to potentially read memory insGoogle Chrome
- CVE-2026-79261Incorrect authorization in Controls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafGoogle Chrome
- CVE-2026-79233UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via Google Chrome
- CVE-2026-79022UI misrepresentation in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineerinGoogle Chrome
- CVE-2026-79098UI misrepresentation in PermissionElement in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering toGoogle Chrome
- CVE-2026-79147Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2026-79089Race condition in Transactions Platform in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social enGoogle Chrome
- CVE-2026-78897Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtaiGoogle Chrome
- CVE-2026-79206Out of bounds read in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to read memGoogle Chrome
- CVE-2026-79190Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-79181Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craftGoogle Chrome
- CVE-2026-78979Race condition in Core in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypaGoogle Chrome
- CVE-2026-79000Improper input validation in DeviceBoundSessionCredentials in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging sociGoogle Chrome
- CVE-2026-79196Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitivGoogle Chrome
- CVE-2026-79077Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictionsGoogle Chrome
- CVE-2026-79001Information leak in Bluetooth in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-79289Improper control of a resource through its lifetime in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comGoogle Chrome
- CVE-2026-79184Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-79124Information leak in Intents in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information viGoogle Chrome
- CVE-2026-79055Information leak in Sharing in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker leveraging social engineering to Google Chrome
- CVE-2026-78974UI misrepresentation in Linux Toolkit Theming in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineerinGoogle Chrome
- CVE-2026-79141Incorrect authorization in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-79025Improper input validation in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-79185Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML pagGoogle Chrome
- CVE-2026-79004Out of bounds read in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to reGoogle Chrome
- CVE-2026-78984Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-78960Information leak in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain croGoogle Chrome
- CVE-2026-79075Information leak in Geolocation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain seGoogle Chrome
- CVE-2026-79034Information leak in CORS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak Google Chrome
- CVE-2026-79221Uninitialized resource in Dawn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbGoogle Chrome
- CVE-2026-79203Improper input validation in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-78962Uninitialized resource in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentialGoogle Chrome
- CVE-2026-79252Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafteGoogle Chrome
- CVE-2026-79211Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass sysGoogle Chrome
- CVE-2026-79258Incorrect authorization in WebXR in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain cGoogle Chrome
- CVE-2026-79265Incomplete cleanup in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-79249Code injection in Bisection in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted Google Chrome
- CVE-2026-79220Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obGoogle Chrome
- CVE-2026-79003Incorrect authorization in Device in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass Google Chrome
- CVE-2026-79134Incorrect authorization in GetUserMedia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information viGoogle Chrome
- CVE-2026-79085Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-79269Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy viGoogle Chrome
- CVE-2026-79068Improper resource exposure in StreamsAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin Google Chrome
- CVE-2026-79154Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain Google Chrome
- CVE-2026-79103Incorrect reference resolution in Speech in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-79059Information leak in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obGoogle Chrome
- CVE-2026-79178Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker tGoogle Chrome
- CVE-2026-79234Injection in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain sensitive information via a craftedGoogle Chrome
- CVE-2026-78959Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engiGoogle Chrome
- CVE-2026-78903Incomplete cleanup in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-79205Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-79070Incorrect reference resolution in Cache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a Google Chrome
- CVE-2026-79283UI misrepresentation in Geometry in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML pGoogle Chrome
- CVE-2026-79291Information leak in CSS in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTMLGoogle Chrome
- CVE-2026-78949Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin dGoogle Chrome
- CVE-2026-79238Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to Google Chrome
- CVE-2026-79146Information leak in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data viGoogle Chrome
- CVE-2026-79023Incorrect authorization in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cGoogle Chrome
- CVE-2026-79293Information leak in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafteGoogle Chrome
- CVE-2026-79180UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeGoogle Chrome
- CVE-2026-79242Observable discrepancy in HTML in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craftGoogle Chrome
- CVE-2026-79193Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-79024Information leak in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crGoogle Chrome
- CVE-2026-79099Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via Google Chrome
- CVE-2026-79191Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-79276Improper privilege management in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering Google Chrome
- CVE-2026-78976Improper input validation in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rendGoogle Chrome
- CVE-2026-79173UI misrepresentation in WebAppInstalls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted Google Chrome
- CVE-2026-79094Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a craftGoogle Chrome
- CVE-2026-79287Observable discrepancy in Forms in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafGoogle Chrome
- CVE-2026-78975Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a craftGoogle Chrome
- CVE-2026-79050Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions viGoogle Chrome
- CVE-2026-78936Observable discrepancy in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin dGoogle Chrome
- CVE-2026-79151Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictGoogle Chrome
- CVE-2026-79272Improper input validation in FindInPage in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-79002Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-79229Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-78953Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer prGoogle Chrome
- CVE-2026-79228Incorrect authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer Google Chrome
- CVE-2026-79214Improper input validation in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-78967Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-79241Out of bounds read in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandboxGoogle Chrome
- CVE-2026-79143Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypGoogle Chrome
- CVE-2026-78955Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origGoogle Chrome
- CVE-2026-78912UI misrepresentation in Browser in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML paGoogle Chrome
- CVE-2026-79204UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a craftedGoogle Chrome
- CVE-2026-79217Incorrect authorization in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to bypass system access restriGoogle Chrome
- CVE-2026-79250UI misrepresentation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof address bar via a crafted HTMLGoogle Chrome
- CVE-2026-79285Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data Google Chrome
- CVE-2026-79053Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-79051Incorrect authorization in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafteGoogle Chrome
- CVE-2026-79201Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-79049Incorrect reference resolution in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restriGoogle Chrome
- CVE-2026-79074Information leak in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obGoogle Chrome
- CVE-2026-79013Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafGoogle Chrome
- CVE-2026-79199Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions viGoogle Chrome
- CVE-2026-79122Information leak in SignIn in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafted netGoogle Chrome
- CVE-2026-79042Missing authorization in Payments in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineerGoogle Chrome
- CVE-2026-79251Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin poliGoogle Chrome
- CVE-2026-79208Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted nGoogle Chrome
- CVE-2026-79259Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictGoogle Chrome
- CVE-2026-78943Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-79213Incorrect authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to bypass system aGoogle Chrome
- CVE-2026-79067Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-79270Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a cGoogle Chrome
- CVE-2026-79120Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially obtain cross-origin data viGoogle Chrome
- CVE-2026-79107Incorrect authorization in TabGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive informaGoogle Chrome
- CVE-2026-78940Improper initialization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-79038Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via Google Chrome
- CVE-2026-79086Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive inforGoogle Chrome
- CVE-2026-79255Improper input validation in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2026-79066Improper input validation in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer pGoogle Chrome
- CVE-2026-79264Incorrect reference resolution in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via Google Chrome
- CVE-2026-78894Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leaGoogle Chrome
- CVE-2026-79137Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypGoogle Chrome
- CVE-2026-78969Uninitialized resource in Video in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to read memory inside the sandbox via a crGoogle Chrome
- CVE-2026-79087Injection in Chrome Tabs in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass system access restrictions Google Chrome
- CVE-2026-78907Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a Google Chrome
- CVE-2026-79136Incorrect authorization in ServiceWorker in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via aGoogle Chrome
- CVE-2026-79110Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftedGoogle Chrome
- CVE-2026-79031Improper resource exposure in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass site isolation via a craftGoogle Chrome
- CVE-2026-79248Incorrect authorization in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process Google Chrome
- CVE-2026-78991Race condition in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to oGoogle Chrome
- CVE-2026-79084Inadequate encryption strength in Notifications in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker leveraging sGoogle Chrome
- CVE-2026-79095Information leak in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTMGoogle Chrome
- CVE-2026-79006Protection mechanism failure in HttpsUpgrades in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy Google Chrome
- CVE-2026-79116Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bGoogle Chrome
- CVE-2026-78942Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via cGoogle Chrome
- CVE-2026-79192Improper input validation in Variations in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin pGoogle Chrome
- CVE-2026-79065Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-79144Information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML paGoogle Chrome
- CVE-2026-79271Information leak in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive Google Chrome
- CVE-2026-78987Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML Google Chrome
- CVE-2026-79046Race condition in Permissions in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering Google Chrome
- CVE-2026-79028Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crGoogle Chrome
- CVE-2026-78898Incorrect authorization in Downloads in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypaGoogle Chrome
- CVE-2026-79237Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crGoogle Chrome
- CVE-2026-79032Improper input validation in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2026-78941Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypasGoogle Chrome
- CVE-2026-79010Operation on a resource after expiration or release in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had comGoogle Chrome
- CVE-2026-79016Observable discrepancy in SVG in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTGoogle Chrome
- CVE-2026-79267Race condition in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypaGoogle Chrome
- CVE-2026-79186Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-78966Externally controlled reference in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a Google Chrome
- CVE-2026-79176UI misrepresentation in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtainGoogle Chrome
- CVE-2026-79106Improper input validation in Input in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-79262Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a craftGoogle Chrome
- CVE-2026-78961Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process aGoogle Chrome
- CVE-2026-78958Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process toGoogle Chrome
- CVE-2026-79044Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised Google Chrome
- CVE-2026-79104Missing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2026-79088Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypGoogle Chrome
- CVE-2026-79076Improper input validation in Sync in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via crafGoogle Chrome
- CVE-2026-79222Incorrect authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin poGoogle Chrome
- CVE-2026-78893Information leak in QUIC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML Google Chrome
- CVE-2026-79007Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-79030Observable discrepancy in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a cGoogle Chrome
- CVE-2026-79274Information leak in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML pagGoogle Chrome
- CVE-2026-78954Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-79014Race condition in Autofill in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypGoogle Chrome
- CVE-2026-79174Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2026-79118Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted Google Chrome
- CVE-2026-78895Information leak in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML pGoogle Chrome
- CVE-2026-78908Information leak in Canvas in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML Google Chrome
- CVE-2026-79082Incorrect authorization in Transactions Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the rGoogle Chrome
- CVE-2026-79117Race condition in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineeriGoogle Chrome
- CVE-2026-78965Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted Google Chrome
- CVE-2026-79288Improper input validation in Autofill in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive inGoogle Chrome
- CVE-2026-79093Incorrect authorization in Paint in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially bypass web origin policy vGoogle Chrome
- CVE-2026-79212Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer procesGoogle Chrome
- CVE-2026-78986Uninitialized resource in GPU in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2026-77585Improper Validation of SSH Target in Okta Privileged Access ClientOkta Privileged Access Client
- CVE-2026-68514OpenEXR: Heap buffer overflow in PyOpenEXR from literal/prefixed RGB channel name collision in deep imagesAcademySoftwareFoundation openexr
- CVE-2026-65367A null pointer dereference was addressed with improved input validation.Apple iOS and iPadOS
- CVE-2026-64705A buffer overflow was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2026-43657A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS
- CVE-2026-65979OpenEXR: Out-of-bounds read in HTJ2K decoder from unvalidated chunk header length (PLEN)AcademySoftwareFoundation openexr
- CVE-2026-62986OpenEXR: PyOpenEXR deep prefixed RGB stale lane disclosureAcademySoftwareFoundation openexr
- CVE-2026-55619eml_parser: Parser DoS via deeply nested parentheses in e-mail headersGOVCERT-LU eml_parser · eml-parser
- CVE-2026-55618eml_parser: URL extraction bypass via HTML entities in URLsGOVCERT-LU eml_parser · eml-parser
- CVE-2026-61555OpenEXR: Empty multiView viewFromChannelName file crashAcademySoftwareFoundation openexr
- CVE-2026-59985OpenEXR: Heap out-of-bounds read in OpenEXRCore RLE decoding on ILP32AcademySoftwareFoundation openexr
- CVE-2026-55663mediasoup: SCTP state cookie lacks cryptographic authentication, enabling unauthorized association establishment (RFC 9260 violation)versatica mediasoup · mediasoup
- CVE-2026-59984OpenEXR: Scratch buffer overflow decoding B44-compressed InputFile on ILP32AcademySoftwareFoundation openexr
- CVE-2026-59983OpenEXR: Out-of-bounds read in DeepTiledInputFile sample-count table decode on ILP32AcademySoftwareFoundation openexr
- CVE-2026-75752Substance3D - Painter | Out-of-bounds Read (CWE-125)Adobe Substance3D - Painter
- CVE-2026-80051github.com/graphql-go/graphql (GraphQL for Go) through 0.8.1 does not validate that a scalar variable value matches its declared type.graphql-go project graphql-go
- CVE-2026-71441Illustrator | Out-of-bounds Read (CWE-125)Adobe Illustrator Desktop
- CVE-2026-48429Substance3D - Designer | NULL Pointer Dereference (CWE-476)Adobe Substance 3D Designer
- CVE-2026-55419Reachy Mini: Unrestricted Upload of File with Dangerous Typepollen-robotics reachy_mini · reachy-mini
- CVE-2026-76189CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-71444CAI Content Credentials | Integer Underflow (Wrap or Wraparound) (CWE-191)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-76198CAI Content Credentials | Improper Input Validation (CWE-20)Adobe C2PA Tool · Adobe Content Credentials Rust SDK
- CVE-2026-26211Ekushey Project Manager CRM 5.0 Stored XSS via System Name FieldCreativeitem Ekushey Project Manager CRM
- CVE-2026-24166NVIDIA UFM Enterprise contains a vulnerability in the session management component, where an attacker could use a hard-coded cryptographic kNVIDIA Unified Fabric Manager Enterprise - GA · NVIDIA Unif…
- CVE-2026-24168NVIDIA UFM Enterprise contains a vulnerability in the IBDiagnet API where an authenticated attacker with administrative privileges may causeNVIDIA Unified Fabric Manager Enterprise - GA · NVIDIA Unif…
- CVE-2026-24167NVIDIA UFM Enterprise contains a vulnerability in the user management component, where an authenticated administrator could inject commands NVIDIA Unified Fabric Manager Enterprise - GA · NVIDIA Unif…
- CVE-2026-18445Integer Overflow Vulnerability Resulting in an Out of Bounds Write in NI LabVIEWNI LabVIEW
- CVE-2026-47624NVIDIA DGX Spark contains a vulnerability in UEFI where a Attacker may cause a/an CWE-693 by privileged local user.NVIDIA DGX Spark
- CVE-2026-24225NVIDIA DGX Spark contains a vulnerability in the standalone MM firmware where an attacker could be able to cause an out-of-bounds read.NVIDIA DGX Spark
- CVE-2026-18444Integer Conversion Vulnerability Resulting in an Out of Bounds Read in NI LabVIEWNI LabVIEW
- CVE-2026-13478Out-of-bounds read in Zephyr ext2 block-bitmap validation from a crafted s_blocks_countzephyrproject zephyr
- CVE-2026-13217NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoizephyrproject zephyr
- CVE-2026-13216Out-of-bounds stack write in Zephyr virtio PCI driver from unvalidated device-supplied capability lengthzephyrproject zephyr
- CVE-2026-70550Potential unauthorized access to private Composer repository metadata in JFrog Artifactoryjfrog artifactory
- CVE-2026-70548SSRF In CocoaPods Via JFrog Artifactory External Dependencyjfrog artifactory
- CVE-2026-79783rclone before 1.74.4 Privilege Escalation via setuid Metadatarclone · github.com/rclone/rclone
- CVE-2026-79781rclone serve s3 Path Traversal via dot-dot object keysrclone · github.com/rclone/rclone
- CVE-2026-79780rclone before v1.75.0 Credential Exposure via S3 Redirectrclone · github.com/rclone/rclone
- CVE-2026-79779rclone before v1.75.0 WebDAV Credential Exposure via HTTPS-to-HTTP Redirectrclone · github.com/rclone/rclone
- CVE-2026-79778rclone before v1.75.0 Denial of Service via TUS nil-response panicrclone · github.com/rclone/rclone
- CVE-2026-79777rclone before v1.75.0 Information Disclosure via RC APIrclone · github.com/rclone/rclone
- CVE-2026-79776rclone before 1.75.0 Authentication Bypass via pprofrclone
- CVE-2026-79773Winter CMS before 1.2.13 Local File Inclusion via JavaScriptwintercms winter · winter/wn-system-module
- CVE-2026-79772Nokogiri before 1.19.1 Unchecked Return Value canonicalizesparklemotion nokogiri · nokogiri
- CVE-2026-79771Nokogiri before 1.19.3 Memory Leak via XSLT Transformsparklemotion nokogiri · nokogiri
- CVE-2026-15310zipfile: bzip2/LZMA/Zstandard members decompress without a max_length bound, defeating chunked-read memory limitsPython Software Foundation CPython · libpython +2
- CVE-2026-55535PraisonAI: Server-Side Request Forgery via DNS rebinding bypass in webhook_url validationMervinPraison PraisonAI · praisonai
- CVE-2026-55624MintyItanium Lost-Auction takes items like barrier blocks out from search GUIMintyItanium Lost-Auction
- CVE-2026-79717Galaxy_ng: galaxy_ng: blind ssrf via namespace avatar_url with no private-address restrictionRed Hat Ansible Automation Platform
- CVE-2026-55530PraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation toolMervinPraison PraisonAI · MervinPraison praisonaiagents +1
- CVE-2026-55531PraisonAI: Unauthenticated unbounded session accumulation in the PraisonAI MCP HTTP server (memory exhaustion; session TTL never enforced)MervinPraison PraisonAI · praisonai
- CVE-2026-55529PraisonAI: Origin validation bypass in MCP HTTP Stream transport allows browser-mediated unauthenticated tool execution on local MCP serverMervinPraison PraisonAI · praisonai
- CVE-2026-16599Denial of Service in GNU wgetGNU wget
- CVE-2026-79623FishCodeTech Muteki Default Local Worker Backend settings.json os command injectionFishCodeTech Muteki
- CVE-2026-79622dekdee adobe-xd-mcp file-access-from-request Endpoint xd-parser.ts path traversaldekdee adobe-xd-mcp
- CVE-2026-78581Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Data Modification in KibanaElastic Kibana
- CVE-2026-79406macrozheng mall quantity OmsCartItemServiceImpl.updateQuantity logic errormacrozheng mall
- CVE-2026-63074CMP Indefinite Cache Growth of ExtraCertsOpenSSL
- CVE-2026-78887liketrek TREK Journey Photo Proxy validateShareTokenForAsset authorizationliketrek TREK
- CVE-2026-78886liketrek TREK Public Journey Photo Proxy journey-public.controller.ts path traversalliketrek TREK
- CVE-2026-78885liketrek TREK OIDC Service oidcService.ts findOrCreateUser improper authenticationliketrek TREK
- CVE-2026-77997Joomla Extension - yootheme.com - Authenticated, privileged information disclosure about site modules YOOtheme Pro 1.0.0-5.0.40yootheme.com YOOtheme Pro extension for Joomla
- CVE-2026-79671Ech0 before 4.4.3 SSRF via DNS Resolution Bypasslin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79670Ech0 before 4.4.3 Stored XSS via SVG Uploadlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79669Ech0 before 4.4.3 Missing Authorization on System Logslin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79668Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflationlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79663Ech0 before 4.7.3 Stored XSS via RSS feed tag nameslin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79661Ech0 before 4.7.3 Unauthenticated fav_count Modificationlin-snow Ech0 · github.com/lin-snow/ech0
- CVE-2026-79660Ech0 before 4.7.3 Email Disclosure via Public APIlin-snow Ech0 · github.com/lin-snow/Ech0
- CVE-2026-78684vLLM before 0.27.0 Denial of Service via DeepStream Backendvllm-project vllm · vllm
- CVE-2026-78864liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injectionliketrek TREK
- CVE-2026-77824Media Sweep <= 1.1.3 - Authenticated (Administrator+) SQL Injection via 'fields' Parameterwpcreatix Media Sweep – WordPress Media Cleaner
- CVE-2026-18547Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)ultimatemember Ultimate Member – User Profile, Registration…
- CVE-2026-17587My Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actionsformulaagile My Agile Privacy® – CMP, Cookie Consent & Priv…
- CVE-2026-75908Newsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parametercontrid Newsletters
- CVE-2026-79652Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequiredRed Hat build of Keycloak · Red Hat Single Sign-On
- CVE-2026-78863liketrek TREK Pre-2FA mfa_token authService.ts loginUser improper authenticationliketrek TREK
- CVE-2026-21754HCL Hive is affected by multiple security vulnerabilities.HCL Software Hive
- CVE-2026-21753HCL Hive is affected by multiple security vulnerabilities.HCL Software Hive
- CVE-2026-21758HCL Hive is affected by multiple security vulnerabilities.HCL Software Hive
- CVE-2026-75038Predictable temporary file in /tmp allows symlink attack in LACTilya-zlobintsev LACT
- CVE-2026-76128eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attributeimplecode eCommerce Product Catalog
- CVE-2026-56093Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Extension "Apache Solr for TYPO3 - Enterprise Search"
- CVE-2026-56094Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Extension "Apache Solr for TYPO3 - Enterprise Search"
- CVE-2026-56096Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)Extension "Apache Solr for TYPO3 - Enterprise Search"
- CVE-2026-77127Information Disclosure in extension "Modules" (modules)TYPO3 Extension "Modules"
- CVE-2026-77128Broken Access Control in extension "Event management and registration" (sf_event_mgt)TYPO3 Extension "Event management and registration"
- CVE-2026-77130Insufficient Session Expiration in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)Extension "SYSSY - TYPO3 Monitoring & Security Checks"
- CVE-2026-77131Cleartext Transmission of Sensitive Information in extension "SYSSY - TYPO3 Monitoring & Security Checks" (syssy)Extension "SYSSY - TYPO3 Monitoring & Security Checks"
- CVE-2026-77133Broken Access Control in extension "femanager" (femanager)TYPO3 Extension "femanager"
- CVE-2026-77139Path Traversal in extension "Mask" (mask)TYPO3 Extension "Mask"
- CVE-2026-17548Missing authorization for viewing background jobsCheckmk
- CVE-2026-66882Reflected XSS in AshAuthentication confirmation and magic link interaction formsteam-alembic ash_authentication
- CVE-2026-18512TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editorcozmoslabs TranslatePress – Translate Multilingual sites wi…
- CVE-2026-18100MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Settingroxnor MetForm – Contact Form, Survey, Quiz, Conditional Fo…
- CVE-2026-78701389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dosRed Hat Enterprise Linux · Red Hat Directory Server
- CVE-2026-78322File-roller: file-roller: stack buffer overflow in parse_progress_line for 7z and rar handlersRed Hat Enterprise Linux
- CVE-2026-78656itsourcecode Sales and Inventory System cust_del.php sql injectionitsourcecode Sales and Inventory System
- CVE-2026-78654cleverbrush framework/deep deepExtend.ts deepExtend prototype pollutioncleverbrush framework · cleverbrush deep
- CVE-2026-78470WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injectionwedevs WP Project Manager Pro
- CVE-2026-78638peerigon unzip-crx/unzip-crx-3 Archive Extraction index.js unzip path traversalpeerigon unzip-crx · peerigon unzip-crx-3
- CVE-2026-78637Fdawgs node-poppler Argument Injection index.js pdfUnite argument injectionFdawgs node-poppler
- CVE-2026-13215Zephyr ext2 mount: unvalidated superblock block size causes out-of-bounds write from a crafted filesystem imagezephyrproject zephyr
- CVE-2026-12561tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site ScriptingtagDiv Composer
- CVE-2026-19943Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attributejegstudio Gutenverse – WordPress Blocks, Page Builder & Sit…
- CVE-2026-14280Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keysnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2026-17089Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameternetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2026-76063FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameterroxnor FundEngine – Donation and Crowdfunding Platform
- CVE-2026-75930FundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameterroxnor FundEngine – Donation and Crowdfunding Platform
- CVE-2026-75019Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attributecozythemes Cozy Blocks – Page Builder for Gutenberg Editor…
- CVE-2025-9878Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scriptingbuildwps PPWP – Password Protect Pages
- CVE-2026-75982LearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameterthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2026-10627Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parametersnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2026-75575Rocket.Chat Missing DDP Rate Limit on the sendForgotPasswordEmail Meteor MethodRocketChat Rocket.Chat
- CVE-2026-72701Grav CMS before 2.0.16 Timing Attack via verifyNoncegetgrav grav · getgrav/grav
- CVE-2026-56708Grav API Plugin before 1.0.16 SSRF via DNS Rebindinggetgrav grav
- CVE-2026-56706Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Maskingvrana adminer
- CVE-2026-56704Adminer before 5.4.3 Cross-Site Scripting via MySQL Version Stringvrana adminer
- CVE-2026-34967Adminer sql-log Plugin 5.3.0 through 5.4.2 Arbitrary File Writevrana adminer
- CVE-2026-34964Adminer before 5.5.0 SSRF via PDO DSN Injectionvrana adminer
- CVE-2026-34959Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefixvrana adminer
- CVE-2026-16434Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypassvrana adminer
- CVE-2026-15023Events Manager <= 7.4.0 - Authenticated (Contributor+) SQL Injection via 'meta_key' Parameter in Event/Location Duplicate Actionnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2026-19801BetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Actionwpdevteam BetterLinks – Link Shortener, Link Cloaking, Redi…
- CVE-2026-10630WP Courses LMS <= 3.2.29 - Insecure Direct Object Reference to Authenticated (Custom+) Sensitive Information Disclosure via 'resultID' Parameterhookandhook WP Courses LMS – Online Courses Builder, eLearn…
- CVE-2026-59183OpenEXR: Signed Integer Overflow Leading to Out-of-Bounds Memory Access in Deep Tile DecodingAcademySoftwareFoundation openexr
- CVE-2026-55373OpenEXR: OpenEXRUtil SampleCountChannel endEdit() can loop forever on UINT_MAX sample countsAcademySoftwareFoundation openexr
- CVE-2026-55371OpenEXR: OpenEXRCore exr_attr_set_bytes() accepts NULL type_hint with positive hint_lengthAcademySoftwareFoundation openexr
- CVE-2026-55059OpenEXR: OpenEXRUtil SampleCountChannel row setter heap has an out-of-bounds write vulnerabilityAcademySoftwareFoundation openexr
- CVE-2026-54920OpenEXR: Integer overflow and uninitialized pointer cause invalid delete in OpenEXRUtil image resizeAcademySoftwareFoundation openexr
- CVE-2026-38465A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a48648
- CVE-2026-38466A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864
- CVE-2026-38467A SQL injection vulnerability in the tags manager in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows re
- CVE-2026-38468A SQL injection vulnerability in the country-code lookup endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18
- CVE-2026-38469A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d1844644
- CVE-2026-38470A Broken access control vulnerability in the API user endpoint in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446
- CVE-2026-38472A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows
- CVE-2026-38473A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 al
- CVE-2026-38474GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 suffers from a Broken access control vulnerability in the IP l
- CVE-2026-39113Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f10695
- CVE-2026-75421aria2 <=1.37.0 has a stack-buffer-underflow vulnerability in the IOFile::getLine() function.