# CVEs published 2026-09-09

653 CVEs were published on September 9, 2026: 60 critical, 204 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2026-87931](https://cve.now/CVE-2026-87931.md): Behavioral Technology Group Pavlok Behavioral Conditioning Wearable Apple Notification Center Service Event buffer overflow (CVSS 9.4, Behavioral Technology Group Pavlok Behavioral Conditioning…)
- [CVE-2026-87926](https://cve.now/CVE-2026-87926.md): Rizwan17 inventory-management-system Login Page index.php cross site scripting (CVSS 5.3, Rizwan17 inventory-management-system)
- [CVE-2026-87925](https://cve.now/CVE-2026-87925.md): Rizwan17 inventory-management-system manage.php storeCustomerOrderInvoice sql injection (CVSS 6.9, Rizwan17 inventory-management-system)
- [CVE-2026-87924](https://cve.now/CVE-2026-87924.md): Rizwan17 inventory-management-system Invoice Generation invoice\_bill.php missing authentication (CVSS 6.9, Rizwan17 inventory-management-system)
- [CVE-2026-15460](https://cve.now/CVE-2026-15460.md): Missing channel-state validation in Zephyr Bluetooth Classic L2CAP receive path (CVSS 5.4, zephyrproject zephyr)
- [CVE-2026-87923](https://cve.now/CVE-2026-87923.md): Rizwan17 inventory-management-system List DBOperation.php cross site scripting (CVSS 5.3, Rizwan17 inventory-management-system)
- [CVE-2026-87922](https://cve.now/CVE-2026-87922.md): Rizwan17 inventory-management-system AJAX Backend process.php DBOperation.addCategory missing authentication (CVSS 6.9, Rizwan17 inventory-management-system)
- [CVE-2026-88002](https://cve.now/CVE-2026-88002.md): Open WebUI: Any authenticated user can hang the server via a cyclic chat message history (CVSS 6.5, open-webui)
- [CVE-2026-88001](https://cve.now/CVE-2026-88001.md): Open WebUI: Server-side fetches reach blocked and internal hosts via unvalidated HTTP redirect targets (CVSS 5.0, open-webui)
- [CVE-2026-88069](https://cve.now/CVE-2026-88069.md): Path traversal in Pandora archive extractor allows arbitrary file writes outside the extraction directory in pandora analysis (CVSS 9.3, pandora-analysis pandora)
- [CVE-2026-88000](https://cve.now/CVE-2026-88000.md): Open WebUI: Any authenticated user can hang the server via message deletion in a cyclic chat tree (CVSS 6.5, open-webui)
- [CVE-2026-87999](https://cve.now/CVE-2026-87999.md): Open WebUI: Any authenticated user can reach the Azure platform channel via server-side web fetch (CVSS 7.1, open-webui)
- [CVE-2026-87998](https://cve.now/CVE-2026-87998.md): Open WebUI: Non-admin users can delete admin-owned external knowledge connections via knowledge base deletion (CVSS 7.1, open-webui)
- [CVE-2026-87921](https://cve.now/CVE-2026-87921.md): Rizwan17 inventory-management-system manage.php update\_record sql injection (CVSS 6.9, Rizwan17 inventory-management-system)
- [CVE-2026-87997](https://cve.now/CVE-2026-87997.md): Open WebUI: Any authenticated user can inject chats into another user's folder via chat completions (CVSS 4.3, open-webui)
- [CVE-2026-87996](https://cve.now/CVE-2026-87996.md): Open WebUI: SSRF into internal services via DNS rebinding in the Playwright web loader (CVSS 7.7, open-webui)
- [CVE-2026-87995](https://cve.now/CVE-2026-87995.md): Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin (CVSS 8.7, open-webui)
- [CVE-2026-87994](https://cve.now/CVE-2026-87994.md): Open WebUI: Channel members can overwrite another member's message via the chat completions endpoint (CVSS 4.3, open-webui)
- [CVE-2026-87017](https://cve.now/CVE-2026-87017.md): Open WebUI: Inaccessible knowledge bases are exposed through the built-in knowledge tool on most vector backends (CVSS 4.3, open-webui)
- [CVE-2026-87016](https://cve.now/CVE-2026-87016.md): Open WebUI: Sign-in as another user via wildcard characters in the OAuth subject claim on SQLite (CVSS 8.1, open-webui)
- [CVE-2026-15913](https://cve.now/CVE-2026-15913.md): Path Traversal in Fortra's GoAnywhere MFT Endpoint (CVSS 7.7, Fortra GoAnywhere MFT)
- [CVE-2026-87015](https://cve.now/CVE-2026-87015.md): Open WebUI: A user's session cookies are sent to tool servers configured for bearer authentication (CVSS 6.8, open-webui)
- [CVE-2026-87014](https://cve.now/CVE-2026-87014.md): Open WebUI: Admin demoted through SSO role sync keeps read and write access to all users' notes (CVSS 6.5, open-webui)
- [CVE-2026-87013](https://cve.now/CVE-2026-87013.md): Open WebUI: Any authenticated user can start a non-terminating request via a folder parent cycle (CVSS 4.3, open-webui)
- [CVE-2026-87012](https://cve.now/CVE-2026-87012.md): Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value (CVSS 4.3, open-webui)
- [CVE-2026-87011](https://cve.now/CVE-2026-87011.md): Open WebUI: Unauthenticated requests can stall the server via uncached OIDC fetches in back-channel logout (CVSS 7.5, open-webui)
- [CVE-2026-53956](https://cve.now/CVE-2026-53956.md): Rattler vulnerable to package cache path traversal via conda package build string (CVSS 5.4, conda rattler\_cache · conda py-rattler +2)
- [CVE-2026-50165](https://cve.now/CVE-2026-50165.md): alf.io has Improper Access Control for Organization Owners that Exposes System Secrets (CVSS 7.1, alfio-event alf.io)
- [CVE-2026-87911](https://cve.now/CVE-2026-87911.md): Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 9.6, AWS Labs postgres MCP Server)
- [CVE-2026-73789](https://cve.now/CVE-2026-73789.md): Unauthenticated Insecure Parameter Manipulation allows Data Tampering In CPPM Web Interface (CVSS 5.3, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2026-73788](https://cve.now/CVE-2026-73788.md): Privilege Escalation in ClearPass OnGuard Agent (CVSS 6.5, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2026-73787](https://cve.now/CVE-2026-73787.md): Authenticated Arbitrary File Write allows Remote Code Execution via CPPM Web Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2026-73786](https://cve.now/CVE-2026-73786.md): Unauthenticated Network-Based Denial of Service in CPPM systems (CVSS 7.5, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2026-73769](https://cve.now/CVE-2026-73769.md): Authenticated Remote Code Execution in CPPM Web Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) ClearPass Policy Manager)
- [CVE-2026-54694](https://cve.now/CVE-2026-54694.md): NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover (CVSS 9.6, NationalSecurityAgency skills-service)
- [CVE-2026-87930](https://cve.now/CVE-2026-87930.md): MaxSite CMS through 109.6 PHP Object Injection via ci\_session (CVSS 9.2, MaxSite CMS)
- [CVE-2026-87929](https://cve.now/CVE-2026-87929.md): MaxSite CMS through 109.6 Authentication Bypass via Hardcoded Encryption Key (CVSS 9.3, MaxSite CMS)
- [CVE-2026-87928](https://cve.now/CVE-2026-87928.md): MaxSite CMS 0.94 through 109.6 HTML Upload XSS via admin\_page (CVSS 5.1, MaxSite CMS)
- [CVE-2026-87927](https://cve.now/CVE-2026-87927.md): MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher (CVSS 8.8, MaxSite CMS)
- [CVE-2026-18147](https://cve.now/CVE-2026-18147.md): Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url (CVSS 8.1, Red Hat Enterprise Linux)
- [CVE-2026-77120](https://cve.now/CVE-2026-77120.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause pri (CVSS 8.7, Schneider Electric PowerLogic T300)
- [CVE-2026-46460](https://cve.now/CVE-2026-46460.md): Dell PowerScale OneFS, versions 9.5.0.0 through 9.7.1.15, versions 9.8.0.0 through 9.13.1.0, and versions prior to 9.15.0.0, contain an Inco (CVSS 3.5, Dell PowerScale OneFS)
- [CVE-2026-19233](https://cve.now/CVE-2026-19233.md): CWE-918: Server-Side Request Forgery (SSRF) vulnerability exists that could cause unauthorized command execution and disclosure of server da (CVSS 8.6, Schneider Electric EcoStruxure™ IT Data Center Expert)
- [CVE-2026-85788](https://cve.now/CVE-2026-85788.md): Incomplete list of disallowed inputs in awslabs mysql-mcp-server (CVSS 5.5, AWS Labs MySQL MCP Server)
- [CVE-2026-40635](https://cve.now/CVE-2026-40635.md): Dell PowerScale OneFS versions 9.12.0.0 through 9.13.1.0 contain an Insecure Temporary File vulnerability. (CVSS 5.4, Dell PowerScale OneFS)
- [CVE-2026-80925](https://cve.now/CVE-2026-80925.md): vlan: fix skb\_under\_panic and races when toggling HW VLAN offload (no CVSS, Linux)
- [CVE-2026-80924](https://cve.now/CVE-2026-80924.md): crypto: krb5 - use kfree\_sensitive() for derived key buffers (CVSS 7.5, Linux)
- [CVE-2026-80923](https://cve.now/CVE-2026-80923.md): xhci: dbgtty: Fix unregister on tty\_register\_driver() failure (no CVSS, Linux)
- [CVE-2026-80922](https://cve.now/CVE-2026-80922.md): crypto: qcom-rng - Allow zero as a random number (no CVSS, Linux)
- [CVE-2026-80921](https://cve.now/CVE-2026-80921.md): KVM: s390: vsie: zero stale crypto bits (CVSS 8.8, Linux)
- [CVE-2026-8044](https://cve.now/CVE-2026-8044.md): CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability exists that could cause remote code (CVSS 8.6, Schneider Electric EcoStruxure™ IT Data Center Expert)
- [CVE-2026-70425](https://cve.now/CVE-2026-70425.md): Dell PowerScale OneFS, Versions 9.5.0.0 through 9.7.1.0, Versions 9.8.0.0 through 9.10.1.0, and Versions 9.11.0.0 through 9.14.0.1, contain (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2026-80920](https://cve.now/CVE-2026-80920.md): io\_uring: defer eventfd signaling when queued from a wakeup handler (no CVSS, Linux)
- [CVE-2026-80919](https://cve.now/CVE-2026-80919.md): drm/amdgpu: fix recursive ww\_mutex acquire in amdgpu\_devcoredump\_format (no CVSS, Linux)
- [CVE-2026-80918](https://cve.now/CVE-2026-80918.md): HID: core: fix number/pointer type confusion on long items (no CVSS, Linux)
- [CVE-2026-80917](https://cve.now/CVE-2026-80917.md): PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems (no CVSS, Linux)
- [CVE-2026-80916](https://cve.now/CVE-2026-80916.md): kcov: fix data corruption and race conditions on PREEMPT\_RT (no CVSS, Linux)
- [CVE-2026-80915](https://cve.now/CVE-2026-80915.md): drm/xe: Fix DPT allocation paths. (no CVSS, Linux)
- [CVE-2026-87876](https://cve.now/CVE-2026-87876.md): Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up) (CVSS 3.0, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-80914](https://cve.now/CVE-2026-80914.md): Bluetooth: ISO: fix use-after-free of listener socket in iso\_conn\_ready (CVSS 8.8, Linux)
- [CVE-2026-47156](https://cve.now/CVE-2026-47156.md): MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator (CVSS 9.3, mantisbt · mantisbt/mantisbt)
- [CVE-2026-87872](https://cve.now/CVE-2026-87872.md): Community.general: community.general: ocapi module\_utils (ocapi\_command, ocapi\_info) hardcode validate\_certs=false with no override, enabling tls man-in-the-middle and credential disclosure (CVSS 6.8, Red Hat Ceph Storage · Red Hat OpenStack Platform)
- [CVE-2026-87875](https://cve.now/CVE-2026-87875.md): Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound (CVSS 4.3, Red Hat Hardened Images · Red Hat Enterprise Linux +1)
- [CVE-2026-87853](https://cve.now/CVE-2026-87853.md): Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation (CVSS 7.5, Red Hat Enterprise Linux · Red Hat OpenShift Container Plat…)
- [CVE-2026-87874](https://cve.now/CVE-2026-87874.md): Community.general: community.general: memcached cache plugin deserializes untrusted pickle data from memcached, enabling cache-poisoning remote code execution on the ansible controller (CVSS 8.1, Red Hat Ceph Storage · Red Hat OpenStack Platform)
- [CVE-2026-23855](https://cve.now/CVE-2026-23855.md): Dell iDRAC9, 14G versions prior to 7.00.00.184, 15G/16G versions prior to 7.30.10.50, and Dell iDRAC10, 17G versions prior to 1.30.30.50, co (CVSS 7.2, Dell iDRAC9 · Dell iDRAC10)
- [CVE-2026-79947](https://cve.now/CVE-2026-79947.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-67401](https://cve.now/CVE-2026-67401.md): A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component (CVSS 9.9, WebPros cPanel)
- [CVE-2026-68484](https://cve.now/CVE-2026-68484.md): Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. (CVSS 9.0, Sage AR Automation)
- [CVE-2026-67403](https://cve.now/CVE-2026-67403.md): Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. (CVSS 9.0, Sage AR Automation)
- [CVE-2026-22591](https://cve.now/CVE-2026-22591.md): Fast DDS DDSSQLFilter Recursive Parser Stack Exhaustion (Remote DoS) (CVSS 7.5, eProsima Fast-DDS)
- [CVE-2026-22590](https://cve.now/CVE-2026-22590.md): Fast-DDS Discovery Server: Out-of-Bounds Read & Heap Memory Disclosure via DATA\_FRAG sampleSize / fragmentsInSubmessage (CVSS 9.1, eProsima Fast-DDS)
- [CVE-2026-78484](https://cve.now/CVE-2026-78484.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-77974](https://cve.now/CVE-2026-77974.md): Softish C6 Ear Camera and EarVision Android Application Missing authentication for critical function (CVSS 8.5, Softish EarVision Android application · Softish C6 Ear Came…)
- [CVE-2026-81640](https://cve.now/CVE-2026-81640.md): Softish C6 Ear Camera and EarVision Android Application Use of Hard-coded Credentials (CVSS 8.7, Softish EarVision Android application · Softish C6 Ear Came…)
- [CVE-2026-79945](https://cve.now/CVE-2026-79945.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-82563](https://cve.now/CVE-2026-82563.md): Softish C6 Ear Camera and EarVision Android Application Authentication bypass by spoofing (CVSS 8.4, Softish EarVision Android application · Softish C6 Ear Came…)
- [CVE-2026-78493](https://cve.now/CVE-2026-78493.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-81330](https://cve.now/CVE-2026-81330.md): Softish C6 Ear Camera and EarVision Android Application Cleartext transmission of sensitive information (CVSS 7.1, Softish EarVision Android application · Softish C6 Ear Came…)
- [CVE-2026-79735](https://cve.now/CVE-2026-79735.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 4.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79693](https://cve.now/CVE-2026-79693.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Vi (CVSS 3.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79942](https://cve.now/CVE-2026-79942.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Execution with Un (CVSS 3.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79944](https://cve.now/CVE-2026-79944.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Least Privilege Vi (CVSS 3.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79946](https://cve.now/CVE-2026-79946.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79741](https://cve.now/CVE-2026-79741.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79689](https://cve.now/CVE-2026-79689.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79941](https://cve.now/CVE-2026-79941.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79690](https://cve.now/CVE-2026-79690.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 3.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-83530](https://cve.now/CVE-2026-83530.md): Uncontrolled Memory Allocation in cel-go (CVSS 6.9, Google cel-go)
- [CVE-2026-79736](https://cve.now/CVE-2026-79736.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 3.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-26212](https://cve.now/CVE-2026-26212.md): Rara One Click Demo Import \< 1.3.5 Arbitrary File Upload RCE (CVSS 8.6, Rara Themes Rara One Click Demo Import)
- [CVE-2026-79729](https://cve.now/CVE-2026-79729.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 3.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79732](https://cve.now/CVE-2026-79732.md): Dell Secure Connect Gateway (SCG) 5.0 Appliance, versions prior to 5.36.00.xx, contains an Improper Certificate Validation vulnerability. (CVSS 3.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78482](https://cve.now/CVE-2026-78482.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-87877](https://cve.now/CVE-2026-87877.md): zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free via Setters Called After close() (CVSS 7.0, luben zstd-jni)
- [CVE-2026-87825](https://cve.now/CVE-2026-87825.md): zstd-jni 1.3.8-4 through 1.5.7-13 Use-After-Free of Compression and Decompression Dictionaries (CVSS 7.0, luben zstd-jni)
- [CVE-2026-87824](https://cve.now/CVE-2026-87824.md): zstd-jni 1.3.3-1 through 1.5.7-13 Out-of-Bounds Read via Zstd.trainFromBufferDirect (CVSS 8.7, luben zstd-jni)
- [CVE-2026-87823](https://cve.now/CVE-2026-87823.md): zstd-jni 1.1.1 through 1.5.7-13 Out-of-Bounds Read via Direct ByteBuffer Frame-Size Methods (CVSS 8.8, luben zstd-jni)
- [CVE-2026-87822](https://cve.now/CVE-2026-87822.md): t-digest 3.1 through 3.3 Denial of Service via NaN Centroid Means in MergingDigest.fromBytes (CVSS 8.7, tdunning t-digest)
- [CVE-2026-79617](https://cve.now/CVE-2026-79617.md): Improper Access Control Leading to Display Exposure in TÜBİTAK BİLGEM's Pardus LightDM Greeter (CVSS 7.1, TÜBİTAK BİLGEM Software Technologies Research Institute Par…)
- [CVE-2026-82530](https://cve.now/CVE-2026-82530.md): IP2Location Country Blocker \< 2.45.0 Access Control Bypass via X-Real-IP Header (CVSS 6.9, IP2Location Country Blocker)
- [CVE-2026-78483](https://cve.now/CVE-2026-78483.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 5.9, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79731](https://cve.now/CVE-2026-79731.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 4.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-64857](https://cve.now/CVE-2026-64857.md): tirreno has Session Fixation in Login Authentication (CVSS 5.3, tirrenotechnologies tirreno)
- [CVE-2026-79950](https://cve.now/CVE-2026-79950.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 7.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-86775](https://cve.now/CVE-2026-86775.md): knowns before 0.30.0 Path Traversal via Document API (CVSS 8.8, knowns-dev knowns)
- [CVE-2026-86774](https://cve.now/CVE-2026-86774.md): Snipe-IT before 8.7.0 Broken Access Control via AssetModelPolicy (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86773](https://cve.now/CVE-2026-86773.md): Snipe-IT 8.6.3 Broken Access Control via Kit Update Endpoints (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86772](https://cve.now/CVE-2026-86772.md): Snipe-IT 8.6.3 Stored XSS via Department Names (CVSS 5.1, grokability snipe-it)
- [CVE-2026-86771](https://cve.now/CVE-2026-86771.md): Snipe-IT before 8.7.0 Server-Side Request Forgery via employee\_num (CVSS 8.3, grokability snipe-it)
- [CVE-2026-86770](https://cve.now/CVE-2026-86770.md): Snipe-IT before 8.7.0 Authentication Bypass via SAML Username Collation (CVSS 8.6, grokability snipe-it)
- [CVE-2026-86769](https://cve.now/CVE-2026-86769.md): Snipe-IT before 8.7.0 Audit Log Misattribution via Consumables Checkout (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86768](https://cve.now/CVE-2026-86768.md): Snipe-IT before 8.7.0 Improper Input Validation via API Checkout (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86767](https://cve.now/CVE-2026-86767.md): Snipe-IT before 8.7.0 Cross-Company Read via requested-assets (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86766](https://cve.now/CVE-2026-86766.md): Snipe-IT 8.6.3 Race Condition via Consumable Checkout (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86765](https://cve.now/CVE-2026-86765.md): Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86764](https://cve.now/CVE-2026-86764.md): Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86763](https://cve.now/CVE-2026-86763.md): snipe-it 7.0.12 through 8.6.3 Authorization Bypass via Importer (CVSS 5.1, grokability snipe-it)
- [CVE-2026-86762](https://cve.now/CVE-2026-86762.md): Snipe-IT before 8.7.0 Authentication Bypass via API Middleware (CVSS 8.6, grokability snipe-it)
- [CVE-2026-86761](https://cve.now/CVE-2026-86761.md): snipe-it 8.6.3 before 8.7.0 Authorization Bypass via print endpoints (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86760](https://cve.now/CVE-2026-86760.md): snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86759](https://cve.now/CVE-2026-86759.md): Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86758](https://cve.now/CVE-2026-86758.md): Snipe-IT before 8.7.0 License Key Exposure via CSV Export (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86757](https://cve.now/CVE-2026-86757.md): Snipe-IT before 8.7.0 Information Disclosure via Custom Fields (CVSS 7.1, grokability snipe-it)
- [CVE-2026-86756](https://cve.now/CVE-2026-86756.md): Snipe-IT 8.5.0 through 8.6.3 Open Redirect via SAML RelayState (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86755](https://cve.now/CVE-2026-86755.md): Snipe-IT 4.2.0 through 8.6.3 Permission Bypass via OAuth (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86754](https://cve.now/CVE-2026-86754.md): Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients (CVSS 8.5, grokability snipe-it)
- [CVE-2026-86753](https://cve.now/CVE-2026-86753.md): snipe-it before 8.7.0 Business Logic Bypass via asset\_model endpoint (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86752](https://cve.now/CVE-2026-86752.md): snipe-it before 8.7.0 Authorization Bypass via Asset Audit Endpoints (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86751](https://cve.now/CVE-2026-86751.md): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Markdown (CVSS 8.4, grokability snipe-it)
- [CVE-2026-86750](https://cve.now/CVE-2026-86750.md): snipe-it before 8.7.0 Authorization Bypass via API User Create/Update (CVSS 8.3, grokability snipe-it)
- [CVE-2026-86749](https://cve.now/CVE-2026-86749.md): snipe-it before 8.7.0 Data Loss via Failed Image Write (CVSS 7.0, grokability snipe-it)
- [CVE-2026-86748](https://cve.now/CVE-2026-86748.md): Snipe-IT before 8.7.0 Database Wipe via Invalid Backup Archive (CVSS 6.9, grokability snipe-it)
- [CVE-2026-86747](https://cve.now/CVE-2026-86747.md): snipe-it before 8.7.0 Authorization Bypass via Pivot-Only User (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86746](https://cve.now/CVE-2026-86746.md): Snipe-IT before 8.7.0 Authorization Bypass via Livewire Snapshot Replay (CVSS 7.4, grokability snipe-it)
- [CVE-2026-86745](https://cve.now/CVE-2026-86745.md): Snipe-IT before 8.7.0 CSV Formula Injection via Location-Scoping Export (CVSS 5.1, grokability snipe-it)
- [CVE-2026-86744](https://cve.now/CVE-2026-86744.md): snipe-it before 8.7.0 Race Condition in Asset Checkout (CVSS 2.1, grokability snipe-it)
- [CVE-2026-86743](https://cve.now/CVE-2026-86743.md): Snipe-IT before 8.7.0 Authorization Bypass via Asset Acceptance Report (CVSS 5.3, grokability snipe-it)
- [CVE-2026-86742](https://cve.now/CVE-2026-86742.md): Snipe-IT before 8.7.0 CSV Formula Injection via Asset Acceptance Report (CVSS 5.1, grokability snipe-it)
- [CVE-2026-86741](https://cve.now/CVE-2026-86741.md): Snipe-IT before 8.7.0 Arbitrary File Read and SSRF via Category EULA (CVSS 8.4, grokability snipe-it)
- [CVE-2026-86740](https://cve.now/CVE-2026-86740.md): Snipe-IT before 8.7.0 Attachment Deletion Reports Success While File Remains (CVSS 5.1, grokability snipe-it)
- [CVE-2026-86739](https://cve.now/CVE-2026-86739.md): Snipe-IT before 8.7.0 Acceptance Finalization Without Stored Evidence (CVSS 2.3, grokability snipe-it)
- [CVE-2026-86204](https://cve.now/CVE-2026-86204.md): PocketMine-MP before 5.39.2 Denial of Service via ModalFormResponsePacket (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86203](https://cve.now/CVE-2026-86203.md): PocketMine-MP before 5.39.2 Item Duplication via Despawn State (CVSS 6.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86202](https://cve.now/CVE-2026-86202.md): PocketMine-MP before 5.39.2 Network Amplification via ActorEventPacket (CVSS 5.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86201](https://cve.now/CVE-2026-86201.md): PocketMine-MP before 5.41.1 LogDoS via LoginPacket clientData (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86200](https://cve.now/CVE-2026-86200.md): PocketMine-MP before 5.42.1 LogDoS via LoginPacket clientData JWT (CVSS 6.9, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86199](https://cve.now/CVE-2026-86199.md): PocketMine-MP before 5.43.1 Denial of Service via unauthenticated login (CVSS 8.7, pmmp PocketMine-MP)
- [CVE-2026-86198](https://cve.now/CVE-2026-86198.md): PocketMine-MP before 5.44.2 Denial of Service via ResourcePackClientResponsePacket (CVSS 2.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-86099](https://cve.now/CVE-2026-86099.md): Chainlit through 2.12.0 Path Traversal via socket.io sessionId (CVSS 8.8, chainlit)
- [CVE-2026-73324](https://cve.now/CVE-2026-73324.md): VLC media player 3.0.0 through 3.0.23 information disclosure vulnerability (CVSS 5.3, VideoLAN VLC media player)
- [CVE-2026-56711](https://cve.now/CVE-2026-56711.md): VLC media player 3.0.0 through 3.0.23 memory corruption vulnerability (CVSS 7.3, VideoLAN VLC media player)
- [CVE-2025-71418](https://cve.now/CVE-2025-71418.md): PocketMine-MP before 5.25.2 Denial of Service via explode (CVSS 6.9, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2025-71417](https://cve.now/CVE-2025-71417.md): PocketMine-MP before 5.32.1 Denial of Service via ResourcePackClientResponsePacket (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2024-58382](https://cve.now/CVE-2024-58382.md): league/commonmark before 2.6.0 Denial of Service via Quadratic Complexity (CVSS 8.7, thephpleague commonmark · league/commonmark)
- [CVE-2024-58381](https://cve.now/CVE-2024-58381.md): PocketMine-MP before 5.11.1 Denial of Service via LoginPacket (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2024-58380](https://cve.now/CVE-2024-58380.md): PocketMine-MP before 5.11.2 Denial of Service via BookEditPacket (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54396](https://cve.now/CVE-2023-54396.md): PocketMine-MP before 4.8.1 Server Crash via Banner NBT (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54395](https://cve.now/CVE-2023-54395.md): PocketMine-MP before 4.12.5 Denial of Service via ModalFormResponsePacket (CVSS 5.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54394](https://cve.now/CVE-2023-54394.md): PocketMine-MP before 4.18.0-ALPHA2 Bandwidth Amplification via InventoryTransactionPacket (CVSS 5.3, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54393](https://cve.now/CVE-2023-54393.md): PocketMine-MP before 4.20.5 Denial of Service via LoginPacket (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54392](https://cve.now/CVE-2023-54392.md): PocketMine-MP before 4.22.3 Denial of Service via BlockActorDataPacket (CVSS 7.1, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54390](https://cve.now/CVE-2023-54390.md): PocketMine-MP before 5.3.1 Denial of Service via LoginPacket (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2023-54355](https://cve.now/CVE-2023-54355.md): PocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve (CVSS 8.7, pmmp PocketMine-MP · pocketmine/pocketmine-mp)
- [CVE-2026-79740](https://cve.now/CVE-2026-79740.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 7.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79738](https://cve.now/CVE-2026-79738.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 7.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78486](https://cve.now/CVE-2026-78486.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 4.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79964](https://cve.now/CVE-2026-79964.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79952](https://cve.now/CVE-2026-79952.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Encoding (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79971](https://cve.now/CVE-2026-79971.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Sanitiza (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79968](https://cve.now/CVE-2026-79968.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check Time (CVSS 5.6, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-85103](https://cve.now/CVE-2026-85103.md): Heap-based Buffer Overflow in VPN Certificate ASN.1 Decoding (CVSS 9.8, checkpoint Quantum Security Gateway · checkpoint Quantum Se…)
- [CVE-2026-85102](https://cve.now/CVE-2026-85102.md): Improper Certificate Validation in Quantum Security Gateway (CVSS 9.8, KEV, checkpoint Quantum Security Gateway)
- [CVE-2026-79962](https://cve.now/CVE-2026-79962.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Executi (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79965](https://cve.now/CVE-2026-79965.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79966](https://cve.now/CVE-2026-79966.md): CWE-532: Insertion of Sensitive Information into Log File (CVSS 3.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-15140](https://cve.now/CVE-2026-15140.md): A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift (OCP). (CVSS 7.7, Everpure Portworx Operator)
- [CVE-2026-79969](https://cve.now/CVE-2026-79969.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Concurrent Executi (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80169](https://cve.now/CVE-2026-80169.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sens (CVSS 3.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79638](https://cve.now/CVE-2026-79638.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79694](https://cve.now/CVE-2026-79694.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sens (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79728](https://cve.now/CVE-2026-79728.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Relative Path Trav (CVSS 6.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79961](https://cve.now/CVE-2026-79961.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authentica (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78481](https://cve.now/CVE-2026-78481.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Use of Hard-coded (CVSS 6.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79972](https://cve.now/CVE-2026-79972.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 7.2, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79730](https://cve.now/CVE-2026-79730.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Time-of-check Time (CVSS 5.6, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80172](https://cve.now/CVE-2026-80172.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Veri (CVSS 9.8, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79970](https://cve.now/CVE-2026-79970.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Verifica (CVSS 5.6, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79692](https://cve.now/CVE-2026-79692.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an External Control (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78490](https://cve.now/CVE-2026-78490.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Restrict (CVSS 7.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79695](https://cve.now/CVE-2026-79695.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Handling (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78485](https://cve.now/CVE-2026-78485.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Limitati (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-87821](https://cve.now/CVE-2026-87821.md): Lara Dashboard 0.9.2 through 1.3.1 Server-Side Request Forgery in Builder Markdown Fetch (CVSS 7.1, laradashboard)
- [CVE-2026-87820](https://cve.now/CVE-2026-87820.md): CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner (CVSS 6.9, usmannasir cyberpanel)
- [CVE-2026-87819](https://cve.now/CVE-2026-87819.md): GitPython before 3.1.60 Denial of Service via ReDoS (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-87818](https://cve.now/CVE-2026-87818.md): GitPython 3.1.59 Local File Content Oracle via --no-index (CVSS 7.1, gitpython-developers GitPython · gitpython)
- [CVE-2026-87817](https://cve.now/CVE-2026-87817.md): GitPython before 3.1.60 Remote Code Execution via Git Directory Impersonation (CVSS 8.7, gitpython-developers GitPython · gitpython)
- [CVE-2026-87816](https://cve.now/CVE-2026-87816.md): PasswordPusher before 2.11.1 Race Condition View Limit Bypass (CVSS 8.7, pglombardo PasswordPusher)
- [CVE-2026-87815](https://cve.now/CVE-2026-87815.md): SiYuan before v3.8.2 Path Traversal via removeRiffDeck (CVSS 8.4, siyuan-note siyuan)
- [CVE-2026-87814](https://cve.now/CVE-2026-87814.md): SiYuan before v3.8.2 Stored XSS via Asset Preview (CVSS 8.4, siyuan-note siyuan)
- [CVE-2026-87813](https://cve.now/CVE-2026-87813.md): SiYuan before v3.8.2 Stored XSS via unescaped asset filenames (CVSS 8.4, siyuan-note siyuan)
- [CVE-2026-87812](https://cve.now/CVE-2026-87812.md): SiYuan before v3.8.2 Stored XSS via Bazaar iconURL (CVSS 7.4, siyuan-note siyuan)
- [CVE-2026-87811](https://cve.now/CVE-2026-87811.md): SiYuan before v3.8.2 Stored XSS via notebook template paths (CVSS 8.4, siyuan-note siyuan)
- [CVE-2026-87810](https://cve.now/CVE-2026-87810.md): Siyuan before v3.8.2 Information Disclosure via fullTextSearchBlock (CVSS 6.9, siyuan-note siyuan)
- [CVE-2026-87809](https://cve.now/CVE-2026-87809.md): Siyuan before v3.8.2 Information Disclosure via Export Preview (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-87808](https://cve.now/CVE-2026-87808.md): SiYuan before v3.8.2 Read-Only Boundary Bypass via fullTextSearchBlock (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-87807](https://cve.now/CVE-2026-87807.md): siyuan before v3.8.2 SQL Injection via fullTextSearchBlock (CVSS 8.7, siyuan-note siyuan)
- [CVE-2026-87806](https://cve.now/CVE-2026-87806.md): Parse Server 9.0.0 Authentication Bypass via LDAP Empty Password (CVSS 9.1, parse-community parse-server)
- [CVE-2026-78489](https://cve.now/CVE-2026-78489.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 5.9, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78492](https://cve.now/CVE-2026-78492.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 7.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-74761](https://cve.now/CVE-2026-74761.md): Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Spoofing of RemoveSubscription clientId (CVSS 7.5, Apache Software Foundation Apache ActiveMQ Broker · Apac… +1)
- [CVE-2026-79637](https://cve.now/CVE-2026-79637.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 7.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80171](https://cve.now/CVE-2026-80171.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Entr (CVSS 4.7, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79963](https://cve.now/CVE-2026-79963.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Download of Code W (CVSS 7.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79635](https://cve.now/CVE-2026-79635.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Reques (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-87827](https://cve.now/CVE-2026-87827.md): KGUARD DVR unauthenticated remote command execution vulnerability (CVSS 10.0, KGUARD\_firmware)
- [CVE-2026-73334](https://cve.now/CVE-2026-73334.md): Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation (CVSS 8.1, Apache Software Foundation Apache Parquet Hadoop)
- [CVE-2026-41871](https://cve.now/CVE-2026-41871.md): Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API) (CVSS 9.8, Apache Software Foundation Apache Nutch)
- [CVE-2026-41869](https://cve.now/CVE-2026-41869.md): Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API) (CVSS 9.1, Apache Software Foundation Apache Nutch)
- [CVE-2026-41870](https://cve.now/CVE-2026-41870.md): Apache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API) (CVSS 8.8, Apache Software Foundation Apache Nutch)
- [CVE-2026-65181](https://cve.now/CVE-2026-65181.md): Apache Impala: RCE via External Data Source Class Loading (CVSS 8.1, Apache Software Foundation Apache Impala)
- [CVE-2026-57866](https://cve.now/CVE-2026-57866.md): Apache Impala: Secrets Exfiltration via SSRF (CVSS 8.8, Apache Software Foundation Apache Impala)
- [CVE-2026-79641](https://cve.now/CVE-2026-79641.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 7.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-56207](https://cve.now/CVE-2026-56207.md): Apache Impala: SAML authentication bypass via forged bearer token (CVSS 9.8, Apache Software Foundation Apache Impala)
- [CVE-2026-79727](https://cve.now/CVE-2026-79727.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensi (CVSS 3.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-54048](https://cve.now/CVE-2026-54048.md): Apache Impala: Avro Schema URL Server-Side Request Forgery (CVSS 5.3, Apache Software Foundation Apache Impala)
- [CVE-2026-85978](https://cve.now/CVE-2026-85978.md): Unauthenticated Remote Code Execution in Akana API Platform (CVSS 10.0, Perforce Akana)
- [CVE-2026-80239](https://cve.now/CVE-2026-80239.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Exposure of Sensi (CVSS 2.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80174](https://cve.now/CVE-2026-80174.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insufficient Sess (CVSS 5.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-87795](https://cve.now/CVE-2026-87795.md): zstd-jni 1.2.0 through 1.5.7-13 Out-of-Bounds Read via ZstdDictCompress (CVSS 8.8, luben zstd-jni)
- [CVE-2026-87794](https://cve.now/CVE-2026-87794.md): bestzip 2.2.6 and 3.0.2 Argument Injection via the Native Zip Destination (CVSS 8.6, nfriedly bestzip)
- [CVE-2026-86777](https://cve.now/CVE-2026-86777.md): AlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes (CVSS 6.9, AlchemyCMS alchemy\_cms)
- [CVE-2026-86776](https://cve.now/CVE-2026-86776.md): KeePass 2.35 through 2.61.1 Memory Exhaustion via KDBX Header Field Size (CVSS 3.3, KeePass)
- [CVE-2026-86547](https://cve.now/CVE-2026-86547.md): mrubyc through 4.0.0 NULL Pointer Dereference via OP\_ENTER (CVSS 6.2, mrubyc)
- [CVE-2026-78377](https://cve.now/CVE-2026-78377.md): Open Redirect in Yordam Informatics's Library Automation System (CVSS 6.1, Yordam Informatics Technology Consulting, Training, and Ele…)
- [CVE-2026-19733](https://cve.now/CVE-2026-19733.md): SSRF in Yordam Informatics's Library Automation System (CVSS 5.3, Yordam Informatics Technology Consulting, Training, and Ele…)
- [CVE-2025-3271](https://cve.now/CVE-2025-3271.md): DOM-based XSS vulnerability in OpenText™ Documentum Webtop (CVSS 4.8, OpenText™ Documentum Webtop)
- [CVE-2026-11838](https://cve.now/CVE-2026-11838.md): Improper Authorization in Yordam Informatics' Library Reservation System (CVSS 4.3, Yordam Informatics Technology Consulting, Training, and Ele…)
- [CVE-2026-79974](https://cve.now/CVE-2026-79974.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Authenti (CVSS 6.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79967](https://cve.now/CVE-2026-79967.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 5.6, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-87766](https://cve.now/CVE-2026-87766.md): Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup (CVSS 8.8, Red Hat Enterprise Linux · Red Hat Hardened Images)
- [CVE-2026-79973](https://cve.now/CVE-2026-79973.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Unsynchronized Ac (CVSS 6.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-12858](https://cve.now/CVE-2026-12858.md): Local privilege escalation vulnerability in ESET AV Remover (CVSS 8.5, ESET spol. s.r.o. ESET AV Remover)
- [CVE-2026-14989](https://cve.now/CVE-2026-14989.md): Cookie Banner for GDPR / CCPA \<= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl\_user\_preference' Parameter (CVSS 7.2, wplegalpages WPLP Cookie Consent – Cookie Banner & Consent…)
- [CVE-2026-14359](https://cve.now/CVE-2026-14359.md): YITH WooCommerce Waitlist Premium \<= 3.35.0 - Authenticated (Subscriber+) Privilege Escalation to Admin via wp\_ajax\_yith\_wcwtl\_add\_user (CVSS 8.8, YITH WooCommerce Waitlist Premium)
- [CVE-2026-80099](https://cve.now/CVE-2026-80099.md): Various Newfold Plugins Various Versions - Unauthenticated Authentication Bypass via Bearer Token Validation with Empty Secret (CVSS 8.8, Newfold WP Plugin Web · Newfold WP Plugin Crazy Domains +3)
- [CVE-2026-79640](https://cve.now/CVE-2026-79640.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 5.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2025-46808](https://cve.now/CVE-2025-46808.md): Sensitive information is leaked into NeuVector’s manager container logs (CVSS 6.8, SUSE neuvector)
- [CVE-2026-78491](https://cve.now/CVE-2026-78491.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 8.2, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80122](https://cve.now/CVE-2026-80122.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-16272](https://cve.now/CVE-2026-16272.md): Client IP Spoofing via Untrusted HTTP Headers in PayTR's PayTR Virtual Pos iFrame API WHMCS Module (CVSS 9.1, PayTR Payment and Electronic Money Institution PayTR Virtua…)
- [CVE-2026-79696](https://cve.now/CVE-2026-79696.md): Remote Code Execution in Google ADK for Python via Incomplete Standard Library Denylist (CVSS 10.0, Google Cloud Agent Development Kit (ADK) for Python)
- [CVE-2026-80175](https://cve.now/CVE-2026-80175.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sens (CVSS 3.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-78494](https://cve.now/CVE-2026-78494.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Certific (CVSS 7.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-79636](https://cve.now/CVE-2026-79636.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Validati (CVSS 7.0, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80123](https://cve.now/CVE-2026-80123.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Reques (CVSS 7.3, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80124](https://cve.now/CVE-2026-80124.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Insertion of Sens (CVSS 5.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80177](https://cve.now/CVE-2026-80177.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 6.5, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-80055](https://cve.now/CVE-2026-80055.md): Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutrali (CVSS 4.4, Dell Secure Connect Gateway 5.0 - Application · Dell Secure…)
- [CVE-2026-17149](https://cve.now/CVE-2026-17149.md): myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program \<= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute (CVSS 6.4, saadiqbal Points Management System For Gamification, Ranks,…)
- [CVE-2026-75927](https://cve.now/CVE-2026-75927.md): PublishPress Capabilities \<= 2.50.0 - Authenticated (Editor+) Privilege Escalation to Fresh-Install Default Capability Grant (CVSS 7.2, User Role Editor – PublishPress Capabilities: Access Contro…)
- [CVE-2026-19778](https://cve.now/CVE-2026-19778.md): WPMR Google Feed Manager for WooCommerce \<= 2.23.7 - Authenticated (Administrator+) SQL Injection via 'feed' Parameter (CVSS 6.5, aukejomm WPMR Google Feed Manager for WooCommerce – Sell on…)
- [CVE-2026-19729](https://cve.now/CVE-2026-19729.md): Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters (CVSS 4.9, Red Hat build of Keycloak · Red Hat Single Sign-On)
- [CVE-2026-19802](https://cve.now/CVE-2026-19802.md): Checkout Custom Fields Builder for WooCommerce \<= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter (CVSS 4.3, stylemix Checkout Custom Fields Builder for WooCommerce)
- [CVE-2026-87747](https://cve.now/CVE-2026-87747.md): Ragic｜Enterprise Cloud Database - Arbitrary File Read (CVSS 6.9, Ragic Enterprise Cloud Database)
- [CVE-2026-85117](https://cve.now/CVE-2026-85117.md): Contact Form 7 Captcha 0.1.7 - 0.1.8 - Unauthenticated Arbitrary Shortcode Execution via Form Field Repopulation (CVSS 6.5, Contact Form 7 Captcha)
- [CVE-2026-83537](https://cve.now/CVE-2026-83537.md): WP Express Checkout \< 2.5.0 - Unauthenticated Payment Bypass via wpec\_process\_empty\_payment (CVSS 5.3, WP Express Checkout)
- [CVE-2026-80440](https://cve.now/CVE-2026-80440.md): Hustle \< 7.8.14.2 - Unauthenticated Arbitrary Shortcode Execution via Success Message Placeholders (CVSS 4.8, Hustle)
- [CVE-2026-19855](https://cve.now/CVE-2026-19855.md): Spam protection, Honeypot, Anti-Spam by CleanTalk \< 6.87 - Unauthenticated Arbitrary Shortcode Execution via Comment Text (CVSS 6.5, CleanTalk)
- [CVE-2025-7062](https://cve.now/CVE-2025-7062.md): Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education (CVSS 5.2, Lumi Education UG h5p-nodejs-library)
- [CVE-2026-85418](https://cve.now/CVE-2026-85418.md): Orbit Fox \< 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget (CVSS 5.4, Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie…)
- [CVE-2026-85133](https://cve.now/CVE-2026-85133.md): WPLP Cookie Consent \< 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions (CVSS 5.4, WPLP Cookie Consent)
- [CVE-2026-85132](https://cve.now/CVE-2026-85132.md): WPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc\_get\_schedule\_scan (CVSS 4.3, WPLP Cookie Consent)
- [CVE-2026-85037](https://cve.now/CVE-2026-85037.md): Sunshine Photo Cart \< 3.7 - Unauthenticated Price Manipulation via IDOR (CVSS 5.3, Sunshine Photo Cart)
- [CVE-2026-84222](https://cve.now/CVE-2026-84222.md): Kirki 6.2.1 - 6.2.5 - Unauthenticated Non-Public Post Content Disclosure via 'kirki\_data' Parameter (CVSS 5.3, Kirki)
- [CVE-2026-84113](https://cve.now/CVE-2026-84113.md): Quentn WP \< 1.2.15 - Admin+ SQLi via 'orderby'/'order' Parameter (CVSS 4.1, Quentn WP)
- [CVE-2026-84068](https://cve.now/CVE-2026-84068.md): Quentn WP 1.2.13 - 1.2.14 - Unauthenticated SQLi via 'qntn\_wp' Parameter (CVSS 8.6, Quentn WP)
- [CVE-2026-83541](https://cve.now/CVE-2026-83541.md): Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget (CVSS 6.8, Sina Extension for Elementor)
- [CVE-2026-82848](https://cve.now/CVE-2026-82848.md): Masteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure (CVSS 5.3, Masteriyo LMS)
- [CVE-2026-82185](https://cve.now/CVE-2026-82185.md): WPLP Cookie Consent \< 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset (CVSS 4.3, WPLP Cookie Consent)
- [CVE-2026-82184](https://cve.now/CVE-2026-82184.md): WPLP Cookie Consent \< 4.4.2 - Unauthenticated IAB TCF Consent Option Update (CVSS 5.3, WPLP Cookie Consent)
- [CVE-2026-81741](https://cve.now/CVE-2026-81741.md): Groundhogg \< 4.7.2 - Open Redirect via 'redirect\_to' Parameter (CVSS 4.7, Groundhogg — CRM, Newsletters, and Marketing Automation)
- [CVE-2026-81022](https://cve.now/CVE-2026-81022.md): SupportCandy 3.3.6 - 3.5.2 - Unauthenticated Ticket Content Disclosure via Auth Code Leak (CVSS 5.3, SupportCandy)
- [CVE-2026-81021](https://cve.now/CVE-2026-81021.md): SupportCandy 3.2.9 - 3.5.2 - Unauthenticated Ticket Attachment Disclosure (CVSS 5.3, SupportCandy)
- [CVE-2026-80341](https://cve.now/CVE-2026-80341.md): Payment Plugins for PayPal WooCommerce \< 2.0.26 - Subscriber+ Stored Payment Method Assignment via IDOR (CVSS 5.9, Payment Plugins for PayPal WooCommerce)
- [CVE-2026-80340](https://cve.now/CVE-2026-80340.md): Payment Plugins for PayPal WooCommerce \< 2.0.26 - Unauthenticated Customer PII Disclosure via order-pay (CVSS 5.3, Payment Plugins for PayPal WooCommerce)
- [CVE-2026-80339](https://cve.now/CVE-2026-80339.md): Payment Plugins for Stripe WooCommerce \< 4.0.12 - Unauthenticated Customer PII Disclosure via order-pay (CVSS 5.3, Payment Plugins for Stripe WooCommerce)
- [CVE-2026-75861](https://cve.now/CVE-2026-75861.md): Ultimate Gift Cards for WooCommerce \< 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption (CVSS 6.5, Ultimate Gift Cards for WooCommerce)
- [CVE-2026-18042](https://cve.now/CVE-2026-18042.md): WP Travel \< 12.0.2 - Unauthenticated Arbitrary Booking Cancellation (CVSS 5.3, WP Travel)
- [CVE-2026-16960](https://cve.now/CVE-2026-16960.md): Loops & Logic \< 4.3.0 - Unauthenticated User Data and Site Option Disclosure (CVSS 7.5, Loops & Logic)
- [CVE-2026-14962](https://cve.now/CVE-2026-14962.md): ELEX WooCommerce Request a Quote \< 2.4.1 - Unauthenticated SQLi via variation\_id (CVSS 8.6, ELEX WooCommerce Request a Quote)
- [CVE-2026-13146](https://cve.now/CVE-2026-13146.md): WP Travel \< 12.0.2 - Unauthenticated Booking Payment State Tampering via IDOR (CVSS 3.7, WP Travel)
- [CVE-2026-13144](https://cve.now/CVE-2026-13144.md): WP Travel \< 12.0.2 - Unauthenticated Arbitrary Booking Payment Reset (CVSS 3.7, WP Travel)
- [CVE-2025-15690](https://cve.now/CVE-2025-15690.md): Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles (CVSS 6.8, Content Mask)
- [CVE-2026-75905](https://cve.now/CVE-2026-75905.md): WP Recipe Maker \<= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '\[wprm-recipe\]' Shortcode (CVSS 4.3, brechtvds WP Recipe Maker)
- [CVE-2026-8615](https://cve.now/CVE-2026-8615.md): ilGhera Reviso Exporter for WooCommerce \<= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect\_callback Function (CVSS 4.3, ghera74 ilGhera Reviso Exporter for WooCommerce)
- [CVE-2026-76009](https://cve.now/CVE-2026-76009.md): Next-Cart Store to WooCommerce Migration \<= 3.9.8 - Unauthenticated Authentication Bypass via Default '\_\_token\_\_' Fallback in REST Migration Endpoint (CVSS 8.1, martinnguyen1990 Next-Cart Store to WooCommerce Migration)
- [CVE-2026-83593](https://cve.now/CVE-2026-83593.md): WPBot \<= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter (CVSS 7.2, quantumcloud WPBot – AI ChatBot for Live Support, Lead Gene…)
- [CVE-2026-84908](https://cve.now/CVE-2026-84908.md): WPFunnels \<= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl\_load\_payment' AJAX Action (CVSS 5.3, getwpfunnels WPFunnels – Funnel Builder for WooCommerce wit…)
- [CVE-2026-19946](https://cve.now/CVE-2026-19946.md): Awesome Support \<= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user\_id' Parameter (CVSS 4.3, awesomesupport Awesome Support – WordPress HelpDesk & Suppo…)
- [CVE-2026-21113](https://cve.now/CVE-2026-21113.md): Improper export of android application components in Visual Voicemail prior to version 20.1.00.05 allows local attackers to initiate call wi (CVSS 4.8, Samsung Mobile Visual Voicemail)
- [CVE-2026-21112](https://cve.now/CVE-2026-21112.md): Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privileg (CVSS 5.1, Samsung Mobile Samsung Tips)
- [CVE-2026-21111](https://cve.now/CVE-2026-21111.md): Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory. (CVSS 6.9, Samsung Mobile libsthmbc)
- [CVE-2026-21110](https://cve.now/CVE-2026-21110.md): Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code. (CVSS 6.9, Samsung Mobile libsavscmn.so)
- [CVE-2026-21109](https://cve.now/CVE-2026-21109.md): Improper access control in Watch Plugin prior to Android Watch 17 allows local attackers to access sensitive information. (CVSS 2.1, Samsung Mobile Watch Plugin)
- [CVE-2026-21108](https://cve.now/CVE-2026-21108.md): Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive infor (CVSS 6.9, Samsung Mobile Bixby Touch)
- [CVE-2026-21107](https://cve.now/CVE-2026-21107.md): Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. (CVSS 6.9, Samsung Mobile Samsung Notes)
- [CVE-2026-21106](https://cve.now/CVE-2026-21106.md): Improper verification of intent by broadcast receiver in Samsung Cloud Assistant prior to version 9.0.5 allows local attackers to disable en (CVSS 5.1, Samsung Mobile Samsung Cloud Assistant)
- [CVE-2026-21105](https://cve.now/CVE-2026-21105.md): Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access se (CVSS 5.9, Samsung Mobile Collection)
- [CVE-2026-21104](https://cve.now/CVE-2026-21104.md): Heap-based buffer overflow in KnoxVault trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2026-21103](https://cve.now/CVE-2026-21103.md): Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical attackers to access files with system privilege. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2026-21102](https://cve.now/CVE-2026-21102.md): Use after free in DualDAR prior to SMR Sep-2026 Release 1 allows local privileged attackers to execute arbitrary code with root privilege. (CVSS 9.3, Samsung Mobile Devices)
- [CVE-2026-21101](https://cve.now/CVE-2026-21101.md): Improper input validation in DualDAR driver prior to SMR Sep-2026 Release 1 allows local privileged attackers to potentially execute arbitra (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-21100](https://cve.now/CVE-2026-21100.md): Improper access control in SystemUI prior to SMR Sep-2026 Release 1 allows local attackers to launch arbitrary activity. (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21099](https://cve.now/CVE-2026-21099.md): Improper access control in SettingsProvider prior to SMR Sep-2026 Release 1 allows local attackers to access sensitive information. (CVSS 5.1, Samsung Mobile Devices)
- [CVE-2026-21098](https://cve.now/CVE-2026-21098.md): Improper access control in Link to Windows prior to SMR Sep-2026 Release 1 allows local attackers to establish a connection with the PC with (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21097](https://cve.now/CVE-2026-21097.md): Improper authentication in ActivityTaskManagerService prior to SMR Sep-2026 Release 1 allows local privileged attackers to launch arbitrary (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2026-21096](https://cve.now/CVE-2026-21096.md): Heap-based buffer overflow in JPEG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbi (CVSS 9.2, Samsung Mobile Devices)
- [CVE-2026-21095](https://cve.now/CVE-2026-21095.md): Heap-based buffer overflow in DNG decoder of libimagecodec.quram.so prior to SMR Sep-2026 Release 1 allows remote attackers to execute arbit (CVSS 9.2, Samsung Mobile Devices)
- [CVE-2026-21094](https://cve.now/CVE-2026-21094.md): Improper input validation in wpa\_supplicant prior to SMR Sep-2026 Release 1 allows adjacent attackers to write out-of-bounds memory. (CVSS 6.1, Samsung Mobile Devices)
- [CVE-2026-21093](https://cve.now/CVE-2026-21093.md): Stack-based buffer overflow in PROCA trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memor (CVSS 5.6, Samsung Mobile Devices)
- [CVE-2026-21092](https://cve.now/CVE-2026-21092.md): Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to create image files with system server privilege. (CVSS 8.8, Samsung Mobile Devices)
- [CVE-2026-21091](https://cve.now/CVE-2026-21091.md): Out-of-bounds write in libcodec2secevrcdec.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2026-21090](https://cve.now/CVE-2026-21090.md): Out-of-bounds write in libsaviextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of-bounds memory. (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2026-21089](https://cve.now/CVE-2026-21089.md): Improper input validation in removing style tag in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write out-of (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21088](https://cve.now/CVE-2026-21088.md): Improper input validation in loading a subtitle frame in libsubextractor.so prior to SMR Sep-2026 Release 1 allows local attackers to write (CVSS 6.9, Samsung Mobile Devices)
- [CVE-2026-21087](https://cve.now/CVE-2026-21087.md): Out-of-bounds write in libmdnie.so prior to SMR Sep-2026 Release 1 allows local attackers to execute arbitrary code with system server privi (CVSS 8.6, Samsung Mobile Devices)
- [CVE-2026-21086](https://cve.now/CVE-2026-21086.md): Improper authorization in ProxyHandler prior to SMR Aug-2026 Release 1 allows local attackers to access proxy configuration. (CVSS 4.8, Samsung Mobile Devices)
- [CVE-2026-21085](https://cve.now/CVE-2026-21085.md): Out-of-bounds write in Keymaster trustlet prior to SMR Sep-2026 Release 1 allows local privileged attackers to write out-of-bounds memory. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2026-11821](https://cve.now/CVE-2026-11821.md): Eventin \<= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint (CVSS 5.4, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-19945](https://cve.now/CVE-2026-19945.md): WP Crowdfunding \<= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first\_name' Parameter (CVSS 6.4, themeum WP Crowdfunding)
- [CVE-2026-87737](https://cve.now/CVE-2026-87737.md): An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. (CVSS 5.9, OCaml mirage-crypto-ec)
- [CVE-2026-87736](https://cve.now/CVE-2026-87736.md): An issue was discovered in the mirage-crypto-ec package before 2.3.0 for OCaml. (CVSS 4.3, OCaml mirage-crypto-ec)
- [CVE-2026-87735](https://cve.now/CVE-2026-87735.md): An issue was discovered in the mirage-crypto-pk package before 2.3.0 for OCaml. (CVSS 4.3, OCaml mirage-crypto-pk)
- [CVE-2026-87734](https://cve.now/CVE-2026-87734.md): An issue was discovered in the utcp package before 0.0.6 for OCaml. (CVSS 7.5, OCaml utcp)
- [CVE-2026-87733](https://cve.now/CVE-2026-87733.md): An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. (CVSS 6.2, OCaml mirage-crypto-ec)
- [CVE-2026-87732](https://cve.now/CVE-2026-87732.md): An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. (CVSS 6.2, OCaml mirage-crypto)
- [CVE-2026-49313](https://cve.now/CVE-2026-49313.md): Permission control vulnerability in the app lock module. (CVSS 5.5, Huawei HarmonyOS)
- [CVE-2026-49309](https://cve.now/CVE-2026-49309.md): Permission control vulnerability in the Settings module. (CVSS 4.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-12855](https://cve.now/CVE-2026-12855.md): H19WMIHandlerSmm: unvalidated memory boundary could result in arbitrary code execution. (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2026-41987](https://cve.now/CVE-2026-41987.md): Permission control vulnerability in the app management module. (CVSS 6.2, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-6485](https://cve.now/CVE-2026-6485.md): UEFI BIOS embedded Shell can be used to bypass Secure Boot (CVSS 8.2, Insyde Software InsydeH2O)
- [CVE-2026-49315](https://cve.now/CVE-2026-49315.md): DoS vulnerability in the input device module. (CVSS 7.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2026-81647](https://cve.now/CVE-2026-81647.md): Out-of-bounds read vulnerability in the graphics module. (CVSS 5.3, Huawei HarmonyOS)
- [CVE-2026-81646](https://cve.now/CVE-2026-81646.md): Out-of-bounds read vulnerability in the graphics module. (CVSS 5.9, Huawei HarmonyOS)
- [CVE-2026-75966](https://cve.now/CVE-2026-75966.md): Podlove Podcast Publisher \<= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode\_contributor\[..\]\[..\]\[comment\]' Parameter (CVSS 6.4, eteubert Podlove Podcast Publisher)
- [CVE-2026-11363](https://cve.now/CVE-2026-11363.md): Ninja Forms \<= 3.14.6 - Authenticated (Administrator+) PHP Object Injection via Form Import (CVSS 6.6, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2026-19944](https://cve.now/CVE-2026-19944.md): WP Crowdfunding \<= 2.2.1 - Authenticated (Shop Manager+) SQL Injection via 'wpneo\_reward' Post Meta (CVSS 4.9, themeum WP Crowdfunding)
- [CVE-2026-19800](https://cve.now/CVE-2026-19800.md): Mail Mint \<= 1.31.0 - Authenticated (Custom+) SQL Injection via 'status' Parameter (CVSS 4.9, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2026-19797](https://cve.now/CVE-2026-19797.md): User Access Manager \<= 2.3.18 - Reflected Cross-Site Scripting via 'tab\_group\_section' Parameter (CVSS 6.1, gm\_alex User Access Manager)
- [CVE-2026-77187](https://cve.now/CVE-2026-77187.md): My Calendar \<= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes (CVSS 6.4, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-77186](https://cve.now/CVE-2026-77186.md): My Calendar \<= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute (CVSS 6.4, joedolson My Calendar – Accessible Event Manager)
- [CVE-2026-84293](https://cve.now/CVE-2026-84293.md): Repeater Fields for Gravity Forms \<= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values (CVSS 7.2, addonsorg Repeater Fields for Gravity Forms)
- [CVE-2026-7804](https://cve.now/CVE-2026-7804.md): Product Filter for WooCommerce by WBW \<= 3.4.2 - Reflected Cross-Site Scripting via 'wpf\_fid' Parameter (CVSS 6.1, woobewoo Product Filter for WooCommerce by WBW)
- [CVE-2026-17553](https://cve.now/CVE-2026-17553.md): Shopping Cart & eCommerce Store \<= 5.9.3 - Authenticated (Store Manager+) Privilege Escalation to ec\_ajax\_save\_page\_default\_options AJAX Action (CVSS 7.2, levelfourstorefront Shopping Cart & eCommerce Store)
- [CVE-2026-81644](https://cve.now/CVE-2026-81644.md): DoS vulnerability in the preview service module. (CVSS 4.3, Huawei HarmonyOS)
- [CVE-2026-49312](https://cve.now/CVE-2026-49312.md): Permission control vulnerability in the window module. (CVSS 4.0, Huawei HarmonyOS)
- [CVE-2026-49310](https://cve.now/CVE-2026-49310.md): Permission control vulnerability in the event notification module. (CVSS 8.6, Huawei HarmonyOS)
- [CVE-2026-49314](https://cve.now/CVE-2026-49314.md): OOB write vulnerability in the rendering and composition module. (CVSS 7.3, Huawei HarmonyOS)
- [CVE-2026-49311](https://cve.now/CVE-2026-49311.md): Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availabil (CVSS 6.2, Huawei HarmonyOS)
- [CVE-2026-13709](https://cve.now/CVE-2026-13709.md): Graphina \<= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq\_tree\_tree\_chart\_template' Widget Setting (CVSS 6.4, iqonicdesign Graphina – Charts and Graphs For Elementor)
- [CVE-2026-15667](https://cve.now/CVE-2026-15667.md): Eventin \<= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event\_layout' Parameter (CVSS 7.5, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-15406](https://cve.now/CVE-2026-15406.md): Eventin \<= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event\_layout' Parameter (CVSS 7.5, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-76801](https://cve.now/CVE-2026-76801.md): FireBox \<= 3.1.10 - Authenticated (Author+) Remote Code Execution to Privilege Escalation (CVSS 8.8, fireplugins FireBox – WooCommerce Popup Builder, Exit Inten…)
- [CVE-2026-13359](https://cve.now/CVE-2026-13359.md): Contact Form to DB by BestWebSoft \<= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm\_contact\_dropdown Parameter (CVSS 7.2, bestweblayout Contact Form to DB by BestWebSoft – Messages…)
- [CVE-2026-12956](https://cve.now/CVE-2026-12956.md): Eventin \<= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter (CVSS 5.3, arraytics Eventin – Event Calendar, Tickets, Registration,…)
- [CVE-2026-87036](https://cve.now/CVE-2026-87036.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 8.1, Tanium Comply)
- [CVE-2026-87021](https://cve.now/CVE-2026-87021.md): Tanium addressed an unauthorized code execution vulnerability in Comply. (CVSS 7.2, Tanium Comply)
- [CVE-2026-87023](https://cve.now/CVE-2026-87023.md): Tanium addressed a path traversal vulnerability in Comply. (CVSS 8.5, Tanium Comply)
- [CVE-2026-87084](https://cve.now/CVE-2026-87084.md): Tanium addressed a server-side request forgery vulnerability in Enforce. (CVSS 7.7, Tanium Enforce)
- [CVE-2026-87048](https://cve.now/CVE-2026-87048.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 5.4, Tanium Comply)
- [CVE-2026-87034](https://cve.now/CVE-2026-87034.md): Tanium addressed a SQL injection vulnerability in Comply. (CVSS 8.3, Tanium Comply)
- [CVE-2026-87073](https://cve.now/CVE-2026-87073.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 6.5, Tanium Comply)
- [CVE-2026-87032](https://cve.now/CVE-2026-87032.md): Tanium addressed an information disclosure vulnerability in Tanium Server. (CVSS 4.3, Tanium Server)
- [CVE-2026-87072](https://cve.now/CVE-2026-87072.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 7.1, Tanium Comply)
- [CVE-2026-87035](https://cve.now/CVE-2026-87035.md): Tanium addressed an information disclosure vulnerability in Comply. (CVSS 4.3, Tanium Comply)
- [CVE-2026-87033](https://cve.now/CVE-2026-87033.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 5.4, Tanium Comply)
- [CVE-2026-14892](https://cve.now/CVE-2026-14892.md): Tanium addressed an improper access controls vulnerability in Tanium Server. (CVSS 4.3, Tanium Server)
- [CVE-2026-87030](https://cve.now/CVE-2026-87030.md): Tanium addressed a path traversal vulnerability in Comply. (CVSS 8.5, Tanium Comply)
- [CVE-2026-87046](https://cve.now/CVE-2026-87046.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 4.3, Tanium Comply)
- [CVE-2026-87025](https://cve.now/CVE-2026-87025.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 5.4, Tanium Comply)
- [CVE-2026-87075](https://cve.now/CVE-2026-87075.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 8.1, Tanium Comply)
- [CVE-2026-87047](https://cve.now/CVE-2026-87047.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 6.3, Tanium Comply)
- [CVE-2026-87019](https://cve.now/CVE-2026-87019.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 4.3, Tanium Comply)
- [CVE-2026-14505](https://cve.now/CVE-2026-14505.md): Tanium addressed a path traversal vulnerability in Tanium Data Service. (CVSS 6.6, Tanium Data Service)
- [CVE-2026-87037](https://cve.now/CVE-2026-87037.md): Tanium addressed an improper access controls vulnerability in Comply. (CVSS 5.4, Tanium Comply)
- [CVE-2026-87088](https://cve.now/CVE-2026-87088.md): Tanium addressed an unauthorized code execution vulnerability in Enforce. (CVSS 7.0, Tanium Enforce)
- [CVE-2026-87724](https://cve.now/CVE-2026-87724.md): Tor before 0.4.9.12 interprets the CC\_RESPONSE extension even when CC\_REQUEST was not sent, which allows remote attackers to cause a denial (CVSS 6.5, torprject Tor)
- [CVE-2026-87083](https://cve.now/CVE-2026-87083.md): tile-ai tilelang Kernel Cache kernel\_cache.py KernelCache.\_load\_kernel\_from\_disk deserialization (CVSS 5.1, tile-ai tilelang)
- [CVE-2026-87593](https://cve.now/CVE-2026-87593.md): Information leak in Editing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-87430](https://cve.now/CVE-2026-87430.md): Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the (CVSS 8.8, Google Chrome)
- [CVE-2026-87544](https://cve.now/CVE-2026-87544.md): Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions (CVSS 8.8, Google Chrome)
- [CVE-2026-87601](https://cve.now/CVE-2026-87601.md): Race condition in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 7.5, Google Chrome)
- [CVE-2026-87602](https://cve.now/CVE-2026-87602.md): Out of bounds read in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially read memory outsi (CVSS 4.7, Google Chrome)
- [CVE-2026-87437](https://cve.now/CVE-2026-87437.md): Information leak in Frames in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTM (CVSS 6.5, Google Chrome)
- [CVE-2026-87608](https://cve.now/CVE-2026-87608.md): Improper certificate validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to (CVSS 7.5, Google Chrome)
- [CVE-2026-87551](https://cve.now/CVE-2026-87551.md): Improper certificate validation in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to b (CVSS 4.3, Google Chrome)
- [CVE-2026-87477](https://cve.now/CVE-2026-87477.md): Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML (CVSS 6.5, Google Chrome)
- [CVE-2026-87571](https://cve.now/CVE-2026-87571.md): Improper certificate validation in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to (CVSS 5.4, Google Chrome)
- [CVE-2026-87575](https://cve.now/CVE-2026-87575.md): Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass (CVSS 5.4, Google Chrome)
- [CVE-2026-87489](https://cve.now/CVE-2026-87489.md): Memory corruption in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the s (CVSS 8.8, Google Chrome)
- [CVE-2026-87469](https://cve.now/CVE-2026-87469.md): Improper input validation in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a (CVSS 4.3, Google Chrome)
- [CVE-2026-87631](https://cve.now/CVE-2026-87631.md): Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via (CVSS 6.5, Google Chrome)
- [CVE-2026-87461](https://cve.now/CVE-2026-87461.md): Information leak in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted Chrome ex (CVSS 4.3, Google Chrome)
- [CVE-2026-87473](https://cve.now/CVE-2026-87473.md): Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to b (CVSS 6.5, Google Chrome)
- [CVE-2026-87509](https://cve.now/CVE-2026-87509.md): Incorrect authorization in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code (CVSS 8.1, Google Chrome)
- [CVE-2026-87583](https://cve.now/CVE-2026-87583.md): UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a (CVSS 5.4, Google Chrome)
- [CVE-2026-87490](https://cve.now/CVE-2026-87490.md): Information leak in Transactions Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information (CVSS 6.5, Google Chrome)
- [CVE-2026-87605](https://cve.now/CVE-2026-87605.md): Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process (CVSS 5.3, Google Chrome)
- [CVE-2026-87624](https://cve.now/CVE-2026-87624.md): UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the re (CVSS 4.2, Google Chrome)
- [CVE-2026-87597](https://cve.now/CVE-2026-87597.md): UI misrepresentation in CustomTabs in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to spoof address bar via (CVSS 4.8, Google Chrome)
- [CVE-2026-87565](https://cve.now/CVE-2026-87565.md): Information leak in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information (CVSS 6.5, Google Chrome)
- [CVE-2026-87523](https://cve.now/CVE-2026-87523.md): Race condition in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sen (CVSS 6.5, Google Chrome)
- [CVE-2026-87617](https://cve.now/CVE-2026-87617.md): Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitr (CVSS 8.8, Google Chrome)
- [CVE-2026-87545](https://cve.now/CVE-2026-87545.md): Information leak in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak (CVSS 6.5, Google Chrome)
- [CVE-2026-87538](https://cve.now/CVE-2026-87538.md): Clickjacking in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leverag (CVSS 4.2, Google Chrome)
- [CVE-2026-87546](https://cve.now/CVE-2026-87546.md): Incorrect type conversion or cast in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass syst (CVSS 4.3, Google Chrome)
- [CVE-2026-87463](https://cve.now/CVE-2026-87463.md): Incorrect authorization in Certificate in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially spoof (CVSS 4.8, Google Chrome)
- [CVE-2026-87459](https://cve.now/CVE-2026-87459.md): Observable discrepancy in Select in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a cra (CVSS 6.5, Google Chrome)
- [CVE-2026-87448](https://cve.now/CVE-2026-87448.md): Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox v (CVSS 9.6, Google Chrome)
- [CVE-2026-87502](https://cve.now/CVE-2026-87502.md): Confused deputy in Fullscreen in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and (CVSS 4.2, Google Chrome)
- [CVE-2026-87620](https://cve.now/CVE-2026-87620.md): Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2026-87592](https://cve.now/CVE-2026-87592.md): Out of bounds read in Tint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially read memory inside the sandbox v (CVSS 4.3, Google Chrome)
- [CVE-2026-87595](https://cve.now/CVE-2026-87595.md): Server-side request forgery in Mobile in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to byp (CVSS 9.8, Google Chrome)
- [CVE-2026-87627](https://cve.now/CVE-2026-87627.md): Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engine (CVSS 6.5, Google Chrome)
- [CVE-2026-87511](https://cve.now/CVE-2026-87511.md): Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-87656](https://cve.now/CVE-2026-87656.md): Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrict (CVSS 5.4, Google Chrome)
- [CVE-2026-87568](https://cve.now/CVE-2026-87568.md): Improper input validation in Chromium in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro (CVSS 4.8, Google Chrome)
- [CVE-2026-87522](https://cve.now/CVE-2026-87522.md): Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeri (CVSS 6.5, Google Chrome)
- [CVE-2026-87543](https://cve.now/CVE-2026-87543.md): Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 4.3, Google Chrome)
- [CVE-2026-87519](https://cve.now/CVE-2026-87519.md): Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to b (CVSS 6.5, Google Chrome)
- [CVE-2026-87598](https://cve.now/CVE-2026-87598.md): Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a (CVSS 4.3, Google Chrome)
- [CVE-2026-87561](https://cve.now/CVE-2026-87561.md): Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy (CVSS 4.3, Google Chrome)
- [CVE-2026-87619](https://cve.now/CVE-2026-87619.md): Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-87614](https://cve.now/CVE-2026-87614.md): Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 3.1, Google Chrome)
- [CVE-2026-87618](https://cve.now/CVE-2026-87618.md): Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromise (CVSS 8.3, Google Chrome)
- [CVE-2026-87429](https://cve.now/CVE-2026-87429.md): Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pr (CVSS 6.5, Google Chrome)
- [CVE-2026-87634](https://cve.now/CVE-2026-87634.md): Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outsi (CVSS 9.6, Google Chrome)
- [CVE-2026-87653](https://cve.now/CVE-2026-87653.md): UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via (CVSS 5.4, Google Chrome)
- [CVE-2026-87629](https://cve.now/CVE-2026-87629.md): Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak s (CVSS 6.5, Google Chrome)
- [CVE-2026-87626](https://cve.now/CVE-2026-87626.md): Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web ori (CVSS 6.5, Google Chrome)
- [CVE-2026-87610](https://cve.now/CVE-2026-87610.md): Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions in (CVSS 6.5, Google Chrome)
- [CVE-2026-87609](https://cve.now/CVE-2026-87609.md): Use after free in Sharing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-87526](https://cve.now/CVE-2026-87526.md): Use after free in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially e (CVSS 9.6, Google Chrome)
- [CVE-2026-87591](https://cve.now/CVE-2026-87591.md): Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions (CVSS 6.5, Google Chrome)
- [CVE-2026-87455](https://cve.now/CVE-2026-87455.md): Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the s (CVSS 9.6, Google Chrome)
- [CVE-2026-87638](https://cve.now/CVE-2026-87638.md): Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 9.6, Google Chrome)
- [CVE-2026-87566](https://cve.now/CVE-2026-87566.md): Observable discrepancy in Layout in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a craft (CVSS 5.3, Google Chrome)
- [CVE-2026-87623](https://cve.now/CVE-2026-87623.md): Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sens (CVSS 6.5, Google Chrome)
- [CVE-2026-87528](https://cve.now/CVE-2026-87528.md): Type confusion in Rust in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code (CVSS 9.6, Google Chrome)
- [CVE-2026-87632](https://cve.now/CVE-2026-87632.md): Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-87584](https://cve.now/CVE-2026-87584.md): Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into (CVSS 6.5, Google Chrome)
- [CVE-2026-87586](https://cve.now/CVE-2026-87586.md): Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-87470](https://cve.now/CVE-2026-87470.md): Improper quantity validation in Tint in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbi (CVSS 9.6, Google Chrome)
- [CVE-2026-87529](https://cve.now/CVE-2026-87529.md): Numeric truncation error in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code ou (CVSS 9.6, Google Chrome)
- [CVE-2026-87637](https://cve.now/CVE-2026-87637.md): Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-87531](https://cve.now/CVE-2026-87531.md): Information leak in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtai (CVSS 3.1, Google Chrome)
- [CVE-2026-87435](https://cve.now/CVE-2026-87435.md): Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce (CVSS 5.3, Google Chrome)
- [CVE-2026-87510](https://cve.now/CVE-2026-87510.md): Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-87563](https://cve.now/CVE-2026-87563.md): Origin validation error in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-87468](https://cve.now/CVE-2026-87468.md): Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass site isolation via a crafted (CVSS 6.5, Google Chrome)
- [CVE-2026-87625](https://cve.now/CVE-2026-87625.md): Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary co (CVSS 8.8, Google Chrome)
- [CVE-2026-87493](https://cve.now/CVE-2026-87493.md): Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypas (CVSS 6.5, Google Chrome)
- [CVE-2026-87431](https://cve.now/CVE-2026-87431.md): Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a (CVSS 7.5, Google Chrome)
- [CVE-2026-87641](https://cve.now/CVE-2026-87641.md): Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a craft (CVSS 5.3, Google Chrome)
- [CVE-2026-87635](https://cve.now/CVE-2026-87635.md): UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML p (CVSS 5.4, Google Chrome)
- [CVE-2026-87533](https://cve.now/CVE-2026-87533.md): Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox vi (CVSS 8.1, Google Chrome)
- [CVE-2026-87644](https://cve.now/CVE-2026-87644.md): Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the ren (CVSS 8.3, Google Chrome)
- [CVE-2026-87535](https://cve.now/CVE-2026-87535.md): Information loss or omission in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to bypass system ac (CVSS 6.5, Google Chrome)
- [CVE-2026-87616](https://cve.now/CVE-2026-87616.md): Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the ren (CVSS 8.3, Google Chrome)
- [CVE-2026-87454](https://cve.now/CVE-2026-87454.md): Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive informati (CVSS 6.5, Google Chrome)
- [CVE-2026-87483](https://cve.now/CVE-2026-87483.md): Incorrect authorization in Browser in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to bypass system access r (CVSS 6.5, Google Chrome)
- [CVE-2026-87494](https://cve.now/CVE-2026-87494.md): Use after free in Browser in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to e (CVSS 9.6, Google Chrome)
- [CVE-2026-87550](https://cve.now/CVE-2026-87550.md): Improper encoding or escaping of output in CSS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially bypass web o (CVSS 4.3, Google Chrome)
- [CVE-2026-87530](https://cve.now/CVE-2026-87530.md): Uncontrolled search path element in CredentialProvider in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to exe (CVSS 8.1, Google Chrome)
- [CVE-2026-87484](https://cve.now/CVE-2026-87484.md): UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI (CVSS 5.4, Google Chrome)
- [CVE-2026-87589](https://cve.now/CVE-2026-87589.md): Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-87518](https://cve.now/CVE-2026-87518.md): Observable discrepancy in Safebrowsing in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker who had compromised the r (CVSS 5.3, Google Chrome)
- [CVE-2026-87594](https://cve.now/CVE-2026-87594.md): Incorrect authorization in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer p (CVSS 5.3, Google Chrome)
- [CVE-2026-87540](https://cve.now/CVE-2026-87540.md): Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTM (CVSS 5.4, Google Chrome)
- [CVE-2026-87622](https://cve.now/CVE-2026-87622.md): Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2026-87505](https://cve.now/CVE-2026-87505.md): Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro (CVSS 8.1, Google Chrome)
- [CVE-2026-87450](https://cve.now/CVE-2026-87450.md): Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to ob (CVSS 7.5, Google Chrome)
- [CVE-2026-87439](https://cve.now/CVE-2026-87439.md): Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process (CVSS 5.3, Google Chrome)
- [CVE-2026-87532](https://cve.now/CVE-2026-87532.md): Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrict (CVSS 6.5, Google Chrome)
- [CVE-2026-87600](https://cve.now/CVE-2026-87600.md): Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social (CVSS 6.5, Google Chrome)
- [CVE-2026-87555](https://cve.now/CVE-2026-87555.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to read memory outside the san (CVSS 4.7, Google Chrome)
- [CVE-2026-87570](https://cve.now/CVE-2026-87570.md): Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 8.8, Google Chrome)
- [CVE-2026-87451](https://cve.now/CVE-2026-87451.md): Information leak in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 3.1, Google Chrome)
- [CVE-2026-87541](https://cve.now/CVE-2026-87541.md): Information leak in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 6.5, Google Chrome)
- [CVE-2026-87495](https://cve.now/CVE-2026-87495.md): Information leak in Scroll in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to lea (CVSS 4.3, Google Chrome)
- [CVE-2026-87574](https://cve.now/CVE-2026-87574.md): Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-87458](https://cve.now/CVE-2026-87458.md): UI misrepresentation in Geometry in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI (CVSS 5.4, Google Chrome)
- [CVE-2026-87549](https://cve.now/CVE-2026-87549.md): Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sy (CVSS 6.5, Google Chrome)
- [CVE-2026-87441](https://cve.now/CVE-2026-87441.md): Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions vi (CVSS 6.5, Google Chrome)
- [CVE-2026-87496](https://cve.now/CVE-2026-87496.md): UI misrepresentation in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI (CVSS 5.4, Google Chrome)
- [CVE-2026-87567](https://cve.now/CVE-2026-87567.md): UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spo (CVSS 5.4, Google Chrome)
- [CVE-2026-87445](https://cve.now/CVE-2026-87445.md): UI misrepresentation in Session in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML pa (CVSS 5.4, Google Chrome)
- [CVE-2026-87649](https://cve.now/CVE-2026-87649.md): UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass (CVSS 5.4, Google Chrome)
- [CVE-2026-87462](https://cve.now/CVE-2026-87462.md): UI misrepresentation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI el (CVSS 5.4, Google Chrome)
- [CVE-2026-87655](https://cve.now/CVE-2026-87655.md): Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elemen (CVSS 5.4, Google Chrome)
- [CVE-2026-87486](https://cve.now/CVE-2026-87486.md): Clickjacking in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to spoof address bar via (CVSS 4.0, Google Chrome)
- [CVE-2026-87472](https://cve.now/CVE-2026-87472.md): Improper input validation in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces (CVSS 4.2, Google Chrome)
- [CVE-2026-87559](https://cve.now/CVE-2026-87559.md): UI misrepresentation in UI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI eleme (CVSS 4.2, Google Chrome)
- [CVE-2026-87507](https://cve.now/CVE-2026-87507.md): UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof U (CVSS 5.4, Google Chrome)
- [CVE-2026-87599](https://cve.now/CVE-2026-87599.md): Improper input validation in Interstitials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a craf (CVSS 5.4, Google Chrome)
- [CVE-2026-87516](https://cve.now/CVE-2026-87516.md): Observable discrepancy in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-87452](https://cve.now/CVE-2026-87452.md): Incorrect authorization in GPU in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 3.1, Google Chrome)
- [CVE-2026-87501](https://cve.now/CVE-2026-87501.md): UI misrepresentation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML (CVSS 5.4, Google Chrome)
- [CVE-2026-87548](https://cve.now/CVE-2026-87548.md): Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restriction (CVSS 4.3, Google Chrome)
- [CVE-2026-87573](https://cve.now/CVE-2026-87573.md): Improper input validation in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a cra (CVSS 4.3, Google Chrome)
- [CVE-2026-87643](https://cve.now/CVE-2026-87643.md): Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary cod (CVSS 9.6, Google Chrome)
- [CVE-2026-87508](https://cve.now/CVE-2026-87508.md): Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafte (CVSS 4.3, Google Chrome)
- [CVE-2026-87556](https://cve.now/CVE-2026-87556.md): Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via (CVSS 4.3, Google Chrome)
- [CVE-2026-87562](https://cve.now/CVE-2026-87562.md): Incorrect reference resolution in Accessibility in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially s (CVSS 5.4, Google Chrome)
- [CVE-2026-87534](https://cve.now/CVE-2026-87534.md): Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineeri (CVSS 6.5, Google Chrome)
- [CVE-2026-87648](https://cve.now/CVE-2026-87648.md): Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro (CVSS 8.3, Google Chrome)
- [CVE-2026-87539](https://cve.now/CVE-2026-87539.md): Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafte (CVSS 3.1, Google Chrome)
- [CVE-2026-87521](https://cve.now/CVE-2026-87521.md): Information leak in WebMCP in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obt (CVSS 3.1, Google Chrome)
- [CVE-2026-87560](https://cve.now/CVE-2026-87560.md): Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via (CVSS 4.3, Google Chrome)
- [CVE-2026-87432](https://cve.now/CVE-2026-87432.md): Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro (CVSS 4.2, Google Chrome)
- [CVE-2026-87513](https://cve.now/CVE-2026-87513.md): Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to (CVSS 6.5, Google Chrome)
- [CVE-2026-87479](https://cve.now/CVE-2026-87479.md): Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rend (CVSS 8.3, Google Chrome)
- [CVE-2026-87436](https://cve.now/CVE-2026-87436.md): Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web (CVSS 6.5, Google Chrome)
- [CVE-2026-87475](https://cve.now/CVE-2026-87475.md): Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass s (CVSS 6.5, Google Chrome)
- [CVE-2026-87476](https://cve.now/CVE-2026-87476.md): Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a cr (CVSS 6.5, Google Chrome)
- [CVE-2026-87576](https://cve.now/CVE-2026-87576.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the render (CVSS 3.4, Google Chrome)
- [CVE-2026-87579](https://cve.now/CVE-2026-87579.md): Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, Google Chrome)
- [CVE-2026-87497](https://cve.now/CVE-2026-87497.md): Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a c (CVSS 4.3, Google Chrome)
- [CVE-2026-87482](https://cve.now/CVE-2026-87482.md): Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to lea (CVSS 5.9, Google Chrome)
- [CVE-2026-87580](https://cve.now/CVE-2026-87580.md): Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 6.5, Google Chrome)
- [CVE-2026-87590](https://cve.now/CVE-2026-87590.md): Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive infor (CVSS 5.9, Google Chrome)
- [CVE-2026-87630](https://cve.now/CVE-2026-87630.md): Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-87443](https://cve.now/CVE-2026-87443.md): Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a craft (CVSS 6.5, Google Chrome)
- [CVE-2026-87645](https://cve.now/CVE-2026-87645.md): Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrict (CVSS 5.4, Google Chrome)
- [CVE-2026-87613](https://cve.now/CVE-2026-87613.md): Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitr (CVSS 9.0, Google Chrome)
- [CVE-2026-87449](https://cve.now/CVE-2026-87449.md): Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web (CVSS 4.3, Google Chrome)
- [CVE-2026-87577](https://cve.now/CVE-2026-87577.md): Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a pri (CVSS 4.3, Google Chrome)
- [CVE-2026-87642](https://cve.now/CVE-2026-87642.md): Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HT (CVSS 4.3, Google Chrome)
- [CVE-2026-87615](https://cve.now/CVE-2026-87615.md): Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI eleme (CVSS 5.4, Google Chrome)
- [CVE-2026-87603](https://cve.now/CVE-2026-87603.md): Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions v (CVSS 6.5, Google Chrome)
- [CVE-2026-87466](https://cve.now/CVE-2026-87466.md): Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-87582](https://cve.now/CVE-2026-87582.md): Confused deputy in DataTransfer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process t (CVSS 8.3, Google Chrome)
- [CVE-2026-87652](https://cve.now/CVE-2026-87652.md): Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces (CVSS 3.1, Google Chrome)
- [CVE-2026-87485](https://cve.now/CVE-2026-87485.md): Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process t (CVSS 3.1, Google Chrome)
- [CVE-2026-87471](https://cve.now/CVE-2026-87471.md): Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer (CVSS 8.1, Google Chrome)
- [CVE-2026-87537](https://cve.now/CVE-2026-87537.md): Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce (CVSS 8.1, Google Chrome)
- [CVE-2026-87481](https://cve.now/CVE-2026-87481.md): Incorrect authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the r (CVSS 8.3, Google Chrome)
- [CVE-2026-87503](https://cve.now/CVE-2026-87503.md): Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social (CVSS 6.5, Google Chrome)
- [CVE-2026-87457](https://cve.now/CVE-2026-87457.md): Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside t (CVSS 8.1, Google Chrome)
- [CVE-2026-87557](https://cve.now/CVE-2026-87557.md): Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the render (CVSS 4.3, Google Chrome)
- [CVE-2026-87433](https://cve.now/CVE-2026-87433.md): Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypa (CVSS 8.8, Google Chrome)
- [CVE-2026-87506](https://cve.now/CVE-2026-87506.md): Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.3, Google Chrome)
- [CVE-2026-87442](https://cve.now/CVE-2026-87442.md): Confused deputy in Prerender in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to p (CVSS 3.1, Google Chrome)
- [CVE-2026-87547](https://cve.now/CVE-2026-87547.md): Incorrect reference resolution in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering (CVSS 9.6, Google Chrome)
- [CVE-2026-87515](https://cve.now/CVE-2026-87515.md): Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass (CVSS 6.5, Google Chrome)
- [CVE-2026-87465](https://cve.now/CVE-2026-87465.md): Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc (CVSS 4.2, Google Chrome)
- [CVE-2026-87658](https://cve.now/CVE-2026-87658.md): Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cro (CVSS 4.3, Google Chrome)
- [CVE-2026-87553](https://cve.now/CVE-2026-87553.md): Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the rendere (CVSS 8.3, Google Chrome)
- [CVE-2026-87456](https://cve.now/CVE-2026-87456.md): Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process t (CVSS 3.4, Google Chrome)
- [CVE-2026-87606](https://cve.now/CVE-2026-87606.md): Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pr (CVSS 8.1, Google Chrome)
- [CVE-2026-87611](https://cve.now/CVE-2026-87611.md): Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce (CVSS 3.1, Google Chrome)
- [CVE-2026-87636](https://cve.now/CVE-2026-87636.md): Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the san (CVSS 8.8, Google Chrome)
- [CVE-2026-87588](https://cve.now/CVE-2026-87588.md): Use after free in Chromecast in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox (CVSS 8.8, Google Chrome)
- [CVE-2026-87453](https://cve.now/CVE-2026-87453.md): Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces (CVSS 5.3, Google Chrome)
- [CVE-2026-87487](https://cve.now/CVE-2026-87487.md): Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proce (CVSS 8.3, Google Chrome)
- [CVE-2026-87434](https://cve.now/CVE-2026-87434.md): Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 3.1, Google Chrome)
- [CVE-2026-87657](https://cve.now/CVE-2026-87657.md): Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memo (CVSS 3.1, Google Chrome)
- [CVE-2026-87446](https://cve.now/CVE-2026-87446.md): Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass s (CVSS 6.5, Google Chrome)
- [CVE-2026-87478](https://cve.now/CVE-2026-87478.md): Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a c (CVSS 6.5, Google Chrome)
- [CVE-2026-87491](https://cve.now/CVE-2026-87491.md): Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via (CVSS 8.8, KEV, Google Chrome)
- [CVE-2026-87640](https://cve.now/CVE-2026-87640.md): Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the render (CVSS 6.1, Google Chrome)
- [CVE-2026-87504](https://cve.now/CVE-2026-87504.md): Use after free in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary (CVSS 9.6, Google Chrome)
- [CVE-2026-87474](https://cve.now/CVE-2026-87474.md): Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-87536](https://cve.now/CVE-2026-87536.md): Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-87612](https://cve.now/CVE-2026-87612.md): Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-87480](https://cve.now/CVE-2026-87480.md): Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to pot (CVSS 8.3, Google Chrome)
- [CVE-2026-87581](https://cve.now/CVE-2026-87581.md): Use after free in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially ex (CVSS 9.6, Google Chrome)
- [CVE-2026-87558](https://cve.now/CVE-2026-87558.md): Use after free in Payments in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-87607](https://cve.now/CVE-2026-87607.md): Use after free in Device in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code o (CVSS 9.6, Google Chrome)
- [CVE-2026-87499](https://cve.now/CVE-2026-87499.md): Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces (CVSS 8.1, Google Chrome)
- [CVE-2026-87498](https://cve.now/CVE-2026-87498.md): Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 3.1, Google Chrome)
- [CVE-2026-87564](https://cve.now/CVE-2026-87564.md): Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML (CVSS 4.3, Google Chrome)
- [CVE-2026-87587](https://cve.now/CVE-2026-87587.md): Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr (CVSS 8.8, Google Chrome)
- [CVE-2026-87651](https://cve.now/CVE-2026-87651.md): Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted (CVSS 4.3, Google Chrome)
- [CVE-2026-87552](https://cve.now/CVE-2026-87552.md): Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensi (CVSS 5.5, Google Chrome)
- [CVE-2026-87639](https://cve.now/CVE-2026-87639.md): Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 8.3, Google Chrome)
- [CVE-2026-87542](https://cve.now/CVE-2026-87542.md): Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a (CVSS 8.8, Google Chrome)
- [CVE-2026-87460](https://cve.now/CVE-2026-87460.md): Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox vi (CVSS 8.8, Google Chrome)
- [CVE-2026-87572](https://cve.now/CVE-2026-87572.md): Injection in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentia (CVSS 8.3, Google Chrome)
- [CVE-2026-87500](https://cve.now/CVE-2026-87500.md): Improper validation of array index in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitra (CVSS 9.6, Google Chrome)
- [CVE-2026-87646](https://cve.now/CVE-2026-87646.md): Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-87647](https://cve.now/CVE-2026-87647.md): Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to (CVSS 3.4, Google Chrome)
- [CVE-2026-87621](https://cve.now/CVE-2026-87621.md): Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrar (CVSS 9.6, Google Chrome)
- [CVE-2026-87604](https://cve.now/CVE-2026-87604.md): Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.3, Google Chrome)
- [CVE-2026-87654](https://cve.now/CVE-2026-87654.md): Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside t (CVSS 9.6, Google Chrome)
- [CVE-2026-87596](https://cve.now/CVE-2026-87596.md): Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a craft (CVSS 4.3, Google Chrome)
- [CVE-2026-87650](https://cve.now/CVE-2026-87650.md): Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside (CVSS 9.6, Google Chrome)
- [CVE-2026-87514](https://cve.now/CVE-2026-87514.md): Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a (CVSS 8.1, Google Chrome)
- [CVE-2026-87520](https://cve.now/CVE-2026-87520.md): Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the (CVSS 9.6, Google Chrome)
- [CVE-2026-87492](https://cve.now/CVE-2026-87492.md): Incorrect authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code (CVSS 9.6, Google Chrome)
- [CVE-2026-87467](https://cve.now/CVE-2026-87467.md): Race condition in Updater in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary co (CVSS 8.1, Google Chrome)
- [CVE-2026-87554](https://cve.now/CVE-2026-87554.md): Race condition in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outsid (CVSS 8.1, Google Chrome)
- [CVE-2026-87569](https://cve.now/CVE-2026-87569.md): Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys (CVSS 8.8, Google Chrome)
- [CVE-2026-87524](https://cve.now/CVE-2026-87524.md): Use after free in Core in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc (CVSS 8.3, Google Chrome)
- [CVE-2026-87517](https://cve.now/CVE-2026-87517.md): Race condition in Mobile in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass (CVSS 3.1, Google Chrome)
- [CVE-2026-87578](https://cve.now/CVE-2026-87578.md): Use after free in Receiver in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to execute arbitrary code outside the sandbo (CVSS 8.3, Google Chrome)
- [CVE-2026-87525](https://cve.now/CVE-2026-87525.md): Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the s (CVSS 2.7, Google Chrome)
- [CVE-2026-87633](https://cve.now/CVE-2026-87633.md): Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via U (CVSS 8.6, Google Chrome)
- [CVE-2026-87440](https://cve.now/CVE-2026-87440.md): Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox v (CVSS 8.8, Google Chrome)
- [CVE-2026-87447](https://cve.now/CVE-2026-87447.md): Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass (CVSS 6.5, Google Chrome)
- [CVE-2026-87444](https://cve.now/CVE-2026-87444.md): Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox v (CVSS 8.8, Google Chrome)
- [CVE-2026-87585](https://cve.now/CVE-2026-87585.md): Double free in PDFium in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code (CVSS 8.8, Google Chrome)
- [CVE-2026-87512](https://cve.now/CVE-2026-87512.md): Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside th (CVSS 9.6, Google Chrome)
- [CVE-2026-87628](https://cve.now/CVE-2026-87628.md): Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside th (CVSS 8.3, Google Chrome)
- [CVE-2026-87527](https://cve.now/CVE-2026-87527.md): Buffer overflow in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via (CVSS 9.6, Google Chrome)
- [CVE-2026-87438](https://cve.now/CVE-2026-87438.md): Out of bounds write in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outsi (CVSS 9.6, Google Chrome)
- [CVE-2026-87488](https://cve.now/CVE-2026-87488.md): Use after free in WebGL in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside th (CVSS 9.6, Google Chrome)
- [CVE-2026-87464](https://cve.now/CVE-2026-87464.md): Use after free in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via (CVSS 9.6, Google Chrome)
- [CVE-2025-51619](https://cve.now/CVE-2025-51619.md): A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (CVSS 5.5)
- [CVE-2026-36433](https://cve.now/CVE-2026-36433.md): An issue in Actions Semiconductor Co. (CVSS 9.8)
- [CVE-2026-38998](https://cve.now/CVE-2026-38998.md): A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02. (CVSS 6.5)
- [CVE-2026-39020](https://cve.now/CVE-2026-39020.md): An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file (CVSS 5.5)
- [CVE-2026-52482](https://cve.now/CVE-2026-52482.md): An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the inetd service spa (CVSS 7.5)
- [CVE-2026-57825](https://cve.now/CVE-2026-57825.md): In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of . (CVSS 5.7, OCaml opam)
- [CVE-2026-61907](https://cve.now/CVE-2026-61907.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 4.3, cyrusimap Cyrus IMAP)
- [CVE-2026-61908](https://cve.now/CVE-2026-61908.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 3.1, cyrusimap Cyrus IMAP)
- [CVE-2026-61909](https://cve.now/CVE-2026-61909.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 3.5, cyrusimap Cyrus IMAP)
- [CVE-2026-61910](https://cve.now/CVE-2026-61910.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 3.5, cyrusimap Cyrus IMAP)
- [CVE-2026-61911](https://cve.now/CVE-2026-61911.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 4.3, cyrusimap Cyrus IMAP)
- [CVE-2026-61915](https://cve.now/CVE-2026-61915.md): An issue was discovered in Cyrus IMAP before 3.12.4. (CVSS 4.2, cyrusimap Cyrus IMAP)
- [CVE-2026-71612](https://cve.now/CVE-2026-71612.md): Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the nhntdmx\_ (CVSS 8.4)
- [CVE-2026-71613](https://cve.now/CVE-2026-71613.md): Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec\_p (CVSS 7.8)
- [CVE-2026-71614](https://cve.now/CVE-2026-71614.md): An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the src/media\_tools/dvb\_mpe.c, de (CVSS 8.4)
- [CVE-2026-71616](https://cve.now/CVE-2026-71616.md): An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf\_route\_media\_co (CVSS 6.2)
- [CVE-2026-71801](https://cve.now/CVE-2026-71801.md): An issue was discovered in s-pms SPMS-Server through v1.0. (CVSS 9.8)
- [CVE-2026-71802](https://cve.now/CVE-2026-71802.md): A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3. (CVSS 5.4)
- [CVE-2026-71803](https://cve.now/CVE-2026-71803.md): money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability. (CVSS 5.4)
- [CVE-2026-71805](https://cve.now/CVE-2026-71805.md): An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. (CVSS 9.8)
- [CVE-2026-71807](https://cve.now/CVE-2026-71807.md): In RuoYi-Cloud-Plus \<= 2.6.2 in the ruoyi-workflow module, multiple core task APIs in FlwTaskController lack permission annotations, and the (CVSS 4.3)
- [CVE-2026-71808](https://cve.now/CVE-2026-71808.md): A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands v (CVSS 8.8)
- [CVE-2026-71809](https://cve.now/CVE-2026-71809.md): Authentication Bypass via Hardcoded Master Verification Code vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote unauthenticate (CVSS 8.1)
- [CVE-2026-75307](https://cve.now/CVE-2026-75307.md): zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint. (CVSS 6.1)
- [CVE-2026-75308](https://cve.now/CVE-2026-75308.md): yshopmall \<=3.3 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2026-79322](https://cve.now/CVE-2026-79322.md): SQL injection in the RelatedProduct block in Mageplaza Blog for Magento 2 (mageplaza/magento-2-blog-extension) through 4.3.2 allows remote u (CVSS 8.6)
- [CVE-2026-79323](https://cve.now/CVE-2026-79323.md): Information disclosure in the blogComments GraphQL query in Magefan Blog GraphQL for Magento 2 (magefan/module-blog-graph-ql) through 2.2.1 (CVSS 7.5)
- [CVE-2026-79324](https://cve.now/CVE-2026-79324.md): Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote u (CVSS 7.5)
- [CVE-2026-79387](https://cve.now/CVE-2026-79387.md): SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (i (CVSS 4.3)
- [CVE-2026-79513](https://cve.now/CVE-2026-79513.md): A divide-by-zero vulnerability in the gf\_dash\_get\_timeline\_duration function (src/media\_tools/dash\_client.c) of GPAC v26.07.0 allows attacke (CVSS 6.5)
- [CVE-2026-79514](https://cve.now/CVE-2026-79514.md): An out-of-bounds read in the gf\_dm\_data\_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS (CVSS 6.5)
- [CVE-2026-79515](https://cve.now/CVE-2026-79515.md): An out-of-bounds read in the stbtt\_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS (CVSS 4.3)
- [CVE-2026-79516](https://cve.now/CVE-2026-79516.md): An out-of-bounds read in the stbsp\_vsnprintf function (stb\_sprintf.h) of nothings stb commit 31c1ad3 allows attackers to cause a Denial of S (CVSS 4.0)
- [CVE-2026-79522](https://cve.now/CVE-2026-79522.md): An out-of-bounds read in the gf\_dm\_get\_chunk\_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of S (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.