248793 matches found
CVE-2026-84324: Use After Free
Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: High...
CVE-2026-84670: Deserialization of Untrusted Data
Jenkins Performance Plugin 1015.v09ca52b3370e and earlier does not restrict the classes that can be instantiated when deserializing cached performance reports stored in the build directory on the Jenkins controller, allowing attackers with Item/Configure permission to execute arbitrary code on th...
CVE-2023-20577: Stack-based Buffer Overflow
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution...
Important: perl-DBI security update
DBI is a database access Application Programming Interface API for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used. Security Fixes: perl-DBI: perl-DBI: Hea...
SPIP analyse_resultat_skel() Code Execution
The vulnerability of the analyseresultatskel function in the SPIP content management system is related to improper handling of code generation. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
Skia Component Code Execution
The vulnerability of the Skia component in Google Chrome’s browser is related to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...
ANGLE Library Code Execution
The vulnerability of the ANGLE library in Google Chrome and Microsoft Edge relates to writing beyond the buffer limit. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox by using a specially created HTML page...
Views Component Code Execution
The vulnerability of the Views component in Google Chrome and Microsoft Edge relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow an attacker to execute arbitrary code through a specially created HTML page...
Extensions Component Code Execution
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers relates to the ability to utilize memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code within the browser’s sandbox environment using a specially...
Google Chrome Microsoft Edge Code Execution
The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a data protection mechanism breach. Exploiting this vulnerability allows an attacker to execute arbitrary code through a specially created HTML page from a remote location...
elFinder Volume Driver Code Execution
The vulnerability of the checkExtractItems method in the elFinderVolumeDriver.class.php file of the elFinder file manager allows for unlimited downloading of malicious files. Exploiting this vulnerability could enable a remote attacker to execute arbitrary code...
Workers mechanism Code Execution
The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
TOTOLINK A7000R Router Code Execution
The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A7000R router’s microprogramming system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...
CVE-2026-84452: Permissive Cross-domain Policy with Untrusted Domains
Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cliapi.py component exposes WinML CLI commands through a localhost HTTP API without authentication and configures the alloworigins setti...
Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fixes: FreeRDP: FreeRDP: Memory disclosure or denial of service via crafted RDP...
CVE-2026-84350
Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: Low...
CVE-2026-84335
A remote code execution vulnerability exists in the TabStrip component of Google Chrome (prior to 152.0.7977.75) and Microsoft Edge (Chromium-based). The root cause is incorrect authorization , which allows a remote attacker who has compromised the renderer process and used social engineering to ...
CVE-2026-84637
A flaw was found in Thunderbird. Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows systems. This bypasses Thunderbird's built-in protections for executable attachments, potentially leading to arbitrary code execution...
Deserialization of Untrusted Data
Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the machine learning component when processing trained model artifacts. An attacker can execu...
