1049796 matches found
CVE-2026-121170: Google Chrome: Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web…
Improper resource control in WebCodecs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121251: Google Chrome: Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…
Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-118444: Bitdefender pybddisasm: Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during…
Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The nddecode function may read up to 15 bytes without checking the actual length of the supplied Python buffer. The nddecodeex, nddecodeex2, and nddecodewithconte...
CVE-2026-118445: Bitdefender pybddisasm: A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects
A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are exposed through Python objects that reference memory owned by the parent INSTRUX object. A retained reference to a member does not keep the parent allocation...
CVE-2026-118448: Bitdefender pybddisasm: A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text
A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects ndtotext. If the underlying text conversion fails, including failures caused by invalid parameters, the output buffer may remain uninitialized while still being converted into a Python return value. This may...
CVE-2026-120551: aresit WP Compress – Instant Performance & Speed Optimization: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass…
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for...
CVE-2026-120518: kalengi BuddyPress XProfile Custom Image Field: The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up…
The BuddyPress XProfile Image Field plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 3.1.0. This is due to bpxpimagefieldupdateonuseractivation calling unlink on a path built from visitor-supplied signup metadata with no realpath resolution, no...
CVE-2026-120558: zorem Advanced Shipment Tracking for WooCommerce: The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the…
The Advanced Shipment Tracking for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the trackingprovider parameter of the POST /wp-json/wc-ast/v3/orders/ /shipment-trackings REST endpoint in all versions up to, and including, 3.9. This is due to insufficient escaping on the...
CVE-2026-121040: Google Chrome: Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…
Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121069: Google Chrome: Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121096: Google Chrome: Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local…
Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. Chromium security severity: Medium...
CVE-2026-120955: MongoDB C Driver: The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain…
The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this...
CVE-2026-121020: AxxonSoft Axxon One: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200) in the security configuration API in AxxonSoft…
Exposure of Sensitive Information to an Unauthorized Actor CWE-200 in the security configuration API in AxxonSoft Axxon One before 3.2.0 on Windows and Linux allows a remote authenticated user with limited privileges to enumerate all user accounts and roles configured in the system via the user...
CVE-2026-120953: MongoDB Atlas SQL JDBC Driver: A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver
A URI redirection weakness exists in the authentication component of the Atlas SQL JDBC Driver. During an interactive sign-in flow the driver accepts endpoint addresses supplied by the remote endpoint it is pointed at without validating their scheme, and passes the resulting address to the local...
CVE-2026-120971: Red Hat: A flaw was found in RESTEasy's default exception mapper
A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can...
CVE-2026-121021: AxxonSoft Axxon One: Plaintext Storage of a Password (CWE-256) in the SecurityManager shared configuration in AxxonSoft Axxon One before…
Plaintext Storage of a Password CWE-256 in the SecurityManager shared configuration in AxxonSoft Axxon One before 3.1.0 on Windows and Linux allows a local attacker with read access to the configuration directory or to configuration backups to obtain the password of the LDAP directory service...
CVE-2026-120956: MongoDB C Driver: The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query…
The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application...
CVE-2026-103653: Qt: An out-of-bounds read vulnerability in the Qt CoAP message parsing (QCoapInternalReply::createFromFrame()) of the Qt…
An out-of-bounds read vulnerability in the Qt CoAP message parsing QCoapInternalReply::createFromFrame of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash loss of availability or to continue operating on incorrect data potential loss of...
CVE-2026-121501: mathurvishal CloudClassroom-PHP-Project: A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project
A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project. The affected element is the function sessionregenerateid of the file loginlinkadmin.php. Executing a manipulation of the argument PHPSESSID can lead to session fixiation. The attack can be launched remotely. The exploit ha...
CVE-2026-116667: Tanium Discover: Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover...