1049798 matches found
CVE-2026-116664: Tanium Discover: Tanium addressed an improper access controls vulnerability in Discover.
Tanium addressed an improper access controls vulnerability in Discover...
CVE-2026-111752: angular: Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and…
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for...
CVE-2026-115298: Elastic Elasticsearch: Incorrect Authorization (CWE-863) in Elasticsearch can lead to information disclosure via Accessing Functionality Not…
Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...
CVE-2026-119495: WebberZone Better Search: Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured…
Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2...
CVE-2026-119509: eranfl ClickCease Click Fraud Protection: Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection…
Missing Authorization vulnerability in eranfl ClickCease Click Fraud Protection clickcease-click-fraud-protection allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ClickCease Click Fraud Protection: from n/a through 3.3.0...
CVE-2026-119636: Devolutions Server: Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server…
Improper release of expired privileged access checkouts in the PAM scheduled check-in task in Devolutions Server 2025.3.2.0 through 2026.2.22.0 allows an authenticated user with checkout rights on a PAM account to retain access to that account on the target system after the checkout expires via a...
CVE-2026-120331: TYPO3 Extension "Mail": Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the…
Content of external URL mails, their stylesheets and images to embed is fetched by the server without validating the target host. Backend users with access to the mail module can make the server send requests to hosts in the internal network...
CVE-2026-120333: TYPO3 Extension "Frontend User Registration": The actions linked in the emails of the extension (e.g
The actions linked in the emails of the extension e.g. to confirm a registration or the deletion of an account do not reject requests with a missing or invalid hash. Instead, the frontend user given in the request is used. Unauthenticated attackers can therefore perform these actions for arbitrar...
CVE-2026-121112: Google Chrome: Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised…
Out of bounds read in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-121115: Google Chrome: Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass…
Improper input validation in Shopping in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions into a privileged page via crafted network traffic. Chromium security severity: Medium...
CVE-2026-121070: Google Chrome: Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121198: Google Chrome: Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121204: Google Chrome: Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin…
Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121205: Google Chrome: Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. Chromium security severity: Low...
CVE-2026-121190: Google Chrome: UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social…
UI misrepresentation in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted Chrome extension. Chromium security severity: Low...
CVE-2026-121186: Google Chrome: UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker…
UI misrepresentation in Passwords in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-121214: Google Chrome: Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute…
Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-120575: tigroumeow Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…
The Photo Engine Media Organizer & Lightroom plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hierarchy.name' parameter in all versions up to, and including, 6.5.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-121044: Google Chrome: Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code…
Use after free in Layout in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-121033: Google Chrome: Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had…
Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. Chromium security severity: Medium...