CVE-2026-87450

A flaw was found in Google Chrome. This incorrect authorization vulnerability in Permissions allows a remote attacker, by leveraging social engineering and a crafted Chrome extension, to obtain sensitive information. This could lead to the unauthorized disclosure of user data...

CVE-2026-87539

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. Chromium security severity: Medium...

CVE-2021-2471

CVE-2021-2471 - XXE en MySQL Connector/J Vulnerabilidad en el producto MySQL Connectors de Oracle MySQL componente: Connector/J. Las versiones compatibles afectadas son 8.0.26 y anteriores. Los ataques exitosos de esta vulnerabilidad pueden resultar en acceso no autorizado a datos críticos o acce...

CVE-2026-63039

CVE-2026-63039 — Apache InLong AuditAlertRule ORDER BY SQL injection Runnable proof-of-concept reproducer for the SQL injection in Apache InLong's audit-alert-rule query. The InLong manager mapper AuditAlertRuleEntityMapper.selectByCondition filters with safe MyBatis parameters, but sorts with $...

PoC-CVE-2024-44349

PoC-CVE-2024-44349 Vulnerabilidad encontrada y probada en Anteeo WMS - v4.7.31 La vulnerabilidad permite a los actores de amenazas elaborar un comando SQL dentro del parámetro de nombre de usuario y divulgar datos en la base de datos subyacente. Las versiones afectadas de ANTEEO B2B WMS son desde...

PT-2026-86325

🚨 CVE-2026-19858 The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving request-derived data during page rendering, allowing unauthenticated users to read arbitrary user, post and term properties and metadata, includin...

CVE-2026-84504

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84504

A flaw was found in fastify. An authenticated low-privilege caller can exploit a vulnerability where the framework incorrectly processes the result of an Ajv asynchronous async validator. If a request body contains a root-level property named 'value', fastify replaces the entire request body with...

CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

CVE-2026-84504

fastify versions before 5.12.2 are vulnerable to a request body replacement flaw caused by an Ajv async validator result collision. When a request that passes its route schema contains a root-level property named value, fastify treats that property as the value result protocol used by custom vali...

CVE-2026-84504 fastify vulnerable to request body replacement via an async validation result collision

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

EUVD-2026-70984

fastify versions before 5.12.2 treat the object resolved by a successful Ajv async validator as the value result protocol used by custom validator compilers. If a request that passes its route schema contains a property named value at the root, fastify replaces the entire request body with that...

GHSA-V6J9-JH3Q-JQQ6 vulnerabilities

Vulnerabilities for packages: chromium...

CVE-2026-71622

CVE-2026-71622 is a SQL injection vulnerability in the User.php component of Zhao-github APiAdmin v.5.0.1 , allowing a remote attacker to obtain sensitive information. The CVSS 3.1 score is 7.4 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, indicating no privileges are required but ...

CVE-2026-85090

A flaw was found in FreeRDP. A heap out-of-bounds read vulnerability exists in the generalChromaV1ToYUV444 function during AVC444 chroma plane reconstruction. A remote attacker, acting as a malicious Remote Desktop Protocol RDP server, can exploit this by sending a specially crafted...

PT-2026-85205

Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoi...

ManageEngine PAM360 < Build 8561 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine PAM360 application running on the remote host is prior to build 8561. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious query to execu...

ManageEngine Access Manager Plus < Build 4405 SQLi (CVE-2026-14828)

According to its self-reported build number, the ManageEngine Access Manager Plus application running on the remote host is prior to build 4405. It is, therefore, affected by an authenticated SQL injection vulnerability. An authenticated, remote attacker can exploit this by crafting a malicious...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...

CVE-2025-15481 Notification Bar for WordPress <= 1.1.8 – Unauthenticated Subscriber Data Disclosure

The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber emails...