CVE-2026-95302

A flaw was found in chromium-browser. An incorrect authorization issue within the WebAPK Web Android Package implementation allows a local attacker to bypass security boundaries using a co-installed application. A malicious application installed on the same device can exploit this vulnerability t...

CVE-2026-95302

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

CVE-2026-95358

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...

CVE-2026-95316

Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a local program. Chromium security severity: Low...

CVE-2026-95328

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...

EUVD-2026-89167

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...

EUVD-2026-89121

Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. Chromium security severity: Medium...

CVE-2026-95302

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

CVE-2026-95302

Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin data via a co-installed app. Chromium security severity: Medium...

CVE-2026-95298

A use-after-free vulnerability exists in the browser process of Google Chrome (and Chromium ) prior to version 154.0.8037.57 . This flaw occurs because memory is improperly accessed after being released, allowing a local attacker to potentially execute arbitrary code outside the security sandbox ...

CVE-2026-102437 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in DeepSeek-Reasonix

OS Command Injection in internal/gitcmd git diff filter.clean/smudge invocation in esengine DeepSeek-Reasonix Reasonix Studio allows a local attacker who controls repository content .gitattributes + .git/config to execute arbitrary commands via the desktop app's workspace-changes diff viewer...

CVE-2026-95298: Use After Free

Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sandbox via UI Interaction. Chromium security severity: High...

CVE-2026-95358: Incorrect Authorization

Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app. Chromium security severity: Medium...

CVE-2026-95328: Unintended Proxy or Intermediary

Confused deputy in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. Chromium security severity: Low...

CVE-2023-43871-WBCE-Arbitrary-File-Upload--XSS---Media

WBCE XSS при загрузке файлов - WBCE v1.6.1 Автор: Sergio Описание: Уязвимость загрузки файлов в WBCE v.1.6.1 позволяет локальному злоумышленнику загрузить PDF-файл со скрытым XSS. Векторы атаки: Уязвимость в санитизации загрузки медиафайлов позволяет загрузить PDF-файл со скрытым XSS. POC: После...

CVE-2023-43341-Evolution-Reflected-XSS---Installation-Connection-

Evolution CMS: отражённый XSS v3.2.3 Автор: Sergio Описание: Отражённая уязвимость межсайтового скриптинга XSS в процессе подключения при установке Evolution v.3.2.3 позволяет локальному злоумышленнику выполнять произвольные веб-сценарии с помощью специально сформированного пейлоада, внедряемого ...

kernel: perf/core: Detach event groups during remove_on_exec

A flaw was found in the Linux kernel's performance monitoring unit PMU subsystem. This vulnerability occurs when a performance event group leader is removed during process execution, but its associated events siblings remain active and linked to a stale list. This inconsistent state can lead to a...

CVE-2023-43354-CMSmadesimple-Stored-XSS---MicroTIny-extension

CMSmadesimple Хранимая XSS v2.2.18 Автор: Sergio Описание: Уязвимость межсайтового скриптинга XSS в CMSmadesimple v.2.2.18 позволяет локальному злоумышленнику выполнить произвольный код с помощью специально созданного скрипта в профилях в разделе Extensions - MicroTiny WYSIWYG editor. Векторы...

CVE-2023-44761_ConcreteCMS-Stored-XSS---Forms

ConcreteCMS Stored XSS v.9.2.1 Auteur: Sergio Description: De multiples vulnérabilités Cross Site Scripting dans ConcreteCMS v.9.2.1 permettent à un attaquant local d'exécuter du code arbitraire via un script spécialement conçu dans les formulaires des objets de données. Vecteurs d'attaque:...

CVE-2023-43357-CMSmadesimple-Stored-XSS---Shortcut

CMSmadesimple XSS stockée v2.2.18 Auteur : Sergio Description : Vulnérabilité de Cross Site Scripting dans CMSmadesimple v.2.2.18 permet à un attaquant local d'exécuter du code arbitraire via un script malveillant dans le champ Titre de la section My Preferences - Manage Shortcuts Vecteurs...