CVE-2026-5292

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-5282

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: High...

CVE-2026-5288

Use after free in WebView in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-5286

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-5286

The provided documents describe CVE-2026-5286 as a memory-use-after-free in Chrome’s Dawn component, exploitable via crafted HTML pages to achieve remote code execution. Affected software: Google Chrome (Dawn component) with vulnerable Dawn paths in Chromium prior to version 146.0.7680.178. Root ...

CVE-2026-5284

Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-5283

Inappropriate implementation in ANGLE in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-5282

Out of bounds read in WebCodecs in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: High...

CVE-2026-5280

CVE-2026-5280 affects Google Chrome’s WebCodecs component. A use-after-free in WebCodecs prior to 146.0.7680.178 allows a remote attacker to run arbitrary code in the sandbox via a crafted HTML page. The issue is acknowledged across multiple advisories (Chromium/Chrome updates and trackers). The ...

CVE-2026-5279

Object corruption in V8 in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-5277

Integer overflow in ANGLE in Google Chrome on Windows prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

CVE-2026-5278

Use after free in Web MIDI in Google Chrome on Android prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page. Chromium security severity: High...

CVE-2026-35056

XenForo before 2.3.9 and before 2.2.18 allows remote code execution RCE by authenticated, but malicious, admin users. An attacker with admin panel access can execute arbitrary code on the server...

CVE-2026-35055

XenForo is vulnerable to cross-site scripting (XSS) via lightbox usage in posts in versions before 2.3.9 and before 2.2.18. An attacker can inject scripts that execute when users interact with post content displayed in the lightbox. The issue is reported across multiple sources (including CVE-202...

CVE-2026-35054 XenForo Stored Cross-Site Scripting via BB Code Rendering

XenForo before 2.3.9 is vulnerable to stored cross-site scripting XSS related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content...

CVE-2025-71281

XenForo before 2.3.7 contains a template method-call restriction bypass. The issue stems from a loose prefix match instead of a strict first-word match for methods accessible via callbacks and variable method calls in templates, potentially allowing unauthorized method invocations. Affected softw...

CVE-2024-58342

XenForo Open Redirect (CVE-2024-58342): Affected: XenForo pre-2.2.17 and pre-2.3.1. Root cause: the getDynamicRedirect() path does not adequately validate the redirect target, allowing an open redirect via specially crafted URLs (including newlines, user credentials, or host mismatches). Impact: ...

Nothing OS 安全漏洞

Nothing OS is an operating system developed by Nothing Corporation. Versions of Nothing OS prior to 2.30 contained a security vulnerability. This vulnerability stemmed from a flaw in the stbimage.h library’s GIF decoding component, specifically the function stbigifloadnext, which could lead to...

VulnCheck KEV: CVE-2026-27971

Qwik is a performance focused javascript framework. qwik =1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ RPC mechanism that allows any unauthenticated user to execute arbitrary code on the server with a single HTTP request. Affects any deployment where...

Lakeside SysTrack Agent 安全漏洞

Lakeside SysTrack Agent is a proxy component developed by Lakeside Corporation in the United States, used for collecting performance data from terminal devices and user experience metrics. Versions of Lakeside SysTrack Agent prior to 11.5.0.15 contained security vulnerabilities. These...