CVE-2026-85042

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70706

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70707

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70708

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85042

A use-after-free vulnerability in DevTools within Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code outside the sandbox by serving a crafted HTML page. Chromium rates this as High severity; CVSS 3.1 scores it 9.6 (Critical) with a Changed Scope, reflecting sa...

CVE-2026-85045

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85053

Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85050

CVE-2026-85050 is an out-of-bounds write in the WebGL component of Google Chrome on Android , affecting versions prior to 152.0.7977.82 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code outside the sandbox , yielding a CVSS 3.1 score of 9.6 (CRITICAL) with scope...

CVE-2026-85050

Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85045

Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85042

Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85046

A type confusion in the V8 JavaScript engine in Google Chrome prior to 152.0.7977.82 allows a remote attacker to execute arbitrary code inside the browser sandbox by enticing a user to visit a crafted HTML page. The vulnerability was reported by Salvatore Gulizia (Serotav) on 2026-08-04 and is ra...

CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-70702

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-85046

Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

cve-2024-56348

JetBrains TeamCity 認証バイパス + RCE CVE-2024-56348 PoC 📜 説明 CVE-2024-56348 は、JetBrains TeamCity オンプレミス における重大な認証バイパスの脆弱性であり、2024.12 より前のすべてのバージョンに影響します。REST API は ;.jsp を含むパスへのリクエストを不適切に処理し、認証されていない攻撃者が完全に認証されたかのように任意の REST エンドポイントを呼び出すことを可能にします。 このエクスプロイトは、バイパスを TeamCity 自身の REST API...

EUVD-2026-62599

Orval: RCE via OpenAPI path - unescaped request-URL template literal backtick breakout...

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

Summary Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL /users/... without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key functi...

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

Summary When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers0.url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation...