CVE-2023-43148

CVE-2023-43148 Author : Aitor Herrero Fuentes Vendor: SPA-Cart Vendor Homepage: https://spa-cart.com/ Software Link: https://demo.spa-cart.com/admin Version: 1.9.0.3 Tested on: Windows 10 Pro CSRF DELETE ALL ACCOUNT Cross Site Request Forgery vulnerability in application demo.spa-cart.com allows ...

CVE-2024-51358

CVE-2024-51358: SSRF in Heimdall application A server-side request forgery SSRF vulnerability was discovered in Heimdall version 2.6.1, specifically within the Add Application feature. This flaw allows remote attackers to perform HTTP requests. References: Heimdall GitHub repository:...

CVE-2023-31711

CVE-2023-31711 Incorrect Access Control in ZKTECO allows remote attackers to read any file via the administrative API. Installing required modules Inside the directory ZKTEco: $ pip install -r ./pyzatt/requirementsdev.txt Running the exploit Inside the directory ZKTEco: $ python exploit.py...

CVE-2026-85630

A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...

CVE-2026-87534

A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...

CVE-2026-87622

A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...

CVE-2026-87523

A flaw was found in Chromium. A race condition in the DataTransfer component allows a remote attacker, by leveraging social engineering techniques, to obtain sensitive information. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-87623

A flaw was found in Google Chrome. An observable discrepancy in the Document Object Model DOM could be exploited by a remote attacker. By leveraging social engineering techniques and a specially crafted HTML page, an attacker could obtain sensitive user information...

CVE-2026-87593

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...

CVE-2026-87445

A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to user interface UI elements being spoofed, potentially misleading users and allowing for information disclosure...

CVE-2026-87540

A flaw was found in Google Chrome. Incorrect authorization in the Isolated component allowed a remote attacker to spoof user interface UI elements. This could be achieved by enticing a user to visit a specially crafted HTML page, leading to a deceptive user experience...

CVE-2026-87599

A flaw was found in Google Chrome. Improper input validation within the Interstitials component allows a remote attacker to spoof user interface UI elements. This can be achieved by enticing a user to visit a specially crafted HTML page, potentially leading to deceptive visual information being...

CVE-2026-87431

A flaw was found in Google Chrome's Extensions. This missing authorization vulnerability allows a remote attacker to obtain sensitive information. The attacker can exploit this by persuading a user to install a specially crafted Chrome extension...

CVE-2026-87655

A flaw was found in chromium-browser. This vulnerability, known as clickjacking, allows a remote attacker to trick users into performing unintended actions by overlaying malicious content over legitimate user interface UI elements. By leveraging social engineering and a specially crafted HTML pag...

CVE-2026-87563

A flaw was found in Paint in Google Chrome. An origin validation error allows a remote attacker to obtain sensitive cross-origin data by enticing a user to visit a specially crafted HTML page. This vulnerability could lead to information disclosure...

kernel: scsi: target: iscsi: Validate CHAP_R length before base64 decode

A flaw was found in the Linux kernel's iSCSI target functionality. This vulnerability allows a remote attacker to cause a buffer overflow by sending a specially crafted Challenge-Handshake Authentication Authentication Protocol CHAP response. The system fails to validate the length of the...

CVE-2026-87597

A flaw was found in Google Chrome's CustomTabs component on Android. A remote attacker, by leveraging a co-installed application, could exploit a user interface UI misrepresentation vulnerability. This could allow the attacker to spoof the address bar, potentially deceiving users about the...

CVE-2026-87615

A flaw was found in Chromium. A race condition in the Payments component allows a remote attacker to spoof user interface UI elements. This vulnerability can be exploited by leveraging social engineering through a specially crafted HTML page, potentially misleading users...

CVE-2026-87532

A flaw was found in Google Chrome's Safebrowsing component. Improper state validation allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to system resources...

CVE-2026-87651

A flaw was found in Google Chrome's Paint component. This incorrect authorization vulnerability allows a remote attacker to obtain sensitive cross-origin data by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to information from other web origins...