CVE-2026-78891

Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-51368

An issue in Beijing Tongtech Co., Ltd tongweb v.7.0.24 in the Spring HttpInovkerServiceExporter component allows a remote attacker to execute arbitrary code via a crafted request to the console/heimdall endpoint...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104 DB-GPT 0.8.0 Path Traversal Arbitrary File Write via Skill Upload Filename

DB-GPT builds the destination path for an uploaded skill from the multipart filename without constraining it to the upload directory. skillupload in packages/dbgpt-app/src/dbgptapp/openapi/apiv1/agenticdataapi.py takes file.filename as given and writes the request body to uploaddir / filename. A...

CVE-2026-80104

DB-GPT 0.8.0 is affected by a path traversal vulnerability in the skill_upload endpoint (in agentic_data_api.py). The function constructs the destination path using the multipart filename directly via the / operator without canonicalization or a containment check under the upload directory. An ab...

EUVD-2026-66065

Use after free in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Low...

CVE-2026-79056

A use-after-free flaw in the ServiceWorker component of Google Chrome prior to version 152.0.7977.65 allows a remote attacker to potentially execute arbitrary code outside the sandbox by delivering a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical) with a changed scope, requiring user inte...

CVE-2026-78963

Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-79097

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78913

Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-78913

Use after free in Chromoting in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via crafted network traffic. Chromium security severity: Medium...

CVE-2026-78951

A use-after-free vulnerability in the ServiceWorker component of Google Chrome prior to 152.0.7977.65 allows a remote attacker to execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML page. Chromium classifies the severity as Medium , while the NVD/CNA-assigned C...

CVE-2026-79230

Improper input validation in ANGLE in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Medium...

EUVD-2026-65875

Buffer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-78938

Type confusion in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-78938

CVE-2026-78938 is a type confusion vulnerability in the V8 JavaScript engine shipped with Google Chrome prior to version 152.0.7977.65 . A remote attacker can exploit it by delivering a crafted HTML page , requiring only user interaction (visiting the page) to execute arbitrary code inside the br...

CVE-2026-79027

CVE-2026-79027 is a use-after-free vulnerability in the WebRTC component of Google Chrome , affecting versions prior to 152.0.7977.65 . A remote attacker can exploit it by sending crafted network traffic , leading to arbitrary code execution inside the Chrome sandbox . The Chromium team rates the...

CVE-2026-78904

CVE-2026-78904 is a type confusion vulnerability in ANGLE , the graphics abstraction layer used in Google Chrome prior to 152.0.7977.65 . A remote attacker can trigger the flaw via a crafted HTML page, potentially leading to arbitrary code execution outside the browser's security sandbox . The Ch...

CVE-2026-78899

CVE-2026-78899 is a use-after-free vulnerability in the V8 JavaScript engine of Google Chrome prior to 152.0.7977.65 . The flaw arises from incorrect dynamic memory management: after a memory location is freed, the pointer is not cleared, allowing an attacker to manipulate the program. A remote a...

CVE-2026-78899

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...