238 matches found
EUVD-2026-50727
Use after free in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted Chrome Extension. Chromium security severity: Medium...
CVE-2026-17778
A use after free vulnerability exists in Google Chrome (prior to version 151.0.7922.72 ) within its Extensions component. This flaw allows a remote attacker to execute arbitrary code inside a sandbox by utilizing a crafted Chrome Extension. Affected versions include those shipped in Fedora 43 and...
CVE-2026-17719
Use after free in Input in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-17712
Race in Skia in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-50820
Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-17694
Google Chrome versions prior to 151.0.7922.72 are vulnerable to a use after free in the DOM component. A remote attacker can exploit this flaw by navigating a victim to a crafted HTML page to execute arbitrary code within a sandbox. This is a High severity issue (Chromium security severity). Patc...
CVE-2026-17685
Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-17661
A Use after free vulnerability exists in the Loader component of Google Chrome versions prior to 151.0.7922.72 . This flaw allows a remote attacker to execute arbitrary code inside a sandbox by visiting a crafted HTML page. This vulnerability also impacts Chromium and Microsoft Edge (which ingest...
Improper Authorization
OpenClaw is vulnerable to Improper Authorization. The vulnerability is due to insufficient enforcement of network access policies in the sandbox exec-server, allowing lower-trust callers to bypass configured restrictions and send HTTP requests to internal network resources that should be...
EUVD-2026-48441
Use after free in WebMCP in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
EUVD-2026-48442
Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-16805
Use after free in Blink in Google Chrome prior to 150.0.7871.186 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
PT-2026-64191
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 150.0.7871.186 Description A use-after-free issue exists in Blink, the rendering engine used by the browser. This flaw allows a remote attacker to execute arbitrary code within a sandbox by inducing the user to...
EUVD-2026-46128
Use after free in Cast in Google Chrome prior to 150.0.7871.128 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
CVE-2026-15776
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...
Malicious code in jsonfb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a Package [email protected] is presented as a JSON.parse bigint helper mimicking json-bigint, and re-using the real json-bigint maintainer's name in...
MAL-2026-10437 Malicious code in jsonfb (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fc07bf73ed684a1d555baa4dc6cadcd170bde4da4779ef62c0dd3f9cf02c99a Package [email protected] is presented as a JSON.parse bigint helper mimicking json-bigint, and re-using the real json-bigint maintainer's name in...
PT-2026-59148
Unauthenticated Command Execution via HTTP MCP execute module Summary The HTTP MCP endpoint POST /mcp in flyto-core accepts unauthenticated JSON-RPC tools/call requests and dispatches them to arbitrary registered modules, including sandbox.execute shell, which passes attacker-controlled input...
SUSE CVE-2026-15125
Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...