41119 matches found
CVE-2026-110149
A use after free vulnerability exists in the Browser component of Google Chrome prior to version 155.0.8059.79 . A remote attacker could exploit this flaw by interacting with a crafted HTML page to achieve arbitrary code execution outside the sandbox. This issue has a Critical security severity. ...
CVE-2026-110136
Google Chrome versions prior to 155.0.8059.79 are vulnerable to a Use after free flaw in the PDF component . This critical vulnerability allows a remote attacker to execute arbitrary code outside the sandbox by navigating to a crafted HTML page . Remediation is available in version 155.0.8059.79 ...
CVE-2026-110149
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-110149
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-110136
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-110136
Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-110149
Use after free in Browser in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...
CVE-2026-77816 IBM WebSphere Application Server Liberty Improper Certificate Validation
IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacker could exploit this vulnerability to obtain sensitive information...
CVE-2026-77816
The IBM WebSphere Application Server - Liberty administrative client (versions 17.0.0.3 through 26.0.0.9 ) is vulnerable to a man-in-the-middle attack due to Improper Certificate Validation (CWE-295). An attacker could exploit this flaw to obtain sensitive information. This vulnerability also aff...
CVE-2026-63158 Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...
CVE-2026-63158 Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies
Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAPLOG/AGORAPPASS cookie mechanism treating the...
CVE-2026-88195
A buffer over-read vulnerability in Microsoft Office Excel allows an unauthorized attacker to disclose sensitive information over a network. The vulnerability is associated with CWE-126 (Buffer Over-read) and CWE-191 (Integer Underflow). The impact is categorized as high confidentiality with a CV...
CVE-2026-88201
A buffer over-read vulnerability in Microsoft Office Excel allows an unauthorized attacker to disclose sensitive information over a network. This vulnerability impacts the confidentiality of data within the victim's context. Microsoft has released official updates to address this issue; users are...
CVE-2026-79611
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the gues...
CVE-2026-79611
The Xen hypervisor is vulnerable to a VMEntry failure caused by logic introduced in XSA-308 . The issue occurs when a specific combination of states is met: #DB is intercepted, Single Stepping is active, and it is blocked by STI/MovSS . Additionally, a special sub-case exists when branch tracing ...
CVE-2026-79611 VMX: VMentry failure with branch tracing and blocked states
For XSA-308 logic was introduced, as VMX VMEntry checks do not like the exact combination of state which occurs when DB in intercepted, Single Stepping is active, and blocked by STI/MovSS is active, despite this being a legitimate state to be in. The resulting VMEntry failure is fatal to the gues...
CVE-2026-102250
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the affected software. This flaw could allow an attacker to upload modified firmware when an authorized administrator initiates a firmware update procedure. Successful exploitation could result in an attacker gainin...
DEBIAN-CVE-2026-109953
FreeRDP 3.0.0 before 3.32.0 contains an insufficiently protected credentials vulnerability where the /restricted-admin option fails to suppress CredSSP credential delegation, sending the cleartext password to the RDP server. A compromised or man-in-the-middle destination host can decode...
DEBIAN-CVE-2026-109952
The FreeRDP client 3.0.0 before 3.32.0 does not check a server-selected PROTOCOLRDSTLS or PROTOCOLHYBRIDEX against its enabled protocol set in negoprocessnegotiationresponse, allowing a security protocol downgrade. A malicious server or man-in-the-middle can select RDSTLS to override /sec:nla...
