CVE-2026-19146

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-19159

Use after free in Views in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-19174

Integer overflow in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-19163

Summary (CVE-2026-19163) : A use-after-free in Media in Google Chrome on Windows prior to version 151.0.7922.109 could allow a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The vulnerability affects the Chrome release pri...

CVE-2026-19162

Out of bounds write in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-19160

CVE-2026-19160 concerns an uninitialized use in Skia within Google Chrome before version 151.0.7922.109 . The issue allowed a remote attacker who had already compromised the renderer process to leak cross-origin data via a crafted HTML page. Connected documents confirm the vulnerability is tied t...

CVE-2026-19161

Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. Chromium security severity: High...

CVE-2026-19158

Use after free in Views in Google Chrome on Windows prior to 151.0.7922.109 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2026-19148

CVE-2026-19148: Out-of-bounds write in the GPU component of Google Chrome on Linux prior to 151.0.7922.109 can allow a remote attacker who compromises the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software: Google Chrome (Linux). Root cause: GPU-r...

CVE-2026-19146

Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

CVE-2026-19145

Use after free in Translate in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-19140

Use after free in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: High...

CVE-2026-19138

CVE-2026-19138 (Google Chrome) : A heap buffer overflow in the CrashReporting component allows a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page, affecting Chrome builds prior to 151.0.7922.109. The Chrome update notes indicate th...

CVE-2026-19168

Inappropriate implementation in V8 in Google Chrome prior to 151.0.7922.109 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity: High...

EUVD-2026-53866

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...

CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter

OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...

CVE-2026-14192

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

EUVD-2026-52653

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

CVE-2026-34495

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

EUVD-2026-51589

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...