CVE-2026-24268

Summary: CVE-2026-24268 affects NVIDIA TensorRT. The vulnerability is a heap-based buffer overflow in TensorRT that can lead to code execution if exploited. Public descriptions in connected records confirm the issue and its impact, including a CVSS v3.1 base score of 7.8 (High) with local attack ...

CVE-2026-24238

NVIDIA TensorRT is affected by CVE-2026-24238, which involves improper validation of an array index in a TensorRT component. The vulnerability could allow code execution and is characterized by a local attack vector with user interaction required, and high impact on confidentiality, integrity, an...

CVE-2026-24227

CVE-2026-24227 affects NVIDIA TensorRT. The vulnerability arises from deserializing untrusted data, potentially enabling code execution. Impact is high (CVSS v3.1 base score 9.8). NVIDIA’s security bulletin recommends updating to TensorRT v11.0 (and Polygraphy 0.50.0) to mitigate; affected Tensor...

CVE-2026-15778

CVE-2026-15778 affects Google Chrome navigation logic prior to version 150.0.7871.125, due to insufficient validation of untrusted input in Navigation. An attacker who compromises the renderer could bypass navigation restrictions via a crafted HTML page. The issue is addressed in Chrome 150.0.787...

CVE-2026-15776

CVE-2026-15776 affects Google Chrome/V8: an inappropriate implementation in V8 allowed remote code execution inside the sandbox via a crafted HTML page before Chrome 150.0.7871.125. The issue is addressed in the Chrome Stable Channel Update, which upgrades to 150.0.7871.125 (Windows/Mac) and 150....

CVE-2026-15777

CVE-2026-15777 – Use-after-free in the Chrome UI on Linux prior to 150.0.7871.125 can allow a remote attacker to induce heap corruption by tricking a user into performing specific UI gestures on a crafted HTML page. Affected product: Google Chrome (Linux UI subsystem). Root cause: use-after-free ...

CVE-2026-15774

CVE-2026-15774 is a Use-after-free in Skia affecting Google Chrome prior to 150.0.7871.125. The issue could allow a remote attacker (with renderer access) to escape the Chrome sandbox via a crafted HTML page. Public references show a Chrome security update (Stable Channel) and list this CVE among...

CVE-2026-15773

CVE-2026-15773 is a Use-After-Free in Chrome’s Core on Windows prior to 150.0.7871.125 that could allow a remote attacker to achieve a sandbox escape via a crafted HTML page. The vulnerability affects Google Chrome Windows builds and is tracked in multiple sources. No exploitation status is provi...

CVE-2026-15775

CVE-2026-15775 affects Google Chrome's V8 under a pre-150.0.7871.125 build. The issue is an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact is described as high in Chromium notes, with exploitation requiring user interac...

CVE-2026-15772

The CVE-2026-15772 entry describes a Use-After-Free in the GPU component of Google Chrome on Android prior to version 150.0.7871.125, which could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is classified...

CVE-2026-15771

CVE-2026-15771 affects Google Chrome on Windows prior to 150.0.7871.125. The vulnerability arises from insufficient validation of untrusted input in the Media component, allowing a remote attacker who has compromised the renderer process to potentially read sensitive information from process memo...

CVE-2026-15768

CVE-2026-15768 affects Google Chrome’s HTML-in-Canvas: insufficient policy enforcement could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is tied to Chrome prior to version 150.0.7871.125. A Chromium security advisory confirms this CVE among 15 fixes...

CVE-2026-15769

CVE-2026-15769 concerns insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125, potentially allowing a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. The Chrome update notes roll-out of 150.0.7871....

CVE-2026-15770

CVE-2026-15770 affects Google Chrome (V8) prior to 150.0.7871.125. The issue is an uninitialized use in V8 that can allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Impact is confined to information disclosure; no exploit details or in-the-wi...

CVE-2026-15766

CVE-2026-15766 refers to an Uninitialized Use in Skia inside Google Chrome before version 150.0.7871.125. The vulnerability affects Skia components used by Chrome, allowing a remote attacker to potentially read sensitive information from process memory via a crafted HTML page. The Chrome update n...

CVE-2026-15767

Summary of CVE-2026-15767 : A heap buffer overflow in libyuv used by Google Chrome on Windows allows remote code execution in the sandbox via a crafted video file. The issue is tied to Chrome prior to version 150.0.7871.125. In the connected advisories, Chrome’s July 2026 Stable Channel update li...

CVE-2026-15765

CVE-2026-15765 : Use-after-free in Ozone of Google Chrome prior to 150.0.7871.125. A remote attacker, tricking a user into specific UI gestures, could potentially exploit heap corruption via a crafted HTML page. The Chrome security update 150.0.7871.124/125 (Stable Channel) includes fixes for thi...

CVE-2026-15764

CVE-2026-15764 is a use-after-free in Chrome’s Ozone path on Linux, enabling potential heap corruption when a user is coerced into specific UI gestures via a crafted HTML page. Affected software is Google Chrome on Linux prior to the fixed build, with the issue classified as Critical (CVSS v3.1: ...

CVE-2026-24271

NVIDIA TensorRT-LLM’s OpenAI-compatible inference API (CVE-2026-24271) is vulnerable to unthrottled GPU resource allocation, potentially causing denial of service. The affected product is NVIDIA TensorRT-LLM; the issue stems from uncontrolled resource allocation within the inference API. The secu...

CVE-2026-47475

Summary of CVE-2026-47475 (NVIDIA TensorRT-LLM) : A vulnerability in the OpenAI-compatible inference API could allow an attacker to trigger a reachable assertion in the sampler thread, potentially causing a denial of service. The issue is scoped to NVIDIA TensorRT-LLM, with local attack vector an...

CVE-2026-47470

CVE-2026-47470 affects NVIDIA TensorRT-LLM on any platform, via a vulnerability in the gRPC server chat API endpoint. The root cause is improper input validation, exploitable by a local attacker to cause a denial of service. The NVIDIA security bulletin lists remediation by updating to TensorRT-L...

CVE-2026-48367

The CVE-2026-48367 entry concerns Adobe After Effects with an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim opens a malicious file). Affected product: After Effects. Root cause details are...

CVE-2026-48274

CVE-2026-48274 affects Adobe After Effects with an out-of-bounds write (CWE-787) that can lead to arbitrary code execution in the context of the current user. The issue requires user interaction: a victim must open a malicious file. The connected records provide the same description across CVE an...

CVE-2026-53486

The CVE affects the Node.js decompress package used for archive extraction. Before versions 10.2.1 and 11.1.3, crafted archives could read or write files outside the target directory due to: hardlink and symlink entries being created without proper target checks; path containment validated by a s...

CVE-2026-24226

NVIDIA TensorRT-LLM for Linux (CVE-2026-24226) is affected; the vulnerability is described as improper control of code generation, potentially enabling code execution, data tampering, and information disclosure. The NVIDIA security bulletin lists affected versions 0.0 to v1.3.0rc12 with an update...

CVE-2026-24259

CVE-2026-24259 affects NVIDIA TensorRT-LLM for Linux. The vulnerability is described as missing authentication for a critical function, with potential outcomes including code execution, data tampering, and information disclosure. According to the NVIDIA security update, for this CVE the remediati...

CVE-2026-53604

CVE-2026-53604 is a reserved entry with connected details indicating a vulnerability in nebula-mesh where the web path for the mobile bundle incorrectly retains the CA private key in memory. Specifically, after loading the CA key via resolver.LoadByID, CAManager.Wipe() is not invoked on return pa...

CVE-2026-24220

CVE-2026-24220 affects NVIDIA TensorRT-LLM across platforms. The vulnerability lies in the visual gen server, enabling unsafe deserialization through unauthorized ZeroMQ deserialization, which could lead to code execution. The CVSS v3.1 metrics indicate a local attack with high privileges require...

CVE-2026-24234

NVIDIA TensorRT-LLM for Linux is affected by CVE-2026-24234, a vulnerability in the multimodal media fetching functions that could allow a network-accessible attacker to trigger server-side request forgery, potentially leading to denial of service and information disclosure. The NVIDIA security b...

CVE-2026-24229

CVE-2026-24229 affects NVIDIA TensorRT-LLM for Linux, specifically the disaggregated orchestrator. The issue allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server, potentially enabling information disclosure, data tampering, and denial of se...

CVE-2026-48269

Premiere Pro is affected by a heap-based buffer overflow (CWE-122) that could lead to arbitrary code execution in the current user’s context. Exploitation requires user interaction: the victim must open a malicious file. The connected documents confirm this description but do not provide version-...

CVE-2026-48369

Premiere Pro is affected by an out-of-bounds write (CWE-787 ) vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. The connected documents do not provide details on affected versi...

CVE-2026-48270

CVE-2026-48270 affects Adobe Premiere Pro and describes an out-of-bounds write (CWE-787) that can lead to arbitrary code execution in the context of the current user. The vulnerability requires user interaction: a victim must open a malicious file. The CVSS 3.1 metrics provided indicate a low att...

CVE-2026-48308

Technical details (affected products, versions, root cause, exploit info) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-15643

CVE-2026-15643 concerns AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) prior to 0.0.14. A server-side request forgery in the pagination handling component can be exploited by a remote authenticated user to exfiltrate AWS temporary security credentials to an attacker-controlled endpoint...

CVE-2026-48801

Linkify-it (linkify-it) prior to version 5.0.1 has an O(N^2) scan loop in LinkifyIt.prototype.match, making inputs with many fuzzy links or emails vulnerable to resource exhaustion on a request hot path that renders untrusted Markdown with linkify: true. The issue arises from re-slicing input and...

CVE-2026-47473

CVE-2026-47473 affects NVIDIA TensorRT-LLM. The vulnerability is a write-what-where condition in TensorRT-LLM components, with potential impacts including data tampering, denial of service, and information disclosure as described in multiple sources. NVIDIA’s security update table lists this CVE ...

CVE-2026-49978

CVE-2026-49978 affects DOMPurify, where IN_PLACE sanitization before version 3.4.7 could skip shadow contents inside a .content, allowing attacker-controlled markup (e.g., event handlers, JavaScript URLs, scripts) to survive during cloning and insertion of sanitized templates. The issue is fixed ...

CVE-2026-47471

NVIDIA TensorRT-LLM (any platform) is reported vulnerable to a heap-based buffer overflow in tensor deserialization (CVE-2026-47471). Affected component: TensorRT-LLM’s tensor deserialization pathway. Consequences described: information disclosure, data tampering, and denial of service. Exploitat...

CVE-2026-54628

CVE-2026-54628 (Anyquery SSRF) is referenced via connected advisories describing a Server Mode vulnerability. In Anyquery, the server binds a MySQL-compatible port and allows dynamic virtual tables using modules like json_reader or log_reader that fetch URLs via go-getter without restricting outb...

CVE-2026-49459

CVE-2026-49459 affects DOMPurify prior to 3.4.6, where IN_PLACE mode could retain event-handler attributes on an attacker‑controlled root DOM due to _isClobbered logic and incomplete removal paths. Affected component: DOMPurify.sanitize(root, { IN_PLACE: true }) with a clobbered root form. Conseq...

CVE-2026-47472

NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer (CVE-2026-47472). A local, same-user attacker could trigger deserialization, with potential impacts including code execution, information disclosure, data tampering, and denial of service. The NVIDIA security up...

CVE-2026-24233

NVIDIA TensorRT-LLM for Linux is affected by CVE-2026-24233, involving a vulnerability in the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker could cause deserialization of untrusted data, with potential for code execution, privilege escalation, data ...

CVE-2026-47971

Media Encoder is affected by a Stack-based Buffer Overflow (CWE-121) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. The CVE entry provides no vendor-specific patch details in the connecte...

CVE-2026-48366

CVE-2026-48366 affects Media Encoder and is described as an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. The description specifies local exploitability with user interaction required (a victim must open a malicious file). Connected do...

CVE-2026-47979

Media Encoder is affected by an out-of-bounds read vulnerability (CWE-125) that could disclose sensitive memory. Exploitation requires user interaction: the victim must open a malicious file. CVSSv3.1 base score is 5.5 (Medium) with LOCAL attack vector, low complexity, no privileges required, and...

CVE-2026-47976

CVE-2026-47976 affects Media Encoder with an out-of-bounds write (CWE-787) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim opens a malicious file). The connected documents provide the same details and do not specify af...

CVE-2026-48370

CVE-2026-48370 affects Media Encoder with an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. CVSSv3.1 base score 7.8 (High); vectors: Local, Privileges Requir...

CVE-2026-49458

DOMPurify prior to v3.4.6 had a cross-realm IN_PLACE sanitization flaw where instanceof checks across realms allowed executable markup to bypass certain branches; fixed in v3.4.6. Affected: DOMPurify.sanitize with IN_PLACE in multi-realm scenarios. Mitigation: upgrade to DOMPurify 3.4.6 or later....

CVE-2026-59889

CVE-2026-59889 affects jackson-databind. UnwrappedPropertyHandler.processUnwrapped replays buffered JSON for a @JsonUnwrapped property and may bypass @JsonView guards during deserialization, enabling writes from attacker JSON under a less-privileged active view. Fixed in 2.18.9, 2.21.5, 2.22.1, 3...