378969 matches found
CVE-2026-24268
Summary: CVE-2026-24268 affects NVIDIA TensorRT. The vulnerability is a heap-based buffer overflow in TensorRT that can lead to code execution if exploited. Public descriptions in connected records confirm the issue and its impact, including a CVSS v3.1 base score of 7.8 (High) with local attack ...
CVE-2026-24238
NVIDIA TensorRT is affected by CVE-2026-24238, which involves improper validation of an array index in a TensorRT component. The vulnerability could allow code execution and is characterized by a local attack vector with user interaction required, and high impact on confidentiality, integrity, an...
CVE-2026-24227
CVE-2026-24227 affects NVIDIA TensorRT. The vulnerability arises from deserializing untrusted data, potentially enabling code execution. Impact is high (CVSS v3.1 base score 9.8). NVIDIA’s security bulletin recommends updating to TensorRT v11.0 (and Polygraphy 0.50.0) to mitigate; affected Tensor...
CVE-2026-15778
CVE-2026-15778 affects Google Chrome navigation logic prior to version 150.0.7871.125, due to insufficient validation of untrusted input in Navigation. An attacker who compromises the renderer could bypass navigation restrictions via a crafted HTML page. The issue is addressed in Chrome 150.0.787...
CVE-2026-15776
CVE-2026-15776 affects Google Chrome/V8: an inappropriate implementation in V8 allowed remote code execution inside the sandbox via a crafted HTML page before Chrome 150.0.7871.125. The issue is addressed in the Chrome Stable Channel Update, which upgrades to 150.0.7871.125 (Windows/Mac) and 150....
CVE-2026-15777
CVE-2026-15777 – Use-after-free in the Chrome UI on Linux prior to 150.0.7871.125 can allow a remote attacker to induce heap corruption by tricking a user into performing specific UI gestures on a crafted HTML page. Affected product: Google Chrome (Linux UI subsystem). Root cause: use-after-free ...
CVE-2026-15774
CVE-2026-15774 is a Use-after-free in Skia affecting Google Chrome prior to 150.0.7871.125. The issue could allow a remote attacker (with renderer access) to escape the Chrome sandbox via a crafted HTML page. Public references show a Chrome security update (Stable Channel) and list this CVE among...
CVE-2026-15773
CVE-2026-15773 is a Use-After-Free in Chrome’s Core on Windows prior to 150.0.7871.125 that could allow a remote attacker to achieve a sandbox escape via a crafted HTML page. The vulnerability affects Google Chrome Windows builds and is tracked in multiple sources. No exploitation status is provi...
CVE-2026-15775
CVE-2026-15775 affects Google Chrome's V8 under a pre-150.0.7871.125 build. The issue is an inappropriate implementation that allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. Impact is described as high in Chromium notes, with exploitation requiring user interac...
CVE-2026-15772
The CVE-2026-15772 entry describes a Use-After-Free in the GPU component of Google Chrome on Android prior to version 150.0.7871.125, which could allow a remote attacker who already compromised the renderer process to potentially escape the sandbox via a crafted HTML page. The issue is classified...
CVE-2026-15771
CVE-2026-15771 affects Google Chrome on Windows prior to 150.0.7871.125. The vulnerability arises from insufficient validation of untrusted input in the Media component, allowing a remote attacker who has compromised the renderer process to potentially read sensitive information from process memo...
CVE-2026-15768
CVE-2026-15768 affects Google Chrome’s HTML-in-Canvas: insufficient policy enforcement could allow a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is tied to Chrome prior to version 150.0.7871.125. A Chromium security advisory confirms this CVE among 15 fixes...
CVE-2026-15769
CVE-2026-15769 concerns insufficient validation of untrusted input in Linux Toolkit Theming in Google Chrome on Linux prior to 150.0.7871.125, potentially allowing a renderer-compromised remote attacker to escape the sandbox via a crafted HTML page. The Chrome update notes roll-out of 150.0.7871....
CVE-2026-15770
CVE-2026-15770 affects Google Chrome (V8) prior to 150.0.7871.125. The issue is an uninitialized use in V8 that can allow a remote attacker to read potentially sensitive data from process memory via a crafted HTML page. Impact is confined to information disclosure; no exploit details or in-the-wi...
CVE-2026-15766
CVE-2026-15766 refers to an Uninitialized Use in Skia inside Google Chrome before version 150.0.7871.125. The vulnerability affects Skia components used by Chrome, allowing a remote attacker to potentially read sensitive information from process memory via a crafted HTML page. The Chrome update n...
CVE-2026-15767
Summary of CVE-2026-15767 : A heap buffer overflow in libyuv used by Google Chrome on Windows allows remote code execution in the sandbox via a crafted video file. The issue is tied to Chrome prior to version 150.0.7871.125. In the connected advisories, Chrome’s July 2026 Stable Channel update li...
CVE-2026-15765
CVE-2026-15765 : Use-after-free in Ozone of Google Chrome prior to 150.0.7871.125. A remote attacker, tricking a user into specific UI gestures, could potentially exploit heap corruption via a crafted HTML page. The Chrome security update 150.0.7871.124/125 (Stable Channel) includes fixes for thi...
CVE-2026-15764
CVE-2026-15764 is a use-after-free in Chrome’s Ozone path on Linux, enabling potential heap corruption when a user is coerced into specific UI gestures via a crafted HTML page. Affected software is Google Chrome on Linux prior to the fixed build, with the issue classified as Critical (CVSS v3.1: ...
CVE-2026-24271
NVIDIA TensorRT-LLM’s OpenAI-compatible inference API (CVE-2026-24271) is vulnerable to unthrottled GPU resource allocation, potentially causing denial of service. The affected product is NVIDIA TensorRT-LLM; the issue stems from uncontrolled resource allocation within the inference API. The secu...
CVE-2026-47475
Summary of CVE-2026-47475 (NVIDIA TensorRT-LLM) : A vulnerability in the OpenAI-compatible inference API could allow an attacker to trigger a reachable assertion in the sampler thread, potentially causing a denial of service. The issue is scoped to NVIDIA TensorRT-LLM, with local attack vector an...
CVE-2026-47470
CVE-2026-47470 affects NVIDIA TensorRT-LLM on any platform, via a vulnerability in the gRPC server chat API endpoint. The root cause is improper input validation, exploitable by a local attacker to cause a denial of service. The NVIDIA security bulletin lists remediation by updating to TensorRT-L...
CVE-2026-48367
The CVE-2026-48367 entry concerns Adobe After Effects with an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim opens a malicious file). Affected product: After Effects. Root cause details are...
CVE-2026-48274
CVE-2026-48274 affects Adobe After Effects with an out-of-bounds write (CWE-787) that can lead to arbitrary code execution in the context of the current user. The issue requires user interaction: a victim must open a malicious file. The connected records provide the same description across CVE an...
CVE-2026-53486
The CVE affects the Node.js decompress package used for archive extraction. Before versions 10.2.1 and 11.1.3, crafted archives could read or write files outside the target directory due to: hardlink and symlink entries being created without proper target checks; path containment validated by a s...
CVE-2026-24226
NVIDIA TensorRT-LLM for Linux (CVE-2026-24226) is affected; the vulnerability is described as improper control of code generation, potentially enabling code execution, data tampering, and information disclosure. The NVIDIA security bulletin lists affected versions 0.0 to v1.3.0rc12 with an update...
CVE-2026-24259
CVE-2026-24259 affects NVIDIA TensorRT-LLM for Linux. The vulnerability is described as missing authentication for a critical function, with potential outcomes including code execution, data tampering, and information disclosure. According to the NVIDIA security update, for this CVE the remediati...
CVE-2026-53604
CVE-2026-53604 is a reserved entry with connected details indicating a vulnerability in nebula-mesh where the web path for the mobile bundle incorrectly retains the CA private key in memory. Specifically, after loading the CA key via resolver.LoadByID, CAManager.Wipe() is not invoked on return pa...
CVE-2026-24220
CVE-2026-24220 affects NVIDIA TensorRT-LLM across platforms. The vulnerability lies in the visual gen server, enabling unsafe deserialization through unauthorized ZeroMQ deserialization, which could lead to code execution. The CVSS v3.1 metrics indicate a local attack with high privileges require...
CVE-2026-24234
NVIDIA TensorRT-LLM for Linux is affected by CVE-2026-24234, a vulnerability in the multimodal media fetching functions that could allow a network-accessible attacker to trigger server-side request forgery, potentially leading to denial of service and information disclosure. The NVIDIA security b...
CVE-2026-24229
CVE-2026-24229 affects NVIDIA TensorRT-LLM for Linux, specifically the disaggregated orchestrator. The issue allows an attacker to read, write, or delete internal cluster state by sending requests to the FastAPI server, potentially enabling information disclosure, data tampering, and denial of se...
CVE-2026-48269
Premiere Pro is affected by a heap-based buffer overflow (CWE-122) that could lead to arbitrary code execution in the current user’s context. Exploitation requires user interaction: the victim must open a malicious file. The connected documents confirm this description but do not provide version-...
CVE-2026-48369
Premiere Pro is affected by an out-of-bounds write (CWE-787 ) vulnerability that can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. The connected documents do not provide details on affected versi...
CVE-2026-48270
CVE-2026-48270 affects Adobe Premiere Pro and describes an out-of-bounds write (CWE-787) that can lead to arbitrary code execution in the context of the current user. The vulnerability requires user interaction: a victim must open a malicious file. The CVSS 3.1 metrics provided indicate a low att...
CVE-2026-48308
Technical details (affected products, versions, root cause, exploit info) are not publicly provided in the supplied documents. Monitor for updates.
CVE-2026-15643
CVE-2026-15643 concerns AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) prior to 0.0.14. A server-side request forgery in the pagination handling component can be exploited by a remote authenticated user to exfiltrate AWS temporary security credentials to an attacker-controlled endpoint...
CVE-2026-48801
Linkify-it (linkify-it) prior to version 5.0.1 has an O(N^2) scan loop in LinkifyIt.prototype.match, making inputs with many fuzzy links or emails vulnerable to resource exhaustion on a request hot path that renders untrusted Markdown with linkify: true. The issue arises from re-slicing input and...
CVE-2026-47473
CVE-2026-47473 affects NVIDIA TensorRT-LLM. The vulnerability is a write-what-where condition in TensorRT-LLM components, with potential impacts including data tampering, denial of service, and information disclosure as described in multiple sources. NVIDIA’s security update table lists this CVE ...
CVE-2026-49978
CVE-2026-49978 affects DOMPurify, where IN_PLACE sanitization before version 3.4.7 could skip shadow contents inside a .content, allowing attacker-controlled markup (e.g., event handlers, JavaScript URLs, scripts) to survive during cloning and insertion of sanitized templates. The issue is fixed ...
CVE-2026-47471
NVIDIA TensorRT-LLM (any platform) is reported vulnerable to a heap-based buffer overflow in tensor deserialization (CVE-2026-47471). Affected component: TensorRT-LLM’s tensor deserialization pathway. Consequences described: information disclosure, data tampering, and denial of service. Exploitat...
CVE-2026-54628
CVE-2026-54628 (Anyquery SSRF) is referenced via connected advisories describing a Server Mode vulnerability. In Anyquery, the server binds a MySQL-compatible port and allows dynamic virtual tables using modules like json_reader or log_reader that fetch URLs via go-getter without restricting outb...
CVE-2026-49459
CVE-2026-49459 affects DOMPurify prior to 3.4.6, where IN_PLACE mode could retain event-handler attributes on an attacker‑controlled root DOM due to _isClobbered logic and incomplete removal paths. Affected component: DOMPurify.sanitize(root, { IN_PLACE: true }) with a clobbered root form. Conseq...
CVE-2026-47472
NVIDIA TensorRT-LLM contains a vulnerability in its inter-process communication layer (CVE-2026-47472). A local, same-user attacker could trigger deserialization, with potential impacts including code execution, information disclosure, data tampering, and denial of service. The NVIDIA security up...
CVE-2026-24233
NVIDIA TensorRT-LLM for Linux is affected by CVE-2026-24233, involving a vulnerability in the restricted unpickler used for model weight deserialization. A local, unauthenticated attacker could cause deserialization of untrusted data, with potential for code execution, privilege escalation, data ...
CVE-2026-47971
Media Encoder is affected by a Stack-based Buffer Overflow (CWE-121) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. The CVE entry provides no vendor-specific patch details in the connecte...
CVE-2026-48366
CVE-2026-48366 affects Media Encoder and is described as an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. The description specifies local exploitability with user interaction required (a victim must open a malicious file). Connected do...
CVE-2026-47979
Media Encoder is affected by an out-of-bounds read vulnerability (CWE-125) that could disclose sensitive memory. Exploitation requires user interaction: the victim must open a malicious file. CVSSv3.1 base score is 5.5 (Medium) with LOCAL attack vector, low complexity, no privileges required, and...
CVE-2026-47976
CVE-2026-47976 affects Media Encoder with an out-of-bounds write (CWE-787) that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim opens a malicious file). The connected documents provide the same details and do not specify af...
CVE-2026-48370
CVE-2026-48370 affects Media Encoder with an out-of-bounds write (CWE-787) that could allow arbitrary code execution in the context of the current user. Exploitation requires user interaction: the victim must open a malicious file. CVSSv3.1 base score 7.8 (High); vectors: Local, Privileges Requir...
CVE-2026-49458
DOMPurify prior to v3.4.6 had a cross-realm IN_PLACE sanitization flaw where instanceof checks across realms allowed executable markup to bypass certain branches; fixed in v3.4.6. Affected: DOMPurify.sanitize with IN_PLACE in multi-realm scenarios. Mitigation: upgrade to DOMPurify 3.4.6 or later....
CVE-2026-59889
CVE-2026-59889 affects jackson-databind. UnwrappedPropertyHandler.processUnwrapped replays buffered JSON for a @JsonUnwrapped property and may bypass @JsonView guards during deserialization, enabling writes from attacker JSON under a less-privileged active view. Fixed in 2.18.9, 2.21.5, 2.22.1, 3...