CVE-2026-84700

PikiwiDB (Pika) v3.5.7 exposes an internal protobuf replication server on a port derived from the client port plus 2000 (e.g., 11221 for the default 9221) that lacks authentication for non-MetaSync messages. The root cause is that the frame dispatcher (DealMessage ) does not require a completed o...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...

CVE-2026-84699

Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow, allowing unauthenticated attackers to reset local account passwords and authenticate as those users, resulting in unauthorized access. The vulnerability is rated CVSS 3.1...

CVE-2026-84697

Mailpit (open-source mail testing tool) contains a Server-Side Request Forgery (SSRF) vulnerability in its IsInternalIP deny list function (file: internal/tools/net.go). The deny list fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IPv6 prefix , all...

CVE-2026-84698

PX4 Autopilot is affected by a heap buffer overflow in the sd_bench command. The command writes a four-byte block number into a user-supplied sized allocation; invoking it with a block size below four bytes overflows the buffer, potentially allowing arbitrary code execution or a system crash . Th...

CVE-2026-84696

Phison PS3111-S11 controller firmware, in versions through SBFQT1.3 , exposes privileged vendor unique commands (VUC) over the ATA interface with absent or defeatable authentication. Attackers with local access can bypass a weak CRC-16 based unlock handshake or target builds lacking a VUC lock en...

CVE-2026-84695

BookStack versions before 26.05.4 are affected by a stored cross-site scripting (XSS) vulnerability in the drawing upload endpoint , which accepts unvalidated base64 content and stores it without content inspection. Attackers holding editor permissions can upload SVG files containing scripts that...

CVE-2026-84694

Coolify versions before 4.2.0 are affected by a remote code execution vulnerability caused by improper escaping of environment variable key names in Docker commands executed over SSH on managed servers. An authenticated attacker can inject shell metacharacters into environment variable keys, allo...

CVE-2026-84427

CVE-2026-84427 affects zhayujie CowAgent versions up to 2.1.7 . The vulnerability resides in the Bash Tool component, specifically in the file agent/tools/bash/bash.py. The root-cause function is not precisely identified in the CVE description, though a linked GitHub report title references an ou...

CVE-2026-84425

zhayujie CowAgent (versions up to 2.1.3) is vulnerable to a remote denial of service in the BrowserTool function within agent/tools/browser/browser_tool.py (the Browser Tool component). An attacker with low privileges can trigger the DoS remotely with low complexity and no user interaction. A pro...

CVE-2026-84921

This CVE has been reserved but no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates when the candidate is officially publicized.

CVE-2026-84920

CVE-2026-84920 has been reserved by an organization or individual, with no technical details publicly available yet. Monitor for updates when the candidate is publicized.

CVE-2026-16648

CVE-2026-16648 has been reserved but no technical details are yet publicly available in the provided documents. The affected product, root cause, and impact remain unknown. Action: monitor for updates when the candidate is publicized.

CVE-2026-84924

CVE-2026-84924 has been reserved by an organization or individual and no technical details (affected product, root cause, or impact) are publicly available yet. Monitor for updates as the candidate is expected to be publicized with full details.

CVE-2026-84918

CVE-2026-84918 has been reserved but no technical details are yet publicly available. The vulnerability type, affected products, and impact remain unknown. Monitor for updates once the assigning organization publicizes the entry.

CVE-2026-84916

The description for CVE-2026-84916 is currently a reserved placeholder with no public technical details provided. No connected documents offer additional information. Monitor for updates when the candidate is publicized.

CVE-2026-84914

CVE-2026-84914 is currently a reserved candidate with no public technical details. The description indicates it will be filled in when the security issue is officially announced. Monitor for updates as details become available.

CVE-2026-81163

CVE-2026-81163 is a reserved candidate with no public technical details yet. The affected product, vulnerability type, and impact remain undisclosed. Action: monitor for updates once the reserving organization publicizes the entry.

CVE-2026-84910

CVE-2026-84910 is currently in reserved status with no public technical details available. The vulnerability type, affected products, and impact are not yet disclosed. Monitor for future updates when the assignee publishes the full description.

CVE-2024-26225

CVE-2024-26225 is currently reserved with no public technical details available in the provided documents. Monitor for future updates when the candidate is officially publicized with full disclosure.

CVE-2026-84919

This CVE entry is currently reserved and no technical details are publicly available in the provided documents. Affected products, root cause, and impact remain unspecified. Monitor for updates once the candidate is publicized.

CVE-2024-35585

Oxford Nanopore MinKNOW , a sequencing software used in nanopore-based genomic analysis, is vulnerable to weak authentication in versions before 24.06 . The application relies on a client's source IP address as its authentication mechanism, meaning an attacker who can spoof or originate traffic f...

CVE-2025-23029

CVE-2025-23029 is currently in reserved status with no public technical details about the affected product, root cause, or impact. Monitor for updates as the reserving organization publicizes the vulnerability.

CVE-2025-46418

Westermo WeOS 5 (version 5.24 and later), an operating system deployed in industrial settings, is vulnerable to OS command injection through unsafe handling of media definitions . An attacker with administrative privileges can execute commands beyond their typical access rights, potentially compr...

CVE-2026-84915

This CVE is currently reserved as a placeholder with no public technical details available regarding the affected product, root cause, or impact. Monitor for updates when the candidate is formally publicized.

CVE-2026-84923

CVE-2026-84923 has been reserved but no technical details are yet publicly available in the provided documents. Affected products, root cause, and impact remain unknown. Monitor for updates as the reserving organization publishes details.

CVE-2026-84913

This CVE is currently reserved with no public technical details available in the provided documents. The vulnerability description, affected products, and impact remain unknown. Monitor for updates as details are expected once the vendor publicizes the issue.

CVE-2026-77522

CVE-2026-77522 is currently a reserved candidate with no public technical details yet. Affected product, root cause, and impact remain unknown. Monitor for updates when the reserving organization publicizes the vulnerability.

CVE-2026-84911

CVE-2026-84911 has been reserved by an organization or individual and no technical details are yet publicly available. Monitor for updates when the candidate is publicized.

CVE-2026-84917

CVE-2026-84917 is currently in a reserved state. No technical details about affected products, root cause, or impact are publicly available in the provided documents. Monitor for updates once the candidate is publicized.

CVE-2026-84912

CVE-2026-84912 has been reserved but no public technical details are currently available. Monitor for updates when the vendor announces the vulnerability and releases associated patch information.

CVE-2026-84356

CVE-2026-84356 is a UI misrepresentation flaw in the FullScreen component of Google Chrome prior to version 152.0.7977.75 . A remote attacker could deliver a crafted HTML page that spoofs the address bar , allowing the victim to be tricked into believing they are on a different site. Chromium rat...

CVE-2026-84331

CVE-2026-84331 is an incorrect authorization flaw in the Actor component of Google Chrome prior to version 152.0.7977.75 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass the web origin policy . Chromium rates the severity as Low ; t...

CVE-2026-84350

CVE-2026-84350 is a use-after-free in the TabStrip component of Google Chrome prior to 152.0.7977.75 . A remote attacker leveraging social engineering can trigger the flaw via UI interaction to execute arbitrary code outside the browser sandbox. Chromium rates the severity as Low , while the assi...

CVE-2026-84335

CVE-2026-84335 is an incorrect authorization vulnerability in the TabStrip component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a cra...

CVE-2026-84334

CVE-2026-84334 is an incorrect authorization vulnerability in the Chromoting component of Google Chrome on Windows , prior to version 152.0.7977.75 . A local attacker can exploit it to execute arbitrary code outside the Chrome sandbox via a local program. The flaw was reported by Google on 2026-0...

CVE-2026-84348

CVE-2026-84348 is an information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 (Linux) and 152.0.7977.75/.76 (Windows/Mac). A remote attacker can potentially leak sensitive information via a crafted HTML page . Chromium rates this as Medium severity; CVSS 3.1 base score is 6.5 (AV:...

CVE-2026-84327

CVE-2026-84327 is an incorrect authorization flaw in the Autofill component of Google Chrome on Android , affecting versions prior to 152.0.7977.75 . A remote attacker can leverage social engineering to obtain sensitive information via a crafted HTML page. Chromium rates the severity as Low , whi...

CVE-2026-84329

A confused deputy vulnerability in the CredentialProvider component of Google Chrome on Windows (prior to 152.0.7977.75 ) allowed a remote attacker who had already compromised the renderer process to leak sensitive information via a crafted HTML page. Chromium rates the severity as Low ; the CVSS...

CVE-2026-84323

CVE-2026-84323 is a missing authorization flaw in the FileSystem component of Google Chrome prior to 152.0.7977.75 (and 152.0.7977.76 on Windows/Mac). A remote attacker who had already compromised the renderer process could leverage social engineering to obtain sensitive information via a crafted...

CVE-2026-84355

CVE-2026-84355 is an incorrect authorization vulnerability in the Navigation component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process could leverage a crafted HTML page to bypass the web origin policy . The Chromium project rates this ...

CVE-2026-84332

CVE-2026-84332 is an incorrect authorization flaw in the SiteSettings component of Google Chrome prior to 152.0.7977.75 . A remote attacker can bypass system access restrictions by delivering a crafted HTML page to the victim, requiring user interaction. The CVSS v3.1 score is 6.5 (Medium) with a...

CVE-2026-84358

CVE-2026-84358 is a Medium -severity improper privilege management flaw in the Downloads component of Google Chrome prior to 152.0.7977.75 . A remote attacker who had already compromised the renderer process could use a crafted HTML page to spoof the address bar , potentially misleading users int...

CVE-2026-84330

CVE-2026-84330 is a UI misrepresentation vulnerability in Google Chrome on Android prior to version 152.0.7977.75 , affecting the FullScreen component. A remote attacker can spoof the address bar via a crafted HTML page, requiring user interaction. The CVSS 3.1 score is 5.4 (Medium) with a vector...

CVE-2026-84328

CVE-2026-84328 is a missing authorization vulnerability in the FileSystem component of Google Chrome prior to version 152.0.7977.75 . A remote attacker with a compromised renderer process could leverage a crafted HTML page to bypass the web origin policy . The vulnerability was reported by Google...

CVE-2026-84333

CVE-2026-84333 is a use-after-free vulnerability in Dawn , a graphics abstraction component of Google Chrome , affecting versions prior to 152.0.7977.75 on Android (and 152.0.7977.76 on Windows/Mac). A remote attacker can execute arbitrary code outside the sandbox by serving a crafted HTML page, ...

CVE-2026-84326

CVE-2026-84326 is a High-severity uninitialized resource vulnerability in the V8 JavaScript engine of Google Chrome, fixed in version 152.0.7977.75 . A remote attacker can execute arbitrary code inside the sandbox by convincing a user to visit a crafted HTML page. The CVSS 3.1 score is 8.8 (AV:N/...

CVE-2026-84351

CVE-2026-84351 is a buffer overflow in the GPU component of Google Chrome on Windows prior to 152.0.7977.75 . A remote attacker who had compromised the renderer process could exploit it via a crafted HTML page to execute arbitrary code outside the sandbox . The vulnerability was rated High by Chr...

CVE-2026-84325

CVE-2026-84325 is an improper input validation vulnerability in the DataTransfer component of Google Chrome prior to 152.0.7977.75 . A remote attacker leveraging social engineering can bypass system access restrictions via a co-installed app. Chromium rates this as High severity; the CNA-assigned...

CVE-2026-84347

CVE-2026-84347 is a use after free vulnerability in the WebRTC component of Google Chrome prior to 152.0.7977.75 . A remote attacker can exploit it via a crafted HTML page to execute arbitrary code inside the Chrome sandbox . The vulnerability carries a CVSS 3.1 score of 8.8 (High) with user inte...