CVE-2026-17655

The CVE-2026-17655 advisory affects Google Chrome’s ANGLE component, with insufficient validation of untrusted input leading to a potential sandbox escape via a crafted HTML page. The linked Chrome Stable Channel update notes that version 151.0.7922.71/72 for Windows and macOS (and 151.0.7922.71 ...

CVE-2026-17656

CVE-2026-17656 is a use-after-free vulnerability in the Ozone component of Google Chrome, affecting desktop Chrome prior to version 151.0.7922.72. The flaw could allow a remote attacker to escape the Chrome sandbox via a crafted HTML page, representing a critical risk per the advisory metrics. Th...

CVE-2026-17653

CVE-2026-17653: In Google Chrome, a use-after-free in Skia prior to 151.0.7922.72 allowed a renderer-compromised attacker to potentially escape the sandbox via a crafted HTML page. Affected component: Skia inside Chrome’s rendering stack. Root cause: use-after-free in Skia code paths used during ...

CVE-2026-17654

The CVE-2026-17654 entry concerns Google Chrome on macOS with a race in the Updater that could lead to OS-level privilege escalation via a malicious file. Root cause is a race condition in the Updater component; affected version is Chrome prior to 151.0.7922.72. The vulnerability could allow a lo...

CVE-2026-17652

CVE-2026-17652 describes a use-after-free in the Views component of Google Chrome prior to 151.0.7922.72. The issue could allow a remote attacker who has compromised the renderer process to potentially escape the Chrome sandbox via a crafted HTML page. Affected software is Google Chrome (Views/Ch...

CVE-2026-17651

CVE-2026-17651 refers to a vulnerability in Dawn within Google Chrome on Android, caused by insufficient validation of untrusted input. The issue could potentially allow a sandbox escape via a crafted HTML page. The vulnerability is labeled as Critical (CVSS 3.1: 9.6) with network attack vector a...

CVE-2026-17650

CVE-2026-17650 affects Google Chrome (Chromium-based) prior to 151.0.7922.72. Description: Use-after-free in Compositing could allow a remote attacker who has compromised the renderer process to potentially escape the sandbox via a crafted HTML page. Affected component: Compositing in Chrome. Roo...

CVE-2026-59952

Valibot has a concrete vulnerability CVE-2026-59952 in versions prior to 1.4.2 where record() can produce issue paths containing attacker-controlled Object.prototype-like keys (e.g., toString, valueOf, hasOwnProperty). When flatten() processes these issues, flatErrors.nested[dotPath] resolves to ...

CVE-2026-62946

ImageMagick (free/open-source image manipulation tool) has a CVE-2026-62946 affecting the JNX decoder on 32-bit builds. The issue is an integer overflow in the JNX decoder when processing extremely large JNX files, which can lead to a heap buffer over-write. The vulnerability affects builds prior...

CVE-2026-62363

CVE-2026-62363 concerns ImageMagick. A heap buffer over-write can occur in the fx operation when a crafted argument is passed, affecting versions prior to 7.1.2-27. The issue is documented and fixed in 7.1.2-27. Remediation: upgrade to ImageMagick 7.1.2-27 or newer. The CVSS metrics indicate loca...

CVE-2026-51295

SQLite 3.41 is vulnerable to a use-after-free in the jsonExtractFunc function, where premature release of parsed JSON object memory leads to illegal access of freed pointers. This remote flaw allows crafted SQL queries to crash the service and may leak sensitive memory information. Root cause: pr...

CVE-2025-51684

CVE-2025-51684 affects CleverTap Web SDK v1.15.1. The issue is a Cross Site Scripting (XSS) weakness where untrusted data received via window.postMessage is not sanitized before injecting into the DOM by renderCustomHtml, enabling arbitrary JavaScript execution in the hosting site context. Exploi...

CVE-2025-69934

The CVE-2025-69934 entry concerns CodeAstro Membership Management System 1.0 and has a concrete flaw: SQL Injection in /delete_members.php?id=1. The issue is tied to the delete_members.php parameter handling, with CVSS 3.1 metrics showing a Network attack vector, no privileges required, no user i...

CVE-2025-69933

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in /memberProfile.php?id=1. The CVE entry documents a SQLi vulnerability with a CVSS v3.1 base score of 9.8 (CRITICAL), attack vector NETWORK, no user interaction, and no privileges required. The vulnerability affects confi...

CVE-2025-69936

CodeAstro Membership Management System 1.0 is affected by a SQL Injection in /edit_member.php?id=1. The CVE entry has a base CVSS v3.1 score of 9.8 (CRITICAL) with network attack vector, no privileges, no user interaction required, and impacts to confidentiality, integrity, and availability. Root...

CVE-2025-69941

SourceCodester Tailor Management System 1.0 is affected by a SQL Injection in addmeasurement.php?id=1. the vulnerability arises from unsafe SQL handling in that endpoint, with CVSS v3.1 base metrics indicating a CRITICAL impact (C:High, I:High, A:High) and NETWORK attack vector. No remediation or...

CVE-2025-65341

CVE-2025-65341 affects Ecommerce Fruits Bazar 1.0 and is described as a Cross Site Scripting (XSS) vulnerability in the script admin/edit_product.php. The associated metrics show CVSS v3.1 base score 6.1 (Medium) with attack vector Network, attack complexity Low, privileges Required None, user in...

CVE-2025-65342

CVE-2025-65342 affects code-projects Blood System 1.0. The vulnerability is a Cross Site Scripting (XSS) flaw exploitable via the city field in /don.php. The description and connected sources confirm the affected product and the input vector, but do not provide details on root cause, specific pay...

CVE-2025-69931

CVE-2025-69931 affects CodeAstro Membership Management System 1.0, with a vulnerability in the delete_membership.php endpoint where the parameter id=1 is susceptible to SQL Injection. The provided documents state a SQL injection flaw but do not describe affected versions beyond 1.0 or provide rem...

CVE-2025-65336

CVE-2025-65336 affects the package/entity named “Ecommerce-project-with-php-and-mysqli-Fruits-Bazar 1.0” and is vulnerable to SQL Injection specifically in the script /show_price_by_pdtId.php. Several connected sources (NVD, CVE/CVEList, EUVD, PT-2026-66577, vulnrichment) corroborate the issue as...

CVE-2026-52539

CVE-2026-52539 affects Outstatic CMS

CVE-2025-69937

CodeAstro Membership Management System 1.0 contains an SQL Injection vulnerability in the edit_type.php endpoint via the id parameter. CVSS 3.1 base score 9.8 (CRITICAL) with Confidentiality, Integrity, and Availability impacts all High. Exploitation is network-based, requires no authentication, ...

CVE-2026-51294

CVE-2026-51294 affects SQLite 3.41, with a use-after-free vulnerability in the jsonArrayLengthFunc function (json.c). The available data specify the vulnerable component and the function but do not provide explicit exploit details, affected subcomponents, versions beyond 3.41, or concrete remedia...

CVE-2026-15679

A connected document (PT-2026-66635) documents a vulnerability in Hugging Face PyTorch Image Models related to checkpoint deserialization of untrusted data that can lead to remote code execution. The description identifies the issue as a Remote Code Execution vulnerability stemming from how check...

CVE-2026-38709

CVE-2026-38709 affects multiple devices/firmware revisions, including TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15. The vulnerability is a command injection in the net.set_wan interface , allowing...

CVE-2026-51292

CVE-2026-51292 affects SQLite 3.41, describing a use-after-free in the memory buffer processing logic. The vulnerability allows remote attackers to craft input that can lead to arbitrary code execution, information leakage, or denial of service. The available documents identify the affected produ...

CVE-2026-51293

CVE-2026-51293 is a use-after-free in SQLite 3.41. The vulnerability occurs in the jsonBlobAppendNode() function when it is invoked after sqlite3DbFree() has been called on the aBlob member of the Parse structure. Documents do not provide exploit details, affected version ranges beyond 3.41, or r...

CVE-2026-35847

CVE-2026-35847 affects dnsmgr v.2.15 and earlier. The issue allows a local attacker to execute arbitrary code via the Ping function of the CheckUils.php file, indicating a local-execution vulnerability with high impact. The provided connected documents reiterate the same description and do not su...

CVE-2025-69947

CVE-2025-69947 affects SourceCodester Tailor Management System 1.0, with a vulnerability in the PHP component customeredit.php?id=1 that allows SQL Injection. The CVSS 3.1 score is 9.8 (CRITICAL) with network attack vector, no authentication, and high impacts to confidentiality, integrity, and av...

CVE-2025-69935

The CVE-2025-69935 entry concerns CodeAstro Membership Management System 1.0, with a SQL Injection vulnerability in report.php and revenue_report.php exploitable via the fromDate parameter. The provided metrics show CVSS 3.1 base score 9.8 (CRITICAL) with network attack vector, no privileges or u...

CVE-2025-69930

CodeAstro Membership Management System 1.0 is affected by a SQL Injection vulnerability in print_membership_card.php?id=1. The associated CVE (CVE-2025-69930) has a CVSS v3.1 base score of 9.8 (CRITICAL) with network access, low attack complexity, no privileges required, and no user interaction, ...

CVE-2026-51291

CVE-2026-51291 is reflected in several connected sources as a use-after-free vulnerability in sqlite 3.41. The issue is reported in the jsonCacheInsert function of the JSON cache management module. Details across sources indicate affected product/version and the underlying flaw, but explicit impa...

CVE-2026-51290

CVE-2026-51290 entry is rejected/not used and does not represent an active vulnerability.

CVE-2025-69938

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in renew.php via the membershipType parameter. CVSS 3.1 base score 9.8 (CRITICAL) with network access, low attack complexity, no privileges, and user interaction not required. Impact is high for confidentiality, integrity, ...

CVE-2026-51272

The connected AttackerkB entry documents a vulnerability in schreibfaul1 ESP32-audioI2S 3.4.5: a heap-based buffer overflow in latinToUTF8() used for Latin-1 to UTF-8 conversion. The code determines the required buffer size by simply doubling the input length and reallocates a heap buffer without...

CVE-2026-62343

CVE-2026-62343 – ImageMagick heap buffer over-write during morphology with a user-supplied invalid kernel. Affected products/versions: ImageMagick before 6.9.13-51 and 7.0.1-0, and before 7.1.2-26. The flaw is triggered during morphology operations using a crafted kernel, leading to a heap buffer...

CVE-2026-64685

ImageMagick vulnerability CVE-2026-64685 affects the BGR decoder. In versions prior to 7.1.2-27, the BGR decoder does not check for an end-of-file in every location, which could lead to a heap buffer over-read when processing a crafted image. The issue has been fixed in version 7.1.2-27. The CVSS...

CVE-2026-53547

Technical details for CVE-2026-53547 are not publicly available in the provided documents. Monitor for updates on affected products, impact, and remediation.

CVE-2026-67595

CVE-2026-67595 affects VaahCMS versions 2.0.0–2.3.4. The vulnerability is a malicious obfuscated JavaScript payload embedded in the Blade template used to render security OTP emails, which can execute in any browser with JavaScript enabled. The payload opens a WebSocket connection to a hardcoded ...

CVE-2026-15157

undici is vulnerable to CRLF injection via a duck-typed blob-like request body’s type property when used as the Content-Type header on HTTP/1.1 dispatchers. Affected ranges: undici before 6.28.0; 7.0.0–before 7.29.0; and 8.0.0–before 8.9.0. An attacker supplying a hand-rolled blob-like body deriv...

CVE-2026-14643

undici vulnerability CVE-2026-14643 affects the cache interceptor in shared-cache mode. In undici versions 7.0.0–7.28.x and 8.0.0–8.8.x, the Cache-Control directive parser mishandles whitespace around the equals sign, causing the directive to be dropped or stored with literal quotes. This can cau...

CVE-2026-16728

Undici contains a defect in its retry interceptor: after a retry or resume of a partial response, it can assemble a body whose length differs from the Content-Length observed by the application. In affected ranges (before 6.28.0, 7.0.0–7.28.x, and 8.0.0–7.29.0 to 8.8.x), a faulty upstream may ret...

CVE-2026-67439

CVE-2026-67439 affects OliveTin prior to 3000.17.0. The StartActionAndWait and StartActionByGetAndWait endpoints in service/internal/api/api.go return full LogEntry output after execution without enforcing the logs permission, enabling a user with exec permission but logs:false to read action out...

CVE-2026-67438

OliveTin versions 3000.2.0 through 3000.17.0 expose a vulnerability where the checkShellArgumentSafety function does not treat regex: custom argument types as unsafe for Shell mode actions. This allows values that pass typeSafetyCheckRegex to be interpolated by wrapCommandInShell into an sh -c co...

CVE-2026-67437

OliveTin: The CVE-2026-67437 issue is in the OAuth2 login path (service/internal/auth/otoauth2/restapi_auth_oauth2.go) where per-login state is stored in an unbounded registeredStates map on every /oauth/login request. This can allow an unauthenticated attacker to exhaust memory and cause a denia...

CVE-2026-54249

CVE-2026-54249 affects Pydantic AI (Python agent framework) when using a Pydantic AI UI adapter (e.g., Vercel AI adapter). Versions 1.65.0–1.105.0 and 2.0.0b1–2.0.0b5 allow an attacker to reference arbitrary files in the application’s model-provider or cloud-storage account via UploadedFile refer...

CVE-2026-46678

Pydantic AI CVE-2026-46678 affects versions 1.56.0–1.98.0 where force_download='allow-local' on a URL influenced by untrusted input can bypass the cloud-metadata blocklist using IPv6 transition forms (IPv4-mapped IPv6, 6to4, NAT64, NAT64/isatap variants). The issue is mitigated by upgrading to 1....

CVE-2026-13308

CVE-2026-13308 affects Autel MaxiCharger AC Elite Home EV chargers. The flaw lies in the handling of WebSocket messages for the OCPP service, caused by insufficient validation of user-supplied data that can trigger an integer underflow before buffer allocation. This can allow an attacker to execu...

CVE-2026-13307

CVE-2026-13307 affects Autel MaxiCharger AC Elite Home EV chargers. The vulnerability is a heap-based buffer overflow in the handling of custom USB packets, caused by insufficient validation of the length of user-supplied data before copying to a fixed-length heap buffer. This can enable a physic...

CVE-2026-13309

Affected product : Autel MaxiCharger AC Elite Home NFC interface. Vulnerability : stack-based buffer overflow in NFC card response handling that can lead to arbitrary code execution . Impact : attacker with physical access can execute code on the device, with full control in its context; benefits...