CVE-2026-102315

Google Chrome on Windows versions prior to 154.0.8037.92 is affected by an uninitialized resource vulnerability in the Media component. This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by interacting with a crafted HTML page . ...

CVE-2026-102310

Google Chrome versions prior to 154.0.8037.92 are vulnerable to a missing authorization flaw in the Payments component . A remote attacker who has already compromised the renderer process can bypass the web origin policy by serving a crafted HTML page to the victim. This vulnerability was address...

CVE-2026-102318

Google Chrome contains an out of bounds read flaw in the WebGL component, affecting versions prior to 154.0.8037.92 . A remote attacker can exploit this vulnerability by hosting a crafted HTML page to read memory outside the sandbox. The chromium security severity for this issue is rated as High ...

CVE-2026-102308

A Use after free vulnerability in the Views component of Google Chrome versions prior to 154.0.8037.92 allows a remote attacker to execute arbitrary code outside the sandbox. The attack can be initiated by leveraging social engineering to lead a user to a crafted HTML page . Exploitation details ...

CVE-2026-102329

A Cross-site scripting (XSS) vulnerability exists in the WebUI of Google Chrome prior to version 154.0.8037.92 . This flaw allows a remote attacker to bypass the web origin policy to access a privileged page by navigating the user to a crafted HTML page . No specific exploit code or in-the-wild e...

CVE-2026-102301

Google Chrome versions prior to 154.0.8037.92 are vulnerable to an out of bounds write flaw in the GPU component . This vulnerability allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox by using a crafted HTML page. N...

CVE-2026-102324

Google Chrome versions prior to 154.0.8037.92 are vulnerable to a Use after free flaw in the PictureInPicture component. A remote attacker who has already compromised the renderer process can exploit this vulnerability via a crafted HTML page to potentially execute arbitrary code outside the sand...

CVE-2026-102319

Google Chrome versions prior to 154.0.8037.92 are affected by a vulnerability involving an uninitialized resource in the GPU . This flaw allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox by using a crafted HTML page. The impact is charact...

CVE-2026-102304

A use-after-free vulnerability in the Passwords component of Google Chrome (versions prior to 154.0.8037.92) allows a remote attacker to execute arbitrary code outside the sandbox . This can be triggered by a victim viewing a crafted HTML page . No specific exploit details or proof-of-concept lin...

CVE-2026-102328

A type confusion vulnerability exists in the V8 engine within Google Chrome versions prior to 154.0.8037.92 . A remote attacker can exploit this flaw by hosting a crafted HTML page to achieve arbitrary code execution inside the browser sandbox. No specific exploit links or remediation steps are p...

CVE-2026-102316

Google Chrome is vulnerable to a use-after-free issue in the Views framework, affecting versions prior to 154.0.8037.92 . A remote attacker can exploit this vulnerability by leveraging social engineering to trick a user into visiting a crafted HTML page , potentially allowing for arbitrary code e...

CVE-2026-102325

A vulnerability in the Skia graphics library within Google Chrome (prior to version 154.0.8037.92 ) allows a remote attacker to obtain cross-origin data . This issue is triggered by a crafted HTML page and involves an uninitialized resource . While the vulnerability is classified with high securi...

CVE-2026-102309

A use after free vulnerability exists in the FullScreen component of Google Chrome prior to version 154.0.8037.92 . A remote attacker can exploit this flaw by using a crafted HTML page to achieve arbitrary code execution outside the sandbox. While specific exploit details are not provided, the vu...

CVE-2026-102326

A type confusion vulnerability exists in the V8 JavaScript engine of Google Chrome (prior to version 154.0.8037.92 ). A remote attacker can exploit this flaw by convincing a user to open a specially crafted HTML page , potentially leading to arbitrary code execution inside the browser sandbox. Re...

CVE-2026-102323

A type confusion flaw in the V8 component of the Google Chrome browser allows a remote attacker to execute arbitrary code inside the sandbox. This vulnerability can be triggered via a crafted HTML page . The issue affects versions prior to 154.0.8037.92 . Remediation is available in the stable ch...

CVE-2026-102311

A vulnerability exists in the GPU component of Google Chrome on Android prior to version 154.0.8037.92 . The root cause is an uninitialized resource flaw, which allows a remote attacker who has already compromised the renderer process to read memory outside the sandbox using a crafted HTML page ....

CVE-2026-102307

Google Chrome on Android versions prior to 154.0.8037.92 is vulnerable to an uninitialized resource flaw in the Dawn component. A remote attacker can exploit this by providing a crafted HTML page to read memory outside the sandbox. No specific exploitation details or remediation steps are provide...

CVE-2026-102303

Google Chrome on Android versions prior to 154.0.8037.92 is vulnerable to an uninitialized resource in the GPU . This flaw allows a remote attacker to obtain cross-origin data by interacting with a crafted HTML page. The Chromium security severity for this issue is High . No specific exploit deta...

CVE-2026-102300

A vulnerability in the WebGPU component of Google Chrome (prior to version 154.0.8037.92 ) stems from an uninitialized resource flaw. This condition allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page . No specific exploit links or alternative...

CVE-2026-102306

A use-after-free vulnerability exists in the Bluetooth component of Google Chrome prior to version 154.0.8037.92 . A remote attacker could exploit this by enticing a user to visit a specially crafted HTML page , triggering the application to access deallocated memory. This could potentially allow...

CVE-2026-102312

A UI misrepresentation flaw exists in the Omnibox component of Google Chrome on Android prior to version 154.0.8037.92 . This vulnerability allows a remote attacker to spoof the address bar by presenting a crafted HTML page to the user. The Chromium security severity for this issue is rated as Hi...

CVE-2026-102299

A type confusion flaw was identified in the V8 component of Google Chrome prior to version 154.0.8037.92 . This vulnerability could allow a remote attacker to execute arbitrary code inside the sandbox by viewing a crafted HTML page . Remediation is available in Chrome version 154.0.8037.92 for Wi...

CVE-2026-102313

Google Chrome on Windows versions prior to 154.0.8037.92 is vulnerable to an uninitialized resource flaw in the ANGLE (Almost Native Graphics Layer Engine) component. A remote attacker can exploit this vulnerability by tricking a user into opening a crafted HTML page , which could allow the attac...

CVE-2026-102331

A buffer overflow vulnerability in the ANGLE component of Google Chrome on Android (prior to version 154.0.8037.92 ) allows a remote attacker to potentially execute arbitrary code outside the sandbox . The attack can be initiated through a crafted HTML page . Exploitation details are not provided...

CVE-2026-102317

Google Chrome on Windows versions prior to 154.0.8037.92 is affected by an improper privilege management vulnerability within the Mojo inter-process communication (IPC) framework. A local attacker can exploit this flaw by running a crafted local program to bypass the browser's sandbox security bo...

CVE-2026-100295

In Anjvision YSSD‑RTMP‑H5 firmware version 3.3.2.4 , an undocumented pathway exists that can enable an internal debug interface . This interface exposes functions not intended for normal operation, which could lead to elevated system access . No specific remediation or exploit details are provide...

CVE-2026-53989

Dockhand versions prior to 1.0.36 are vulnerable to an open redirect in the OIDC initiation endpoint. This flaw allows unauthenticated remote attackers to inject an unvalidated redirect query parameter, forcing authenticated users to navigate to attacker-controlled sites. By targeting the OIDC ca...

CVE-2026-102252

A path traversal vulnerability (CWE-22) exists in the embedded VMDK filesystem extractor within Google OSV-SCALIBR versions 0.3.6 through 0.5.0 . The root cause is insufficient validation of archive path entries , which enables an attacker controlling the scan target to extract files outside of t...

CVE-2026-18533

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to improper input validation (CWE-94: Code Injection) in a Kubernetes operator template . The root cause is an unsanitised container image configuration , which could allow an attacker to execute arbitrary code. ...

CVE-2026-18513

The IBM Maximo Application Suite - Location Service for Esri Component (versions 9.0 , 9.1 , and 9.2 ) is vulnerable to improper access control (CWE-269). The root cause is a schema-less Custom Resource Definition , which allows for potential privilege escalation. Impact includes a CVSS Base scor...

CVE-2026-18529

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to command injection (CVE-2026-18529) due to improper sanitization of a user-controlled value passed to a shell command within a Kubernetes operator task . This vulnerability is associated with CWE-78 . Affected ...

CVE-2026-18517

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to unintended network egress due to a misconfigured Kubernetes NetworkPolicy (CVE-2026-18517 ). This flaw allows for unauthorized outbound network connections, impacting the security of the environment. The vulne...

CVE-2026-18537

The IBM Maximo Application Suite - Location Service for Esri Component is vulnerable to CVE-2026-18537 due to improper input validation involving an unsanitised container image reference within a Kubernetes operator template . This vulnerability (CWE-94) could allow for code injection. Affected v...

CVE-2026-100294

The Anjvision YSSD‑RTMP‑H5 firmware, specifically version 3.3.2.4 , contains hardcoded cloud‑API credentials that are shared across all deployed devices. An attacker who obtains the public firmware package can extract these credentials to interact with the cloud service in unauthorized ways. No s...

CVE-2026-100293

Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 contains a vulnerability in its local and cloud update mechanisms. The system applies new firmware without cryptographic verification , relying solely on basic hashing. This allows an attacker with network access to the update routine to inject and ...

CVE-2026-100292

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , an authenticated request can enable a hidden debug interface . This interface allows additional commands to be sent to a backend service, potentially exposing system-level functionality . If crafted inputs reach the underlying command handler, ...

CVE-2026-100291

In Anjvision YSSD-RTMP-H5 firmware version 3.3.2.4 , several ONVIF service endpoints fail to enforce required authentication when processing management requests. This vulnerability allows an unauthorized attacker to access sensitive device operations. No specific exploit details or remediation in...

CVE-2026-96274

The Baicells Nova 430H is vulnerable to a denial-of-service (DoS) condition where an unauthenticated device within radio range can send a malformed uplink message during connection setup. The flaw exists because the eNodeB fails to properly validate an invalid NAS payload , leading it to forward ...

CVE-2026-76738

A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On . This flaw allows an authenticated attacker with administrative privileges to cause a denial of service (DoS) by interrupting the normal operation of the affected service. While the service is impacted, it is...

CVE-2026-76737

A path traversal vulnerability exists in the command line interface of HPE Networking Instant On . This authenticated vulnerability allows an attacker with administrative access to modify a limited set of files on the underlying operating system and interrupt the normal operation of the affected ...

CVE-2026-76736

A buffer overflow vulnerability exists in the underlying operating system of HPE Networking Instant On . A low-privilege authenticated local attacker could successfully exploit this flaw to interrupt the normal operation of the affected service, leading to a Denial-of-Service (DoS). No specific e...

CVE-2026-76735

A sensitive information disclosure vulnerability exists in the underlying operating system of HPE Networking Instant On . An authenticated local attacker with high privileges could exploit this flaw to retrieve sensitive information, provided specific external preconditions are met. This data cou...

CVE-2026-76734

A memory corruption vulnerability exists in the affected interface of HPE Networking Instant On . This flaw could allow an unauthenticated remote attacker to perform a denial of service (DoS) attack, potentially interrupting normal service operations and accessing limited information within the a...

CVE-2026-76733

A denial-of-service vulnerability exists in the API endpoint of HPE Networking Instant On . An authenticated attacker with administrative privileges can exploit this flaw to interrupt the normal operation of the affected service. The service is designed to resume operation automatically without m...

CVE-2026-76732

A local privilege-escalation vulnerability exists in a daemon of HPE Networking Instant ON . If successful, a local attacker could achieve arbitrary code execution with root privileges , provided that certain preconditions outside of the attacker's control are met. No specific exploit details or ...

CVE-2026-76731

An authentication bypass vulnerability exists in the captive portal of HPE Networking Instant On . This flaw could allow an unauthenticated remote attacker to circumvent existing authentication controls. If successfully exploited, the attacker could gain limited access to some data and perform li...

CVE-2026-76730

An authentication bypass vulnerability exists in the PAPI protocol of HPE Networking Instant ON APs due to improper packet handling. This flaw allows an unauthenticated adjacent attacker to circumvent existing authentication controls and send unauthorized network traffic to the target device. Spe...

CVE-2026-76729

A format string vulnerability exists in the API endpoint of HPE Networking Instant ON APs . An authenticated remote attacker with high privileges can provide modified input to cause memory corruption . This could lead to a denial-of-service (DoS) condition or remote code execution (RCE) within th...

CVE-2026-76728

A vulnerability exists in the API endpoint of HPE Networking Instant ON APs , where an authenticated remote attacker with high privileges can perform a server-side request forgery (SSRF) attack. Successful exploitation may enable the attacker to execute arbitrary commands as a privileged user on ...

CVE-2026-76727

HPE Networking Instant ON is affected by authenticated command injection vulnerabilities. These vulnerabilities exist in the affected interface and can be leveraged by an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow the attac...