CVE-2026-94282

A flaw was found in libXi. A malicious or compromised X server can trigger a client-side Denial of Service DoS or limited information disclosure by sending crafted event messages. When processing X Input Extension XI2 enter, leave, or focus events, the library does not validate that the reported...

CVE-2026-67242

A flaw was found in rabbitmq-server. When configured to use OAuth 2.0 authentication, the server does not properly validate token expiration timestamps that are represented as floating-point numbers. A remote attacker with an expired token can exploit this issue to bypass expiration checks, gaini...

CVE-2026-67241

A flaw was found in rabbitmq-server. This vulnerability allows an authenticated user to bypass access controls and perform unauthorized message routing. When an exchange is declared via the Advanced Message Queuing Protocol AMQP 1.0 management interface, the application fails to verify write...

CVE-2026-59313

A flaw was found in the Spring MVC functional web framework. This vulnerability allows for stream corruption when applications use Server-Sent Events SSE, a technology for pushing real-time updates from a server to a client. This could lead to unreliable data delivery and impact the integrity of...

CVE-2026-59278

A flaw was found in Spring for Apache Kafka. The JsonKafkaHeaderMapper and DefaultKafkaHeaderMapper components, which are used by default in @KafkaListener consumers, include java.net in their list of trusted packages. This allows a remote attacker, by sending a specially crafted message, to inje...

CVE-2026-47883

A flaw was found in the UrlHandlerFilter component of Spring Framework. When this filter is configured with overly broad patterns, it can be vulnerable to an open redirect. A remote attacker could exploit this by crafting a malicious URL, which, when clicked by a user, redirects them to an...

CVE-2025-15613

A flaw was found in Kyverno. An attacker with permissions to create Kyverno policies can exploit a Server-Side Request Forgery SSRF vulnerability within its Service Call functionality. This allows the attacker to specify an external URL in a policy's configuration, causing Kyverno to send request...

CVE-2026-47834

A flaw was found in Spring Data JPA. This vulnerability allows a remote attacker to bypass data validation mechanisms by submitting specially crafted input. This could lead to unauthorized access to limited information and minor disruptions in service availability. Mitigation There is no mitigati...

CVE-2026-89032

A flaw was found in LiteLLM. Due to a metadata key mismatch in the semantic cache component, an authenticated remote attacker can bypass tenant isolation by submitting semantically similar queries. This issue leads to information disclosure, allowing unauthorized access to cached responses...

CVE-2026-77619

A flaw was found in Vector. The Logstash source component allocates memory based on a network-declared frame length without enforcing an upper limit. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted frame that declares an excessively large payload...

CVE-2026-79064

A flaw was found in the Network component of Google Chrome. A remote attacker, by leveraging social engineering tactics and a specially crafted Chrome extension, could exploit a use-after-free vulnerability. This could lead to the execution of arbitrary code outside of the browser's security...

CVE-2026-79210

A flaw was found in the Audio component of Chromium, specifically in Google Chrome on Android. This use-after-free vulnerability allows a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to...

CVE-2026-79005

A flaw was found in Google Chrome's StorageAccessAPI. A remote attacker, after compromising the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted HTML page. This could allow the attacker to bypass the web origin policy, potentially leading to...

CVE-2026-51773

A flaw was found in the VMware datastore driver of OpenStack glancestore. When an authenticated user supplies a crafted image location Uniform Resource Identifier URI pointing to an external host, the driver fails to validate the destination before forwarding requests. An attacker can exploit thi...

CVE-2026-79721

A flaw was found in MLflow. This vulnerability allows a remote attacker to achieve arbitrary code execution on an end user's system. This occurs when a maliciously crafted model artifact is loaded by the MLflow platform, enabling the execution of unauthorized code. Mitigation Avoid loading,...

CVE-2026-79173

A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page, leading to user interface UI misrepresentation. This misrepresentation allows the attacker to spoof UI elements, potentially deceiving users...

CVE-2026-93834

A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data, bypassing directory traversal...

CVE-2026-79151

A flaw was found in Chromium-browser's Safebrowsing component. A remote attacker could exploit this vulnerability by providing a specially crafted file. This could allow the attacker to bypass system access restrictions...

CVE-2026-84348

A flaw was found in the MediaCapture component of chromium-browser. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially lead to the leakage of sensitive information...

CVE-2026-97222

A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent element, the XML parser can dereference a freed sheet-object component, causing Gnumeric to crash. Mitigation Do not open Gnumeric workbook files from...

CVE-2026-84332

A flaw was found in Google Chrome. This incorrect authorization vulnerability in SiteSettings allows a remote attacker to bypass system access restrictions by enticing a user to visit a specially crafted HTML page. This could lead to unauthorized access to sensitive system configurations...

CVE-2026-84350

A flaw was found in Chromium's TabStrip component. A remote attacker could leverage social engineering techniques and user interface UI interaction to trigger a use-after-free vulnerability. This could lead to the execution of arbitrary code outside of the browser's sandbox...

CVE-2026-79009

A flaw was found in Google Chrome. This user interface UI misrepresentation vulnerability allows a remote attacker, leveraging social engineering, to spoof UI elements. The attacker can achieve this by tricking a user into visiting a specially crafted HTML page. The consequence is that users coul...

CVE-2026-84331

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker, who has already compromised the renderer process, to bypass the web origin policy by using a specially crafted HTML page. This could lead to unauthorized access to data or functionality acro...

CVE-2026-79090

A flaw was found in chromium-browser. Improper privilege management in the Actor component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...

CVE-2026-96775

A flaw was found in MLflow's dspy flavor. The security control intended to prevent pickle deserialization is only enforced when the model file path ends with '.pkl'. This oversight allows a remote attacker to bypass the security control and execute arbitrary code by providing a specially crafted...

CVE-2026-88360

A flaw was found in libvips, an image processing library. When handling specially crafted little-endian PFM Portable Float Map images, an attacker could trigger an unaligned memory access. This occurs if the image's text header length is not a multiple of four bytes, causing the loader to expose...

CVE-2026-79028

A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the network component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...

CVE-2026-76921

A flaw was found in Wireshark. A use-after-free vulnerability exists in the CMS Cryptographic Message Syntax protocol dissector. An attacker could exploit this by crafting a malicious network packet, leading to a crash and a denial of service DoS for the application. Mitigation To mitigate this d...

CVE-2026-96804

A flaw was found in MLflow. The statsmodel component of MLflow fails to enforce a security control that prevents insecure deserialization during model loading. This allows a remote attacker to execute arbitrary code by submitting a specially crafted MLmodel artifact. This vulnerability can lead t...

CVE-2026-79181

A flaw was found in Google Chrome. An observable discrepancy in the Glic component allows a remote attacker to obtain sensitive information. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-79109

A flaw was found in Google Chrome's printing component. A remote attacker, after compromising the renderer process, could exploit improper input validation by crafting a malicious HTML page. This could potentially allow the attacker to execute arbitrary code outside of the browser's security...

CVE-2026-69146

A flaw was found in MLflow, an open-source AI engineering platform. An authenticated user could bypass authorization controls by sending requests to the LogInputs endpoint for another user's data. This allowed the user to inject unauthorized data records into the dataset lineage metadata, leading...

CVE-2026-69148

A flaw was found in MLflow, an open-source AI engineering platform. Insufficient validation in the CreateModelVersion function allows an authenticated user to create a model version that references another user's artifact directory. This enables the authenticated user to read files from that...

CVE-2026-73253

A flaw was found in Mongoose. Wildcard certificate matching in its built-in Transport Layer Security TLS stack does not properly restrict matches to a single domain level. An on-path network attacker with a valid wildcard certificate for a parent domain could exploit this flaw to bypass hostname...

CVE-2026-59682

A flaw was found in OpenRGB. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted SAVEPROFILE network message to the application. Successful exploitation allows the attacker to overwrite or delete arbitrary files on the target system, leading to...

CVE-2026-79042

A flaw was found in Google Chrome on Android. Missing authorization in the Payments functionality allows a remote attacker, leveraging social engineering, to potentially bypass system access restrictions. This can be achieved by enticing a user to interact with a specially crafted HTML page...

CVE-2026-79088

A flaw was found in Google Chrome's FileSystem component. A remote attacker could exploit this vulnerability by leveraging social engineering techniques and a specially crafted HTML page. This could allow the attacker to bypass system access restrictions, potentially leading to unauthorized acces...

CVE-2026-79179

A flaw was found in Chromium's Document Object Model DOM due to incorrect authorization. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could potentially lead to the leakage of sensitive information...

CVE-2026-79018

A flaw was found in Chromium's FoldableAPIs. A remote attacker could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive user information...

CVE-2026-79124

A flaw was found in Google Chrome on Android. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak through the improper handling of Intents, allowing the attacker to access sensitive user information...

CVE-2026-79015

A flaw was found in ServiceWorker in Google Chrome. A remote attacker could exploit improper input validation by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...

CVE-2026-93603

A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted script within the sandbox to achieve arbitrary code execution on the underlying host system by escaping sandbox containment. The issue occurs because vm2 fails to properly handle function calls lacking an...

CVE-2026-79056

A flaw was found in chromium-browser. A use-after-free vulnerability in the ServiceWorker component allows a remote attacker to potentially execute arbitrary code outside of the sandbox. This can be achieved by enticing a user to visit a specially crafted HTML page...

CVE-2026-93606

A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise...

CVE-2026-93605

A flaw was found in vm2. The sandbox environment fails to restrict access to the childprocess module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break...

CVE-2026-79199

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. By crafting a malicious HTML page, an attacker can gain unauthorized access within the network component...

CVE-2026-78897

A flaw was found in BrowserTag in Google Chrome. Missing authorization allows a remote attacker, leveraging social engineering, to obtain sensitive information by using a specially crafted Chrome extension...

CVE-2026-79313

A flaw was found in webpy. The application's session management relies on periodic cleanup to expire sessions instead of checking the last-access time when a session is loaded. This allows an attacker holding a previously valid session cookie to replay and use an expired session. As a result, an...

CVE-2026-79310

A flaw was found in webpy. This vulnerability, known as Server-Side Template Injection SSTI, allows a remote attacker to execute malicious code on the server. By exploiting how the application precompiles and renders templates, an attacker can bypass security measures and run arbitrary Python cod...