214880 matches found
CVE-2026-11573
A flaw was found in qtbase. Uncontrolled recursion in Qt's QDomDocument serialization QtXml allows a remote attacker to provide deeply nested untrusted XML, leading to stack exhaustion. This can cause the application to crash, resulting in a Denial of Service DoS. Mitigation To mitigate this issu...
CVE-2026-61907
A flaw was found in cyrus-imapd. An authenticated user with insert permissions on another user's snoozed mailbox could bypass access controls. This allows the user to insert mail into the target user's inbox or other known mailboxes, even without explicit insert permissions for those mailboxes...
CVE-2026-16028
A flaw was found in Protocol::HTTP2 for Perl. A remote attacker could exploit this vulnerability by repeatedly opening and closing HTTP/2 streams. This action causes the system to retain residual entries for each closed stream, leading to an unbounded increase in memory usage. This memory...
CVE-2026-53938
A flaw was found in cjose, a C library for Javascript Object Signing and Encryption JOSE. A remote, unauthenticated attacker can exploit a heap buffer overflow vulnerability in the AES Key Wrap decryption process. By submitting a crafted Javascript Web Encryption JWE to an application, the attack...
CVE-2026-19729
A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...
CVE-2026-87724
A flaw was found in Tor. A remote attacker could exploit this vulnerability by sending a specific congestion-control CC response extension without first sending a corresponding request. This misinterpretation of the CCRESPONSE extension leads to a corrupted congestion-control state, which can cau...
CVE-2026-85630
A flaw was found in perl-HTML-FormHandler. This vulnerability allows a remote attacker to inject malicious scripts into web pages due to the processattrs method failing to properly escape field attributes when rendering HTML. By manipulating input, an attacker can embed JavaScript, leading to...
CVE-2026-57825
A flaw was found in the opam package manager for OCaml. This vulnerability allows a malicious package to bypass the sandbox protection mechanism. By mishandling symlinks during the processing of .install files, an attacker can write arbitrary files to unintended locations on the system, potential...
CVE-2026-87624
A flaw was found in Google Chrome on Android. A remote attacker, after compromising the renderer process, could exploit a user interface UI misrepresentation vulnerability. This vulnerability allows the attacker to spoof UI elements by using a specially crafted HTML page, potentially deceiving...
CVE-2026-87630
A flaw was found in WebRTC in Chromium-browser. A remote attacker could exploit an integer overflow vulnerability by enticing a user to visit a specially crafted HTML page. This could allow the attacker to read sensitive memory within the browser's sandbox environment...
CVE-2026-87521
A flaw was found in WebMCP in Chromium. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive cross-origin data...
CVE-2026-87083
A flaw was found in tile-ai tilelang. This vulnerability, located in the Kernel Cache component's KernelCache.loadkernelfromdisk function, allows a remote attacker to perform deserialization. This could lead to various impacts, such as arbitrary code execution or information disclosure, by...
CVE-2026-87451
A flaw was found in Google Chrome. This information leak vulnerability in the Downloads component allows a remote attacker, who has already compromised the browser's renderer process, to obtain sensitive cross-origin data. This can be achieved by enticing a user to visit a specially crafted HTML...
CVE-2026-87439
A flaw was found in chromium-browser's ServiceWorker. A remote attacker, who has already compromised the renderer process, could exploit this vulnerability by providing a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...
CVE-2026-87626
An incorrect authorization flaw was found in the DeviceBoundSessionCredentials component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=553155590...
CVE-2026-87598
An incorrect authorization flaw was found in the ServiceWorker component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=499218516...
CVE-2026-87434
A flaw was found in Chromium, affecting Google Chrome. A remote attacker, having compromised the renderer process, could exploit missing authorization in Cross-Origin Resource Sharing CORS to bypass the web origin policy. This could be achieved by enticing a user to visit a crafted HTML page,...
CVE-2026-87534
A flaw was found in WebView in Google Chrome. This missing authorization vulnerability allows a remote attacker, by leveraging social engineering techniques, to bypass system access restrictions. This can be achieved through specially crafted network traffic...
CVE-2026-87505
A flaw was found in the FileSystem component of Chromium. A remote attacker, who has already compromised the renderer process, could exploit an incorrect authorization vulnerability by using a specially crafted PDF file. This could allow the attacker to bypass site isolation, potentially leading ...
CVE-2026-87430
A flaw was found in WebRTC, a real-time communication component, within Google Chrome. A remote attacker could exploit this buffer overflow vulnerability by enticing a user to visit a specially crafted HTML page. Successful exploitation may allow the attacker to execute arbitrary code within the...
CVE-2026-87429
A flaw was found in the ServiceWorker component of Chromium. A remote attacker, after compromising the renderer process, could exploit a missing authorization vulnerability by crafting a malicious HTML page. This could allow the attacker to bypass system access restrictions...
CVE-2026-87622
A flaw was found in chromium-browser. Missing authorization in the Federated Credential Management FedCM API allowed a remote attacker to bypass the web origin policy. This bypass could be achieved by enticing a user to visit a crafted HTML page, potentially leading to unauthorized access to...
CVE-2026-87604
A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability could allow a remote attacker, who has already compromised the browser's renderer process, to potentially execute arbitrary code outside of the browser's security sandbox. This exploitation occurs when ...
CVE-2026-87586
A flaw was found in ANGLE, a component of Google Chrome. This out-of-bounds read vulnerability allows a remote attacker to read memory outside of the browser's security sandbox. The flaw can be exploited by enticing a user to visit a specially crafted HTML page. The primary consequence is the...
CVE-2026-87506
A flaw was found in Google Chrome's WebUI. A remote attacker, after compromising the renderer process, could exploit this vulnerability by tricking a user into visiting a specially crafted HTML page. This could lead to privilege elevation, allowing the attacker to execute arbitrary code outside o...
CVE-2026-87553
A flaw was found in SiteIsolation in Google Chrome. Improper input validation could allow a remote attacker, who has already compromised the renderer process, to execute arbitrary code outside of the sandbox. This exploitation occurs when the attacker provides a specially crafted HTML page, leadi...
CVE-2026-87453
A flaw was found in chromium-browser's BackgroundFetch component. A remote attacker, who has already compromised the renderer process, could exploit a confused deputy vulnerability by using a specially crafted HTML page. This could lead to the disclosure of sensitive information...
CVE-2026-87449
A flaw was found in Google Chrome. This cross-site request forgery CSRF vulnerability, which tricks a web browser into executing an unwanted action on a trusted site where the user is authenticated, specifically affects the DeviceBoundSessionCredentials feature. A remote attacker can exploit this...
CVE-2026-87538
A flaw was found in Chromium. A remote attacker, after compromising the renderer process and leveraging social engineering, could exploit a clickjacking vulnerability in the input mechanism. This could allow the attacker to spoof user interface UI elements via a specially crafted HTML page,...
CVE-2026-87543
A flaw was found in Google Chrome. A remote attacker who has compromised the renderer process can exploit a missing authorization vulnerability by crafting a malicious HTML page. This allows them to bypass site isolation, which is a security mechanism designed to protect user data and prevent...
CVE-2026-87618
A flaw was found in Google Chrome. This vulnerability involves incorrect reference resolution within the browser's Storage component. A remote attacker, who has already compromised the browser's renderer process, could exploit this by enticing a user to visit a specially crafted HTML page...
CVE-2026-87523
A flaw was found in Chromium. A race condition in the DataTransfer component allows a remote attacker, by leveraging social engineering techniques, to obtain sensitive information. This can be achieved by enticing a user to visit a specially crafted HTML page...
CVE-2026-87502
A flaw was found in Google Chrome. This confused deputy vulnerability in the Fullscreen feature allows a remote attacker, who has compromised the renderer process and leveraged social engineering, to spoof user interface UI elements. This can be achieved by presenting a specially crafted HTML pag...
CVE-2026-87653
A flaw was found in chromium-browser. A remote attacker could exploit this vulnerability by crafting a malicious HTML page. This could lead to user interface UI misrepresentation in FullScreen mode, allowing the attacker to spoof UI elements...
CVE-2026-87620
A flaw was found in Google Chrome. A remote attacker could exploit an observable discrepancy in the Scalable Vector Graphics SVG rendering engine by enticing a user to open a specially crafted HTML page. This could lead to the disclosure of sensitive information...
CVE-2026-87634
A flaw was found in Chromium. A use-after-free vulnerability exists in the WebPackaging component. A remote attacker could exploit this by enticing a user to open a specially crafted HTML page. This could potentially lead to arbitrary code execution outside of the sandbox...
CVE-2026-87519
A flaw was found in Safebrowsing. This incorrect authorization vulnerability could allow a remote attacker, through social engineering, to bypass system access restrictions by tricking a user into interacting with a specially crafted HTML page...
CVE-2026-87623
A flaw was found in Google Chrome. An observable discrepancy in the Document Object Model DOM could be exploited by a remote attacker. By leveraging social engineering techniques and a specially crafted HTML page, an attacker could obtain sensitive user information...
CVE-2026-87507
A flaw was found in chromium-browser. A remote attacker, leveraging social engineering tactics, could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to user interface UI misrepresentation within the Downloads section, allowing the attacker to...
CVE-2026-87443
A missing authorization flaw was found in the Actor component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=502768228...
CVE-2026-87564
A type confusion flaw was found in the V8 component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=552342545...
CVE-2026-87501
An ui misrepresentation flaw was found in the Passwords component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=513509804...
CVE-2026-87475
A missing authorization flaw was found in the Omnibox component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=507225626...
CVE-2026-87572
A flaw was found in the DevTools component of Chromium. A remote attacker, after compromising the renderer process, could exploit an injection vulnerability by crafting a malicious HTML page. This could potentially lead to the execution of arbitrary code outside the sandbox, allowing the attacker...
CVE-2026-87486
A flaw was found in Google Chrome. This clickjacking vulnerability allows a local attacker, through a co-installed application, to spoof the address bar. This could mislead users about the authenticity of the displayed website...
CVE-2026-87635
An ui misrepresentation flaw was found in the Payments component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=522304737...
CVE-2026-87593
A flaw was found in Google Chrome. A remote attacker could exploit this vulnerability by enticing a user to visit a specially crafted HTML page. This could lead to an information leak, allowing the attacker to obtain sensitive information...
CVE-2026-87444
A memory corruption flaw was found in the Codecs component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=489489002...
CVE-2026-87493
A flaw was found in chromium-browser. Missing authorization in the FileSystem component allows a remote attacker to bypass system access restrictions. This can be achieved by leveraging social engineering techniques through a specially crafted HTML page...