CVE-2026-91731

CVE-2026-91731 is a type confusion vulnerability in the Compositing component of Google Chrome , affecting versions prior to 153.0.8010.47 . A remote attacker can exploit it by enticing a user to visit a crafted HTML page, leading to arbitrary code execution inside the browser's sandbox . The CVS...

CVE-2026-91720

CVE-2026-91720 is an uninitialized resource flaw in the ANGLE component of Google Chrome , present in versions prior to 153.0.8010.47 (Windows/Mac) and 153.0.8010.47 (Linux). A remote attacker can leverage a crafted HTML page to read memory outside the sandbox , rated High by Chromium. The CVSS v...

CVE-2026-91748

CVE-2026-91748 is a race condition in the Extensions component of Google Chrome on Mac prior to 153.0.8010.47 . A remote attacker who had already compromised the renderer process could leverage social engineering to execute arbitrary code outside the sandbox via UI Interaction, rated CVSS 3.1: 8....

CVE-2026-91743

A race condition in the Core component of Google Chrome prior to 153.0.8010.47 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser's sandbox by tricking a user into visiting a crafted HTML page. The bug was internally reported by...

CVE-2026-91744

CVE-2026-91744 is a race condition in the PlatformIntegration component of Google Chrome on Mac , affecting versions prior to 153.0.8010.47 . A remote attacker who has already compromised the renderer process and leverages social engineering can obtain sensitive information by delivering a crafte...

CVE-2026-91712

A race condition in the Extensions component of Google Chrome (Mac) prior to 153.0.8010.47 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the browser sandbox via a crafted HTML page. The vulnerability was reported by Google ...

CVE-2026-91727

CVE-2026-91727 is an incorrect reference resolution flaw in the Extensions component of Google Chrome on Mac , affecting versions prior to 153.0.8010.47 . A local attacker who has already compromised the renderer process can exploit this to execute arbitrary code outside the sandbox via a local p...

CVE-2026-91724

A use-after-free vulnerability in the Input component of Google Chrome prior to 153.0.8010.47 allows a remote attacker who has already compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The flaw carries a CVSS 8.3 (HIGH) score and a...

CVE-2026-91734

CVE-2026-91734 is an incorrect authorization flaw in Core of Google Chrome on Windows prior to version 153.0.8010.47 . A local attacker can leverage a local program to execute arbitrary code outside the browser sandbox , potentially leading to complete compromise of the affected system (CVSS 3.1:...

CVE-2026-91728

CVE-2026-91728 is an integer overflow in V8 , the JavaScript engine used by Google Chrome prior to version 153.0.8010.47 . A remote attacker can exploit this flaw by enticing a user to visit a crafted HTML page , leading to arbitrary code execution inside the browser sandbox . The bug was reporte...

CVE-2026-91721

CVE-2026-91721 is a use after free vulnerability in the Internals component of Google Chrome , affecting versions prior to 153.0.8010.47 . A remote attacker can exploit it via a crafted HTML page to potentially execute arbitrary code outside the sandbox . The Chromium team rates it Critical ; CVS...

CVE-2026-91749

CVE-2026-91749 is a use-after-free in the Workers component of Google Chrome , rated Critical by Chromium with a CVSS 3.1 score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). A remote attacker could potentially execute arbitrary code outside the sandbox by convincing a user to visit a crafted HTML...

CVE-2026-91726

CVE-2026-91726 is an out-of-bounds read in WebGL affecting Google Chrome on Android prior to 153.0.8010.47 . A remote attacker can exploit a crafted HTML page to read memory outside the browser's sandbox , leading to information disclosure . Chromium rates it Critical ; the NVD CVSS 3.1 score is ...

CVE-2026-66372

CVE-2026-66372 affects the Digital Watchdog VMAX DVR and NVR product lineups. The root cause is a predictable seed in the pseudo-random number generator (PRNG) , resulting in insufficiently random values that make web session tokens predictable and bound their entropy to the seed space. The CVSS ...

CVE-2026-66887

Digital Watchdog VMAX DVR and NVR devices are vulnerable due to missing authorization on state-changing CGI endpoints and the absence of session checks , allowing an attacker on the adjacent network to modify device state without authentication. CISA ICS-CERT rated this CRITICAL (CVSS 3.1: 9.6 / ...

CVE-2026-79994

CVE-2026-79994 affects the guest-to-host Unix-domain socket (UDS) forwarder in Docker Sandboxes . The relay validates that a socket path resides inside an authorized workspace but later reconnects using the raw pathname. A malicious guest can exploit a symlink race by replacing an intermediate di...

CVE-2026-68950

CVE-2026-68950 affects Digital Watchdog VMAX DVR and NVR product lineups. The root cause is hard-coded credentials , which allow an attacker to run the ftpd service as root , granting remote root file access where FTP is reachable. The vulnerability is rated HIGH severity (CVSS 3.1: 8.8, CVSS 4.0...

CVE-2026-68070

Digital Watchdog VMAX DVR and NVR product lineups are affected by a missing authentication flaw for a critical function, allowing an adjacent-network attacker—requiring no privileges—to execute code as root by passing received bytes directly to a system command (command injection). CISA rates it ...

CVE-2026-54544

Fireshare , a self-hosted media and link sharing platform, contains an unauthenticated SSRF vulnerability prior to version 1.6.16 . Two API endpoints—POST /api/test-discord-webhook and POST /api/test-webhook—are missing the @login_required decorator, allowing an attacker to trigger arbitrary outb...

CVE-2026-66890

Digital Watchdog VMAX DVR and NVR devices are affected by a hard-coded credentials vulnerability that allows an attacker with adjacent-network access to gain remote file access with root privileges when the device's FTP service is reachable. The CISA-assigned CVSS 3.1 score is 9.6 (CRITICAL) , wi...