Export limit exceeded: 365306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 365306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 365306 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (365306 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-78894 | 1 Google | 1 Chrome | 2026-08-27 | 3.1 Low |
| Race condition in Payments in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78896 | 1 Google | 1 Chrome | 2026-08-27 | 4.3 Medium |
| Information leak in StorageAccessAPI in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78897 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | ||||
| CVE-2026-78900 | 1 Google | 1 Chrome | 2026-08-27 | 9.6 Critical |
| Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78904 | 1 Google | 1 Chrome | 2026-08-27 | 9.6 Critical |
| Type confusion in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78907 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Incorrect authorization in WebProtect in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-78911 | 1 Google | 1 Chrome | 2026-08-27 | 8.3 High |
| Incorrect authorization in USB in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-78914 | 1 Google | 1 Chrome | 2026-08-27 | 6.5 Medium |
| Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-78934 | 1 Google | 1 Chrome | 2026-08-27 | 8.3 High |
| Race condition in ReadAloud in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-44902 | 1 Opentelemetry | 7 Auto-instrumentations-node, Exporter-prometheus, Opentelemetry-js and 4 more | 2026-08-27 | 7.5 High |
| opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0. | ||||
| CVE-2026-79028 | 1 Google | 1 Chrome | 2026-08-27 | 5.3 Medium |
| Observable discrepancy in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-79040 | 1 Google | 1 Chrome | 2026-08-27 | 4.3 Medium |
| Uninitialized resource in GPU in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-47845 | 1 Spring | 1 Reactor Netty | 2026-08-27 | 5.3 Medium |
| In specific scenarios, Reactor Netty HTTP Server may incorrectly evaluate the remote IP address when HAProxy Protocol is enabled. In order for this to happen, the application must be configured to use HAProxy Protocol. Reactor Netty 1.3.0 - 1.3.6 Reactor Netty 1.1.0 - 1.2.18 Reactor Netty 1.0.52 and earlier | ||||
| CVE-2026-58086 | 1 Freebsd | 1 Freebsd | 2026-08-27 | 8.1 High |
| As an inadvertent side effect of an unrelated code change, PRIV_KTRACE was always denied to a jailed root user. Tracing configured by a jailed root user was therefore not flagged as privileged. An unprivileged user in a jail that has permission to debug the target process can modify the jailed root user's ktrace(2) flags, or disable tracing outright. A jailed root user therefore cannot reliably trace unprivileged processes. | ||||
| CVE-2026-75336 | 2026-08-27 | 9.8 Critical | ||
| Funiture 1.0.0 is vulnerable to SQL Injection in the backend tool interfaces /sys/tool/select.json and /sys/tool/update.json. | ||||
| CVE-2026-54285 | 1 Opentelemetry | 2 Opentelemetry, Opentelemetry-js | 2026-08-27 | 5.3 Medium |
| opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size limits when parsing inbound baggage HTTP headers. The W3C Baggage specification recommends a maximum of 8,192 bytes and 180 entries; these limits were only enforced on the outbound (inject()) path, not on the inbound (extract()) path. Parsing oversized baggage causes memory allocation proportional to the header size without any cap. This vulnerability is fixed in 2.8.0. | ||||
| CVE-2026-74770 | 2026-08-27 | 8.8 High | ||
| Dell PowerProtect One, versions 20.1.0.0 and below, contain an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Code execution. | ||||
| CVE-2026-81668 | 2 Red Hat, Redhat | 2 Red Hat Satellite 6, Satellite | 2026-08-27 | 5.4 Medium |
| A flaw was found in Katello where the Content View Filter Rules API does not properly enforce authorization on the parent Content View Filter. An authenticated, low-privileged user with Content View permissions in one organization may be able to access and modify filter rules belonging to a Content View Filter in another organization by supplying that filter's identifier. This can result in unauthorized disclosure of filter-rule information and unauthorized changes to unpublished Content View filter configuration. | ||||
| CVE-2026-19506 | 1 Rdk | 1 Rdk-b Webui | 2026-08-27 | 8.1 High |
| Race condition in `check.jst` in RDK-B WebUI `rdkb-2025q4-kirkstone.04.10.26` allows a remote attacker to gain unauthorized access via concurrent authentication requests that exploit shared authentication state. | ||||
| CVE-2026-75332 | 2026-08-27 | 9.1 Critical | ||
| Zyplayer-Doc <=1.0.0 is vulnerable to Server-Side Request Forgery (SSRF) via WikiPageWebService.download(). | ||||