Export limit exceeded: 385646 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (385646 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-84349 | 1 Google | 1 Chrome | 2026-09-02 | 8.3 High |
| Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-84348 | 1 Google | 1 Chrome | 2026-09-02 | 6.5 Medium |
| Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84335 | 1 Google | 1 Chrome | 2026-09-02 | 8.3 High |
| Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84327 | 1 Google | 1 Chrome | 2026-09-02 | 6.5 Medium |
| Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-84324 | 1 Google | 1 Chrome | 2026-09-02 | 9 Critical |
| Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: High) | ||||
| CVE-2026-84323 | 1 Google | 1 Chrome | 2026-09-02 | 5.3 Medium |
| Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84328 | 1 Google | 1 Chrome | 2026-09-02 | 3.1 Low |
| Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-84331 | 1 Google | 1 Chrome | 2026-09-02 | 3.1 Low |
| Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-84326 | 1 Google | 1 Chrome | 2026-09-02 | 8.8 High |
| Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-52103 | 2026-09-02 | 9.8 Critical | ||
| A zero-click remote code execution (RCE) vulnerability in the /Terminal/Notification.hs component of SimpleX Chat before v6.5 allows attackers to execute arbitrary commands in the context of the application without user interaction via sending a crafted payload in a text message. | ||||
| CVE-2026-36102 | 1 Bluewave-labs | 1 Checkmate | 2026-09-02 | 7.2 High |
| An issue in the inviteController.js component in Bluewave Labs Checkmate <=3.3.0 allows remote authenticated administrators to escalate privileges to superadmin via the role parameter to the /api/v1/invite endpoint. | ||||
| CVE-2026-37003 | 1 Agno | 1 Agno | 2026-09-02 | 9.8 Critical |
| Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.run_path(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server. | ||||
| CVE-2026-51376 | 1 Permissionlesstech | 1 Bitchat | 2026-09-02 | 6.5 Medium |
| An issue in BitChat for iOS v1.15.0 allows a remote attacker to cause a denial of service via an unauthenticated MESSAGE packet into the mesh gossip cache | ||||
| CVE-2026-51661 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the getPortForwardRules function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain port-forwarding rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51616 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the getWanIeCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain LAN addressing and DHCP configuration information via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-75415 | 2026-09-02 | 7.5 High | ||
| AntFlow V2.0.0 is vulnerable to Incorrect Access Control. JiMuMDCCommonsRequestLoggingFilter.java retrieves the userid from the request header as the core of the identity verification mechanism, allowing attackers to forge any user identity credential information, thereby causing sensitive information leakage. | ||||
| CVE-2026-47894 | 2 Spring, Vmware | 2 Spring Cloud Config, Spring Cloud Config | 2026-09-02 | 4.9 Medium |
| Spring Cloud Config Server native environment repository allows exposure of configuration files outside of the configured repository path. Spring Cloud Config 5.0.0 - 5.0.4 Spring Cloud Config 4.3.0 - 4.3.4 Spring Cloud Config 4.0.0 - 4.2.8 Spring Cloud Config 3.1.14 and earlier | ||||
| CVE-2026-51625 | 1 Totolink | 1 T6 | 2026-09-02 | 7.5 High |
| Incorrect access control in the getWiFiEasyCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain sensitive information such as SSIDs and Wi-Fi keys, via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51635 | 1 Totolink | 1 T6 | 2026-09-02 | 4.3 Medium |
| Incorrect access control in the getWiFiScheduleCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain Wi-Fi scheduling rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||
| CVE-2026-51643 | 1 Totolink | 1 T6 | 2026-09-02 | 9.1 Critical |
| Incorrect access control in the getNtpCfg function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to obtain NTP configuration and current time data via sending a crafted POST request to /cgi-bin/cstecgi.cgi. | ||||