103,766 indexed
CVECVE vulnerabilities
103,766 CVEs indexed — newest first. Filter by CVSS severity or CISA KEV listing; KEV-flagged entries surface a rose pill. Authored by Adam Lundqvist.
Showing 9,601–9,650 of 103,766 · page 193 of 2076
| ID | Title | Summary |
|---|---|---|
| CVE-2026-84353 | CVE-2026-84353 CVSS 9.6google | Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute ar… |
| CVE-2026-84352 | CVE-2026-84352 CVSS 9.6google | Use after free in WebGL in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a cra… |
| CVE-2026-84351 | CVE-2026-84351 CVSS 8.3google | Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbi… |
| CVE-2026-84350 | CVE-2026-84350 CVSS 8.8google | Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside th… |
| CVE-2026-8435 | CVE-2026-8435 CVSS 6.5concretecms | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file approveVersion(). The Concrete CMS security… |
| CVE-2026-84349 | CVE-2026-84349 CVSS 8.3google | Use after free in Browser in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code … |
| CVE-2026-84348 | CVE-2026-84348 CVSS 6.5google | Information leak in MediaCapture in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to potentially leak sensitive information via a crafted HTML… |
| CVE-2026-84347 | CVE-2026-84347 CVSS 8.8google | Use after free in WebRTC in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page… |
| CVE-2026-8434 | CVE-2026-8434 CVSS 8.8concretecms | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescanMultiple(). The Concrete CMS security… |
| CVE-2026-84335 | CVE-2026-84335 CVSS 8.3google | Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
| CVE-2026-84334 | CVE-2026-84334 CVSS 8.1google | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary code outside the sand… |
| CVE-2026-84333 | CVE-2026-84333 CVSS 9.6google | Use after free in Dawn in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
| CVE-2026-84332 | CVE-2026-84332 CVSS 6.5google | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictions via a crafted HT… |
| CVE-2026-84331 | CVE-2026-84331 CVSS 3.1google | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
| CVE-2026-84330 | CVE-2026-84330 CVSS 5.4google | UI misrepresentation in FullScreen in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker to spoof address bar via a crafted HTML page… |
| CVE-2026-8433 | CVE-2026-8433 CVSS 8.8concretecms | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file rescan(). The Concrete CMS security team ga… |
| CVE-2026-84329 | CVE-2026-84329 CVSS 5.3google | Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process … |
| CVE-2026-84328 | CVE-2026-84328 CVSS 3.1google | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web or… |
| CVE-2026-84327 | CVE-2026-84327 CVSS 6.5google | Incorrect authorization in Autofill in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to obtain sen… |
| CVE-2026-84326 | CVE-2026-84326 CVSS 8.8google | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML … |
| CVE-2026-84325 | CVE-2026-84325 CVSS 9.8google | Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to bypass system acce… |
| CVE-2026-84324 | CVE-2026-84324 CVSS 9.0google | Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network tra… |
| CVE-2026-84323 | CVE-2026-84323 CVSS 5.3google | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
| CVE-2026-84321 | CVE-2026-84321 CVSS 5.4 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value… |
| CVE-2026-84320 | CVE-2026-84320 CVSS 6.3 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storage_path, but AutoBackup.GetName return… |
| CVE-2026-8432 | CVE-2026-8432 CVSS 8.8concretecms | Concrete CMS 9 before 9.5.0 is vulnerable to Cross Site Request Forgery (CSRF) at concrete/controllers/backend/file star(). The Concrete CMS security team gave… |
| CVE-2026-84319 | CVE-2026-84319 CVSS 8.3 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the regular HTTP configuration API rejects restricted Nginx directives such as load_… |
| CVE-2026-84318 | CVE-2026-84318 CVSS 8.8 | Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configuration files to disk … |
| CVE-2026-84317 | CVE-2026-84317 CVSS 8.8 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, internal/config/validation.go (ValidateConfigFile) is a security control that blocks… |
| CVE-2026-84316 | CVE-2026-84316 CVSS 8.8 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline and checks only the … |
| CVE-2026-84315 | CVE-2026-84315 CVSS 8.3 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation rout… |
| CVE-2026-84314 | CVE-2026-84314 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to ch… |
| CVE-2026-84313 | CVE-2026-84313 CVSS 8.8 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, POST /api/otp_enroll and POST /api/finish_passkey_register are registered outside Re… |
| CVE-2026-84312 | CVE-2026-84312 CVSS 7.1 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GetCasdoorUri uses the configured Casdoor application name as a constant OAuth state… |
| CVE-2026-84311 | CVE-2026-84311 CVSS 3.3pypdf_project | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and P… |
| CVE-2026-84310 | CVE-2026-84310 CVSS 3.3pypdf_project | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume … |
| CVE-2026-8431 | CVE-2026-8431 CVSS 7.2mongodb | An administrative user with access to configure webhooks can execute arbitrary commands by configuring and then triggering webhooks containing specific FreeMar… |
| CVE-2026-84309 | CVE-2026-84309 CVSS 5.5pypdf_project | pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_st… |
| CVE-2026-84308 | CVE-2026-84308 CVSS 6.3 | phpseclib is a PHP secure communications library. Prior to 3.0.57 and 4.0.1, pure-PHP X25519 scalar multiplication in phpseclib/Math/PrimeField/Integer.php per… |
| CVE-2026-84307 | CVE-2026-84307 CVSS 3.7 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.… |
| CVE-2026-84306 | CVE-2026-84306 CVSS 6.5 | Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/… |
| CVE-2026-84305 | CVE-2026-84305 | sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controll… |
| CVE-2026-84304 | CVE-2026-84304 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recv… |
| CVE-2026-84303 | CVE-2026-84303 | gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header … |
| CVE-2026-84302 | CVE-2026-84302 CVSS 4.2 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, Discourse AI reviewables associated with private messages… |
| CVE-2026-84301 | CVE-2026-84301 CVSS 6.3 | FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/servic… |
| CVE-2026-8430 | CVE-2026-8430 CVSS 8.1 | SPIP versions prior to 4.4.14 contain a remote code execution vulnerability in the public space that is limited to certain nginx configurations, allowing attac… |
| CVE-2026-84298 | CVE-2026-84298 CVSS 3.1 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores … |
| CVE-2026-84293 | CVE-2026-84293 CVSS 7.2 | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versio… |
| CVE-2026-84292 | CVE-2026-84292 CVSS 7.5openjsf | fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the por… |