product: System Control Interface v3

vendor: ASUS

product: System Control Interface

product: Business Manager

summary: Allocation of Resources Without Limits and Throttling and Sensitive Information in Resource Not Removed Before Reuse in the ASUS System Control Interface driver and ASUS Business Manager allow a local administrator to disclose sensitive information via crafted IOCTL requests, which, in severe cases, may lead to a Denial of Service (DoS) on the system. Refer to the ' Security Update for ASUS System Control Interface ' section on the ASUS Security Advisory for more information.

title: Asus System Control Interface V3 security vulnerability


default_status: unaffected

product: BC-JAVA

vendor: Legion of the Bouncy Castle Inc.

status: affected

version_type: maven

product: BC-LTS-JAVA

product: BC-FJA

ecosystem: java/maven

metric_type: Secondary

severity: medium

quality: metadata-backed

recipe_kind: composed

status: Undergoing Analysis

summary: In Bouncy Castle for Java before 1.85, PKCS#12 MAC and bag-decryption KDF iteration-count bound (DoS). This issue also affects Bouncy Castle for Java LTS before 2.73.12, and Bouncy Castle for Java FIPS (BC-FJA) before bc-fips 1.0.2.7 (1.0.X series), 2.0.2 (2.0.X series) and 2.1.3 (2.1.X series).


product: PcapPlusPlus

vendor: seladb

ecosystem: software/application

severity: low

part: a

status: Deferred

summary: A vulnerability was determined in seladb PcapPlusPlus 25.05. The impacted element is the function pcpp::SSLClientHelloMessage::getHandshakeVersion of the file Packet++/src/SSLHandshake.cpp of the component TLS Hello Handler. Executing a manipulation of the argument handshakeVersion can lead to heap-based buffer overflow. It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is regarded as difficult. The exploit has been publicly disclosed and may be utilized. This patch is called 98e671010bc7c87b95898c22ae289220ae92542b. It is best practice to apply a patch to resolve this issue.


summary: A vulnerability was identified in seladb PcapPlusPlus 25.05. This affects the function pcpp::TelnetLayer::getSubCommand of the file Packet++/src/TelnetLayer.cpp of the component Telnet Subnegotiation Packet Handler. The manipulation leads to heap-based buffer overflow. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is reported as difficult. The exploit is publicly available and might be used. The identifier of the patch is 98e671010bc7c87b95898c22ae289220ae92542b. It is recommended to apply a patch to fix this issue.


summary: A security flaw has been discovered in seladb PcapPlusPlus 25.05. This impacts the function pcpp::ModbusLayer::getLength in the library Packet++/header/ModbusLayer.h of the component Modbus Protocol Handler. The manipulation of the argument length results in heap-based buffer overflow. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as 4c90c3e3418a2b09dc82b7ca5775e9c1e22fe454. Applying a patch is advised to resolve this issue.


product: Mysti

vendor: DeepMyst

summary: A weakness has been identified in DeepMyst Mysti 0.4.0. Affected is the function _isTrackedConversation of the file src/managers/ChannelBridge.ts of the component Contact Tracking. This manipulation of the argument _channelType causes improper authorization. The attack may be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is told to be difficult. The exploit has been made available to the public and could be used for attacks. Patch name: 9b4aff0f106db424aa45a35aa89dd0b8f2eb9a48. It is suggested to install a patch to address this issue.


product: CIPster

vendor: liftoff-sr

author: Codex

description: CVE-2026-13592 is CIPster BufWriter OOB write. GHAD vulnerabilities is empty. Rolling-release leftover text is not a catalog floor.

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-13592: CIPster BufWriter::append out-of-bounds write

severity: high

recipe_kind: markdown-draft

summary: A vulnerability was detected in liftoff-sr CIPster up to e8e9dba09bf56962807d3504b783ccdb6287f3e4. Affected by this issue is the function BufWriter::append of the component EtherNet IP Message Handler. Performing a manipulation results in out-of-bounds write. Remote exploitation of the attack is possible. The exploit is now public and may be used. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The patch is named 3a0159ed43125dcd024a1965f0289cb186bae9ff. To fix this issue, it is recommended to deploy a patch.


vendor: GTERMARS

version_type: custom

summary: CSS::Minifier::XS versions before 0.14 for Perl have a memory leak when the entire document is minified away. The minify function has a memory leak when processing a document containing only characters to be removed, such as comments and whitespace.


default_status: affected

product: Red Hat Hardened Images

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 7

product: Red Hat Enterprise Linux 8

product: Red Hat Enterprise Linux 9

product: Red Hat OpenShift Container Platform 4

metric_type: Primary

vendor: redhat

part: o

product: util-linux

vendor: kernel

status: Analyzed

summary: A flaw was found in the libblkid library of util-linux. During nested partition probing, the BSD, Minix, Solaris x86, and UnixWare partition probers cache a raw pointer to a parent partition entry in a dynamically allocated array. When subsequent partition additions cause the array to be reallocated, this pointer becomes stale, leading to a heap use-after-free read. An attacker who can present a crafted block device image (for example, via USB insertion or a loop-mounted disk image) can trigger this flaw without user interaction, as libblkid is invoked automatically by udev/udisks as root on block-device hot-plug events. This could lead to limited information disclosure or denial of service.


product: Participants Database

vendor: Unknown

version_type: semver

ecosystem: php/wordpress

severity: critical

status: Received

summary: The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks.

title: Participants Database security vulnerability


default_status: unknown

product: 微信二维码登陆

summary: The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login code in the webhook response. This allows an unauthenticated attacker to forge a login event for any existing username, read the login code, and redeem it through an unauthenticated AJAX action to log in as that user, including an administrator, without a password.

title: 微信二维码登陆 security vulnerability


product: AutoNetTV Relay

summary: The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.

title: Autonettv Relay security vulnerability


product: Red Hat Enterprise Linux 7 Extended Lifecycle Support

product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

product: Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

product: Red Hat Enterprise Linux 8.8 Telecommunications Update Service

product: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.6 Extended Update Support

description: CVE-2026-13601 is Yelp leftover. GHAD vulnerabilities empty. NVD excludes 49.1. RHEL CPE rows are not Yelp floors. Do not invent 49.2.

title: CVE-2026-13601: Yelp leftover dump, GHAD vulnerabilities empty

product: yelp

vendor: gnome

status: Modified

summary: A flaw was found in Yelp due to an overly permissive Content Security Policy (CSP) implementation provided by yelp-xsl. A malicious Flatpak application can open crafted help content through the OpenURI portal. By embedding an untrusted CSS stylesheet within a structured SVG document, attacker-controlled content can bypass Flatpak's intended sandbox isolation, allowing Yelp to evaluate local XML inclusions and disclose arbitrary user-readable host files through remote CSS resource requests. This may result in the unauthorized disclosure of sensitive information.


product: pretix

vendor: pretix

version_type: python

product: pretix-mollie

product: pretix-oppwa

product: pretix-bitpay

product: pretix-payone

product: pretix-secuconnect

product: pretix-sofort

product: pretix-saferpay

summary: We found a chain of combining multiple weaknesses in the product that could allow an attacker to become any user in the backend and access any data: * The payment integration plugins Stripe (included in the core system), pretix-mollie, pretix-oppwa, pretix-bitpay, pretix-payone, pretix-secuconnect, pretix-sofort, and pretix-saferpay contain a code path that is intended for the transport of session parameters from a tab with isolated cookies (e.g. in the pretix widget) to a new tab. For this purpose, a set of session parameters is cryptographically signed and then passed to the new tab as a URL parameter. The plugins perform no further validation of the session parameters, other than the cryptographic signature being valid. This is fixed with the releases issued today by strictly validating that no session parameters outside of the scope of the respective plugin may be set. * An unrelated feature in the core system is used to generate redirect links that obfuscate any Referer headers for outgoing links to prevent leakage of secrets in URLs. This redirect page also requires cryptographically signed parameters.

title: Pretix security vulnerability


archetype: ssrf

summary: The payment integration pretix-oppwa provides support for the payment providers VR Payment, Hobex, and potentially others based on Oppwa's technology. The integration of Oppwa, following their official documentation, includes a step where the user is redirected from the payment provider back to our system with a query parameter like ?resourcePath=/v1/checkouts/{checkoutId}/payment in the URL. Our system is then supposed to fetch the status of the transaction from the URL given by baseUrl + resourcePath. Our plugin pretix-oppwa did so insecurely by concatenating the parameter form the URL to the base domain of the API without further validation and, critically, without a / at the end of the baseUrl. Therefore, an attacker could inject a resourcePath argument in a way that causes pretix to call a different server instead. Since the request includes the access token (API key) of the Oppwa account, this would leak the access token, giving access to data contained in the payment provider's system. This is fixed with the release today by strictly validating the given API URL.

title: Pretix Pretix-Oppwa security vulnerability


product: Pixelavo

summary: The Pixelavo WordPress plugin before 1.5.4 registers an unauthenticated AJAX action, gated only by a nonce that it emits publicly on every front-end page, that forwards client-supplied event data to the configured Facebook Conversions API using the administrator's stored access token. This allows an unauthenticated visitor to inject arbitrary conversion events into the administrator's Facebook ads account and exhaust the configured API quota.

title: Pixelavo security vulnerability


product: PhotoSwipe

summary: The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link.

title: Photoswipe security vulnerability


product: Frontend Admin by DynamiApps

summary: The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live tag and later output without escaping on the Frontend Admin by DynamiApps WordPress plugin before 3.29.9's front-end display surfaces, resulting in stored cross-site scripting that executes in the browser of any user, including an administrator, who views a page displaying the submitted value.

title: Frontend Admin By Dynamiapps security vulnerability


product: KiviCare

summary: The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.

title: Kivicare security vulnerability


summary: The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.

title: Kivicare security vulnerability


summary: The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

title: Kivicare security vulnerability


product: Red Hat Container Native Virtualization 4.12

product: Red Hat Container Native Virtualization 4.13

product: Red Hat Container Native Virtualization 4.14

product: Red Hat Container Native Virtualization 4.15

product: Red Hat Container Native Virtualization 4.16

product: Red Hat Container Native Virtualization 4.17

product: Red Hat Container Native Virtualization 4.18

product: Red Hat Container Native Virtualization 4.19

product: Red Hat Container Native Virtualization 4.20

product: Red Hat Container Native Virtualization 4.21

product: Red Hat Container Native Virtualization 4.22

part: redhat

status: Awaiting Analysis

summary: A symlink following vulnerability was found in KubeVirt's virt-handler migration proxy. During live migration, virt-handler dials Unix sockets inside the target virt-launcher pod via /proc/<pid>/root/ paths using net.Dial() without symlink protection. These socket paths reside in qemu-owned directories writable by the virt-launcher user. An attacker with namespace edit and pods/exec permissions can replace a migration proxy socket with a symlink to the host CRI-O socket. Because virt-handler runs as root in the host mount namespace, absolute symlink targets resolve against the host filesystem, and the bidirectional io.Copy proxy relays attacker-controlled bytes to the container runtime, enabling full node compromise.


product: fast-uri

vendor: fast-uri

product: Red Hat Enterprise Linux 10

product: multicluster engine for Kubernetes 2.11

product: Red Hat Advanced Cluster Management for Kubernetes 2.16

product: Red Hat Ansible Automation Platform 2.2

product: Red Hat Ansible Automation Platform 2.6

product: Red Hat Ansible Automation Platform 2.7

product: Red Hat Developer Hub 1.10

product: Red Hat Developer Hub 1.9

product: Red Hat Discovery 2

product: Red Hat Edge Manager 1.1

product: Red Hat Migration Toolkit 1.8

archetype: generic

description: CVE-2026-13676 is fast-uri leftover. GHAD first_patched is 2.4.2 / 3.1.3 / 4.0.1. NVD CPE collapses 2.x into less than 3.1.3.

title: CVE-2026-13676: fast-uri three-train leftover dump

vendor: openjsf

summary: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.


product: UsersWP

summary: The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.

title: Userswp security vulnerability


product: PayU CommercePro Plugin

summary: The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders.

title: Payu Commercepro Plugin security vulnerability


product: Bit Form

summary: The Bit Form WordPress plugin before 3.1.0 does not restrict a form file-field value to a safe path before reading the file and attaching it to a notification email, allowing unauthenticated attackers to read arbitrary server files such as the WordPress configuration file.

title: Bit Form security vulnerability


summary: The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthenticated attackers to re-trigger a form's configured workflow actions such as notification emails and integrations.

title: Bit Form security vulnerability


product: Liman MYS

vendor: HAVELSAN Inc.

summary: Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in HAVELSAN Inc. Liman MYS allows LDAP Injection. This issue affects Liman MYS: before release.Master.1107.


product: undici

vendor: undici

ecosystem: javascript/npm

vendor: nodejs

summary: undici's cache interceptor mishandles malformed Cache-Control private directives. In undici 7.0.0 up to before 7.29.0 and 8.0.0 up to before 8.9.0, a response carrying a degenerate qualified private directive, such as private set to an empty value, can be stored in the default shared cache and later served to a different caller with the same cache key, disclosing private response bodies and headers including Set-Cookie. Separately, a Cache-Control header that combines an unqualified private directive with a qualified one triggers an uncaught TypeError in the cache-control parser, which rejects the request and, depending on the consumer's error handling, can terminate the process. Both issues affect applications using the cache interceptor in shared mode, including the default configuration. The issues are fixed in undici 7.29.0 and 8.9.0.


product: OpenVPN

vendor: OpenVPN

description: CVE-2026-13698 is an OpenVPN memory leak. GHAD vulnerabilities is empty. Leftover 2.5.x dump text is not a catalog floor.

title: CVE-2026-13698: OpenVPN memory leak

product: openvpn

vendor: openvpn

summary: A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote attackers with a valid tls-crypt-v2 client key to potentially cause a denial of service

title: Openvpn security vulnerability


product: Eclipse KUKSA - Databroker

vendor: Eclipse Foundation

product: kuksa

vendor: eclipse

summary: In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.VAL/PublishValue gRPC handler fails to validate the existence of the optional data_point field in PublishValueRequest. When a request contains a valid signal_id but omits data_point, the server directly calls unwrap() on request.data_point, triggering a panic in the Tokio worker thread. This issue can be triggered by any client holding a valid JWT token. Unauthenticated or invalid-token requests are rejected and do not reach the vulnerable path. The panic causes the individual gRPC call to be cancelled but does not terminate the Databroker process, which remains available for subsequent requests.

title: Eclipse Kuksa security vulnerability


product: WooMS

summary: The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

title: Wooms security vulnerability


product: Advanced Excerpt

summary: The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.

title: Advanced Excerpt security vulnerability


product: SEO Redirection Plugin

summary: The SEO Redirection Plugin WordPress plugin before 9.19 does not perform a capability check in one of its authenticated AJAX actions, allowing any logged-in user such as a subscriber to read the site's configured 301 redirect rules, including their source and destination URLs.

title: Seo Redirection Plugin security vulnerability


vendor: stellarwp

summary: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sequoia[introduction][image]' parameter in all versions up to, and including, 4.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Give Worker-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Stellarwp Givewp – Donation Plugin And Fundraising Platform security vulnerability


product: Imager

vendor: TONYC

summary: Imager versions before 1.032 for Perl have a heap out-of-bounds read in the bundled Imager::File::SGI reader via a 16-bit RLE literal run in read_rgb_16_rle. read_rgb_16_rle guards each literal run with if (count > data_left), but count is a pixel count while every 16-bit sample consumes two bytes. The copy loop reads inp[0] * 256 + inp[1] and advances two bytes per pixel, so a run with data_left / 2 < count <= data_left passes the guard yet consumes 2 * count bytes and reads past the end of the buffer. The 8-bit path is unaffected because there one pixel is one byte. Reading a crafted SGI image through Imager->read triggers the over-read before the parser rejects the malformed image, which can crash the process.

title: Tonyc Imager security vulnerability


product: UrlShortener

vendor: Wikimedia Foundation

description: CVE-2026-13706 is improper input validation in MediaWiki UrlShortener. GHSA names no version range and no floor. Do not copy 1.46.0 from CVE-2026-8857.

title: CVE-2026-13706: MediaWiki UrlShortener, No Named Floor

product: mediawiki

vendor: mediawiki

summary: Improper input validation vulnerability in Wikimedia Foundation UrlShortener. This vulnerability is associated with program files includes/UrlShortenerUtils.Php.


product: OAuth

summary: Session fixation vulnerability in Wikimedia Foundation OAuth. This vulnerability is associated with program files src/Backend/MWOAuthServer.Php. This issue affects OAuth: from * through 1.46.0, 1.45.4, 1.44.6, 1.43.9.


summary: Imager::File::JPEG versions before 1.003 for Perl leak heap memory when reading a JPEG with repeated APP13 markers in i_readjpeg_wiol. i_readjpeg_wiol walks the marker list libjpeg returns and, for each APP13 marker, allocates a new buffer with *iptc_itext = mymalloc(...) and overwrites the previous pointer without freeing it. Only the final payload is later turned into a Perl scalar and freed, so a JPEG with N such markers leaks the first N-1 payloads on every read. In a long-lived process, such as an upload or thumbnailing service, repeated reads accumulate these leaks and exhaust available memory, a denial of service. The same handler ships bundled in the Imager distribution, where versions before 1.032 are affected and the fix ships in 1.032.


vendor: jegtheme

summary: The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Box widget's 'sg_body_description' parameter in versions up to, and including, 3.2.6. This is due to insufficient input sanitization and output escaping on the description attribute in the render_body() method of the Image_Box_View class — every other attribute used by the method is wrapped in esc_attr(), but the description value is concatenated directly into HTML body context. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Jegtheme Jeg Kit For Elementor – Powerful Addons For Elementor, Widgets… security vulnerability


product: Divi

vendor: Unknown

summary: The Divi WordPress theme before 5.9.0 does not properly escape some of its Social Media Follow module settings before outputting them in link attributes, allowing users with a role as low as contributor to store JavaScript which will run when a higher privileged user, such as an administrator, views the post.

title: Divi security vulnerability


vendor: TODDR

summary: YAML::Syck versions before 1.47 for Perl allow a use-after-free and double-free via an anchor node freed while still on the parser value stack. In the bundled libsyck, when an anchor name is redefined or removed, syck_hdlr_add_anchor and syck_hdlr_remove_anchor free the node stored under that name with syck_free_node. That node can still be live on the parser's value stack, so syck_hdlr_add_node reaches it again and frees it a second time. On a normal build the 48-byte node chunk is freed twice and the interpreter aborts. Anchors need no special flags, so this is reached on the default Load path, and a 7-byte document that redefines an anchor triggers it. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor mid-parse crashes the interpreter, a denial of service.

title: Toddr Yaml::Syck security vulnerability


summary: The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an API that is enabled by default and authenticated with hardcoded credentials shipped identically across all installations. This makes it possible for unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

title: Realtyna Organic Idx Plugin + Wpl Real Estate security vulnerability


product: Crafty Controller

vendor: Arcadia Technology, LLC

vendor: craftycontrol

summary: Path traversal in server import and admin file upload in Crafty Controller. Allows a remote, authenticated attacker to upload files to arbitrary paths permitted to the Crafty Controller application and perform remote code execution.


product: Red Hat OpenShift AI 3.4

vendor: Red Hat

product: Red Hat OpenShift AI (RHOAI)

summary: A flaw was found in the Red Hat OpenShift AI (RHOAI) MaaS Gateway. Improper configuration of the Gateway in a model-serving context allows a standard user with low privileges to intercept, read, log, and alter all MaaS model traffic. This includes sensitive information such as access keys, input prompts, and outputs, leading to significant information disclosure and data tampering.


product: Fireware OS

vendor: WatchGuard

ecosystem: operating-system

product: fireware

vendor: watchguard

summary: WatchGuard Fireware OS contains a firmware validation bypass when processing a backup image via the backup/restore feature. An authenticated administrator can exploit this vulnerability to install a tampered firmware image.


product: app-builder

vendor: Develar

summary: A vulnerability in the `zipx.Unzip` extraction routine of Develar's app-builder allows an attacker to overwrite arbitrary files on macOS APFS by exploiting a Unicode Normalization Collision combined with symlink following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. As a result, a crafted ZIP archive containing: • a symlink entry named ss pointing to a target file, and • a regular file named ß containing attacker controlled data, will cause the second write to follow the symlink and overwrite the target file.

title: Develar App-Builder security vulnerability


product: Corporate Training Management System

summary: Client-Side Enforcement of Server-Side Security vulnerability in Gobito Informatics Technologies Engineering Industry and Trade Ltd. Co. Corporate Training Management System allows Input Data Manipulation. This issue affects Corporate Training Management System: before dd1a9df64.


summary: The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

title: Dynamic Pricing With Discount Rules For Woocommerce security vulnerability


product: MPG

summary: The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request.

title: Mpg security vulnerability


summary: In exception circumstances, WatchGuard Fireware OS on a FireCluster may use a hard-coded encryption key to encrypt saved credentials for Access Portal resources. This vulnerability does not affect devices that do not support the Access Portal feature or standalone Fireboxes not deployed in a FireCluster.

title: Watchguard Fireware security vulnerability


product: Podlove Podcast Publisher

summary: The Podlove Podcast Publisher WordPress plugin before 4.5.3 does not perform nonce validation on some of its administrative create and delete actions, allowing attackers to create rogue records or delete legitimate ones via a forged request (CSRF) when a logged-in administrator is tricked into visiting a crafted page.

title: Podlove Podcast Publisher security vulnerability


vendor: quantumcloud

description: CVE-2026-13731 stores XSS via the WPBot conversation parameter through 8.4.9. Upgrade chatbot to 8.5.0+.

title: CVE-2026-13731: WPBot Conversation XSS

summary: The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conversation' parameter in all versions up to, and including, 8.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The AJAX nonce required to authenticate the save request is publicly emitted on every frontend page via wp_localize_script, making it freely obtainable by any anonymous visitor and removing any practical barrier to exploitation.

title: Quantumcloud Wpbot – Ai Chatbot For Live Support, Lead Generation, Ai S… security vulnerability


product: Download Manager

summary: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'no_data_msg' Shortcode Attribute in all versions up to, and including, 3.3.60 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Although wp_kses_post is applied to post content on save, it only strips HTML tokens and does not neutralize C-style escape sequences embedded within shortcode attribute values, meaning contributors can craft a payload that survives the kses filter and is silently reconstructed into a raw script tag at render time.

title: Codename065 Download Manager security vulnerability


product: NewPath WildApricotPress Add-on

summary: The NewPath WildApricotPress Add-on WordPress plugin through 1.0.0 does not enforce its members-only field privacy on an unauthenticated REST route, allowing anonymous visitors to read member email addresses and phone numbers that are configured to be visible to members only.

title: Newpath Wildapricotpress Add-On security vulnerability


platforms: Windows Linux

product: Commvault Cloud

vendor: Commvault

summary: CommServe contained an allowlist bypass vulnerability affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.


summary: CommServe contained an authorization bypass vulnerability affecting a limited set of command execution operations. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Media Agents, Clients and HyperScale X.


summary: A legacy endpoint in Command Center contained an unauthenticated server-side request forgery (SSRF) vulnerability related to the handling of arbitrary target URLs. Software customers upgrade to resolved maintenance release. Update Command Center.

title: Commvault Commvault Cloud security vulnerability


vendor: UnitedOver

summary: The Digits: WordPress Mobile Number Signup and Login plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.1.0.5. This is due to missing authorization and role validation in the `dig_update_wpwc_custom_fields()` function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to escalate their privileges to Administrator by submitting a forged `digits_reg_userrole` value during profile update, granted the site administrator has configured the built-in DIGITS User Role field.

title: Unitedover Digits: Wordpress Mobile Number Signup And Login security vulnerability


product: IQ MultiAccess

vendor: Honeywell Technologies

summary: Honeywell IQ MultiAccess, all versions prior to and including version 28, contain an improper digital signature verification vulnerability. An attacker could potentially exploit this vulnerability, leading to the replacement of downloaded file with a malicious one. Honeywell also recommends updating to the most recent version of this product, service, or offering [V27 SP1, V28 SP1]


product: Snowflake CLI

vendor: Snowflake

description: CVE-2026-13744 is Snowflake CLI. GHAD vulnerabilities is empty. Leftover 3.19 is not a catalog floor. Do not invent 3.20.

title: CVE-2026-13744: Snowflake CLI content neutralization

vendor: snowflake

summary: Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.


summary: Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.


summary: Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

title: Snowflake Snowflake Cli security vulnerability


ecosystem: python/pypi

description: CVE-2026-13749 is Snowpark annotation processor. GHAD vulnerabilities is empty. Leftover 3.19 is not a catalog floor.

title: CVE-2026-13749: Snowpark annotation processor callback-template neutralization

summary: Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the user running the CLI. Successful exploitation requires the victim to run the relevant bundling or deployment workflow against attacker-controlled project content, and any resulting code runs with the privileges of that local execution context. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.


summary: Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.


summary: Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. By supplying crafted SQL content processed through a vulnerable command path, an attacker could cause the victim's environment to issue unintended outbound requests to internal or otherwise non-public network locations, and could cause remote SQL content to be retrieved and executed in the context of the victim user's session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges available to that session and environment. The fix is available in Snowflake CLI version 3.19, which adds an option to disable remote URL retrieval.


summary: Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session. Successful exploitation required crafted values to reach vulnerable parameters, including through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI, and impact is limited by the privileges assigned to the active session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.


product: HP 2800 Printer Series

vendor: HP Inc.

summary: A missing authorization vulnerability exists in the embedded webserver of HP Deskjet 2800 Series Printers running firmware version <=TBP1CN2612AR. An unauthenticated attacker with network access can send GET requests to multiple exposed administrative API endpoints and retrieve sensitive configuration data such as plaintext Wi‑Fi Direct credentials, unique device identity information, and other administrative security state details. When accessed through the web interface, these setting pages explicitly require administrator credentials before sensitive information is displayed.

title: Hp Inc. Hp 2800 Printer Series security vulnerability


product: Tickera – Sell Tickets & Manage Events

vendor: tickera

summary: The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all versions up to, and including, 3.6.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

title: Tickera Tickera – Sell Tickets & Manage Events security vulnerability


summary: The Tickera – Sell Tickets & Manage Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'price_wrapper' Shortcode Attribute in all versions up to, and including, 3.6.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution of the injected script is limited to victims who have the referenced ticket ID present in their cart cookie, meaning the payload only fires for users who have previously added that ticket to their cart.


product: WP Grid Builder

vendor: WP Grid Builder

description: CVE-2026-13756 lets a subscriber escalate via the WP Grid Builder key parameter through 2.3.3. Upgrade wp-grid-builder to 2.3.4+.

title: CVE-2026-13756: WP Grid Builder Key Privesc

summary: The WP Grid Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2.3.3. This is due to missing authorization and meta key validation in the `update()` handler for the `/wp-json/wpgb/v2/metadata` REST endpoint. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator by updating their own `wp_capabilities` user meta with a crafted nested array payload.


product: Red Hat Enterprise Linux 10

product: Red Hat Enterprise Linux 9

product: Red Hat Discovery 2

product: Red Hat Hardened Images

product: Red Hat Insights proxy 1.5

product: Red Hat Update Infrastructure 5

product: Red Hat Enterprise Linux 6

product: Red Hat Enterprise Linux 7

product: Red Hat Enterprise Linux 8

product: Red Hat OpenShift Container Platform 4

vendor: redhat

summary: A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

title: A flaw was found in p11-kit


product: WebSphere Extreme Scale

vendor: IBM

description: CVE-2026-13759 is unsafe ObjectInputStream subclasses in WebSphere Extreme Scale (through 8.6.1.6). The title names no next tag. Do not invent 8.6.1.7.

title: CVE-2026-13759: WebSphere Extreme Scale through 8.6.1.6

vendor: ibm

summary: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 ships three ObjectInputStream subclasses (WsObjectInputStream, ObjectStreamPool$ReusableInputStream, ObjectInputStreamResolver) that install no JEP-290 class filter; when Coherence is on the classpath, multiple RCE gadget chains including RemoteConstructor.readResolve and PriorityQueue/ExtractorComparator are confirmed working, allowing a post-login attacker who can write a session attribute or a LAN-adjacent attacker on the grid replication wire to execute arbitrary code on peer WAS JVMs

title: Ibm Websphere Extreme Scale security vulnerability


product: AWS CDK

vendor: AWS

summary: OS command injection in the NodejsFunction Docker bundling pipeline (OsCommand helper) in AWS aws-cdk-lib on all platforms might allow a actor who controls dependency version strings in a project's package.json file to execute arbitrary commands on the host running the CDK toolchain via injected shell metacharacters in the OsCommand helper. This issue requires the actor to control the content of a package.json dependency version string that is processed during Docker-based bundling with nodeModules specified. To remediate this issue, users should upgrade to v2.260.0.

title: Aws Aws Cdk security vulnerability


product: Amazon CloudFront

description: CVE-2026-13762 lets crafted HTTP/2 frames skip AWS WAF body inspection on CloudFront. GHSA names no version and says it was remediated server-side.

title: CVE-2026-13762: CloudFront WAF HTTP/2, No Named Floor

product: cloudfront

vendor: amazon

summary: Inconsistent interpretation of HTTP/2 requests in Amazon CloudFront with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue was remediated server-side. No customer action is required.

title: Amazon Cloudfront security vulnerability


product: AWS Application Load Balancer

description: CVE-2026-13763 lets crafted HTTP/2 frames skip AWS WAF body inspection on ALB. GHSA names no version and points at Inspect after sufficient data.

title: CVE-2026-13763: ALB WAF HTTP/2, No Named Floor

summary: Inconsistent interpretation of HTTP/2 requests in AWS Application Load Balancer with AWS WAF enabled might allow remote actors to bypass AWS WAF managed rule body inspection via crafted HTTP/2 requests that fragment the request body across frames so that only a partial body is inspected. This issue only impacts HTTP/2 ALB target groups. To remediate this issue, customers should enable the "Inspect after sufficient data" target group configuration associated to an ALB load balancer. Refer to: ( https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-target-group-attributes.html#waf-http2-inspection )

title: Amazon Application Load Balancer security vulnerability


vendor: thimpress

summary: The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.4.1 via the check_answer. This makes it possible for unauthenticated attackers to extract the correct-answer markers, full option lists, explanations, and question content for any quiz question on the site — including questions belonging to paid courses the attacker is not enrolled in.

title: Thimpress Learnpress – Wordpress Lms Plugin For Create And Sell Online… security vulnerability


vendor: EXODIST

description: CVE-2026-13766 lets unquoted SQL identifiers inject queries in Perl DBIx::QuickORM before 0.000026. Upgrade to 0.000026+.

title: CVE-2026-13766: DBIx::QuickORM Unquoted Identifier SQLi

summary: DBIx::QuickORM versions before 0.000026 for Perl allow SQL injection via unquoted SQL identifiers. The default SQL builder, a SQL::Abstract subclass, sets bindtype in its constructor but never quote_char, so SQL::Abstract emits identifiers verbatim. Caller-supplied identifiers (order_by, where-clause column keys, field and returning lists, upsert columns, and join aliases) reach the SQL string raw, while values are placeholder-bound and unaffected. A caller that forwards untrusted input to an affected identifier position, such as a user-controlled order_by value, enables SQL injection: the row order can be made to depend on a sub-select over columns the query never selected, and the where and update identifier positions permit further data disclosure and tampering.


product: Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker

vendor: expresstech

summary: The Quiz Master Next plugin for WordPress is vulnerable to SQL Injection via stored quiz page data in versions up to, and including, 11.2.0. This is due to insufficient escaping on the user-supplied 'pages' parameter persisted by the qsm_ajax_save_pages() AJAX handler (sanitize_text_field only) and lack of sufficient preparation on the existing SQL query built in qsm_options_questions_tab_content() at line 143, where the stored page IDs are interpolated into an IN() clause via implode() with no $wpdb->prepare() and no integer casting. This makes it possible for authenticated attackers, with Author-level access and above (who can own a quiz they are entitled to edit), to plant a SQL payload that is executed second-order whenever any user (including an administrator) views the quiz's Questions tab, allowing them to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.


product: Gardyn Home Firmware

vendor: Gardyn

product: Gardyn Studio Firmware

product: Gardyn Cloud API

summary: Gardyn devices expose a privileged iothubowner key. Access to this key will allow a malicious user to invoke an IoTHub Registry Manager function which returns connection information for all Gardyn Home Kit and Studio devices. Access to this key also allows a malicious user to execute arbitrary commands on a specific connected device and may allow the malicious user to pivot to other devices on the user's network.


product: AWS CLI

summary: Overly permissive file permissions in AWS CLI before 1.44.78 (v1) and 2.34.29 (v2) on Unix-like systems where the umask has not been configured to restrict file permissions (the default on most systems) may allow other local users on the same host to read credentials written by certain CLI subcommands (aws codeartifact login, aws iam create-virtual-mfa-device, aws deploy register). To remediate this issue, users should upgrade to AWS CLI 1.44.78 (v1) or 2.34.29 (v2) or later.

title: Aws Aws Cli security vulnerability


product: Customer Reviews for WooCommerce

vendor: ivole

summary: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'color' Shortcode Attribute in all versions up to, and including, 5.113.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

title: Ivole Customer Reviews For Woocommerce security vulnerability


description: CVE-2026-13772 is Object Query Language attacker-controlled resolve in WebSphere Extreme Scale (through 8.6.1.6). The title names no next tag. Do not invent 8.6.1.7.

title: CVE-2026-13772: WebSphere Extreme Scale through 8.6.1.6

summary: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 's Object Query Language engine resolves attacker-supplied class names via Class.forName() and invokes their constructors with no allow-list at three distinct sinks (SELECT NEW, enum literals, and reflection-based comparators); an authenticated remote attacker who can influence an application-built OQL query string can execute arbitrary constructors on the WAS JVM, and a SELECT DISTINCT variant using planted grid values fires the same gadget post-readObject in a manner that survives JEP-290 serialization filters across grid node boundaries


summary: IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 Approximately 50 generated CORBA stub classes in WebSphere eXtreme Scale's ogclient.jar call ORB.string_to_object() on an attacker-controlled IOR string during Java deserialization, turning any unfiltered ObjectInputStream sink in WAS into outbound IIOP SSRF to an attacker-chosen host; when chained with the IBM ORB's getUserException class-instantiation flaw (WAS-26), this SSRF escalates to remote code execution on the calling JVM.


product: Chrome

vendor: Google

ecosystem: browser

description: CVE-2026-13774 is use after free in extensions in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13774: Chrome UAF Extensions

product: chrome

vendor: google

summary: Use after free in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13775 is use after free in gpu in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13775: Chrome UAF GPU

summary: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13776 is type confusion in dawn in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13776: Chrome type confusion Dawn

summary: Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13777 is insufficient validation of untrusted input in iosweb in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13777: Chrome input validation iOSWeb

summary: Insufficient validation of untrusted input in iOSWeb in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13778 is use after free in webusb in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13778: Chrome UAF WebUSB

summary: Use after free in WebUSB in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code via a malicious peripheral. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13779 is use after free in chromoting in Google Chrome on ChromeOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13779: Chrome UAF Chromoting

summary: Use after free in Chromoting in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13780 is insufficient validation of untrusted input in angle in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13780: Chrome input validation ANGLE

summary: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13781 is insufficient validation of untrusted input in skia in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13781: Chrome input validation Skia

summary: Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13782 is use after free in browser in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13782: Chrome UAF Browser

summary: Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13783 is use after free in views in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13783: Chrome UAF Views

summary: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


title: Google Chrome security vulnerability


summary: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13786 is use after free in ozone in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13786: Chrome UAF Ozone

summary: Use after free in Ozone in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)


description: CVE-2026-13787 is use after free in chromoting in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13787: Chrome UAF Chromoting

summary: Use after free in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


description: CVE-2026-13788 is use after free in fullscreen in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13788: Chrome UAF Fullscreen

summary: Use after free in Fullscreen in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)

title: Google Chrome security vulnerability


summary: Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in Scroll in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13791 is insufficient validation of untrusted input in downloads in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13791: Chrome input validation Downloads

summary: Insufficient validation of untrusted input in Downloads in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13794 is insufficient validation of untrusted input in webappinstalls in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13794: Chrome input validation on Windows

summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13797 is insufficient validation of untrusted input in chromecast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13797: Chrome input validation Chromecast

summary: Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13798 is heap buffer overflow in chromecast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13798: Chrome heap overflow Chromecast

summary: Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13799 is use after free in quic in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13799: Chrome UAF QUIC

summary: Use after free in QUIC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13800 is inappropriate implementation in updater in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13800: Chrome implementation Updater

summary: Inappropriate implementation in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13801 is integer overflow in chromecast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13801: Chrome integer overflow Chromecast

title: Google Chrome security vulnerability


description: CVE-2026-13802 is use after free in views in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13802: Chrome UAF Views

summary: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13803 is type confusion in chrome tabs in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13803: Chrome type confusion Chrome Tabs

summary: Type Confusion in Chrome Tabs in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13804 is use after free in chromecast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13804: Chrome UAF Chromecast

summary: Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13805 is use after free in gfx in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13805: Chrome UAF GFX

summary: Use after free in GFX in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13806 is insufficient validation of untrusted input in accessibility in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13806: Chrome input validation Accessibility

summary: Insufficient validation of untrusted input in Accessibility in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13807 is use after free in import in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13807: Chrome UAF Import

summary: Use after free in Import in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient data validation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via physical access to the device. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in Safe Browsing in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Input in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13811 is use after free in ime in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13811: Chrome UAF IME

summary: Use after free in IME in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13813 is insufficient policy enforcement in chrome for ios in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13813: Chrome policy Chrome for iOS

summary: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13814 is use after free in views in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13814: Chrome UAF Views

summary: Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13815 is use after free in blink in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13815: Chrome UAF Blink

summary: Use after free in Blink in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in File Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13817 is insufficient validation of untrusted input in glic in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13817: Chrome input validation Glic

summary: Insufficient validation of untrusted input in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13819 is out of bounds read in angle in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13819: Chrome OOB read ANGLE

summary: Out of bounds read in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Out of bounds read in Skia in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13821 is use after free in canvas in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13821: Chrome UAF Canvas

summary: Use after free in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Extensions in Google Chrome on Android prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13823 is use after free in glic in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13823: Chrome UAF Glic

summary: Use after free in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13824 is insufficient policy enforcement in extensions in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13824: Chrome policy Extensions

summary: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13825 is uninitialized use in dawn in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13825: Chrome uninitialized use Dawn

summary: Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13827 is use after free in updater in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13827: Chrome UAF Updater

summary: Use after free in Updater in Google Chrome on Mac prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13829 is insufficient validation of untrusted input in settings in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13829: Chrome input validation Settings

summary: Insufficient validation of untrusted input in Settings in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13830 is use after free in chromoting in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13830: Chrome UAF Chromoting

summary: Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13831 is out of bounds read and write in gpu in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13831: Chrome OOB read

summary: Out of bounds read and write in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13832 is use after free in headless in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13832: Chrome UAF Headless

summary: Use after free in Headless in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Uninitialized Use in ANGLE in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13834 is insufficient validation of untrusted input in angle in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13834: Chrome input validation ANGLE

summary: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13835 is inappropriate implementation in xml in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13835: Chrome implementation XML

summary: Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Canvas in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13841 is integer overflow in skia in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13841: Chrome integer overflow Skia

summary: Integer overflow in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13843 is insufficient validation of untrusted input in chrome for ios in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13843: Chrome input validation Chrome for iOS

summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13844 is use after free in updater in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13844: Chrome UAF Updater

summary: Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13845 is use after free in dom in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13845: Chrome UAF DOM

summary: Use after free in DOM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13846 is use after free in usb in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13846: Chrome UAF USB

summary: Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13848 is use after free in forms in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13848: Chrome UAF Forms

summary: Use after free in Forms in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13849 is insufficient validation of untrusted input in chromoting in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13849: Chrome input validation Chromoting

summary: Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13850 is insufficient validation of untrusted input in chrome for ios in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13850: Chrome input validation Chrome for iOS

summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a local attacker to execute arbitrary code inside a sandbox via a malicious file. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13851 is insufficient validation of untrusted input in webappinstalls in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13851: Chrome input validation on Android

summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13852 is insufficient validation of untrusted input in webappinstalls in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13852: Chrome input validation on Android

title: Google Chrome security vulnerability


description: CVE-2026-13853 is use after free in journeys in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13853: Chrome UAF Journeys

summary: Use after free in Journeys in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13854 is use after free in ozone in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13854: Chrome UAF Ozone

summary: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13855 is use after free in ozone in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13855: Chrome UAF Ozone

summary: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

title: Google Chrome security vulnerability


description: CVE-2026-13856 is insufficient validation of untrusted input in speech in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13856: Chrome input validation Speech

summary: Insufficient validation of untrusted input in Speech in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Geometry in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Out of bounds read in FFmpeg in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted video file. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13859 is inappropriate implementation in angle in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13859: Chrome implementation ANGLE

summary: Inappropriate implementation in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Autofill in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13861 is use after free in core in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13861: Chrome UAF Core

summary: Use after free in Core in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Web Authentication (Passkeys & Security Keys) in Google Chrome on iOS prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13863 is insufficient validation of untrusted input in customtabs in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13863: Chrome input validation CustomTabs

summary: Insufficient validation of untrusted input in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13864 is insufficient policy enforcement in webhid in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13864: Chrome policy WebHID

summary: Insufficient policy enforcement in WebHID in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Network in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13869 is use after free in device in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13869: Chrome UAF Device

summary: Use after free in Device in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13870 is use after free in webview in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13870: Chrome UAF WebView

summary: Use after free in WebView in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in GuestView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13872 is insufficient validation of untrusted input in webappinstalls in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13872: Chrome input validation on Android

summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Out of bounds read in Layout in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in GPU in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to bypass content security policy via malicious network traffic. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13878 is use after free in bluetooth in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13878: Chrome UAF Bluetooth

summary: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Use after free in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-13880 is use after free in usb in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-13880: Chrome UAF USB

summary: Use after free in USB in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability