Export limit exceeded: 398232 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (100964 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-62246 | 1 Clastix | 1 Kamaji | 2026-07-31 | 8.5 High |
| Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, Kamaji derives a TenantControlPlane datastore schema, database user, and etcd key prefix from a lossy namespace-and-name normalization in GetDefaultDatastoreSchema() and GetDefaultDatastoreUsername(), allowing distinct tenants with colliding normalized identifiers to share control-plane state and read, modify, or destroy another tenant's Kubernetes data. This issue is fixed in version 26.7.4-edge. | ||||
| CVE-2026-61536 | 1 Masci | 1 Banks | 2026-07-31 | 7.5 High |
| Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of {% completion %} blocks and later resolves their import_path field through importlib.import_module(...) + getattr(...) to obtain the callable that handles a tool call. There is no allowlist or sanitization on import_path, so any importable Python attribute (e.g. os.system, subprocess.getoutput) can be selected. When the LLM emits a tool_calls entry whose function.name matches the attacker-supplied tool name, the resolved callable is invoked with kwargs decoded from tool_call.function.arguments, yielding arbitrary code execution in the banks-hosting process. This is distinct from GHSA-gphh-9q3h-jgpp / CVE-2026-44209. That advisory was fixed in 2.4.2 by switching src/banks/env.py from Environment to SandboxedEnvironment. The fix does not touch src/banks/extensions/completion.py, and the unsafe import + getattr chain still executes on 2.4.2. The malicious Tool JSON is plain text in the rendered template body — it requires no Jinja attribute access, so the sandbox is irrelevant. This issue has been fixed in version 2.4.3. | ||||
| CVE-2026-17654 | 2 Apple, Google | 2 Macos, Chrome | 2026-07-31 | 7.8 High |
| Race in Updater in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Critical) | ||||
| CVE-2026-17657 | 1 Google | 1 Chrome | 2026-07-31 | 8.3 High |
| Use after free in Navigation in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17658 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Use after free in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17660 | 1 Google | 1 Chrome | 2026-07-31 | 8.3 High |
| Insufficient validation of untrusted input in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17661 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Use after free in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-12945 | 2 Ibm, Langflow | 2 Langflow Oss, Langflow | 2026-07-31 | 7.1 High |
| IBM Langflow OSS 1.0.0 through 1.10.1 allows authenticated users to access and manipulate other users' build jobs through improper access control on log retrieval and unauthenticated build endpoints. | ||||
| CVE-2026-67349 | 1 Opencost | 1 Opencost | 2026-07-31 | 7.5 High |
| OpenCost before 1.121.0 fails to authenticate the GET /helmValues endpoint, exposing base64-decoded HELM_VALUES environment variable containing cloud provider credentials. Additionally, adminAuthMiddleware fails open when ADMIN_TOKEN is unset, allowing unauthenticated attackers to modify GCP service account keys via POST /serviceKey to redirect billing calls. | ||||
| CVE-2026-67351 | 1 S9y | 1 Serendipity | 2026-07-31 | 8.8 High |
| Serendipity before 2.6.1 contains an authentication context confusion vulnerability where password validation and session loading operate independently without ensuring both use the same user record. An authenticated Editor can create a username collision with an Administrator account and obtain administrative privileges by logging in with their own password while the session loads the Administrator's account data. | ||||
| CVE-2026-44106 | 2 Phoenix Contact, Phoenixcontact | 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more | 2026-07-31 | 7.8 High |
| A privilege escalation vulnerability in the init-script for user-applications allows a low-privileged local user to execute arbitrary commands as root, resulting in full system compromise. | ||||
| CVE-2026-44096 | 2 Phoenix Contact, Phoenixcontact | 8 Charx Sec 3000, Charx Sec 3050, Charx Sec 3100 and 5 more | 2026-07-31 | 7.8 High |
| A privilege escalation vulnerability in udhcpc allows a local user "charx-web" to execute arbitrary commands as root, resulting in full system compromise. | ||||
| CVE-2026-17685 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Use after free in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17694 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Use after free in DOM in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-17751 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Inappropriate implementation in AdFilter in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17811 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-07-31 | 7.1 High |
| Use after free in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17816 | 1 Google | 2 Android, Chrome | 2026-07-31 | 7.5 High |
| Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17784 | 2 Apple, Google | 2 Macos, Chrome | 2026-07-31 | 8.8 High |
| Use after free in Audio in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17971 | 1 Google | 1 Chrome | 2026-07-31 | 8.8 High |
| Inappropriate implementation in Frame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-17995 | 1 Google | 1 Chrome | 2026-07-31 | 8.1 High |
| Out of bounds read in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low) | ||||