Export limit exceeded: 389576 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (389576 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87636 | 1 Google | 1 Chrome | 2026-09-09 | 8.8 High |
| Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87536 | 2026-09-09 | 8.8 High | ||
| Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-87455 | 1 Google | 1 Chrome | 2026-09-09 | 9.6 Critical |
| Use after free in Aura in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87448 | 1 Google | 1 Chrome | 2026-09-09 | 9.6 Critical |
| Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-87478 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87479 | 1 Google | 1 Chrome | 2026-09-09 | 8.3 High |
| Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87454 | 2 Google, Microsoft | 2 Chrome, Windows | 2026-09-09 | 6.5 Medium |
| Information leak in Enterprise in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87439 | 1 Google | 1 Chrome | 2026-09-09 | 5.3 Medium |
| Information leak in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87435 | 1 Google | 1 Chrome | 2026-09-09 | 5.3 Medium |
| Information leak in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-69839 | 1 Microsoft | 14 Windows 10 1607, Windows 10 1809, Windows Server 2012 and 11 more | 2026-09-09 | 6.5 Medium |
| Uncaught exception in Windows iSCSI Target Service allows an authorized attacker to deny service over a network. | ||||
| CVE-2026-87929 | 1 Max-3000 | 1 Maxsite Cms | 2026-09-09 | 9.8 Critical |
| MaxSite CMS through 109.6 ships with a hardcoded session encryption key in application/config/config.php that is never changed during installation, allowing unauthenticated attackers to forge administrator session cookies. Attackers can mint a malicious ci_session cookie with administrator privileges by computing an HMAC-SHA1 using the publicly known encryption key, bypassing authentication checks in is_login() and mso_check_allow() functions. | ||||
| CVE-2026-87928 | 1 Max-3000 | 1 Maxsite Cms | 2026-09-09 | 5.4 Medium |
| MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged-in user to upload HTML files. Attackers can upload HTML containing malicious scripts to the uploads/_pages/ directory, which executes in visitors' browsers when the file is accessed, enabling persistent stored cross-site scripting attacks. | ||||
| CVE-2026-87444 | 1 Google | 1 Chrome | 2026-09-09 | 8.8 High |
| Memory corruption in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-87443 | 1 Google | 1 Chrome | 2026-09-09 | 6.5 Medium |
| Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-87440 | 1 Google | 1 Chrome | 2026-09-09 | 8.8 High |
| Out of bounds read in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | ||||
| CVE-2026-87430 | 1 Google | 1 Chrome | 2026-09-09 | 8.8 High |
| Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low) | ||||
| CVE-2026-85730 | 1 Squirrelchat | 1 Smol-toml | 2026-09-09 | 7.5 High |
| smol-toml is a small, fast, and correct TOML parser and serializer. Prior to 1.7.1, parse() can enter an infinite loop when a value inside an array or inline table is followed by a comment with no trailing newline. In src/util.ts, skipUntil() calls indexOfNewline(), receives -1 at the end of input, and resets the cursor to the beginning of the string instead of leaving the structure scan. The parser then hangs indefinitely and can consume a service's processing capacity when an application parses attacker-controlled TOML. This issue is fixed in version 1.7.1. | ||||
| CVE-2026-0291 | 3 Linux, Palo Alto Networks, Paloaltonetworks | 3 Linux Kernel, Prisma Access Agent, Prisma Access Agent | 2026-09-09 | 4.4 Medium |
| An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access Agent on Linux platforms that enables a local low privileged user to delete system files in a limited scope and disable Prisma Access Agent. The Prisma Access Agent on macOS, Windows, iOS, Android, and Chrome OS is not affected. | ||||
| CVE-2026-0294 | 4 Apple, Microsoft, Palo Alto Networks and 1 more | 4 Macos, Windows, Prisma Access Agent and 1 more | 2026-09-09 | 7.8 High |
| A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and macOS devices enables a local user to execute code with elevated privileges. The Prisma Access Agent on Linux, iOS, Android, and ChromeOS is not affected. | ||||
| CVE-2026-0293 | 3 Microsoft, Palo Alto Networks, Paloaltonetworks | 3 Windows, Prisma Access Agent, Prisma Access Agent | 2026-09-09 | 6.0 Medium |
| A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administrator privileges to bypass the anti-tamper protection, enabling unauthorized access to protected processes and files. The Prisma Access Agent on Linux, macOS, iOS, Android, and Chrome OS is not affected. | ||||