CVE-2026-15141 | | | 2026-08-12 | The web
interface of the affected
device relies on the HTTP referrer header as part of
request validation. Requests containing empty Referer value, or omittin… |
CVE-2026-73419 | Medium | 6.8 | 2026-08-12 | NextAuth.js provides authentication for Next.js. Prior to@auth/core 0.41.3 and next-auth 4.24.15 and 5.0.0-beta.32, Auth.js stores the OAuth/OIDC anti-CSRF che… |
CVE-2026-18676 | | | 2026-08-12 | The default kuma-cp configuration in Kong Mesh reveals the admin bootstrap token and signing keys to any webpage the operator visits while the control plane is… |
CVE-2026-18847 | High | 8.8 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote unauthenticated attacker to harvest credentials due to spoofing of Navigator for i. |
CVE-2026-18098 | High | 8.1 | 2026-08-12 | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to obtain sensitive information and compromise system integrity due to an XML injectio… |
CVE-2026-56179 | High | 8.3 | 2026-08-11 | Origin validation error in Windows Network Address Translation (NAT) allows an unauthorized attacker to perform spoofing over an adjacent network. |
CVE-2026-19418 | | | 2026-08-11 | The referrer enforcement introduced with TYPO3-CORE-SA-2020-006 (CVE-2020-11069) became ineffective in TYPO3 v13.0, where TYPO3 CMS started serving the backend… |
CVE-2026-46409 | Critical | 9.6 | 2026-08-07 | OpenYak is a local-first agent runtime for reliable tool-using models, with a desktop workspace built on top. Prior to version 1.1.3, the OpenYak desktop backe… |
CVE-2026-47194 | | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request H… |
CVE-2026-66732 | Medium | 5.9 | 2026-08-06 | Sonic 3 A.I.R. before commit 2492d18 contains a missing source address validation vulnerability in ConnectionManager where established connections are resolved… |
CVE-2026-66298 | High | 8.8 | 2026-08-05 | Origin Validation Error vulnerability in livebook-dev livebook allows untrusted notebook output JavaScript to trigger session-wide keyboard shortcuts, includin… |
CVE-2026-70599 | Medium | 5.9 | 2026-08-05 | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.7, 40.9.0, 41.2.0, and 42.0.0-beta.1, ser… |
CVE-2026-16442 | High | 7.4 | 2026-08-05 | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the Id… |
CVE-2026-15587 | | | 2026-08-05 | Improper Privilege Management in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to escalate… |
CVE-2026-66322 | High | 7.1 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66318 | High | 8.1 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-66317 | Medium | 5.4 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering over a network. |
CVE-2026-66316 | Medium | 5.4 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-66313 | Medium | 6.8 | 2026-08-04 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. |
CVE-2026-69245 | Medium | 6.5 | 2026-08-03 | Guzzle is an extensible PHP HTTP client. Prior to 7.15.2 and 8.0.1, SetCookie::matchesDomain() gives every subdomain of a cookie Domain that cookie unless SetC… |
CVE-2026-48063 | | | 2026-08-03 | Baileys is a cocket-based TS/JavaScript API for WhatsApp Web. In versions prior to both 6.7.22 and 7.0.0-rc12, any Baileys session can be sent a malicious pay… |
CVE-2026-66420 | High | 8.8 | 2026-07-30 | MeshCentral 1.1.21 contains a cross-site WebSocket hijacking protection bypass vulnerability that allows unauthenticated remote attackers to hijack authenticat… |
CVE-2026-18016 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted… |
CVE-2026-18000 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17997 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cr… |
CVE-2026-17984 | Low | 3.3 | 2026-07-30 | Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17981 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17977 | Medium | 4.3 | 2026-07-30 | Policy bypass in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security se… |
CVE-2026-17963 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-17959 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-17957 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in CORS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2026-17954 | Medium | 4.3 | 2026-07-30 | Policy bypass in MHTML in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted MHTML page. (Chromium security… |
CVE-2026-17933 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in DOMStorage in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17927 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2026-17925 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HT… |
CVE-2026-17916 | High | 7.5 | 2026-07-30 | Insufficient policy enforcement in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perfo… |
CVE-2026-17911 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-17910 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17905 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in SurfaceCapture in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML p… |
CVE-2026-17904 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTM… |
CVE-2026-17900 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Enterprise in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a malicio… |
CVE-2026-17897 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in ORB in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-17895 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in DataTransfer in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2026-17885 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Paint in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17883 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Headless in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-17880 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17879 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17876 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17871 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-17857 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (C… |
CVE-2026-17854 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML pag… |
CVE-2026-17852 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML… |
CVE-2026-17850 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML p… |
CVE-2026-17846 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Media in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to… |
CVE-2026-17843 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-17842 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-17833 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17829 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-17826 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in speci… |
CVE-2026-17823 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-17820 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17817 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17815 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pag… |
CVE-2026-17798 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Cast in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chro… |
CVE-2026-17788 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chr… |
CVE-2026-17787 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page… |
CVE-2026-17783 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Loader in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Ch… |
CVE-2026-17777 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17775 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in PresentationAPI in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17765 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in WebProtect in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak c… |
CVE-2026-17763 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in GPU in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-or… |
CVE-2026-17762 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2026-17754 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (… |
CVE-2026-17753 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (… |
CVE-2026-17748 | Medium | 6.5 | 2026-07-30 | Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to bypass… |
CVE-2026-17743 | Medium | 6.5 | 2026-07-30 | Insufficient policy enforcement in ControlledFrame in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted… |
CVE-2026-17742 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-17733 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2026-17732 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in SVG in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chrom… |
CVE-2026-17731 | Medium | 4.3 | 2026-07-30 | Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2026-17720 | Low | 3.1 | 2026-07-30 | Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak… |
CVE-2026-17715 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2026-17702 | Low | 3.1 | 2026-07-30 | Inappropriate implementation in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-o… |
CVE-2026-17693 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in FileSystem in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML pa… |
CVE-2026-17662 | Medium | 4.3 | 2026-07-30 | Insufficient policy enforcement in Prefetch in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page… |
CVE-2026-6102 | High | 7.8 | 2026-07-29 | MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on af… |
CVE-2026-63118 | | | 2026-07-29 | MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the… |
CVE-2026-54605 | High | 7.2 | 2026-07-28 | OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw… |
CVE-2026-57989 | High | 7.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network. |
CVE-2026-57978 | Medium | 5.4 | 2026-07-26 | Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. |
CVE-2026-16745 | High | 8.8 | 2026-07-23 | A flaw was found in odh-dashboard, the web console component of Red Hat OpenShift AI (RHOAI). Due to incorrect network binding, a malicious actor within the cl… |
CVE-2026-13321 | High | 8.6 | 2026-07-22 | The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.
This issue affects BIND 9 versions 9… |
CVE-2026-16399 | High | 7.5 | 2026-07-21 | Site isolation issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16398 | High | 7.5 | 2026-07-21 | Site isolation issue in the Graphics component. This vulnerability was fixed in Firefox 153 and Thunderbird 153. |
CVE-2026-16387 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.13. |
CVE-2026-16381 | Critical | 9.1 | 2026-07-21 | Same-origin policy bypass in the Networking: DNS component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 1… |
CVE-2026-16375 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Networking: HTTP component. This vulnerability was fixed in Firefox 153, Firefox ESR 140.13, Thunderbird 153, and Thunderbird 140.1… |
CVE-2026-16358 | Critical | 9.8 | 2026-07-21 | Site isolation issue in the Graphics: WebRender component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 153… |
CVE-2026-16349 | Critical | 9.8 | 2026-07-21 | Same-origin policy bypass in the DOM: Navigation component. This vulnerability was fixed in Firefox 153, Firefox ESR 115.38, Firefox ESR 140.13, Thunderbird 15… |
CVE-2026-46701 | High | 7.6 | 2026-07-20 | Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_M… |