2026 CVEs (page 119)
Page 119 of 665 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81647 | Medium | 5.3 | 2026-09-09 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-81646 | Medium | 5.9 | 2026-09-09 | Out-of-bounds read vulnerability in the graphics module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-81644 | Medium | 4.3 | 2026-09-09 | DoS vulnerability in the preview service module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-7804 | Medium | 6.1 | 2026-09-09 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter in all versions up t… |
CVE-2026-77187 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in a… |
CVE-2026-77186 | Medium | 6.4 | 2026-09-09 | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions… |
CVE-2026-75966 | Medium | 6.4 | 2026-09-09 | The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter in all ver… |
CVE-2026-6485 | High | 8.2 | 2026-09-09 | UEFI BIOS embedded Shell could be used to bypass Secure Boot via shell commands or startup scripts. |
CVE-2026-57825 | Medium | 5.7 | 2026-09-09 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files. |
CVE-2026-49315 | High | 7.1 | 2026-09-09 | DoS vulnerability in the input device module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49314 | High | 7.3 | 2026-09-09 | OOB write vulnerability in the rendering and composition module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49313 | Medium | 5.5 | 2026-09-09 | Permission control vulnerability in the app lock module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49312 | Medium | 4.0 | 2026-09-09 | Permission control vulnerability in the window module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49311 | Medium | 6.2 | 2026-09-09 | Permission control vulnerability in the event notification module.Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-49310 | High | 8.6 | 2026-09-09 | Permission control vulnerability in the event notification module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-49309 | Medium | 4.8 | 2026-09-09 | Permission control vulnerability in the Settings module. Impact: Successful exploitation of this vulnerability may affect service confidentiality. |
CVE-2026-41987 | Medium | 6.2 | 2026-09-09 | Permission control vulnerability in the app management module. Impact: Successful exploitation of this vulnerability may affect availability. |
CVE-2026-19944 | Medium | 4.9 | 2026-09-09 | The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and including, 2.2.1 due to… |
CVE-2026-19800 | Medium | 4.9 | 2026-09-09 | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via the 'status' paramet… |
CVE-2026-19797 | Medium | 6.1 | 2026-09-09 | The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all versions up to, and i… |
CVE-2026-17553 | High | 7.2 | 2026-09-09 | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_ajax_save_page_defaul… |
CVE-2026-12855 | High | 8.2 | 2026-09-09 | Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP projects. |
CVE-2026-11363 | Medium | 6.6 | 2026-09-09 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including… |
CVE-2026-87088 | High | 7.0 | 2026-09-09 | Tanium addressed an unauthorized code execution vulnerability in Enforce. |
CVE-2026-87084 | High | 7.7 | 2026-09-09 | Tanium addressed a server-side request forgery vulnerability in Enforce. |
CVE-2026-87075 | High | 8.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87073 | Medium | 6.5 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87072 | High | 7.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87048 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87047 | Medium | 6.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87046 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87037 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87036 | High | 8.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87035 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Comply. |
CVE-2026-87034 | High | 8.3 | 2026-09-09 | Tanium addressed a SQL injection vulnerability in Comply. |
CVE-2026-87033 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87032 | Medium | 4.3 | 2026-09-09 | Tanium addressed an information disclosure vulnerability in Tanium Server. |
CVE-2026-87030 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-87025 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87023 | High | 8.5 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Comply. |
CVE-2026-87021 | High | 7.2 | 2026-09-09 | Tanium addressed an unauthorized code execution vulnerability in Comply. |
CVE-2026-87019 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-76801 | High | 8.8 | 2026-09-09 | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code Execution in all v… |
CVE-2026-15667 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-15406 | High | 7.5 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up… |
CVE-2026-14892 | Medium | 4.3 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Tanium Server. |
CVE-2026-14505 | Medium | 6.6 | 2026-09-09 | Tanium addressed a path traversal vulnerability in Tanium Data Service. |
CVE-2026-13709 | Medium | 6.4 | 2026-09-09 | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setti… |
CVE-2026-13359 | High | 7.2 | 2026-09-09 | The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrm_c… |
CVE-2026-12956 | Medium | 5.3 | 2026-09-09 | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() hand… |
CVE-2026-87724 | Medium | 6.5 | 2026-09-09 | Tor before 0.4.9.12 interprets the CC_RESPONSE extension even when CC_REQUEST was not sent, which allows remote attackers to cause a denial of service (crash)… |
CVE-2026-87083 | Medium | 5.5 | 2026-09-09 | A weakness has been identified in tile-ai tilelang up to 0.1.14. This impacts the function KernelCache._load_kernel_from_disk of the file tilelang/cache/kernel… |
CVE-2026-87658 | Medium | 4.3 | 2026-09-09 | Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via… |
CVE-2026-87657 | Low | 3.1 | 2026-09-09 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory inside the sandb… |
CVE-2026-87656 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87655 | Medium | 5.4 | 2026-09-09 | Clickjacking in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HT… |
CVE-2026-87654 | Critical | 9.6 | 2026-09-09 | Buffer overflow in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-87653 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in FullScreen in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page… |
CVE-2026-87652 | Low | 3.1 | 2026-09-09 | Incorrect authorization in PushAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web ori… |
CVE-2026-87651 | Medium | 4.3 | 2026-09-09 | Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87650 | Critical | 9.6 | 2026-09-09 | Out of bounds read in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a c… |
CVE-2026-87649 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restr… |
CVE-2026-87648 | High | 8.3 | 2026-09-09 | Use after free in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2026-87647 | Low | 3.4 | 2026-09-09 | Uninitialized resource in GPU in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside… |
CVE-2026-87646 | Critical | 9.6 | 2026-09-09 | Use after free in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a craf… |
CVE-2026-87645 | Medium | 5.4 | 2026-09-09 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted… |
CVE-2026-87644 | High | 8.3 | 2026-09-09 | Incorrect authorization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and l… |
CVE-2026-87643 | Critical | 9.6 | 2026-09-09 | Integer overflow in GPU in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandb… |
CVE-2026-87642 | Medium | 4.3 | 2026-09-09 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium… |
CVE-2026-87641 | Medium | 4.2 | 2026-09-09 | Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Chro… |
CVE-2026-87640 | Medium | 6.1 | 2026-09-09 | Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read… |
CVE-2026-87639 | High | 8.3 | 2026-09-09 | Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execut… |
CVE-2026-87638 | Critical | 9.6 | 2026-09-09 | Out of bounds write in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a… |
CVE-2026-87637 | Critical | 9.6 | 2026-09-09 | Use after free in Extensions in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a cr… |
CVE-2026-87636 | High | 8.8 | 2026-09-09 | Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted… |
CVE-2026-87635 | Medium | 5.4 | 2026-09-09 | UI misrepresentation in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium secu… |
CVE-2026-87634 | Critical | 9.6 | 2026-09-09 | Use after free in WebPackaging in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via… |
CVE-2026-87633 | High | 8.6 | 2026-09-09 | Use after free in Views in Google Chrome prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via UI Interaction. (Chr… |
CVE-2026-87632 | Medium | 4.3 | 2026-09-09 | Cross-site scripting in SanitizerAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Ch… |
CVE-2026-87631 | Medium | 6.5 | 2026-09-09 | Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML pag… |
CVE-2026-87630 | Medium | 4.3 | 2026-09-09 | Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromi… |
CVE-2026-87629 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in Sources in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to leak sensitive informatio… |
CVE-2026-87628 | High | 8.3 | 2026-09-09 | Use after free in Cast in Google Chrome prior to 153.0.8010.36 allowed an adjacent attacker to potentially execute arbitrary code outside the sandbox via craft… |
CVE-2026-87627 | Medium | 6.5 | 2026-09-09 | Interpretation conflict in Safebrowsing in Google Chrome on on Mac prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys… |
CVE-2026-87626 | Medium | 6.5 | 2026-09-09 | Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via craf… |
CVE-2026-87625 | High | 8.8 | 2026-09-09 | Use after free in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandb… |
CVE-2026-87624 | Medium | 4.2 | 2026-09-09 | UI misrepresentation in Passwords in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to s… |
CVE-2026-87623 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain sensitive information v… |
CVE-2026-87622 | Medium | 4.3 | 2026-09-09 | Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… |
CVE-2026-87621 | Critical | 9.6 | 2026-09-09 | Out of bounds write in ANGLE in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the… |
CVE-2026-87620 | Medium | 6.5 | 2026-09-09 | Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chrom… |
CVE-2026-87619 | Medium | 4.3 | 2026-09-09 | Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromi… |
CVE-2026-87618 | High | 8.3 | 2026-09-09 | Incorrect reference resolution in Storage in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proc… |
CVE-2026-87617 | High | 8.8 | 2026-09-09 | Use after free in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the… |
CVE-2026-87616 | High | 8.3 | 2026-09-09 | Improper initialization in Views in Google Chrome on on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and l… |
CVE-2026-87615 | Medium | 5.4 | 2026-09-09 | Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted H… |
CVE-2026-87614 | Low | 3.1 | 2026-09-09 | Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass w… |
CVE-2026-87613 | Critical | 9.0 | 2026-09-09 | Incorrect reference resolution in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside th… |
CVE-2026-87612 | High | 8.8 | 2026-09-09 | Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (C… |
CVE-2026-87611 | Low | 3.1 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-… |