2026 CVEs (page 235)
Page 235 of 469 — CVEs published in 2026, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-11646 | High | 8.8 | 2026-06-09 | Use after free in ViewTransitions in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted H… |
CVE-2026-11645 | High | 8.8 | 2026-06-09 | Out of bounds read and write in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted… |
CVE-2026-11644 | High | 7.5 | 2026-06-09 | Use after free in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed an attacker who convinced a user to install a malicious extension to execute… |
CVE-2026-11643 | High | 8.1 | 2026-06-09 | Use after free in Proxy in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium s… |
CVE-2026-11642 | High | 8.3 | 2026-06-09 | Use after free in Web Apps in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-11641 | High | 7.5 | 2026-06-09 | Use after free in Bluetooth in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gesture… |
CVE-2026-11640 | High | 8.3 | 2026-06-09 | Integer overflow in libyuv in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a… |
CVE-2026-11639 | High | 7.5 | 2026-06-09 | Use after free in Compositing in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chr… |
CVE-2026-11638 | Critical | 9.6 | 2026-06-09 | Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page… |
CVE-2026-11637 | High | 8.8 | 2026-06-09 | Use after free in Views in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium… |
CVE-2026-11636 | High | 7.5 | 2026-06-09 | Use after free in Autofill in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures… |
CVE-2026-11635 | High | 8.3 | 2026-06-09 | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially p… |
CVE-2026-11634 | Critical | 9.6 | 2026-06-09 | Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially perform a sandbox escape via a crafted H… |
CVE-2026-11633 | High | 8.8 | 2026-06-09 | Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a malicious peripheral. (Ch… |
CVE-2026-11632 | High | 7.5 | 2026-06-09 | Use after free in TabStrip in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute… |
CVE-2026-11631 | High | 8.3 | 2026-06-09 | Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially pe… |
CVE-2026-11630 | High | 8.8 | 2026-06-09 | Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2026-11629 | High | 8.8 | 2026-06-09 | Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2026-11628 | Medium | 6.8 | 2026-06-09 | Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially exploit heap corruption via physical access to the dev… |
CVE-2026-9669 | | 2026-06-08 | bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor… | |
CVE-2026-44541 | | 2026-06-08 | Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the… | |
CVE-2026-40215 | High | 7.4 | 2026-06-08 | A race condition in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows remote attackers to potentially cause a server crash or leak heap memory v… |
CVE-2026-11585 | Medium | 6.3 | 2026-06-08 | A vulnerability was determined in CodeAstro Student Attendance Management System 1.0. Affected is an unknown function of the file /attendance-php/Admin/createC… |
CVE-2026-49141 | High | 7.1 | 2026-06-08 | WACRM prior to commit 73041bf contain an authorization bypass vulnerability in the automation engine that allows authenticated attackers to access and modify c… |
CVE-2026-47345 | | 2026-06-08 | Namespace attributes are not encoded correctly during HTML serialization. This allows bypassing the cross-site scripting prevention mechanism of typo3/html-san… | |
CVE-2026-47344 | | 2026-06-08 | When ALLOW_INSECURE_RAW_TEXT is enabled, whitespace-variant closing tags (e.g., </style\t>) are not recognized by the sanitizer but accepted by browsers as val… | |
CVE-2026-46484 | High | 8.1 | 2026-06-08 | Headplane is a feature-complete Web UI for Headscale. Prior to versions 0.6.3 and 0.7.0-beta.3, Headplane was vulnerable to a path traversal / authorization by… |
CVE-2026-40519 | High | 7.5 | 2026-06-08 | Nginx Proxy Manager versions 2.9.14 through 2.15.1, fixed in commit a5db5ed, contain an authenticated remote code execution vulnerability via OS command inject… |
CVE-2026-35058 | Medium | 6.5 | 2026-06-08 | Improper validation of packet length during tls-crypt-v2 key extraction in OpenVPN 2.6.0 through 2.6.19 and 2.7_alpha1 through 2.7.1 allows authenticated attac… |
CVE-2026-11584 | Medium | 6.3 | 2026-06-08 | A vulnerability was found in CodeAstro Student Attendance Management System 1.0. This impacts an unknown function of the file /attendance-php/Admin/createClass… |
CVE-2026-11583 | Medium | 6.3 | 2026-06-08 | A vulnerability has been found in CodeAstro Student Attendance Management System 1.0. This affects an unknown function of the file /attendance-php/Admin/create… |
CVE-2026-11582 | High | 7.3 | 2026-06-08 | A flaw has been found in CodeAstro Student Attendance Management System 1.0. The impacted element is an unknown function of the file /attendance-php/index.php… |
CVE-2026-52778 | Critical | 9.8 | 2026-06-08 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, an unsafe execution vulnerability exists in the Bazar form field calculator (CalcField.php) of… |
CVE-2026-46490 | High | 8.8 | 2026-06-08 | samlify is a Node.js library for SAML single sign-on. Prior to version 2.13.0, samlify’s template substitution only escapes attribute contexts. Values inserted… |
CVE-2026-46486 | | 2026-06-08 | MVT (Mobile Verification Toolkit) helps with conducting forensics of mobile devices in order to find signs of a potential compromise. Prior to version 2026.5.1… | |
CVE-2026-11559 | Medium | 6.3 | 2026-06-08 | A vulnerability was detected in CodeAstro Payroll System 1.0. This affects an unknown function of the file /view_account.php. The manipulation of the argument… |
CVE-2026-11558 | Medium | 6.3 | 2026-06-08 | A security vulnerability has been detected in CodeAstro Payroll System 1.0. The impacted element is an unknown function of the file /home_salary.php. The manip… |
CVE-2026-11557 | High | 8.8 | 2026-06-08 | A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component W… |
CVE-2026-11393 | Critical | 9.0 | 2026-06-08 | Improper neutralization of triple-quote characters during Python code generation in AgentCore CLI before v0.14.2 might allow an authenticated remote threat act… |
CVE-2026-10787 | Medium | 4.3 | 2026-06-08 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user gr… |
CVE-2026-10786 | Medium | 6.5 | 2026-06-08 | Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain cleartext credentials… |
CVE-2026-10544 | Medium | 6.5 | 2026-06-08 | Improper neutralization of special elements in the built-in PAM provider password rotation templates in Devolutions Server allows an authenticated user with wr… |
CVE-2026-8913 | | 2026-06-08 | A command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input withi… | |
CVE-2026-11556 | High | 8.8 | 2026-06-08 | A security flaw has been discovered in Tenda F451 1.0.0.7/1.0.0.9. Impacted is the function formWriteFacMac of the file /goform/WriteFacMac of the component We… |
CVE-2026-11555 | Low | 3.7 | 2026-06-08 | A vulnerability was identified in D-Link DGS-1100-08PD 1.00.006. This issue affects some unknown processing of the file /etc/boa.conf of the component Web Inte… |
CVE-2026-11554 | Medium | 4.3 | 2026-06-08 | A vulnerability was determined in TOTOLINK CP450 4.1.0cu.747. This vulnerability affects unknown code of the file /etc/vsftpd.conf of the component vsftpd. Thi… |
CVE-2026-11553 | High | 8.8 | 2026-06-08 | A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formPPPEdit of the file /boaform/formPPPEdit. The manipulation… |
CVE-2026-11552 | Medium | 5.3 | 2026-06-08 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System and Syllabus-aligned Learning Management and Examination System… |
CVE-2026-48507 | High | 7.1 | 2026-06-08 | Snipe-IT is an IT asset/license management system. A vulnerability in versions prior to 8.6.0 allows a non-admin user holding only the granular `users.edit` pe… |
CVE-2026-46481 | High | 8.3 | 2026-06-08 | OpenMetadata is a unified metadata platform. Prior to version 1.12.4, a non-admin SSO user can trigger a TEST_CONNECTION workflow for a Database Service and re… |
CVE-2026-46314 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Reject empty multisync extension to prevent infinite loop v3d_get_extensions() w… |
CVE-2026-46313 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: media: intel/ipu6: fix error pointer dereference In a error path isp->psys is confirmed t… |
CVE-2026-46312 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: media: videobuf2: Set vma_flags in vb2_dma_sg_mmap vb2_dma_contig sets VMA flags VM_DONTE… |
CVE-2026-46311 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: fix access to stale wptr mapping Use drm_exec to take both locks i.e vm… |
CVE-2026-46310 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: media: renesas: vsp1: Fix NULL pointer deref on module unload When unloading the module o… |
CVE-2026-46309 | High | 7.0 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise Add validation in… |
CVE-2026-46308 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix use-after-free in scpsys_get_bus_protection_legacy() In scpsys_ge… |
CVE-2026-46307 | High | 8.3 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: wifi: ath5k: do not access array OOB Vincent reports: > The ath5k driver seems to do an a… |
CVE-2026-46306 | High | 7.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: flow_dissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol F… |
CVE-2026-46305 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: os_dep: avoid NULL pointer dereference in rtw_cbuf_alloc The return v… |
CVE-2026-46304 | High | 7.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free nvmet_tcp_release_queue_work() r… |
CVE-2026-46303 | High | 8.2 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: isofs: validate Rock Ridge CE continuation extent against volume size rock_continue() rea… |
CVE-2026-46302 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: selinux: allow multiple opens of /sys/fs/selinux/policy Currently there can only be a sin… |
CVE-2026-46301 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: spi: topcliff-pch: fix use-after-free on unbind Give the driver a chance to flush its que… |
CVE-2026-46299 | High | 7.0 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: hfsplus: fix held lock freed on hfsplus_fill_super() hfsplus_fill_super() calls hfs_find_… |
CVE-2026-46298 | Medium | 4.7 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: pseries/papr-hvpipe: Fix race with interrupt handler While executing ->ioctl handler or -… |
CVE-2026-46297 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: net: libwx: use request_irq for VF misc interrupt Currently, request_threaded_irq() is us… |
CVE-2026-46296 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: spi: s3c64xx: fix NULL-deref on driver unbind A change moving DMA channel allocation from… |
CVE-2026-46295 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Do IRR scan in __kvm_apic_update_irr even if PIR is empty Fall back to apic_fin… |
CVE-2026-46294 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: dm: fix a buffer overflow in ioctl processing Tony Asleson (using Claude) found a buffer… |
CVE-2026-46293 | High | 7.1 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: clk: microchip: mpfs-ccc: fix out of bounds access during output registration UBSAN repor… |
CVE-2026-46292 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: pmdomain: core: Fix detach procedure for virtual devices in genpd If a device is attached… |
CVE-2026-46291 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: crypto: caam - guard HMAC key hex dumps in hash_digest_key Use print_hex_dump_devel() for… |
CVE-2026-46290 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: x86/efi: Fix graceful fault handling after FPU softirq changes Since commit d02198550423… |
CVE-2026-46289 | Critical | 9.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: lib/scatterlist: fix length calculations in extract_kvec_to_sg Patch series "Fix bugs in… |
CVE-2026-46288 | High | 8.4 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: of: unittest: fix use-after-free in of_unittest_changeset() The variable 'parent' is assi… |
CVE-2026-46287 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: net: txgbe: fix RTNL assertion warning when remove module For the copper NIC with externa… |
CVE-2026-46286 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: leds: qcom-lpg: Check for array overflow when selecting the high resolution When selectin… |
CVE-2026-46285 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mtd: docg3: fix use-after-free in docg3_release() In docg3_release(), the docg3 pointer i… |
CVE-2026-46284 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: fix early boot crash on parameters without '=' separator If hugepages, hugepa… |
CVE-2026-46283 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: tpm: Use kfree_sensitive() to free auth session in tpm_dev_release() tpm_dev_release() us… |
CVE-2026-46282 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: iio: frequency: admv1013: fix NULL pointer dereference on str When device_property_read_s… |
CVE-2026-46281 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: vmalloc: fix buffer overflow in vrealloc_node_align() Commit 4c5d3365882d ("mm/vmalloc: a… |
CVE-2026-46280 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: lib: test_hmm: evict device pages on file close to avoid use-after-free Patch series "Min… |
CVE-2026-46279 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mm/alloc_tag: clear codetag for pages allocated before page_ext initialization Due to ini… |
CVE-2026-46278 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix segfault when updating ftrace mask Fix invalid data access by passin… |
CVE-2026-46277 | High | 7.8 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: mm/zone_device: do not touch device folio after calling ->folio_free() The contents of a… |
CVE-2026-46276 | Medium | 5.5 | 2026-06-08 | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix zero-size GDS range init on RDNA4 RDNA4 (GFX 12) hardware removes the GDS… |
CVE-2026-45581 | Medium | 5.5 | 2026-06-08 | fabric-chaincode-java is a Java based implementation of Hyperledger Fabric chaincode shim APIs. From version 2.3.1 to before version 2.5.10, when chaincode is… |
CVE-2026-43966 | Medium | 5.3 | 2026-06-08 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') vulnerability in ninenines cowlib allows HTTP response splitting… |
CVE-2026-41448 | Critical | 9.4 | 2026-06-08 | AdGuard Home, when started with the --glinet flag, contains an authentication bypass vulnerability that allows unauthenticated attackers to gain full admin acc… |
CVE-2026-39910 | Critical | 9.8 | 2026-06-08 | STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organi… |
CVE-2026-39908 | Medium | 6.5 | 2026-06-08 | OpenBullet2 through version 0.3.2 on Windows contains a credential disclosure vulnerability that allows remote attackers to capture the NTLMv2 hash of the proc… |
CVE-2026-25856 | High | 8.8 | 2026-06-08 | OpenBullet2 through version 0.3.2 contains an authenticated remote code execution vulnerability that allows authenticated users to execute arbitrary C# code on… |
CVE-2026-25855 | High | 8.8 | 2026-06-08 | OpenBullet2 through version 0.3.2 contains a remote code execution vulnerability that allows authenticated users to execute arbitrary commands by uploading scr… |
CVE-2026-25559 | High | 8.8 | 2026-06-08 | OpenBullet2 through version 0.3.2 contains a path traversal vulnerability in the wordlist endpoint that allows authenticated attackers to perform arbitrary fil… |
CVE-2026-25555 | Critical | 9.8 | 2026-06-08 | OpenBullet2 through version 0.3.2 contains an authentication bypass vulnerability in the API key authentication middleware that allows unauthenticated attacker… |
CVE-2026-11611 | Medium | 6.5 | 2026-06-08 | A flaw was found in 389 Directory Server. The Content Synchronization persistent search plugin allows unbounded memory growth when an authenticated client stop… |
CVE-2026-11534 | Low | 3.5 | 2026-06-08 | A vulnerability was detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this issue is some unknown funct… |
CVE-2026-11533 | Medium | 5.4 | 2026-06-08 | A security vulnerability has been detected in imvks786 student_management_system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. Affected by this vulnerability… |