Archive
28 May 2026
Vulnerabilities first published on this day (UTC), newest first.
545 results · Feed
-
Medium 5.0
Improper handling of symbolic links in the installer of My Image Garden for macOS Version 3.6.8 or earlier may allow a …
-
Medium 5.1
TFA Basic Plugins - Access Bypass
An access bypass vulnerability in Drupal TFA Basic Plugins allows users with the administer users permission to view or generate recovery codes for other users. This issue affects TFA Basic Plugins: from 7.x-1.0 through 7.x-1.2.
-
High 7.4
SAML SSO - Service Provider - Critical - Authentication bypass - SA-CONTRIB-2026-031
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal SAML SSO - Service Provider allows Privilege Escalation. This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.4.
-
Medium 4.0
tuf has platform-dependent delegation path matching
`DelegatedRole._is_target_in_pathpattern` uses `fnmatch.fnmatch` to decide whether a given target path is authorized by a delegation's glob pattern. Python's `fnmatch.fnmatch` calls `os.path.normcase()` on both arguments before matching. On POSIX hosts `normc…
-
Medium 4.3
Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain
A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This c…
-
Critical 9.8CVE-2026-8809 Public exploit
Advanced Custom Fields: Extended <= 0.9.2.5 - Unauthenticated Privilege Escalation via Validation Bypass to '_acf_post_id' Parameter
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Privilege Escalation via Validation Bypass in all versions up to and including 0.9.2.5. The vulnerability exists due to the after_validate_save_post() function unconditionally trusting…
-
High 8.8
Insufficient validation of untrusted input in USB in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to…
-
High 7.5
Type Confusion in V8 in Google Chrome prior to 148.0.7778.216 allowed an attacker who convinced a user to install a mal…
-
Medium 4.3
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to leak cross-origin data …
-
High 8.3
Insufficient validation of untrusted input in Skia in Google Chrome on Android prior to 148.0.7778.216 allowed a remote…
-
High 8.8
Use after free in DOM in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code insi…
-
Medium 6.5
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sens…
-
High 8.3
Out of bounds read in Headless in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised t…
-
High 8.8
Integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code in…
-
High 8.3
Use after free in WebMIDI in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had comprom…
-
High 8.8
Use after free in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary cod…
-
High 8.3
Use after free in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rende…
-
Low 3.1
Inappropriate implementation in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had comprom…
-
Medium 5.0
Inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who…
-
Medium 6.5
Uninitialized Use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potent…
-
High 7.5
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the ren…
-
High 8.8
Use after free in SVG in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code insi…
-
Medium 5.4
Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attac…
-
High 7.5
Race in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a …
-
High 7.5
Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convince…
-
High 8.3
Use after free in PerformanceManager in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had comprom…
-
High 7.5
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who convinced a user to enga…
-
High 8.8
Use after free in PDFium in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to potentially exploit heap…
-
High 8.8CVE-2026-9999 Public exploit
Inappropriate implementation in ANGLE in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to exec…
-
High 8.3CVE-2026-9998 Public exploit
Integer overflow in Skia in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the ren…
-
High 8.3
Use after free in Passwords in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compr…
-
Medium 6.5
Out of bounds read in WebRTC in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker to obtain potent…
-
High 8.3CVE-2026-9997 Public exploit
Use after free in Input in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend…
-
High 8.8
Use after free in WebXR in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code in…
-
High 8.3
Use after free in Core in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who had compromise…
-
High 8.3
Use after free in Views in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the rend…
-
High 8.8
Use after free in Network in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code …
-
High 7.5
Use after free in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convince…
-
Medium 6.3
Inappropriate implementation in Media in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to bypass same…
-
Low 3.1
Inappropriate implementation in Media in Google Chrome on Windows prior to 148.0.7778.216 allowed a remote attacker who…