406,158 results · Feed
-
High 8.8
Use after free in Editing in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Incorrect reference resolution in Quota in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compr…
-
High 8.8
Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin…
-
High 8.8
Use after free in DOM in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code insid…
-
Critical 9.6
Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitr…
-
High 8.8
Out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code i…
-
High 8.8
Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code in…
-
Critical 9.6
Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the rende…
-
High 8.8
Improper input validation in Network in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbit…
-
High 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging soci…
-
High 8.8
Incorrect authorization in Input in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social en…
-
High 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging soci…
-
Medium 4.3
Information loss in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to obtain cross-orig…
-
High 8.8
Origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web ori…
-
Medium 6.5
Use after free in MediaStream in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary co…
-
High 8.8
Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging soci…
-
Critical 9.8
An issue was discovered in Keyfactor EJBCA 9. When an administrator is removed from its administrator role while having…
-
Medium 5.3
Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
-
Medium 6.5
Bitcoin Core prior to 29.5, 30.4, 31.2 and 32.1 is vulnerable to an OOM issue.
-
High 7.5CVE-2026-117183 Public exploit
A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape th…
-
High 7.5
Bitcoin Core through 31.1 is vulnerable to Denial of Service via undo files having no size limit
-
Medium 6.5
Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::ch…
-
High 7.5CVE-2026-117184 Public exploit
An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a craf…
-
Medium 5.4CVE-2026-117182 Public exploit
An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 al…
-
Medium 6.1
Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…
-
High 8.7CVE-2026-92744 Public exploit
Delinea Privilege Manager agent unauthenticated remote code execution vulnerability
Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem.
-
Critical 9.3
A vulnerability allowing an unauthenticated attacker to perform remote code execution (RCE) on servers running the Veea…
-
High 8.8
A vulnerability allowing a member of the Veeam Virtualization Extensions Users group to perform remote code execution (…
-
High 8.7
A vulnerability allowing an authenticated domain user to perform remote code execution (RCE) as the LocalSystem account…
-
High 7.5
GraphQL-core: Denial of service via memory leak in aborted validations
GraphQL-core is a Python port of the GraphQL.js reference implementation. From 3.3.0a3 until 3.3.1, validate() reuses a module-level ValidationAbortedError when a document exceeds max_errors. Python appends frames to the reused exception's traceback on every …
-
Critical 9.8
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt
Spreadsheet::XLSX versions before 0.19 for Perl allow code execution via string eval of number format conditions in ExcelFmt. When a number format has a condition such as [>100], ExcelFmt chooses the format section by passing the condition and the cell value …
-
Medium 5.9
Fiber: CORS wildcard origins matched without a dot boundary, allowing credentialed cross-origin reads
Fiber is an Express inspired web framework written in Go. From 2.52.1 until 2.52.3, the CORS middleware's validateDomain wildcard matcher in middleware/cors/utils.go strips the scheme and checks only a host suffix without requiring a dot boundary. An applicat…
-
Medium 6.9
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.6, joserfc compact JWS deserialization calls bytes.split() before enforcing the existing aggregate segment-size limits. Wh…
-
High 8.9
WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saude/historico_prontuarios.php` arises because the `textoProntuario` field accepts arbitrary HTML or JavaScript without proper sanitization. A…
-
Critical 9.0
SOCFortress CoPilot: Stored case-report template injection permits backend code execution
SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are later executed by non…
-
Medium 6.3
WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover
WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in `web/html/memorando/listar_despachos.php` results from unsafe handling of the `texto` field. The affected flow spans `web/controle/memorando…
-
High 8.1
WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes
WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the `/controle/control.php` dispatch endpoint accepts attacker-controlled `nomeClasse`, `metodo`, and record identifier parameters through `extract($_REQ…
-
High 8.3
Lightdash: Unauthenticated dbt Cloud webhook with path injection leaks API key
Lightdash is an open source business intelligence platform. In affected versions through 0.3213.0, the dbt Cloud webhook `POST /api/v1/projects/{projectUuid}/dbt-cloud/webhook` has no authentication middleware or signature validation. In `packages/backend/src…
-
Critical 9.1
Docat has Arbitrary File Upload exists in Upload API
Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `Upload API` arises because the API does not validate the `uploaded file path or type`. An attacker can overwrite sensiti…
-
High 8.3
OpenAM Session Hijacking via CDSSO
Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, the `Cross-Domain Single Sign-On` (`CDSSO`) servlet allows a logged-in user's raw OpenAM session token to be POSTed to an attacker-controlled URL. An attacker who induces an au…