Vendor
9,109 known vulnerabilities.
Products
Chrome 6,157
Android 2,760
Asylo 16
ChromeOS 12
AngularJS 6
MCP Toolbox for Databases (googleapis/mcp-toolbox) 6
gVisor 6
gRPC 6
Dart SDK 5
mcp-toolbox 5
libjxl 4
Keras 4
Guava 3
go-attestation 3
SAM 3
Android XR 3
fscrypt 3
MCP Toolbox for Databases 3
Protocolbuffers 3
OSV-SCALIBR 3
Nearby 3
Fuchsia 3
guest-oslogin 3
AWS S3 Crypto SDK for GoLang 2
Nest Wifi Pro 2
Brotli 2
Web Designer 2
Tink 2
Pixel Watch 2
Fuchsia Kernel 2
Omaha 2
zx 2
protobuf-java 2
Web Stories 2
protobuf-kotlin 2
google-protobuf [JRuby Gem] 2
Site Kit by Google 2
Andrioid 2
Agent Development Kit (ADK) for Python 1
nodejs-firestore 1
611 results · Clear filters · Feed
-
Critical 9.6
Heap buffer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromise…
-
Critical 9.6
Insufficient validation of untrusted input in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attac…
-
Critical 9.6
Integer overflow in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th…
-
Critical 9.6
Use after free in Touchbar in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to potentially perf…
-
Critical 9.6
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere…
-
Critical 9.6
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engag…
-
Critical 9.6
Use after free in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engag…
-
Critical 9.6
Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a us…
-
Critical 9.6
Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the ren…
-
Critical 9.6
Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker w…
-
Critical 9.6
Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker wh…
-
Critical 9.6
Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the render…
-
Critical 9.6
Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the rendere…
-
Critical 9.3
Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a …
-
Critical 9.6
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially pe…
-
Critical 9.6
Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially pe…
-
Critical 9.3
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When the toolbox validates an opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), it decodes the response i…
-
Critical 9.3
googleapis/mcp-toolbox: authentication bypass vulnerability in the generic opaque token validation path (validateOpaqueToken)
An authentication bypass vulnerability exists in the generic opaque token validation path (validateOpaqueToken) of googleapis/mcp-toolbox. When verifying an unparsed opaque token via an OAuth 2.0 introspection endpoint (RFC 7662), the toolbox decodes the resp…
-
Critical 10.0
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could …
-
Critical 10.0
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a l…
-
Critical 10.0
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing pe…
-
Critical 10.0
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lea…
-
Critical 10.0
In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local …
-
Critical 10.0
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due t…
-
Critical 10.0
In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escal…
-
Critical 10.0
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local…
-
Critical 10.0
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSessio…
-
Critical 10.0
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loc…
-
Critical 10.0CVE-2026-0092 Public exploit
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lea…
-
Critical 10.0
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed…
-
Critical 9.6
Use after free in DigitalCredentials in Google Chrome on Windows prior to 149.0.7827.155 allowed a remote attacker to p…
-
Critical 9.4
MCP Toolbox for Databases has an Origin Validation Error
The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "-…
-
Critical 9.6
Inappropriate implementation in Headless in Google Chrome prior to 149.0.7827.115 allowed a remote attacker who had com…
-
Critical 9.6
Insufficient validation of untrusted input in UI in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to …
-
Critical 9.6
Use after free in Navigation in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform …
-
Critical 9.6
Integer overflow in UI in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker to potentially perfo…
-
Critical 9.6
Use after free in CameraCapture in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to potentiall…
-
Critical 9.6
Use after free in Network in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code …
-
Critical 9.6
Use after free in Printing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially perform a …
-
Critical 9.6
Use after free in Gamepad in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially …