Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
400,982 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-113193 | 6.5 Medium | Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113317 | 8.8 High | Use after free in Accessibility in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security… | Oct 20, 2026 |
| CVE-2026-113339 | 8.8 High | Use after free in SVG in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113134 | 8.8 High | Out of bounds read in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113092 | 8.8 High | Missing authorization in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity:… | Oct 20, 2026 |
| CVE-2026-113119 | 8.8 High | Improper certificate validation in Network in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113082 | 6.5 Medium | Integer overflow in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113058 | 8.8 High | Missing authorization in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113242 | 8.8 High | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113098 | 6.5 Medium | Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113097 | 8.8 High | Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High) | Oct 20, 2026 |
| CVE-2026-113101 | 8.8 High | Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.… | Oct 20, 2026 |
| CVE-2026-113303 | 8.8 High | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113271 | 8.8 High | Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113280 | 8.8 High | Use after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113072 | 9.6 Critical | Use after free in CSS in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113279 | 8.8 High | Use after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-113341 | 6.5 Medium | Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical) | Oct 20, 2026 |
| CVE-2026-112712 | 9.1 Critical | @fastify/middie vulnerable to path-scoped middleware bypass via scope prefix mismatch | Oct 20, 2026 |
| CVE-2026-112407 | 8.7 High | Incorrect privilege assignment in AWS CICD-toolchain-for-serverless-applications | Oct 20, 2026 |
| CVE-2016-20104 | 8.7 High | EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php | Oct 20, 2026 |
| CVE-2016-20103 | 8.7 High | Cherry Plugin for WordPress < 1.2.7 Path Traversal via download-content.php | Oct 20, 2026 |
| CVE-2016-20102 | 5.1 Medium | JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter | Oct 20, 2026 |
| CVE-2016-20101 | 9.2 Critical | Issuu Panel WordPress Plugin < 1.6.6 File Inclusion via ajax-docs.php | Oct 20, 2026 |
| CVE-2016-20100 | 8.7 High | Memphis Documents Library WordPress Plugin < 3.1.6 Path Traversal via mdocs-img-preview | Oct 20, 2026 |
| CVE-2015-20128 | 8.8 High | FooSun DotNetCMS 1.0 / 2.0 SQL Injection via City_ajax.aspx | Oct 20, 2026 |
| CVE-2015-20125 | 8.7 High | Aspose PDF Exporter WordPress Plugin < 2.0 Path Traversal via aspose_pdf_exporter_download.php | Oct 20, 2026 |
| CVE-2015-20124 | 8.7 High | Aspose Importer & Exporter WordPress Plugin < 3.0 Path Traversal via aspose_import_export_download.php | Oct 20, 2026 |
| CVE-2015-20123 | 8.7 High | Aspose Doc Exporter WordPress Plugin < 2.0 Path Traversal via aspose_doc_exporter_download.php | Oct 20, 2026 |
| CVE-2014-125134 | 8.7 High | ChurcHope WordPress Theme < 2.2 Path Traversal via downloadlink.php | Oct 20, 2026 |
| CVE-2014-125133 | 8.7 High | NativeChurch WordPress Theme < 1.6.2 Arbitrary File Download via download.php | Oct 20, 2026 |
| CVE-2014-125132 | 5.1 Medium | Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php | Oct 20, 2026 |
| CVE-2014-125131 | 5.1 Medium | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php | Oct 20, 2026 |
| CVE-2012-20005 | 5.1 Medium | SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter | Oct 20, 2026 |
| CVE-2012-20004 | 5.1 Medium | K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter | Oct 20, 2026 |
| CVE-2012-20003 | 5.1 Medium | Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php | Oct 20, 2026 |
| CVE-2012-20002 | 8.7 High | TinyMCE Thumbnail Gallery WordPress Plugin < 1.1.0 Path Traversal via download-image.php | Oct 20, 2026 |
| CVE-2026-107929 | 8.1 High | local interface connection reuse mixup | Oct 20, 2026 |
| CVE-2026-111758 | 7.5 High | markdown-it: Quadratic-time rendering of a single multi-line link reference definition with default options (regression since 14.0) | Oct 20, 2026 |
| CVE-2026-107928 | 8.1 High | info leak uploading over WebSockets with GnuTLS | Oct 20, 2026 |
| CVE-2026-105960 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Improper Handling of Length Parameter Inconsistency | Oct 20, 2026 |
| CVE-2026-94266 | 7.5 High | password leak in CURLINFO_EFFECTIVE_URL | Oct 20, 2026 |
| CVE-2026-110322 | 6.8 Medium | HMS Networks PEAK-System PCAN Windows drivers Untrusted Pointer Dereference | Oct 20, 2026 |
| CVE-2026-94265 | 9.1 Critical | Authorization: Negotiate sent to foreign origin | Oct 20, 2026 |
| CVE-2026-35499 | 9.1 Critical | An os command injection vulnerability exists in the boa formWsc peerRptPin functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… | Oct 20, 2026 |
| CVE-2026-40627 | 9.1 Critical | An os command injection vulnerability exists in the boa formWsc targetAPSsid functionality of Totolink X2000R TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327. A specially crafted HTTP request can lead to arbitrary code execution. An attacker can… | Oct 20, 2026 |
| CVE-2026-28763 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice hostname functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution.… | Oct 20, 2026 |
| CVE-2026-41223 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-33568 | 9.1 Critical | A OS command injection vulnerability exists in the boa formMapDelDevice macstr functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
| CVE-2026-41222 | 9.1 Critical | A stack-based buffer overflow vulnerability exists in the boa formParentControl url functionality of X2000R (version(s): TOTOLINK-X2000R-Gh-V1.0.0-B20250421.1327). A specially crafted HTTP request can lead to arbitrary code execution. An… | Oct 20, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.