product: Chrome

vendor: Google

status: affected

version_type: custom

ecosystem: browser

metric_type: Secondary

severity: medium

part: a

product: chrome

vendor: google

quality: metadata-backed

recipe_kind: composed

status: Analyzed

summary: Inappropriate implementation in XML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


archetype: generic

summary: Inappropriate implementation in Geolocation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


author: Codex

description: CVE-2026-14005 is use after free in omnibox in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

maturity: development

model: GPT 5.5 Extra High reasoning

title: CVE-2026-14005: Chrome UAF Omnibox

severity: high

recipe_kind: markdown-draft

summary: Use after free in Omnibox in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14006 is use after free in navigation in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14006: Chrome UAF Navigation

summary: Use after free in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in PermissionsPolicy in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Uninitialized Use in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14009 is inappropriate implementation in passwords in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14009: Chrome implementation Passwords

summary: Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Uninitialized Use in Codecs in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14011 is out of bounds read in surfacecapture in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14011: Chrome OOB read SurfaceCapture

summary: Out of bounds read in SurfaceCapture in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Paint in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Race in WebRTC in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in SVG in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


severity: critical

summary: Inappropriate implementation in Navigation in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14018 is use after free in updater in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14018: Chrome UAF Updater

summary: Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in SanitizerAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14024 is use after free in ozone in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14024: Chrome UAF Ozone

summary: Use after free in Ozone in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

title: Google Chrome security vulnerability


description: CVE-2026-14025 is use after free in views in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14025: Chrome UAF Views

summary: Use after free in Views in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14027 is use after free in signin in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14027: Chrome UAF SignIn

summary: Use after free in SignIn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


default_status: unaffected

vendor: trainingbusinesspros

version_type: semver

ecosystem: php/wordpress

status: Deferred

summary: The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to generic SQL Injection via the 'select' parameter in all versions up to, and including, 4.5.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires the attacker to hold a Groundhogg custom role with the view_contacts capability, which is granted by default to several built-in Groundhogg roles above the base subscriber level.

title: Trainingbusinesspros Groundhogg — Crm, Newsletters, And Marketing Autom… security vulnerability


summary: Inappropriate implementation in SplitView in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in File Input in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14032 is use after free in bluetooth in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14032: Chrome UAF Bluetooth

summary: Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Media in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in WebXR in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14036 is insufficient policy enforcement in bluetooth in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14036: Chrome policy Bluetooth

summary: Insufficient policy enforcement in Bluetooth in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14037 is insufficient policy enforcement in gpu in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14037: Chrome policy GPU

summary: Insufficient policy enforcement in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14038 is insufficient validation of untrusted input in new tab page in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14038: Chrome input validation New Tab Page

status: Modified

summary: Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14040 is use after free in browsertag in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14040: Chrome UAF BrowserTag

summary: Use after free in BrowserTag in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14041 is insufficient policy enforcement in serial in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14041: Chrome policy Serial

summary: Insufficient policy enforcement in Serial in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Isolated Web Apps in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14043 is use after free in getusermedia in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14043: Chrome UAF GetUserMedia

summary: Use after free in GetUserMedia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14044 is use after free in angle in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14044: Chrome UAF ANGLE

summary: Use after free in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CustomTabs in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to bypass content security policy via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Use after free in Chromecast in Google Chrome prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Uninitialized Use in GamepadAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in FileSystem in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14055 is insufficient validation of untrusted input in device trust in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14055: Chrome input validation Device Trust

summary: Insufficient validation of untrusted input in Device Trust in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14056 is insufficient validation of untrusted input in media in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14056: Chrome input validation Media

summary: Insufficient validation of untrusted input in Media in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in FedCM in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Parser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Related-Website-Sets in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14060 is insufficient validation of untrusted input in chromoting in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14060: Chrome input validation Chromoting

summary: Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Views in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Out of bounds read in Chromecast in Google Chrome prior to 150.0.7871.47 allowed a local attacker to obtain potentially sensitive information from process memory via malicious network traffic. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14064 is use after free in pageinfo in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14064: Chrome UAF PageInfo

summary: Use after free in PageInfo in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in PageInfo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14067 is use after free in chrome for ios in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14067: Chrome UAF Chrome for iOS

summary: Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Integer overflow in WebNN in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in WebAudio in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in SplitView in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in WebAuthentication in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to bypass no-referrer policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Select in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14078 is insufficient validation of untrusted input in webrtc in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14078: Chrome input validation WebRTC

summary: Insufficient validation of untrusted input in WebRTC in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in TabSwitcher in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to bypass navigation restrictions via malicious network traffic. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Race in Storage in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)


summary: Insufficient validation of untrusted input in HTML in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14084 is insufficient validation of untrusted input in chromoting in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14084: Chrome input validation Chromoting

summary: Insufficient validation of untrusted input in Chromoting in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via malicious network traffic. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Side-channel information leakage in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14086 is insufficient policy enforcement in hid in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14086: Chrome policy HID

summary: Insufficient policy enforcement in HID in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14087 is heap buffer overflow in webnn in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14087: Chrome heap overflow WebNN

summary: Heap buffer overflow in WebNN in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Uninitialized Use in Canvas in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


metric_type: Primary

summary: Insufficient validation of untrusted input in PopupBlocker in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14090 is insufficient validation of untrusted input in cameracapture in Google Chrome on ChromeOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14090: Chrome input validation on ChromeOS

summary: Insufficient validation of untrusted input in CameraCapture in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14091 is use after free in devtools in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14091: Chrome UAF DevTools

summary: Use after free in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in Privacy in Google Chrome prior to 150.0.7871.47 allowed an attacker in a privileged network position to leak cross-origin data via malicious network traffic. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14093 is use after free in cast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14093: Chrome UAF Cast

summary: Use after free in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14094 is use after free in installer in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14094: Chrome UAF Installer

summary: Use after free in Installer in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14095 is insufficient policy enforcement in browser in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14095: Chrome policy Browser

summary: Insufficient policy enforcement in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14097 is inappropriate implementation in webappinstalls in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14097: Chrome implementation WebAppInstalls

summary: Inappropriate implementation in WebAppInstalls in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14099 is use after free in chrome for ios in Google Chrome on iOS before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14099: Chrome UAF Chrome for iOS

summary: Use after free in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient data validation in NetworkCache in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14101 is insufficient policy enforcement in sandbox in Google Chrome on Mac before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14101: Chrome policy Sandbox

summary: Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14102 is use after free in passwords in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14102: Chrome UAF Passwords

summary: Use after free in Passwords in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Use after free in SSL in Google Chrome on ChromeOS prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14104 is insufficient validation of untrusted input in webappinstalls in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14104: Chrome input validation WebAppInstalls

summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14105 is insufficient policy enforcement in speech in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14105: Chrome policy Speech

summary: Insufficient policy enforcement in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14106 is insufficient validation of untrusted input in text in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14106: Chrome input validation Text

summary: Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14107 is use after free in scheduling in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14107: Chrome UAF Scheduling

summary: Use after free in Scheduling in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14108 is use after free in pdfium in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14108: Chrome UAF PDFium

summary: Use after free in PDFium in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14109 is insufficient policy enforcement in mojo in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14109: Chrome policy Mojo

summary: Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in DarkMode in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14111 is use after free in webprotect in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14111: Chrome UAF WebProtect

summary: Use after free in WebProtect in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Enterprise in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14113 is use after free in updater in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14113: Chrome UAF Updater

summary: Use after free in Updater in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14114 is inappropriate implementation in webappinstalls in Google Chrome on Android before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14114: Chrome implementation WebAppInstalls

summary: Inappropriate implementation in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.47 allowed a local attacker to perform UI spoofing via a malicious file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14115 is insufficient validation of untrusted input in cast in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14115: Chrome input validation Cast

summary: Insufficient validation of untrusted input in Cast in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in DevTools in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient data validation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Type Confusion in Bluetooth in Google Chrome on Windows prior to 150.0.7871.47 allowed an attacker on the local network segment to obtain potentially sensitive information from process memory via a malicious peripheral. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14120 is inappropriate implementation in devtools in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14120: Chrome implementation DevTools

summary: Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14121 is use after free in chromoting in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14121: Chrome UAF Chromoting

summary: Use after free in Chromoting in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via malicious network traffic. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14122 is insufficient validation of untrusted input in webappinstalls in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14122: Chrome input validation on Windows

summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14124 is inappropriate implementation in credentialprovider in Google Chrome on Windows before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14124: Chrome implementation CredentialProvider

summary: Inappropriate implementation in CredentialProvider in Google Chrome on Windows prior to 150.0.7871.47 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in UI in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Printing in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in PreviewTab in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Omnibox in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Race in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)


summary: Inappropriate implementation in Autofill in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Network in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Input in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Document Picture-in-Picture in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Type Confusion in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14149 is use after free in audio in Google Chrome on Linux before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14149: Chrome UAF Audio

summary: Use after free in Audio in Google Chrome on Linux prior to 150.0.7871.47 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14151 is inappropriate implementation in ai in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14151: Chrome implementation AI

summary: Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


description: CVE-2026-14152 is out of bounds read and write in angle in Google Chrome before 150.0.7871.47. Upgrade to 150.0.7871.47+ (Windows/Mac) or 150.0.7871.46+ (Linux).

title: CVE-2026-14152: Chrome OOB read

summary: Out of bounds read and write in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in Glic in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


summary: Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)

title: Google Chrome security vulnerability


product: Widget Logic Visual

vendor: totalbounty

summary: The Widget Logic Visual plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.52 via the widget_logic_visual_check_visibility function. This is due to missing capability check and nonce verification on the widget-logic-update-conditional-tags AJAX action combined with insufficient sanitization of the 'nwlv[cod-tag]' parameter before storage and subsequent use in an eval() call. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server.

title: Totalbounty Widget Logic Visual security vulnerability


product: Escargot

vendor: Samsung Open Source

ecosystem: software/application

summary: Time-of-check time-of-use (TOCTOU) race condition vulnerability in Samsung Open Source Escargot allows Leveraging Race Conditions. This issue affects Escargot: bab3a5797557014ce3c2e28419a6310cfba90d0d.


product: Hospital Queuing Management

vendor: Advantech

description: CVE-2026-14161 exposes Advantech Hospital Queuing Management API docs without auth. GHSA names no version range and no floor.

title: CVE-2026-14161: Advantech Queue API Docs, No Named Floor

summary: Hospital Quening Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

title: Advantech Hospital Queuing Management security vulnerability


product: Hospital Quering Management

description: CVE-2026-14162 exposes Advantech Hospital Queuing Management API docs without auth. GHSA names no version range and no floor.

title: CVE-2026-14162: Advantech Queue API Docs, No Named Floor

summary: Hospital Queuing Management developed by Advantech has a Sensitive Data Exposure vulnerability, allowing unauthenticated remote attackers to access a specific URL to obtain API documentation.

title: Advantech Hospital Quering Management security vulnerability


platforms: Windows Linux

product: Octopus Server

vendor: Octopus Deploy

status: Received

summary: In affected versions of Octopus Server under certain circumstances it is possible for sensitive variables to be printed in the deployment variable snapshot in clear-text.

title: Octopus Deploy Octopus Server security vulnerability


default_status: affected

product: Red Hat Enterprise Linux 10

vendor: Red Hat

status: unaffected

version_type: rpm

product: Red Hat Enterprise Linux 10.0 Extended Update Support

product: Red Hat Enterprise Linux 9

product: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

product: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

product: Red Hat OpenShift Container Platform 4.22

product: Red Hat Discovery 2

product: Red Hat Hardened Images

product: Red Hat Update Infrastructure 5

product: Red Hat OpenShift Container Platform 4

description: CVE-2026-14164 is a RAR5 filtered_buf double free in libarchive. GHSA names no version range and no floor.

title: CVE-2026-14164: libarchive RAR5 Double Free, No Named Floor

part: redhat

status: Awaiting Analysis

summary: A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.


product: Tuleap Enterprise Edition

vendor: Dassault Systèmes

summary: An Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to access data of other users without authorization.

title: Dassault Systèmes Tuleap Enterprise Edition security vulnerability


vendor: ads-tec Industrial IT

summary: A low privileged remote attacker can perform privileged configuration changes reserved for the administrator level including permission management due to incorrect authorization.

title: Ads-Tec Industrial It Dvg-Irf1401 security vulnerability


summary: A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.


summary: Due to incorrect behavior order a low privileged remote attacker could trigger account inconsistent state via crafted input and overwrites existing user passwords which could result in complete administrative unavailability of the device.


summary: An unauthenticated remote attacker can abuse the improper validation of the post-login redirect of the web-UI to trick users to a malicious website. This can result in a loss of confidentiality and availability.


platforms: Windows Linux macOS

product: InsightVM

product: Nexpose

product: Insight Agent

summary: Rapid7 InsightVM, Nexpose, and the Insight Agent execute discovered executables during authenticated assessment without validating file ownership, allowing a local low-privileged user to run code as the scan credential (Scan Engine) or as root/SYSTEM (Insight Agent). Fixed in Scan Engine content 1.1.3935 and Insight Agent content component 0.0.245.0.

title: Rapid7 Insightvm security vulnerability


product: HUMANIST Digital Human Resources

summary: Unrestricted upload of file with dangerous type vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Upload a Web Shell to a Web Server. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.


platforms: openEuler Centos

vendor: openGauss-server

summary: openGauss 在处理带 NLS 参数的 to_timestamp 调用时，to_timestamp_with_fmt_nls() 会将 nls_fmt_str 保存到 u_sess->parser_cxt.nls_fmt_str。在 seqscan + sort 执行路径下，该字符串原本被分配在 SeqScan 的表达式上下文中；当 SeqScan 完成后，该内存上下文会被 reset，但后续结果输出阶段 timestamp_out() 仍会通过 CheckNlsFormat() 访问 u_sess->parser_cxt.nls_fmt_str，导致访问已释放内存。攻击者在具备数据库 SQL 执行权限的情况下，可构造特定 to_timestamp(..., ..., nlsparam) 查询触发 heap-use-after-free。在 ASan/Memcheck 环境下表现为数据库服务退出；在实际运行环境中可能造成后端进程异常退出，影响数据库服务可用性，形成拒绝服务风险。该问题在openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2版本存在，目前已在openGauss-server-7.0.0-RC3版本修复。由于 openGauss-server-7.0.0-RC1版本和openGauss-server-7.0.0-RC2均为创新版本，不会发布针对性补丁包，涉及版本升级至 openGauss-server-7.0.0-RC3或更新版本即可。

title: Opengauss-Server Opengauss-Server-7.0.0-Rc2 security vulnerability


product: Red Hat build of Apache Camel for Spring Boot 4

product: Red Hat build of Apache Camel - HawtIO 4

product: Red Hat Data Grid 8

product: Red Hat Enterprise Linux 8

product: Red Hat Fuse 7

product: Red Hat JBoss Enterprise Application Platform 7

product: Red Hat JBoss Enterprise Application Platform 8

product: Red Hat JBoss Enterprise Application Platform Expansion Pack

product: Red Hat Single Sign-On 7

summary: A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.

title: Red Hat Red Hat Build Of Apache Camel For Spring Boot 4 security vulnerability


ecosystem: javascript/npm

description: CVE-2026-14181 is standalone URL-normalization DoS in @fastify/middie (through 9.3.2). The title names no next tag. Do not invent 9.3.3.

title: CVE-2026-14181: @fastify/middie through 9.3.2

product: fastify/middie

vendor: fastify

summary: @fastify/middie versions 9.1.0 through 9.3.2 fail to guard the URL normalization step used by the standalone engine when incoming request paths contain malformed percent-encoded sequences. Inputs such as an incomplete percent escape or a truncated multibyte sequence cause the underlying decoder to throw synchronously, and the exception escapes the middie normalize step and terminates the Node.js process. The bypass affects applications that call middie.run directly on the standalone engine API, causing an immediate denial of service for all connected clients until restart. Applications using the Fastify plugin path are not affected because Fastifys error handler catches the exception. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: migrate from the standalone engine API to the Fastify plugin path, where the framework error handler catches the exception.

title: Fastify Fastify/Middie security vulnerability


vendor: Unknown

summary: The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the account of any registered user who has not yet confirmed their email address.

title: Customer Email Verification For Woocommerce security vulnerability


product: Classified Listing

summary: The Classified Listing WordPress plugin before 5.3.9 does not verify that the order targeted by its payment-receipt handler belongs to the requesting user, allowing authenticated users with subscriber-level access to read the payment receipt details of any other user's order.

title: Classified Listing security vulnerability


product: Academy LMS

summary: The Academy LMS WordPress plugin before 3.8.1 does not verify ownership of a user-supplied user identifier in several of its lesson AJAX handlers, allowing authenticated users with subscriber-level access to read and modify other users' lesson notes and mark other users' lesson content as completed.

title: Academy Lms security vulnerability


product: WPBot

summary: The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing authenticated users with subscriber-level access to modify the WPBot WordPress plugin before 8.2.0's configuration.

title: Wpbot security vulnerability


product: Sina Extension for Elementor

summary: The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request.

title: Sina Extension For Elementor security vulnerability


product: WinRAR

vendor: RARLAB

product: RAR

product: UnRAR

description: CVE-2026-14191 is a WinRAR/UnRAR RAR5 .rev heap write. NVD and RARLab name 7.23. Do not copy 6.23 from CVE-2023-40477.

title: CVE-2026-14191: WinRAR RAR5 Recovery-Volume Heap Write

summary: An out-of-bounds heap write exists in the RAR5 recovery-volume (.rev) parser in WinRAR and UnRAR (RecVolumes5::ReadHeader in recvol5.cpp). The RecItems vector is sized only when the first .rev file in a set is processed; subsequent .rev files supply an independent RecNum value that is validated against that file's own TotalCount field but never against the actual size of RecItems. A crafted set of two or more .rev files can therefore write an attacker-controlled 32-bit value (the header's RevCRC field) to RecItems[RecNum] at an attacker-controlled offset up to 65534 * sizeof(RecVolItem) bytes past the allocation, corrupting adjacent heap objects. Triggering requires the victim to run a recovery/test operation on an attacker-supplied .rev set (for example 'unrar t x.part1.rev', WinRAR 'Repair archive', or auto-recovery when extracting a volume set with a missing .rar part). This is the RAR5-path sibling of CVE-2023-40477 (which was fixed in the RAR3 path only in WinRAR 6.23). Fixed in WinRAR / RAR 7.23.


product: HUMANIST Digital Human Resources

summary: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.

title: Bilin Software And Informatics Consultancy Inc. Humanist Digital Human… security vulnerability


vendor: deltaww

description: CVE-2026-14193 is improper array-index validation on DVP80ES300T. GHSA names no version range and no floor. Do not copy a DVP80ES3 floor.

title: CVE-2026-14193: DVP80ES300T Array Index, No Named Floor

summary: DVP80ES300T with Improper Validation of Array Index Vulnerability


summary: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Path Traversal. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.


product: WCFM Marketplace

summary: The WCFM Marketplace WordPress plugin before 3.8.1 does not verify that a marketplace vendor owns a review before allowing it to be unapproved or deleted, allowing any vendor to modify or permanently delete reviews belonging to other vendors' stores.

title: Wcfm Marketplace security vulnerability


description: CVE-2026-14198 is encoded-slash middleware bypass in @fastify/middie (through 9.3.2). The title names no next tag. Do not invent 9.3.3.

title: CVE-2026-14198: @fastify/middie through 9.3.2

summary: @fastify/middie versions 9.1.0 through 9.3.2 decode the encoded slash %2F inside path parameter values before matching middleware paths, while Fastify's underlying router preserves the encoding during route lookup. The two layers disagree on the canonical request path, so the middleware fails to match a URL that the route handler does match. When middleware is used for authentication, authorization, rate limiting, or auditing on parameterized paths, an attacker can reach the protected handler by sending a single crafted URL with an encoded slash in the parameter position. The bypass is HTTP method agnostic and requires no authentication or special preconditions. Patches: upgrade to @fastify/middie 9.3.3. Workarounds: avoid parameterized middleware paths for security decisions, or enforce authentication at the route handler or via a Fastify hook that runs after the router has resolved the request.


summary: Observable response discrepancy vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Account Footprinting. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.


product: Smart Manager

summary: The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, allowing users with the Contributor role or above to inject JavaScript that executes in the browser session of an administrator who views the grid.

title: Smart Manager security vulnerability


product: Google Authenticator

summary: The Google Authenticator WordPress plugin before 0.56 does not verify a CSRF nonce when saving its two-factor setup, allowing attackers to trick a logged-in user into overwriting their own 2FA secret with an attacker-controlled value, which enables two-factor authentication and locks the victim out of their account.

title: Google Authenticator security vulnerability


product: WP Events Manager

summary: The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user to create a completed booking for a paid event without making a payment.

title: Wp Events Manager security vulnerability


product: HT Contact Form

summary: The HT Contact Form WordPress plugin before 2.9.3 does not perform any authorization check on the endpoint that returns a saved form draft, allowing unauthenticated users to read the personal data (name, email, phone, address) stored in form drafts.

title: Ht Contact Form security vulnerability


product: LifterLMS

summary: The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course.

title: Lifterlms security vulnerability


product: Remote Utilities Host

vendor: Remote Utilities Pte. Ltd.

ecosystem: windows/system

summary: Remote Utilities Host <=7.7.3.0 sets insecure ACLs on all DLL files in the installation directory (C:\Program Files (x86)\Remote Utilities - Host\), granting FULL CONTROL (F) to the built-in Everyone group (BUILTIN\Everyone, S-1-1-0). A Windows service running as NT AUTHORITY\SYSTEM loads DLLs from this directory. The DLLs are file-locked at runtime, but a race window exists when the service is stopped (e.g. during a software update or following a crash), during which a local unprivileged attacker can replace a DLL with a malicious payload. Upon service restart, the payload executes as NT AUTHORITY\SYSTEM. The DLL confirmed as actively loaded during testing is libasset32.dll. Additional DLLs in the same directory (eventmsg.dll, libcodec32.dll, vp8encoder.dll, vp8decoder.dll, webmvorbisdecoder.dll, webmvorbisencoder.dll, webmmux.dll) share identical insecure permissions.

title: Remote Utilities Pte. Ltd. Remote Utilities Host security vulnerability


product: Red Hat build of Keycloak 26.4

product: Red Hat build of Keycloak 26.6

product: Red Hat JBoss Enterprise Application Platform Expansion Pack

vendor: redhat

summary: A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path.


summary: URL redirection to untrusted site ('open redirect') vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Phishing. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1.


product: Easy Appointments

summary: The Easy Appointments WordPress plugin before 3.12.28 does not verify ownership or capability when returning stored customer details, allowing users with subscriber-level access to read any customer's personal information by iterating an identifier.

title: Easy Appointments security vulnerability


summary: The Easy Appointments WordPress plugin before 3.12.28 does not verify that the appointment targeted by its customer-data update action belongs to the current user; the action only checks a shared nonce that any authenticated user can obtain from their own appointment's edit form. A subscriber-level user with an appointment of their own can therefore reuse that nonce to overwrite the customer metadata (email, name, phone, description) of another user's appointment. Because the Easy Appointments WordPress plugin before 3.12.28 then treats that metadata as the appointment's contact data, a subsequent administrator status change with customer notifications enabled delivers the victim's appointment notification to the attacker-controlled email address.


summary: The Easy Appointments WordPress plugin before 3.12.28 does not require a sufficient capability on one of its appointment-listing REST endpoints, restricting it only to a capability that every authenticated user holds, allowing users with subscriber-level access to read all bookings on the site, including customer names, schedules, and statuses.


product: RouterOS

vendor: MikroTik

version: All versions

summary: An API session‑management flaw in products with the MikroTik RouterOS API enabled are vulnerable to a Insufficient Session Expiration vulnerability. This could allow active sessions to retain their previous permission set after inactivity timeouts or user‑group changes. As a result, an authenticated user whose permissions have been reduced may continue accessing information.

title: Mikrotik Routeros security vulnerability


product: ECS

summary: The ECS WordPress plugin before 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions, allowing unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

title: Ecs security vulnerability


summary: The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor), so a Contributor can write a data-source binding into any post — including admin-authored pages — whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.

title: Ecs security vulnerability


summary: The LifterLMS WordPress plugin before 10.0.10 does not perform a capability check in one of its select2 query AJAX handlers, only verifying that the user is logged in, allowing any authenticated user with subscriber-level access to read the titles of internal post types such as coupon codes by supplying the post type.

title: Lifterlms security vulnerability


product: WOLF

summary: The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting.

title: Wolf security vulnerability


product: Download Manager

summary: The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token a long-lived, multi-use, portable bearer token, so that an attacker who obtains one leaked download key can repeatedly download a role- or password-protected package file without authorization.

title: Download Manager security vulnerability


product: Contact Form 7

summary: The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and cancel redirect targets of a Stripe checkout, allowing an unauthenticated attacker to redirect a victim, via a crafted link, to an arbitrary external site after the checkout flow.

title: Contact Form 7 security vulnerability


product: vitepos

summary: The vitepos WordPress plugin before 3.6.0, Vitepos WordPress plugin before 3.5.0 do not perform a per-target authorization check in their point-of-sale password-reset API and grant the custom Outlet Manager role an over-broad password-reset capability by default, allowing an Outlet Manager to reset any user's password, including an administrator's, and take over the account.

title: Vitepos security vulnerability


summary: The vitepos WordPress plugin before 3.6.0 does not sanitize or parameterize an identifier taken from a REST request body before using it in a database query in one of its report endpoints, allowing users with administrator-level access to perform SQL injection.

title: Vitepos security vulnerability


product: tourmaster

summary: The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into storing JavaScript that then executes in the admin area (stored Cross-Site Scripting via CSRF).

title: Tourmaster security vulnerability


summary: The tourmaster WordPress plugin before 5.4.9 writes its order/booking export to a fixed, predictable file inside its publicly accessible directory with no access control, allowing unauthenticated users to download the exported customers' personal information once an administrator has run an export.

title: Tourmaster security vulnerability


description: CVE-2026-14241 is Firefox leftover. GHAD is critical and vulnerabilities empty. NVD CPE is exact last-affected. Do not invent a GHAD floor.

title: CVE-2026-14241: Firefox leftover dump

product: firefox

vendor: mozilla

summary: Memory safety bugs present in Firefox 152.0.3. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 152.0.4.


product: Jssor Slider by jssor.com

vendor: jssor

summary: The Jssor Slider by jssor.com plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.1.24 via the 'url' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.

title: Jssor Jssor Slider By Jssor.Com security vulnerability


description: CVE-2026-14245 lets a caller take over an administrator via miniOrange OTP username_b through 5.5.1. Upgrade to 5.5.2+. Do not copy 5.5.0.

title: CVE-2026-14245: miniOrange OTP username_b Bypass

summary: The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to, and including, 5.5.1. This is due to the `um_reset_password_process_hook()` function performing no server-side verification that the OTP validation step was completed, and relying solely on a public `form_nonce` nonce that the plugin itself emits to unauthenticated visitors via the `moumprvar` JavaScript object on the Ultimate Member password reset page, while still accepting the attacker-controlled `username_b` parameter to target any WordPress user without role restriction or any binding to a previously validated OTP session. This makes it possible for unauthenticated attackers to obtain a freshly generated password-reset URL for an arbitrary Administrator account — returned in a 302 `Location` header — and use it to take full control of that account. Exploitation requires the Ultimate Member Password Reset Form integration to be active and the plugin to not be configured for phone-only reset.

title: Cyberlord92 Miniorange Otp Login, Verification And Sms Notifications security vulnerability


product: Request a Quote – Quote Forms for Any WordPress Site

vendor: emarket-design

summary: The Request a Quote plugin for WordPress is vulnerable to Code Injection in versions up to, and including, 2.5.5 via the emd_delete_file AJAX action. This is due to the emd_delete_file() handler deriving a PHP function name from the attacker-controlled $_POST['path'] parameter and invoking it dynamically via the variable-function call $sess_name(), and the handler being registered for wp_ajax_nopriv with its only protection being a nonce that the plugin prints into the public quote-form page via wp_localize_script. This makes it possible for unauthenticated attackers to invoke arbitrary zero-argument PHP functions on the server, such as phpinfo(), potentially exposing sensitive server configuration and credentials, or executing other destructive built-in PHP functions.

title: Emarket-Design Request A Quote – Quote Forms For Any Wordpress Site security vulnerability


product: TH Login Registration

vendor: themehunk

summary: The Themehunk Login Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.0.2. This is due to the handle_frontend_register() function in the unauthenticated /thlogin/v1/register REST endpoint accepting a user-controlled 'role' parameter and validating it only against get_editable_roles() — which returns every defined editable site role, including 'editor' — before passing it to wp_insert_user(). This makes it possible for unauthenticated attackers, when public user registration is enabled, to create new accounts with the editor role.


product: Red Hat OpenShift GitOps

summary: A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A namespace-scoped Argo CD instance can trigger deletion of a ClusterRole owned by a cluster-scoped Argo CD instance by crafting a name collision, resulting in a denial of service.


product: Delphix Continuous Data

vendor: Perforce

summary: A race condition in the account lockout mechanism in Delphix Continous Data allowed the lockout threshold to be bypassed through concurrent authentication requests. Parallel login attempts were processed before the failed-login counter and lockout status were updated, defeating brute-force protections and enabling continued password guessing against a targeted account.

title: Perforce Delphix Continuous Data security vulnerability


product: E16 Gen 2 (Type 21M5, 21M6) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

vendor: Lenovo

product: E14 Gen 6 (Type 21M3, 21M4) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: T14s Gen 6 (Type 21M1, 21M2) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: P16s Gen 4 (Type 21QR, 21QS) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: P16s Gen 4 (Type 21RX, 21RY) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: T16 Gen 4 (Type 21QN, 21QQ) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: P14s Gen 6 (Type 21RV, 21RW) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: T14 Gen 6 (Type 21QJ, 21QK) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: P14s Gen 6 (Type 21QL, 21QM) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: E14 Gen 7 (Type 21T0, 21T1) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: E16 Gen 3 (Type 21ST, 21SU) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

product: L14 Gen 6 (Type 21S8, 21S9) Laptops (ThinkPad) ELAN TrackPoint Device Driver for Windows 11 (Version 23H2 or later) - ThinkPad

summary: ELAN reported a potential out-of-bounds write vulnerability in the ELAN TrackPoint driver that, under certain circumstances, could allow a local authenticated user to cause a system crash.

title: Lenovo E16 Gen 2 (Type 21M5, 21M6) Laptops (Thinkpad) Elan Trackpoint D… security vulnerability


platforms: Linux macOS Windows

product: brace-expansion

vendor: juliangruber

status: Undergoing Analysis

summary: brace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of input ('{a,b}'.repeat(1500)) crashes a default Node.js process. Any application that passes attacker-influenced strings to brace-expansion.expand() - directly or transitively via minimatch / glob brace patterns - can be crashed by a small request. Fixed in 5.0.8 by adding a maxLength option (default 4,000,000) that bounds accumulated output and intermediate arrays.


product: Red Hat Enterprise Linux 10

vendor: Red Hat

summary: A flaw was found in dhcpcd's IPv6 Neighbor Discovery Router Advertisement processing. A specially crafted IPv6 Router Advertisement containing a zero-length Neighbor Discovery option can bypass validation during packet storage and later be reparsed without adequate validation, causing the parser to enter a non-advancing loop. Successful exploitation may result in excessive CPU consumption, leading to a denial of service.


product: Xerte Online Tools

vendor: Xerte

description: CVE-2026-14261 is authentication bypass and RCE in Xerte Online Tools. GHSA names no version range and no floor. Do not copy a floor from CVE-2026-12116.

title: CVE-2026-14261: Xerte Auth Bypass RCE, No Named Floor

summary: A vulnerability in the Xerte Online Tools allows for authentication bypass and remote code execution via reinstallation through the /setup/ folder, enabling attackers to reinstall the service to a remote database they control.

title: Xerte Xerte Online Tools security vulnerability


description: CVE-2026-14262 lets a subscriber mint an admin JWT in Simple JWT Login through 3.6.6. GHSA last-names 3.6.6. Do not invent 3.6.7.

title: CVE-2026-14262: WordPress Simple JWT Auth Bypass, 3.6.6

summary: The Simple JWT Login – Allows you to use JWT on REST endpoints. plugin for WordPress is vulnerable to Authentication Bypass to Privilege Escalation in all versions up to, and including, 3.6.6 via the `payload` parameter. The vulnerability exists because `AuthenticateService::generatePayload()` only overwrites JWT payload keys whose names appear in the admin-configured `jwt_payload` list — leaving any attacker-supplied identity claims such as `email`, `id`, or `username` intact and signed into the JWT with the site's HS256 secret. This makes it possible for authenticated attackers, with subscriber-level access and above, to escalate their privileges to that of an Administrator by injecting a target administrator's email address into the `payload` parameter at the `/wp-json/simple-jwt-login/v1/auth` endpoint, then redeeming the resulting JWT at the `/autologin` endpoint to obtain a fully authenticated session as that administrator.


product: AWS Advanced JDBC Wrapper

vendor: AWS

ecosystem: java/maven

description: CVE-2026-14265 is Amazon RemoteQueryCachePlugin deserialization. No GHSA. Leftover 4.0.1 is not a catalog floor.

title: CVE-2026-14265: Amazon RemoteQueryCachePlugin untrusted deserialization

vendor: amazon

summary: Deserialization of untrusted data in the RemoteQueryCachePlugin in Amazon Web Services AWS Advanced JDBC Wrapper 3.3.0 through 4.0.0 might allow an actor with write access to the shared cache infrastructure to execute arbitrary code on application servers that read cached query results via a crafted serialized Java object. The RemoteQueryCachePlugin uses ObjectInputStream without class filtering when deserializing cached query results from Redis or Valkey, enabling gadget chain execution when cache entries are poisoned. We recommend upgrading to AWS Advanced JDBC Wrapper version 4.0.1 or later.

title: Amazon Advanced Jdbc Wrapper security vulnerability


default_status: unknown

summary: 7-Zip XZ Decompression Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the processing of XZ chunked data. Crafted XZ-compressed data can trigger an overflow of a heap-based buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30169.


product: Extra Checkout Options - addon for Extra Product Options plugin

vendor: ThemeComplete

summary: The Extra Checkout Options (addon for Extra Product Options & Add-Ons for WooCommerce) plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.3.2. This is due to missing authorization and nonce validation in the eco_save_settings() function, which allows low-privileged authenticated users to modify the tc_eco_custom_file_types upload allowlist setting, combined with insufficient authorization on the wc_eco_upload_file AJAX action. This makes it possible for authenticated attackers, with Subscriber-level access and above, to allow PHP uploads, upload a PHP file using the frontend upload nonce exposed on cart and checkout pages, and achieve remote code execution. NOTE: This vulnerability was partially fixed in version 2.3.2.

title: Themecomplete Extra Checkout Options - Addon For Extra Product Options… security vulnerability


product: Wholesale Market

vendor: cedcommerce

summary: The Wholesale Market plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 2.2.2 via the ced_wholesale_request_send AJAX action. The ced_wholesale_request_send_callback() handler only verifies a nonce (which is exposed to any authenticated user through wp_localize_script on the frontend) and that the caller has a positive user ID, then calls WP_User::add_role() with the client-supplied role_required POST parameter without restricting the value to an allowlist of wholesale roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to Administrator when the site administrator has enabled the 'Assigning requested role directly' option.

title: Cedcommerce Wholesale Market security vulnerability


vendor: rtcamp

summary: The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the save_video_file() function hooked into WPForms' public wpforms_process_before_filter, which trusts the attacker-supplied multipart Content-Type header, preserves the original filename via wp_unique_filename(), and moves the raw upload with $wp_filesystem->move() into a web-served directory — bypassing wp_handle_upload()'s MIME/extension allowlist. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

title: Rtcamp Godam – Organize Wordpress Media Library & File Manager With Unl… security vulnerability


product: 10Web Booster

vendor: Unknown

summary: The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.

title: 10Web Booster security vulnerability


summary: The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a cryptographic key that is empty in the default, unconfigured state, allowing unauthenticated attackers to write an arbitrary file into a web-accessible directory and achieve remote code execution.

title: Facturaone Para Woocommerce Con Verifactu security vulnerability


product: Embed Google Photos album

summary: The Embed Google Photos album WordPress plugin through 2.2.1 does not escape a shortcode attribute value before outputting it inside an HTML attribute, allowing users with the Contributor role or above to inject arbitrary JavaScript that executes in the browser of any user, including administrators, who views the affected post.

title: Embed Google Photos Album security vulnerability


product: security-ninja-premium

summary: The security-ninja-premium WordPress plugin before 5.290 does not verify the second authentication factor in one of its two-factor authentication code paths, allowing an unauthenticated attacker who knows a user's password to complete authentication without the one-time code and bypass enforced two-factor authentication for any account, including administrators. The affected two-factor module ships only in the premium build.

title: Security-Ninja-Premium security vulnerability


product: Download Manager

summary: The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package templates, allowing users with the Author role or above to store a title that results in arbitrary JavaScript execution in the browser of any user, including unauthenticated visitors, who views a page displaying the package.

title: Download Manager security vulnerability


product: Autopay

summary: The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the browser of any user, including administrators, who loads the checkout page.

title: Autopay security vulnerability


product: Mattermost

vendor: Mattermost

vendor: mattermost

summary: Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to properly limit resource consumption when processing certain user-supplied input, which allows an authenticated user to cause a denial of service. Mattermost Advisory ID: MMSA-2026-00713

title: Mattermost Mattermost Server security vulnerability


summary: The miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn) WordPress plugin before 7.8.0 does not bind the one-time code used by its optional email-verification (Profile Completion) feature to the account it was issued for, allowing unauthenticated attackers to obtain a valid session for any account, including administrators, by requesting a code for an email address they control and replaying it against the victim's email address. Exploitation requires the Profile Completion feature to be enabled and social login to be configured.

title: Miniorange Social Login And Register (Discord, Google, Twitter, Linkedi… security vulnerability