Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,775

Export CSV
CVE-2026-126891

chromium-browser: chromium-browser: Use after free in V8

Use after free in V8 in Google Chrome prior to 157.0.8103.78 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-97361

Improper Privilege Management on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and Space Battery pack SP with WiFi.

CVSS 4.0 · 8.5 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126894

chromium-browser: chromium-browser: Information disclosure via out-of-bounds read in Skia

Out of bounds read in Skia in Google Chrome prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Google
Products
Chrome
CVE-2026-97358

Inclusion of Web Functionality from an Untrusted Source on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceCom

CVSS 4.0 · 7 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126903

chromium-browser: chromium-browser: Web origin policy bypass via improper state validation in ANGLE

Improper state validation in ANGLE in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Google Microsoft
Products
Chrome Windows
CVE-2026-97357

Out-of-bounds write on B. Braun SpaceCom, Battery Pack SP with Wi-Fi, and Data module compactplus

An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.

CVSS 4.0 · 6.9 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-126906

chromium-browser: chromium-browser: Information disclosure via race condition in Extensions

Race condition in Extensions in Google Chrome on on Mac prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via crafted network traffic. (Chromium security severity: High)

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Apple Google
Products
Macos Chrome
CVE-2026-126907

chromium-browser: chromium-browser: Uninitialized resource in Media

Uninitialized resource in Media in Google Chrome on on Windows prior to 157.0.8103.78 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Google Microsoft
Products
Chrome Windows
CVE-2026-128079

envd: Host file disclosure through requirements path traversal and TOCTOU

envd provides reproducible development environments for humans and agents. In versions starting with 0.3.38 and before 1.3.6, insufficient containment of host-side requirements-file reads in  install.python_packages(requirements=...)  could allow access to files outside the build context. An attacker able to influence build input could cause file contents interpreted as dependency entries to appear in debug logs or build-step metadata, subject to the envd process’s permissions. Exploitation in version 1.3.5 additionally requires concurrent modification of relevant filesystem paths. This issue is fixed in version 1.3.6.

CVSS 4.0 · 6.8 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124679

Apache APISIX: jwe-decrypt and forward-auth may pass a client-supplied identity header

Authentication bypass by spoofing vulnerability in Apache APISIX. On routes using jwe-decrypt with strict: false and a forward_header distinct from the token header an unauthenticated client can supply the value the upstream treats as gateway-decrypted plaintext. Similar can happen when forward-auth is configured with allow_degradation: true, and the auth service is unavailable. This issue affects Apache APISIX: from 3.18.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 7.8 High EPSS n/a KEV · Not listed
Vendors
—
Products
—
CVE-2026-124716

Apache APISIX: authz-keycloak authorization scope mismatch

Incorrect Authorization vulnerability in Apache APISIX. An authenticated user who holds any one of a route's required permissions or scopes can reach the protected upstream without the others, including HTTP methods the authorization server denied. This issue affects Apache APISIX: from 1.4.0 through 3.19.0. Users are recommended to upgrade to version 3.20.0, which fixes the issue.

CVSS 4.0 · 6.4 Medium EPSS n/a KEV · Not listed
Vendors
—
Products
—