CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 28, 18:00 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-87513 | CH Chrome Google | 6.5 | Sep 9 | Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a… |
| CVE-2026-87436 | CH Chrome Google | 6.5 | Sep 9 | Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome… |
| CVE-2026-87475 | CH Chrome Google | 6.5 | Sep 9 | Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a… |
| CVE-2026-87476 | CH Chrome Google | 6.5 | Sep 9 | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page |
| CVE-2026-87497 | CH Chrome Google | 4.3 | Sep 9 | Uninitialized resource in Codecs in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page |
| CVE-2026-87482 | CH Chrome Google | 5.9 | Sep 9 | Cleartext transmission of sensitive data in HttpsUpgrades in Google Chrome on on iOS prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via crafted… |
| CVE-2026-87580 | CH Chrome Google | 6.5 | Sep 9 | Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social… |
| CVE-2026-87590 | CH Chrome Google | 5.9 | Sep 9 | Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via crafted network traffic |
| CVE-2026-87630 | CH Chrome Google | 4.3 | Sep 9 | Integer overflow in WebRTC in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page |
| CVE-2026-87443 | CH Chrome Google | 6.5 | Sep 9 | Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page |
| CVE-2026-87645 | CH Chrome Google | 5.4 | Sep 9 | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page |
| CVE-2026-87449 | CH Chrome Google | 4.3 | Sep 9 | Cross-site request forgery in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page |
| CVE-2026-87577 | CH Chrome Google | 4.3 | Sep 9 | Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page |
| CVE-2026-87642 | CH Chrome Google | 4.3 | Sep 9 | Uninitialized resource in WebGL in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page |
| CVE-2026-87615 | CH Chrome Google | 5.4 | Sep 9 | Race condition in Payments in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page |
| CVE-2026-87603 | CH Chrome Google | 6.5 | Sep 9 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page |
| CVE-2026-87466 | CH Chrome Google | 4.3 | Sep 9 | Incorrect authorization in Workers in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page |
| CVE-2026-87503 | CH Chrome Google | 6.5 | Sep 9 | Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access… |
| CVE-2026-87557 | CH Chrome Google | 4.3 | Sep 9 | Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass system access… |
| CVE-2026-87515 | CH Chrome Google | 6.5 | Sep 9 | Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a… |
| CVE-2026-87465 | CH Chrome Google | 4.2 | Sep 9 | Incorrect authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted… |
| CVE-2026-87658 | CH Chrome Google | 4.3 | Sep 9 | Information leak in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted Chrome… |
| CVE-2026-87453 | CH Chrome Google | 5.3 | Sep 9 | Confused deputy in BackgroundFetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to leak sensitive information via a… |
| CVE-2026-87446 | CH Chrome Google | 6.5 | Sep 9 | Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted… |
| CVE-2026-87478 | CH Chrome Google | 6.5 | Sep 9 | Observable discrepancy in Autofill in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page |
| CVE-2026-87640 | CH Chrome Google | 6.1 | Sep 9 | Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the… |
| CVE-2026-87564 | CH Chrome Google | 4.3 | Sep 9 | Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page |
| CVE-2026-87651 | CH Chrome Google | 4.3 | Sep 9 | Incorrect authorization in Paint in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page |
| CVE-2026-87552 | CH Chrome Google | 5.5 | Sep 9 | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app |
| CVE-2026-87596 | CH Chrome Google | 4.3 | Sep 9 | Out of bounds read in ANGLE in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page |
| CVE-2026-87447 | CH Chrome Google | 6.5 | Sep 9 | Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome… |
| CVE-2026-61908 | CI Cyrus IMAP cyrusimap | 6.5 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-79514 | GP Gpac Gpac | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP request |
| CVE-2026-79522 | GP Gpac Gpac | 6.5 | Sep 9 | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS) via sending a crafted HTTP… |
| CVE-2026-79513 | GP Gpac Gpac | 6.5 | Sep 9 | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS)… |
| CVE-2026-38998 | Product not mapped yet | 6.5 | Sep 9 | A use-after-free in the SocketDescriptor::tcpReadHandler1 function (liveMedia/RTPInterface.cpp) of LIVE555 Streaming Media (version 2026.02.26) allows attackers to cause a Denial… |
| CVE-2026-71616 | Product not mapped yet | 6.2 | Sep 9 | An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf_route_media_complete_object() |
| CVE-2026-75308 | Product not mapped yet | 6.1 | Sep 9 | yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS) |
| CVE-2026-75307 | Product not mapped yet | 6.1 | Sep 9 | zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint |
| CVE-2026-57825 | OP opam OCaml | 5.7 | Sep 9 | In the opam package before 2.5.2 for OCaml, the sandbox protection mechanism can be bypassed because symlinks are mishandled during use of .install files |
| CVE-2025-51619 | Product not mapped yet | 5.5 | Sep 9 | A vulnerability in the Thesycon DPC Latency Checker driver (dpc.sys) thru 1.4.0 allows local unprivileged users to cause a denial-of-service (BSOD) condition on Windows systems |
| CVE-2026-39020 | Product not mapped yet | 5.5 | Sep 9 | An issue in WIngs3D v.2.4.1 allows a local attacker to cause a denial of service via a crafted Wavefront OBJ file |
| CVE-2026-71803 | Product not mapped yet | 5.4 | Sep 9 | money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability |
| CVE-2026-71802 | Product not mapped yet | 5.4 | Sep 9 | A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3 |
| CVE-2026-61910 | CI Cyrus IMAP cyrusimap | 5.0 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61907 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61909 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-61911 | CI Cyrus IMAP cyrusimap | 4.3 | Sep 9 | An issue was discovered in Cyrus IMAP before 3.12.4 |
| CVE-2026-79387 | Product not mapped yet | 4.3 | Sep 9 | SQL injection vulnerability in PbootCMS versions 3.2.0 through 3.2.5 allows an authenticated user to modify arbitrary user account fields (including passwords and roles) via… |
| CVE-2026-79515 | Product not mapped yet | 4.3 | Sep 9 | An out-of-bounds read in the stbtt_GetGlyphShape component of nothings stb commit 31c1ad3 allows attackers to cause a Denial of Service (DoS) via sending a crafted TTF file |