FXBIA/cve-intelligence-stream huggingface dataset:
CVE ID: CVE-2026-11166 Severity: MEDIUM (CVSS 6.8) CWE: CWE-79 KEV (actively exploited): NO Description: Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11165 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebMIDI in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11163 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11162 Severity: MEDIUM (CVSS 4.3) CWE: CWE-200 KEV (actively exploited): NO Description: Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11161 Severity: MEDIUM (CVSS 4.3) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in DataTransfer in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11160 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in Input in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11159 Severity: MEDIUM (CVSS 4.3) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Skia in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11158 Severity: HIGH (CVSS 8.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Downloads in Google Chrome on Mac prior to 149.0.7827.53 allowed a local attacker to potentially perform a sandbox escape via a crafted AppleScript command. (Chromium security severity: Medium)
CVE ID: CVE-2026-11157 Severity: MEDIUM (CVSS 5.4) CWE: CWE-94 KEV (actively exploited): NO Description: Script injection in Accessibility in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML (UXSS) via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2026-11156 Severity: MEDIUM (CVSS 4.3) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11155 Severity: MEDIUM (CVSS 4.3) CWE: CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in CSS in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11154 Severity: HIGH (CVSS 7.5) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11153 Severity: CRITICAL (CVSS 9.1) CWE: CWE-1300 KEV (actively exploited): NO Description: Side-channel information leakage in Forms in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11152 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Object lifecycle issue in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11151 Severity: HIGH (CVSS 7.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11085 Severity: HIGH (CVSS 8.8) CWE: CWE-190, CWE-472 KEV (actively exploited): NO Description: Integer overflow in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11084 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346, CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11083 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346, CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11082 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11081 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Canvas in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11080 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11079 Severity: HIGH (CVSS 8.8) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform an out of bounds memory write via a crafted video file. (Chromium security severity: Medium)
CVE ID: CVE-2026-11078 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20, CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11075 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in V8 in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11073 Severity: MEDIUM (CVSS 6.5) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in WebGL in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11071 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Base in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11070 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Chromoting in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the network process to potentially perform a sandbox escape via malicious network traffic. (Chromium security severity: Medium)
CVE ID: CVE-2026-11069 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11067 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11041 Severity: HIGH (CVSS 8.8) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Media in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2025-4295 Severity: MEDIUM (CVSS 4.6) CWE: CWE-297 KEV (actively exploited): NO Description: Improper Validation of Certificate with Host Mismatch vulnerability in HotelRunner B2B allows HTTP Response Splitting. This issue affects B2B: before 04.06.2025.
CVE ID: CVE-2025-4294 Severity: MEDIUM (CVSS 4.8) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in HotelRunner B2B allows Cross-Site Scripting (XSS). This issue affects B2B: before 04.06.2025.
CVE ID: CVE-2025-4285 Severity: CRITICAL (CVSS 10.0) CWE: CWE-89 KEV (actively exploited): NO Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rolantis Information Technologies Agentis allows SQL Injection. This issue affects Agentis: before 4.32.
CVE ID: CVE-2025-4284 Severity: MEDIUM (CVSS 6.1) CWE: CWE-79 KEV (actively exploited): NO Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Rolantis Information Technologies Agentis allows Reflected XSS, DOM-Based XSS. This issue affects Agentis: before 4.32.
CVE ID: CVE-2025-4130 Severity: HIGH (CVSS 7.5) CWE: CWE-798 KEV (actively exploited): NO Description: Use of Hard-coded Credentials vulnerability in PAVO Inc. PAVO Pay allows Read Sensitive Constants Within an Executable. This issue affects PAVO Pay: before 13.05.2025.
CVE ID: CVE-2025-4129 Severity: HIGH (CVSS 7.5) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in PAVO Inc. PAVO Pay allows Exploitation of Trusted Identifiers. This issue affects PAVO Pay: before 13.05.2025.
CVE ID: CVE-2025-4040 Severity: HIGH (CVSS 7.1) CWE: CWE-639 KEV (actively exploited): NO Description: Authorization Bypass Through User-Controlled Key vulnerability in Turpak Automatic Station Monitoring System allows Privilege Escalation. This issue affects Automatic Station Monitoring System: before 5.0.6.51.
CVE ID: CVE-2019-7386 Severity: MEDIUM (CVSS 6.5) Affected: cpe:2.3:h:nokia:8810_4g:-:*:*:*:*:*:*:*, cpe:2.3:o:kaiostech:kaios:2.5:*:*:*:*:*:*:*, cpe:2.3:o:nokia:8810_4g_firmware:10.05:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A Denial of Service issue has been discovered in the Gecko component of KaiOS 2.5 10.05 (platform 48.0.a2) on Nokia 8810 4G devices. When a crafted web page is visited with the internal browser, the Gecko process crashes with a segfault. Successful exploitation could lead to the remote code execution on the device.
CVE ID: CVE-2026-41511 Severity: MEDIUM (CVSS 5.5) CWE: CWE-835 Affected: cpe:2.3:a:openmcdf:openmcdf:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: OpenMcdf is a fully .NET / C# library to manipulate Compound File Binary File Format files, also known as Structured Storage. Prior to version 3.1.3, OpenMcdf does not detect cycles in the directory entry red-black tree of a Compound File Binary (CFB) document. A crafted CFB file with a cycle in the LeftSiblingID / RightSiblingID chain causes Storage.EnumerateEntries() and Storage.OpenStream() to loop indefinitely, consuming the calling thread with no possibility of recovery via try/catch. This issue has been patched in version 3.1.3.
CVE ID: CVE-2026-44788 Severity: MEDIUM (CVSS 6.5) CWE: CWE-22 Affected: cpe:2.3:a:adamhathcock:sharpcompress:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: SharpCompress is a fully managed C# library to deal with many compression types and formats. In 0.47.4 and earlier, a path traversal vulnerability in IArchive.WriteToDirectory() allows a malicious archive to create directories outside the intended extraction root. For TAR archives, this can be escalated to arbitrary file writes by chaining with a symlink entry, giving a full write primitive on the target filesystem subject to the permissions of the running process.
CVE ID: CVE-2026-40527 Severity: HIGH (CVSS 8.5) CWE: CWE-78 Affected: cpe:2.3:a:radare:radare2:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: radare2 prior to commit bc5a890 contains a command injection vulnerability in the afsv/afsvj command path where crafted ELF binaries can embed malicious r2 command sequences as DWARF DW_TAG_formal_parameter names. Attackers can craft a binary with shell commands in DWARF parameter names that execute when radare2 analyzes the binary with aaa and subsequently runs afsvj, allowing arbitrary shell command execution through the unsanitized parameter interpolation in the pfq command string.
CVE ID: CVE-2026-40518 Severity: HIGH (CVSS 7.1) CWE: CWE-22 Affected: cpe:2.3:a:bytedance:deerflow:2.0-m0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: ByteDance DeerFlow before commit 2176b2b contains a path traversal and arbitrary file write vulnerability in bootstrap-mode custom-agent creation where the agent name validation is bypassed. Attackers can supply traversal-style values or absolute paths as the agent name to influence directory creation and write files outside the intended custom-agent directory, potentially achieving arbitrary file write on the system subject to filesystem permissions.
CVE ID: CVE-2025-15620 Severity: CRITICAL (CVSS 9.2) CWE: CWE-306 Affected: cpe:2.3:a:belden:hios_switch:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: HiOS Switch Platform versions 09.1.00 through 09.4.04 and 10.0.00 through 10.3.00 contain a denial-of-service vulnerability in the web interface that allows remote attackers to reboot the affected device by sending a malicious HTTP GET request to a specific endpoint. Attackers can trigger an uncontrolled reboot condition through crafted HTTP requests to cause service disruption and unavailability of the switch.
CVE ID: CVE-2026-31455 Severity: HIGH (CVSS 7.8) CWE: CWE-416 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
CVE ID: CVE-2026-10591 Severity: HIGH (CVSS 8.6) CWE: CWE-732 Affected: cpe:2.3:a:amazon:kiro_ide:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient access control restrictions in the file write tool in Amazon Kiro IDE before version 0.11 might allow remote unauthenticated actors to execute arbitrary commands via crafted instructions that cause writes to execution-sensitive paths (such as .vscode/tasks.json), enabling auto-execution on folder open. To remediate this issue, users should upgrade to Kiro IDE version 0.11 or later.
CVE ID: CVE-2026-4643 Severity: LOW (CVSS 3.5) CWE: CWE-754 Affected: cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent server-rendered content from closing an underlying application view in the Mattermost Desktop App which allows a malicious server or plugin to crash the desktop client via invoking {{window.close()}} in the renderer context, leading to a denial of service condition at the client level. Mattermost Advisory ID: MMSA-2026-00633
CVE ID: CVE-2026-3471 Severity: MEDIUM (CVSS 6.5) CWE: CWE-939 Affected: cpe:2.3:a:mattermost:mattermost_desktop:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Mattermost Desktop App versions <=6.1 6.0.1 5.4.13.0 fail to prevent an invalid URL from loading in a pop-up window in the Mattermost Desktop App which allows a malicious server owner to repeated crash the application via calling {{window.open('javascript:alert()');}}. Mattermost Advisory ID: MMSA-2026-00618
CVE ID: CVE-2026-10886 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10885 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:iphone_os:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10884 Severity: HIGH (CVSS 8.3) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Chromecast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10883 Severity: HIGH (CVSS 8.8) CWE: CWE-787 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10882 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-47707 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400 Affected: cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:* KEV (actively exploited): NO Description: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.172.0 through0.315.6, the MaxAliasesLimiter extension in Strawberry fails to account for the multiplicative/amplification effect of FragmentSpreadNode. While it correctly counts static aliases within the AST it does not consider how many times a fragments internal aliases are expanded during execution. this allows an attacker to bypass alias limits and force the server to resolve and render a significantly higher number of aliases than allowed, potentially leading to a dos via resource exhaustion. Version 0.315.7 contains a fix for the issue.
CVE ID: CVE-2026-31457 Severity: MEDIUM (CVSS 5.5) CWE: CWE-476 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr in repeat_call_fn damon_sysfs_repeat_call_fn() calls damon_sysfs_upd_tuned_intervals(), damon_sysfs_upd_schemes_stats(), and damon_sysfs_upd_schemes_effective_quotas() without checking contexts->nr. If nr_contexts is set to 0 via sysfs while DAMON is running, these functions dereference contexts_arr[0] and cause a NULL pointer dereference. Add the missing check. For example, the issue can be reproduced using DAMON sysfs interface and DAMON user-space tool (damo) [1] like below. $ sudo damo start --refresh_interval 1s $ echo 0 | sudo tee \ /sys/kernel/mm/damon/admin/kdamonds/0/contexts/nr_contexts
CVE ID: CVE-2026-47706 Severity: MEDIUM (CVSS 5.3) CWE: CWE-400, CWE-674 Affected: cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:* KEV (actively exploited): NO Description: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.71.0 through 0.315.6, the QueryDepthLimiter extension is vulnerable to an Application-level DOS due to a lack of cycle detection in fragment spreads. When a query contains circular fragment references the determine_depth function enters an infinite recursion, leading to a RecursionError and crashing the validation process. Version 0.315.7 patches the issue.
CVE ID: CVE-2026-31458 Severity: MEDIUM (CVSS 5.5) CWE: CWE-476 Affected: cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* KEV (actively exploited): NO Description: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] Multiple sysfs command paths dereference contexts_arr[0] without first verifying that kdamond->contexts->nr == 1. A user can set nr_contexts to 0 via sysfs while DAMON is running, causing NULL pointer dereferences. In more detail, the issue can be triggered by privileged users like below. First, start DAMON and make contexts directory empty (kdamond->contexts->nr == 0). # damo start # cd /sys/kernel/mm/damon/admin/kdamonds/0 # echo 0 > contexts/nr_contexts Then, each of below commands will cause the NULL pointer dereference. # echo update_schemes_stats > state # echo update_schemes_tried_regions > state # echo update_schemes_tried_bytes > state # echo update_schemes_effective_quotas > state # echo update_tuned_intervals > state Guard all commands (except OFF) at the entry point of damon_sysfs_handle_cmd().
CVE ID: CVE-2026-9334 Severity: HIGH (CVSS 7.3) CWE: CWE-843 Affected: cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:* KEV (actively exploited): NO Description: Cpanel::JSON::XS versions before 4.41 for Perl allow type confusion via duplicate object keys when dupkeys_as_arrayref is enabled. decode_hv() collapses duplicate object keys into an array reference under dupkeys_as_arrayref. The branch reached for a duplicate key tests `SvTYPE (old_value) != SVt_RV && SvTYPE (SvRV (old_value)) != SVt_PVAV`, which evaluates SvRV(old_value) before establishing that old_value is a reference. When the existing value is a plain scalar rather than an array reference, a non-reference scalar is dereferenced as a reference. A caller decoding untrusted JSON with dupkeys_as_arrayref enabled is crashed, and the incompatible access follows a pointer taken from attacker controlled scalar contents.
CVE ID: CVE-2026-9516 Severity: HIGH (CVSS 7.5) CWE: CWE-755, CWE-763 Affected: cpe:2.3:a:rurban:cpanel\:\:json\:\:xs:*:*:*:*:*:perl:*:* KEV (actively exploited): NO Description: Cpanel::JSON::XS versions before 4.41 for Perl allow denial of service via UTF-8 BOM prefixed input when a decode filter callback throws. To skip a leading 3-byte UTF-8 BOM, decode_json() advances the input scalar's string pointer past the mark with SvPV_set() and restores it only on the normal return path. When decoding aborts through a Perl exception, for example a filter_json_object callback that croaks, the restore is skipped and the scalar is left with its string pointer offset into its own buffer and a shortened length. When that scalar is later freed, the allocator receives an invalid pointer and the interpreter aborts. A single BOM prefixed document decoded with a throwing filter callback crashes any caller.
CVE ID: CVE-2026-9122 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-9123 Severity: HIGH (CVSS 7.5) CWE: CWE-122 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:google:android:-:*:*:*:*:*:*:*, cpe:2.3:o:google:chrome_os:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Heap buffer overflow in Chromecast in Google Chrome on Android, Linux, ChromeOS prior to 148.0.7778.179 allowed a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. (Chromium security severity: Medium)
CVE ID: CVE-2026-9124 Severity: MEDIUM (CVSS 5.3) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Input in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-9126 Severity: HIGH (CVSS 8.8) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in DOM in Google Chrome on prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-44903 Severity: MEDIUM (CVSS 5.1) CWE: CWE-79 Affected: cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Prometheus is an open-source monitoring system and time series database. From 2.49.0 to before 3.5.3 and 3.11.3, in the Prometheus server's legacy web UI (enabled via the command-line flag --enable-feature=old-ui), the histogram heatmap chart view does not escape le label values when inserting them into the HTML for use as axis tick mark labels. An attacker who can inject crafted metrics can execute JavaScript in the browser of any Prometheus user who views the metric in the heatmap chart UI. This vulnerability is fixed in 3.5.3 and 3.11.3.
CVE ID: CVE-2026-8389 Severity: HIGH (CVSS 8.8) CWE: CWE-119, CWE-686, CWE-843 Affected: cpe:2.3:a:mozilla:firefox:*:*:*:*:-:*:*:* KEV (actively exploited): NO Description: JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 150.0.3.
CVE ID: CVE-2026-48829 Severity: HIGH (CVSS 7.5) CWE: CWE-476 KEV (actively exploited): NO Description: In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
CVE ID: CVE-2026-11181 Severity: MEDIUM (CVSS 6.3) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11180 Severity: MEDIUM (CVSS 6.5) CWE: CWE-200 KEV (actively exploited): NO Description: Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11179 Severity: HIGH (CVSS 8.8) CWE: CWE-284 KEV (actively exploited): NO Description: Inappropriate implementation in ORB in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11096 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125 KEV (actively exploited): NO Description: Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11094 Severity: CRITICAL (CVSS 9.6) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Codecs in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11093 Severity: MEDIUM (CVSS 6.5) CWE: CWE-20 KEV (actively exploited): NO Description: Inappropriate implementation in Printing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11092 Severity: HIGH (CVSS 8.8) CWE: CWE-602 KEV (actively exploited): NO Description: Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to perform privilege escalation via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2026-11091 Severity: HIGH (CVSS 8.8) CWE: CWE-125, CWE-787 KEV (actively exploited): NO Description: Inappropriate implementation in Dawn in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11090 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125, CWE-457, CWE-787 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11089 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457, CWE-908 KEV (actively exploited): NO Description: Uninitialized Use in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11087 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-42789 Severity: HIGH (CVSS 7.0) CWE: CWE-295, CWE-296 Affected: cpe:2.3:a:erlang:erlang\/otp:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper Following of a Certificate's Chain of Trust vulnerability in Erlang OTP public_key (pubkey_cert module) allows a non-CA certificate to be accepted as an intermediate issuer, enabling certificate chain forgery. In lib/public_key/src/pubkey_cert.erl, pubkey_cert:validate_extensions/7 contains two flaws that together allow a certificate with basicConstraints cA:false and no keyUsage extension to be used as an intermediate issuer in a chain passed to public_key:pkix_path_validation/3: the cA:false clause recurses into the remaining extensions without rejecting the certificate when it is in issuer position, and the keyUsage check only fires when the extension is present, so a certificate lacking keyUsage entirely bypasses the keyCertSign enforcement. Any party holding an end-entity certificate with basicConstraints cA:false and no keyUsage extension, issued by any CA in the victim's trust store, can use that certificate's private key to sign forged leaf certificates for arbitrary identities. public_key:pkix_path_validation/3 accepts the resulting chain, and by extension every TLS or mTLS endpoint built on the OTP ssl application that relies on the default verifier is affected, including server identity verification on the client side and client certificate verification on mTLS servers. This issue affects OTP from OTP 17.0 before OTP 26.2.5.21, 27.3.4.12, 28.5.0.1, and 29.0.1 corresponding to public_key from 0.22 before 1.15.1.7, 1.17.1.3, 1.20.3.1, and 1.21.1.
CVE ID: CVE-2026-41184 Severity: MEDIUM (CVSS 6.0) CWE: CWE-532 Affected: cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*, cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*, cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* KEV (actively exploited): NO Description: In Calico, the install-cni init container logs the rendered CNI configuration to standard output. When the configuration template uses the __SERVICEACCOUNT_TOKEN__ placeholder (Canal/Flannel-Calico deployments), the installer substitutes the live Kubernetes ServiceAccount bearer token before logging, exposing the token to any authenticated user with pods/log permission in the namespace with calico-node. The token holds patch privileges on pods/status, enabling annotation-based attacks against cluster workloads. The default kubeconfig-based authentication path is not affected. This is a direct regression of TTA-2018-001.
CVE ID: CVE-2026-23925 Severity: MEDIUM (CVSS 5.1) CWE: CWE-863 Affected: cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An authenticated Zabbix user (User role) with template/host write permissions is able to create objects via the configuration.import API. This can lead to confidentiality loss by creating unauthorized hosts. Note that the User role is normally not sufficient to create and edit templates/hosts even with write permissions.
CVE ID: CVE-2026-11336 Severity: LOW (CVSS 2.1) CWE: CWE-266, CWE-285 KEV (actively exploited): NO Description: A vulnerability has been found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected is an unknown function of the file dashboard_page/admin_page.php of the component Admin Interface. The manipulation of the argument UserAuthData leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE ID: CVE-2026-11362 Severity: UNKNOWN CWE: CWE-150, CWE-93 KEV (actively exploited): NO Description: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections from event tags. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The format_event method (used by the event method) does not validate the content of the tags, which may contain commas (allowing tags to be injected) or newlines, pipes and colons that allow metric injections. (There is an ineffective s/|//g to remove pipes, but because the pipe is not escaped, it is interpreted as a regular expression metacharacter and has no effect.)
CVE ID: CVE-2026-48101 Severity: MEDIUM (CVSS 6.5) CWE: CWE-908 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an An uninitialized memory disclosure vulnerability in the UEFI capsule (.scap) parser in 7-Zip. The OpenCapsule function allocates a heap buffer of attacker-declared CapsuleImageSize (up to 1 GiB) without zero-initialization, then reads the file contents into it with ReadStream_FALSE whose return value is silently discarded. If the file is truncated, the unread tail of the buffer retains uninitialized heap memory, which is then exposed as extracted file content via GetStream. Version 26.0.1 fixes the issue.
CVE ID: CVE-2026-48102 Severity: LOW (CVSS 3.1) CWE: CWE-125 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.11 through 26.00 contain a heap out-of-bounds read of up to 3 bytes in the UDF disc image handler's File Identifier Descriptor parser. In CFileId::Parse (CPP/7zip/Archive/Udf/UdfIn.cpp), after validating size < 38 + idLen + impLen and advancing processed to 38 + impLen + idLen, the alignment-padding loop reads p[processed] while incrementing up to 3 times to reach a 4-byte boundary, and the processed <= size bounds check only runs after the loop. When (38 + impLen + idLen) % 4 != 0 and 38 + impLen + idLen == size, the loop reads 1 to 3 bytes past the end of the exact-size heap buffer allocated via buf.Alloc((size_t)item.Size). The UDF handler is registered for .iso and .udf files and auto-detected by signature, and the OOB read triggers during Open() when listing or extracting a crafted UDF image. Impact is limited to information disclosure (a 1-bit oracle per OOB byte via open/fail behavior) and denial of service (crash under hardened allocators); there is no write primitive. Version 26.01 fixes the issue.
CVE ID: CVE-2026-9270 Severity: UNKNOWN CWE: CWE-150, CWE-93 KEV (actively exploited): NO Description: DataDog::DogStatsd versions through 0.07 for Perl allow metric injections. DataDog::DogStatsd does not properly sanitise input, allowing metric injections of data from untrusted sources. The send_stats method does not remove newlines from metric names ($stat variable), allowing attackers to change the metric name prefix. The send_stats method does not validate the content of the value ($delta variable), allowing attackers to inject metrics, especially from methods that do not restrict the data type for the value, such as set, gauge, count and histogram. The send_stats method does not validate the content of the tags, which may contain newlines, pipes and colons that allow metric injections. Note that the SYNOPSIS shows an example of passing a website form "loginName" parameter as a tag, which is unsafe.
CVE ID: CVE-2026-41185 Severity: MEDIUM (CVSS 6.0) CWE: CWE-532 Affected: cpe:2.3:a:tigera:calico:*:*:*:*:cloud:*:*:*, cpe:2.3:a:tigera:calico:*:*:*:*:enterprise:*:*:*, cpe:2.3:a:tigera:calico:*:*:*:*:open_source:*:*:* KEV (actively exploited): NO Description: When Calico is configured with the Azure IPAM plugin, the Calico CNI binary mutates the incoming CNI configuration to attach subnet information before delegating to the IPAM plugin. After mutating, the Azure IPAM helper logs the entire unmarshaled configuration map (stdinData) at INFO level to /var/log/calico/cni/cni.log on every CNI ADD and DEL invocation — once per pod scheduled or terminated on the node. When the cluster is deployed using token-based Kubernetes authentication, this log entry contains the ServiceAccount token, client key, and certificate authority in plaintext. Any principal with read access to /var/log/calico/cni/cni.log on a node can read these logs and extract the credentials, which grant cluster-wide Calico networking admin privileges.
CVE ID: CVE-2026-48579 Severity: HIGH (CVSS 7.5) CWE: CWE-285 Affected: cpe:2.3:a:microsoft:exchange_online:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a network.
CVE ID: CVE-2026-10878 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-77 Affected: cpe:2.3:h:dlink:dwr-m920:-:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dwr-m920_firmware:1.1.50:*:*:*:*:*:*:*, cpe:2.3:o:dlink:dwr-m920_firmware:1.1.70:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A vulnerability was detected in D-Link DWR-M920 1.1.50/1.1.70. Affected is the function sub_41C8E8 of the file /boafrm/formSmsManage. Performing a manipulation of the argument action_value results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used.
CVE ID: CVE-2026-11244 Severity: LOW (CVSS 3.1) CWE: CWE-20 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Insufficient validation of untrusted input in WebAuthentication in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11243 Severity: MEDIUM (CVSS 5.4) CWE: CWE-346 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-2753 Severity: HIGH (CVSS 7.5) CWE: CWE-36 Affected: cpe:2.3:h:navtor:navbox:-:*:*:*:*:*:*:*, cpe:2.3:o:navtor:navbox_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An Absolute Path Traversal vulnerability exists in Navtor NavBox. The application exposes an HTTP service that fails to properly sanitize user-supplied path input. Unauthenticated remote attackers can exploit this issue by submitting requests containing absolute filesystem paths. Successful exploitation allows the attacker to retrieve arbitrary files from the underlying filesystem, limited only by the privileges of the service process. This can lead to the exposure of sensitive configuration files and system information.
CVE ID: CVE-2026-2754 Severity: HIGH (CVSS 7.5) CWE: CWE-306 Affected: cpe:2.3:h:navtor:navbox:-:*:*:*:*:*:*:*, cpe:2.3:o:navtor:navbox_firmware:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Navtor NavBox exposes sensitive configuration and operational data due to missing authentication on HTTP API endpoints. An unauthenticated remote attacker with network access to the device can execute HTTP GET requests to TCP port 8080 to retrieve internal network parameters including ECDIS & OT Information, device identifiers, and service status logs.
CVE ID: CVE-2026-48567 Severity: CRITICAL (CVSS 9.8) CWE: CWE-290 Affected: cpe:2.3:a:microsoft:azure_horizondb:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Authentication bypass by spoofing in Azure HorizonDB allows an unauthorized attacker to elevate privileges over a network.
CVE ID: CVE-2026-11304 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: Low)
CVE ID: CVE-2026-11302 Severity: MEDIUM (CVSS 4.3) CWE: CWE-284 KEV (actively exploited): NO Description: Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11301 Severity: HIGH (CVSS 8.8) CWE: CWE-125 KEV (actively exploited): NO Description: Inappropriate implementation in LiveCaption in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform out of bounds memory access via malicious network traffic. (Chromium security severity: Low)
CVE ID: CVE-2026-11300 Severity: MEDIUM (CVSS 4.3) CWE: CWE-451 KEV (actively exploited): NO Description: Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11299 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125, CWE-190 KEV (actively exploited): NO Description: Integer overflow in Fonts in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11298 Severity: MEDIUM (CVSS 4.3) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Low)
CVE ID: CVE-2026-11297 Severity: HIGH (CVSS 7.7) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Reader Mode in Google Chrome on Android prior to 149.0.7827.53 allowed a local attacker to bypass navigation restrictions via a malicious file. (Chromium security severity: Low)
CVE ID: CVE-2026-11196 Severity: MEDIUM (CVSS 6.5) CWE: CWE-843 KEV (actively exploited): NO Description: Type Confusion in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted XML file. (Chromium security severity: Medium)
CVE ID: CVE-2026-11195 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346, CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in MHTML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11194 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346, CWE-352 KEV (actively exploited): NO Description: Inappropriate implementation in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11193 Severity: MEDIUM (CVSS 6.5) CWE: CWE-284 KEV (actively exploited): NO Description: Insufficient policy enforcement in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11192 Severity: MEDIUM (CVSS 4.3) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in Password Manager in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Medium)