FXBIA/cve-intelligence-stream huggingface dataset:
CVE ID: CVE-2026-34876 Severity: HIGH (CVSS 7.5) CWE: CWE-125 Affected: cpe:2.3:a:trustedfirmware:mbed_tls:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS 3.x before 3.6.6. An out-of-bounds read vulnerability in mbedtls_ccm_finish() in library/ccm.c allows attackers to obtain adjacent CCM context data via invocation of the multipart CCM API with an oversized tag_len parameter. This is caused by missing validation of the tag_len parameter against the size of the internal 16-byte authentication buffer. The issue affects the public multipart CCM API in Mbed TLS 3.x, where mbedtls_ccm_finish() can be invoked directly by applications. In Mbed TLS 4.x versions prior to the fix, the same missing validation exists in the internal implementation; however, the function is not exposed as part of the public API. Exploitation requires application-level invocation of the multipart CCM API.
CVE ID: CVE-2026-34877 Severity: CRITICAL (CVSS 9.8) CWE: CWE-250, CWE-502 Affected: cpe:2.3:a:arm:mbed_tls:*:*:*:*:*:*:*:*, cpe:2.3:a:trustedfirmware:mbed_tls:4.0.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An issue was discovered in Mbed TLS versions from 2.19.0 up to 3.6.5, Mbed TLS 4.0.0. Insufficient protection of serialized SSL context or session structures allows an attacker who can modify the serialized structures to induce memory corruption, leading to arbitrary code execution. This is caused by Incorrect Use of Privileged APIs.
CVE ID: CVE-2026-10897 Severity: HIGH (CVSS 8.8) CWE: CWE-787 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Inappropriate implementation in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10898 Severity: HIGH (CVSS 8.3) CWE: CWE-121 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*, cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Stack buffer overflow in GPU in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-10900 Severity: HIGH (CVSS 7.5) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Passwords in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-28318 Severity: HIGH (CVSS 7.5) CWE: CWE-400 Affected: cpe:2.3:a:solarwinds:serv-u:*:*:*:*:*:*:*:*, cpe:2.3:a:solarwinds:serv-u:15.5.4:-:*:*:*:*:*:* KEV (actively exploited): YES Description: SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: deflate. Mitigation steps are provided to secure customer environments in the SolarWinds Trust Center if you are unable to deploy the update Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE ID: CVE-2026-10899 Severity: HIGH (CVSS 7.5) CWE: CWE-416 Affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*, cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Use after free in Ozone in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
CVE ID: CVE-2026-46389 Severity: CRITICAL (CVSS 10.0) CWE: CWE-287, CWE-303 KEV (actively exploited): NO Description: UDS Identity Config builds the Keycloak configuration image (realm, plugins, theme, truststore, JARs) consumed by UDS Core's Identity deployment. In versions 0.11.0 through 0.26.0, a logic error in the `client-kubernetes-secret` Keycloak client authenticator (shipped by `uds-identity-config` and consumed by UDS Core) causes the submitted `client_secret` to be overwritten with the mounted Kubernetes secret before comparison. An attacker who can reach the Keycloak token endpoint and knows a `client_id` using this authenticator can authenticate as that client with any `client_secret` value and obtain OAuth2 tokens scoped to the client's service account. In the case of the `uds-operator` client this token can be used to registry/modify other clients. Version 0.26.1 patches the issue.
CVE ID: CVE-2026-10580 Severity: CRITICAL (CVSS 9.8) CWE: CWE-285 KEV (actively exploited): NO Description: The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeover in all versions up to and including 1.9.4. This is due to a logic conflation in HippooPermissions::get_user_permissions(), which returns the same null sentinel for both administrators and unauthenticated visitors — a value that HippooPermissions::has_role_access() unconditionally interprets as full administrator access — causing override_extension_permission_callback() to assign __return_true as the permission callback for every WordPress and WooCommerce REST route cloned under /wc-hippoo/v1/ext/ by HippooControllerWithAuth::re_register_external_routes(), while the block_unauthorized_access() pre-dispatch guard fails to block unauthenticated users for the same reason. This makes it possible for unauthenticated attackers to invoke any core REST endpoint without credentials — most critically, sending a POST request to /wc-hippoo/v1/ext/wp/v2/users/ with a {"password":" "} body to reset the password of any WordPress user, including the site administrator, and gain full administrative control of the site.
CVE ID: CVE-2026-46390 Severity: MEDIUM (CVSS 6.9) CWE: CWE-639 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 2.0.0 and prior to version 26.0.0, the gitlist plugin is exposed to unauthenticated users, allowing unauthenticated browsing of git repositories and git history. Version 26.0.0 patches the issue.
CVE ID: CVE-2026-46391 Severity: HIGH (CVSS 8.7) CWE: CWE-183, CWE-918 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Starting in version 9.0.1 and prior to version 26.0.0 of @haxtheweb/open-apis, multiple functions conduct substring-only matching to validate hostnames to which basic authorization should be sent. An attacker can append the matched substrings to an attacker-controlled endpoint and capture authentication. Version 26.0.0 fixes the issue.
CVE ID: CVE-2026-46393 Severity: HIGH (CVSS 7.1) CWE: CWE-918 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. An authenticated Server-Side Request Forgery (SSRF) vulnerability in versions prior to 26.0.0 allows authenticated users to fetch arbitrary internal or local resources and write the responses to a web-accessible directory, enabling arbitrary file read and internal network access. Version 26.0.0 contains a fix.
CVE ID: CVE-2026-46394 Severity: HIGH (CVSS 7.7) CWE: CWE-78 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an OS command injection vulnerability exists in the Git.php library of the HAXcms PHP backend. The application constructs shell command strings using unsanitized input and executes them via proc_open(). An attacker who can control parameters passed into Git operations can execute arbitrary OS commands with the privileges of the web server. Out of 17 functions that invoke shell commands only 1 function (`commit()`) correctly uses `escapeshellarg()`. When combined with another vulnerability that allows configuration manipulation, this issue can lead to full remote code execution and complete system compromise. Version 26.0.0 patches the issue.
CVE ID: CVE-2026-46396 Severity: CRITICAL (CVSS 9.3) CWE: CWE-79 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. A stored cross-site scripting (XSS) vulnerability exists in versions prior to 26.0.0 due to improper sanitization of ` ` elements. The application allows `javascript:` URIs in the `src` attribute, which are executed when a malicious page is viewed. This enables attackers to execute arbitrary JavaScript in the context of the victim’s browser and access sensitive data exposed to client-side scripts. Version 26.0.0 fixes the issue.
CVE ID: CVE-2026-46399 Severity: CRITICAL (CVSS 9.4) CWE: CWE-15, CWE-73, CWE-78 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. The PHP version of HAX CMS prior to version 26.0.0 has an authenticated file overwrite vulnerability. An attacker can exploit this vulnerability to configure malicious Git filter commands and achieve code execution on the HAX CMS server. Version 26.0.0 patches the issue.
CVE ID: CVE-2026-46511 Severity: HIGH (CVSS 8.7) CWE: CWE-522, CWE-79, CWE-922 KEV (actively exploited): NO Description: HAX CMS helps manage microsite universe with PHP or NodeJs backends. Prior to version 26.0.0, an attack chain utilizing Stored XSS alongside dynamic token exposure in the `/system/api/connectionSettings` endpoint allows an authenticated attacker to perform a complete cross-tenant account takeover. The API dynamically leaks the active session's authentication tokens (including the `jwt`, `user_token`, `site_token`, and `appstore_token`) into a global JavaScript variable (`window.appSettings`). An attacker can exploit the XSS vulnerability to force a victim's browser to silently fetch their specific connection settings, extract the tokens, and exfiltrate them to an attacker-controlled webhook. Version 26.0.0 patches the issue.
CVE ID: CVE-2026-5411 Severity: HIGH (CVSS 8.8) CWE: CWE-434 KEV (actively exploited): NO Description: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 5.38. This is due to a capability check in the save_ajax() function of the licensing module, combined with unrestricted file extraction in sync_cloud_protection(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files including PHP webshells to the server by injecting a malicious cloud_protection_url into the license meta, which the plugin then downloads and extracts without file type validation into a web-accessible uploads directory. This can be used for remote code execution. Note: The vulnerability can only be exploited with a remote URL if "allow_url_fopen" is enabled in the php.ini config.
CVE ID: CVE-2026-5415 Severity: HIGH (CVSS 8.8) CWE: CWE-288 KEV (actively exploited): NO Description: The WP Captcha PRO (the premium version of the Advanced Google reCAPTCHA plugin, both have the same slug) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.38. This is due to the ajax_run_tool() AJAX handler relying solely on a nonce check (check_ajax_referer) for security without performing any capability check, combined with the create_temporary_link tool allowing the generation of passwordless login links for arbitrary users, and the handle_temporary_links() function authenticating visitors via these links without any additional authorization validation. The required nonce is exposed to all authenticated backend users (including Subscribers) via wp_localize_script() on all non-settings admin pages when the plugin's welcome pointer has not been dismissed. This makes it possible for authenticated attackers, with Subscriber-level access and above, to bypass normal authentication and log in as any user, including Administrators, resulting in complete account takeover.
CVE ID: CVE-2026-5589 Severity: MEDIUM (CVSS 6.3) CWE: CWE-787 KEV (actively exploited): NO Description: An integer underflow in bt_mesh_sol_recv() in the Bluetooth Mesh solicitation handling (subsys/bluetooth/mesh/solicitation.c) leads to an out-of-bounds write. When CONFIG_BT_MESH_OD_PRIV_PROXY_SRV is enabled, the function parses solicitation PDUs from raw BLE advertising payloads. The AD parsing loop reads an attacker-controlled length byte (reported_len) and computes reported_len - 3 without checking that reported_len >= 3. When reported_len is less than 3, the subtraction is performed in signed int arithmetic and yields a negative value that bypasses the length guard and is then implicitly converted to a very large size_t when passed to net_buf_simple_pull_mem(). In builds without assertions, this wraps the buffer length and advances the data pointer far out of bounds, so subsequent reads dereference invalid memory. A nearby BLE device can trigger this with a non-connectable advertisement carrying a UUID16 AD structure and a crafted length byte, with no pairing or prior association required, potentially leading to denial of service or arbitrary code execution.
CVE ID: CVE-2026-5066 Severity: MEDIUM (CVSS 6.3) CWE: CWE-787 KEV (actively exploited): NO Description: A potential out-of-bounds write/read exists in the TLS socket connect path of the network sockets subsystem (subsys/net/lib/sockets/sockets_tls.c). When the TLS session cache is enabled, tls_session_store() and tls_session_restore() memcpy the caller-supplied address into a fixed-size buffer using the caller-controlled addrlen value without validating it against the destination size. struct net_sockaddr is an opaque type, so an application can pass an addrlen larger than sizeof(struct net_sockaddr) (for example 128 bytes into a 24-byte stack buffer), causing the memcpy to read and write past the end of the address memory used by the TLS session cache. This out-of-bounds write can lead to a crash and denial of service, and potentially to arbitrary code execution.
CVE ID: CVE-2026-11269 Severity: HIGH (CVSS 7.1) CWE: CWE-829 KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker in a privileged network position to execute arbitrary code inside a sandbox via a crafted Chrome Extension. (Chromium security severity: Low)
CVE ID: CVE-2026-11064 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Race in GPU in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11063 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in WebNN in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11062 Severity: MEDIUM (CVSS 4.3) CWE: CWE-602 KEV (actively exploited): NO Description: Insufficient policy enforcement in Extensions in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: Medium)
CVE ID: CVE-2026-11056 Severity: CRITICAL (CVSS 9.6) CWE: CWE-20 KEV (actively exploited): NO Description: Insufficient validation of untrusted input in SiteIsolation in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11052 Severity: CRITICAL (CVSS 9.6) CWE: CWE-843 KEV (actively exploited): NO Description: Type Confusion in GPU in Google Chrome on Windows prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11036 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in DOM in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11033 Severity: MEDIUM (CVSS 6.5) CWE: CWE-457 KEV (actively exploited): NO Description: Uninitialized Use in WebML in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2025-5088 Severity: HIGH (CVSS 8.7) CWE: CWE-269 KEV (actively exploited): NO Description: An authenticated Redis session could be used to obtain full root access to all servers in the CVX cluster. Note that this would require an attacker to have both network access to the Redis service on a CVX server and the Redis password. Please note that all Redis communication, including authentication, occurs over plaintext in the present day. TLS support is tracked under RFE1294850.
CVE ID: CVE-2025-5089 Severity: HIGH (CVSS 7.1) CWE: CWE-20 KEV (actively exploited): NO Description: In a CVX cluster, an EOS switch connected to a CVX server is not resilient to certain malformed messages received from the connected CVX server. Similarly, the CVX server is not resilient to certain malformed messages received from the connected EOS switch. This leads to either a Sysdb agent crash on the EOS device causing a soft reset of the switch or agent crashes on the CVX server causing instability of the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to already have a high privilege access to the connected device to be able to send custom TCP packets. EOS switches that are not connected to a CVX server are not impacted.
CVE ID: CVE-2025-5090 Severity: HIGH (CVSS 7.1) CWE: CWE-20 KEV (actively exploited): NO Description: CVX is not resilient to unexpected messages from a connected switch. This leads to agent crashes on CVX causing instability in the CVX cluster. An attacker could use this behavior to create a denial of service (DoS) scenario. Note that this would require the attacker to have a high privilege access to the connected switch to be able to send custom TCP packets to the CVX.
CVE ID: CVE-2026-11339 Severity: LOW (CVSS 2.1) CWE: CWE-74, CWE-77 KEV (actively exploited): NO Description: A vulnerability was detected in D-Link DWR-M920 up to 1.1.50. The affected element is the function sub_41CF20 of the file /boafrm/formUSSDSetup. The manipulation of the argument ussdValue results in command injection. It is possible to launch the attack remotely. The exploit is now public and may be used.
CVE ID: CVE-2026-48103 Severity: MEDIUM (CVSS 4.3) CWE: CWE-125 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.34 through 26.00 contain an off-by-one heap out-of-bounds read in the WIM (Windows Imaging) archive handler's security descriptor lookup. In CHandler::GetSecurity (CPP/7zip/Archive/Wim/WimHandler.cpp), the per-image SecurOffsets table holds numEntries + 1 cumulative offsets, but the check securityId >= SecurOffsets.Size() admits securityId == numEntries, and the function then reads SecurOffsets[securityId + 1], fetching one UInt32 past the end of the heap-allocated CRecordVector (which performs no bounds checking on operator[]). The securityId is attacker-controlled at offset +0xC of any directory entry in WIM metadata, and the handler is registered for .wim, .swm, .esd, and .ppkg and enabled by default in stock 7z.dll; the OOB triggers zero-click in the GUI because 7zFM.exe's ListView calls GetRawProp(kpidNtSecure) for every item during listing (ASan-confirmed), and is also reachable via CLI listing with 7zz l -slt. Impact is limited to denial of service under hardened allocators and minor information disclosure, since the OOB value is only consumed arithmetically as a length and is not surfaced to the attacker; there is no write primitive.
CVE ID: CVE-2026-48111 Severity: MEDIUM (CVSS 4.3) CWE: CWE-125 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.21 through 26.00 contain an off-by-one out-of-bounds read vulnerability in the ParseDepedencyExpression function of the UEFI firmware image parser(CPP/7zip/Archive/UefiHandler.cpp). The function validates an attacker-controlled opcode byte using > instead of >= against the element count of the 10-entry kExpressionCommands static array, allowing an opcode value of 10 to read one pointer slot (8 bytes on x64) past the end of the array in .rodata. The out-of-bounds value is then dereferenced as a const char * and passed through strlen and memcpy into the archive's Characts property, which may cause either a denial of service (access violation when the adjacent bytes do not form a valid readable pointer) or a minor information disclosure of an adjacent .rdata string literal into archive metadata. The vulnerability is reached automatically during IInArchive::Open() via the call path OpenFv/OpenCapsule → ParseVolume → ParseSections when processing a SECTION_DXE_DEPEX (0x13) or SECTION_PEI_DEPEX (0x1B) section whose first body byte is 0x0A, and the UEFI handler is enabled by default in stock 7z.dll with signature-based detection for both UEFIc and UEFIf formats. The outcome (crash vs. silent leak) is deterministic per build but linker-layout dependent, with no write primitive and no disclosure of heap data, secrets, or ASLR base addresses. Version 26.01 fixes the issue.
CVE ID: CVE-2026-48112 Severity: MEDIUM (CVSS 6.5) CWE: CWE-125, CWE-190 KEV (actively exploited): NO Description: 7-Zip is a file archiver with a high compression ratio. Versions 9.18 through 26.00 contain a heap out-of-bounds read in 7-Zip Ar handler BSD SYMDEF parser. A 4-byte heap out-of-bounds read exists in the Unix ar archive parser in 7-Zip. When parsing a BSD-style __.SYMDEF symbol table, the ParseLibSymbols function reads a 32-bit namesSize field via Get32 at a position that can equal the buffer size, reading 4 bytes past the end of the heap allocation. This reads uninitialized heap data under the default allocator. Version 26.01 patches the issue.
CVE ID: CVE-2026-7473 Severity: MEDIUM (CVSS 6.9) CWE: CWE-1023 KEV (actively exploited): NO Description: On affected platforms running Arista EOS where a tunnel decapsulation configuration—such as VXLAN (Virtual Extensible LAN), decap-groups, or a GRE (Generic Routing Encapsulation) tunnel interface—is present, the switch will incorrectly decapsulate and forward other unexpected tunneled packet with a destination IP matching its configured decapsulation IP. This occurs because the switch does not verify the tunnel protocol type, potentially leading to the unexpected processing of non-configured tunnel traffic. This issue has been reported as being exploited in the wild.
CVE ID: CVE-2026-8714 Severity: HIGH (CVSS 7.1) CWE: CWE-20 KEV (actively exploited): NO Description: A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter non-responsive state. Successful exploitation may cause the RTSP in a denial-of-service condition.
CVE ID: CVE-2026-2379 Severity: HIGH (CVSS 8.2) CWE: CWE-672 KEV (actively exploited): NO Description: On affected platforms with hardware IPSec support running Arista EOS with certain IPsec features enabled, EOS may exhibit unexpected behavior in specific cases. Physical interface flaps and certain agent restarts can cause IPsec tunnel re-establishment with existing Security Associations, resulting in sequence number mismatches between tunnel endpoints potentially causing unstable communication.
CVE ID: CVE-2026-11337 Severity: LOW (CVSS 2.1) CWE: CWE-79, CWE-94 KEV (actively exploited): NO Description: A vulnerability was found in tittuvarghese CollegeManagementSystem 3e476335cfbfb9a049e09f474c7ec885f69a9df3/a38852979f7e27ae67b610dce5979500ef8ebe01. Affected by this vulnerability is an unknown functionality of the file /dashboard_page/forms/fetch.php. The manipulation of the argument department_name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
CVE ID: CVE-2026-11338 Severity: LOW (CVSS 1.9) CWE: CWE-79, CWE-94 KEV (actively exploited): NO Description: A security vulnerability has been detected in SourceCodester Ship Ferry Ticket Reservation System 1.0. Impacted is an unknown function of the file /admin/?page=user/manage_user. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
CVE ID: CVE-2025-71317 Severity: CRITICAL (CVSS 9.3) CWE: CWE-798 KEV (actively exploited): NO Description: NetMan 204 contains a hard-coded backdoor account with the username and password 'eurek' that grants administrative access. A remote, unauthenticated attacker can authenticate through the cgi-bin/login.cgi endpoint (for example /cgi-bin/login.cgi?username=eurek&password=eurek, which due to lax parameter validation can be shortened to /cgi-bin/login.cgi?username=eurek%20eurek) to obtain administrator privileges, allowing them to alter device configuration, enable the telnet/SSH services, and reset local user credentials.
CVE ID: CVE-2025-71318 Severity: CRITICAL (CVSS 9.3) CWE: CWE-306 KEV (actively exploited): NO Description: NetMan 204 fails to enforce authentication on its administrative pages and command endpoints. A remote, unauthenticated attacker can directly request administrative pages (such as administration.html, administration-commands.html, and configuration.html) to disclose sensitive information including LDAP configuration and active user details, and can invoke privileged UPS control commands — including shutdown, reboot, switch-on-bypass, and battery test — without supplying any credentials.
CVE ID: CVE-2026-11341 Severity: LOW (CVSS 2.1) CWE: CWE-77, CWE-78 KEV (actively exploited): NO Description: A flaw has been found in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_412DA0 of the file /boafrm/formIMEISetup. This manipulation of the argument IMEI_value causes os command injection. The attack can be initiated remotely. The exploit has been published and may be used.
CVE ID: CVE-2026-11342 Severity: MEDIUM (CVSS 5.5) CWE: CWE-74, CWE-89 KEV (actively exploited): NO Description: A vulnerability has been found in code-projects Hotel and Tourism Reservation System 1.0. This affects an unknown function of the file /details.php. Such manipulation of the argument room leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE ID: CVE-2026-11344 Severity: MEDIUM (CVSS 5.5) CWE: CWE-284, CWE-434 KEV (actively exploited): NO Description: A vulnerability was found in code-projects Vehicle Management System 1.0. This impacts an unknown function of the file newdriver.php of the component New Driver Registration Form. Performing a manipulation of the argument photo results in unrestricted upload. The attack may be initiated remotely. The exploit has been made public and could be used.
CVE ID: CVE-2026-36500 Severity: UNKNOWN KEV (actively exploited): NO Description: An issue in the cluster-admin:backup-datastore component of Controller v12.0.5 allows attackers to execute a directory traversal via a crafted request.
CVE ID: CVE-2026-36501 Severity: UNKNOWN KEV (actively exploited): NO Description: An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.
CVE ID: CVE-2026-45290 Severity: HIGH (CVSS 7.5) CWE: CWE-770 KEV (actively exploited): NO Description: Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260417.085727-30` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a vulnerability in Network to stall the netty event loop, rendering it inoperable. All consumers of the library should upgrade to at least version `1.0.0.CR3-20260417.085727-30`. There are no known workarounds beyond updating the library.
CVE ID: CVE-2026-45291 Severity: HIGH (CVSS 7.5) CWE: CWE-20 KEV (actively exploited): NO Description: Cloudburst Network provides network components used within Cloudburst projects. A vulnerability in versions prior to `1.0.0.CR3-20260418.124334-32` impacts publicly accessible software depending on the affected versions of Network and allows an attacker to exploit a bug in Network to close the parent netty channel, rendering it inoperable. All consumers of the library should upgrade to at least version `1.0.0.CR3-20260418.124334-32`. There are no known workarounds beyond updating the library.
CVE ID: CVE-2026-45327 Severity: HIGH (CVSS 8.2) CWE: CWE-306 KEV (actively exploited): NO Description: TinyIce is a streaming server for audio and video. In versions 0.8.95 through 2.4.1, missing authentication on WebRTC ingest endpoint allows unauthenticated stream injection. Version 2.5.0 fixes the issue by requiring either HTTP Basic auth or a `?password=` query parameter, comparing the supplied password against the per-mount source password (or the `default_source_password` fallback) using bcrypt, hooking into the existing brute-force IP rate-limiter (5 failed attempts per IP within 15 minutes triggers a lockout), and rejecting requests for mounts in `disabled_mounts`. The same release also tightens an adjacent endpoint, `POST /admin/golive/chunk`, which previously required session authentication but did not verify the session user's per-mount access nor check the CSRF token.
CVE ID: CVE-2026-45743 Severity: HIGH (CVSS 8.1) CWE: CWE-639 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. 16 file-manager endpoints in Termix prior to version 2.3.2 do not verify that the requesting user owns the SSH session identified by `sessionId`. An authenticated attacker who knows or guesses another user's active `sessionId` can read, write, delete, download, and execute files on the victim's connected SSH host. Version 2.3.2 patches the issue.
CVE ID: CVE-2026-45744 Severity: CRITICAL (CVSS 9.9) CWE: CWE-78 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in Termix is vulnerable to OS command injection. The endpoint uses double-quote escaping for shell command construction, which does not prevent $(...) and backtick command substitution. Any authenticated user with an active File Manager SSH session can execute arbitrary commands on the connected remote host. Version 2.3.2 patches the issue.
CVE ID: CVE-2026-45746 Severity: CRITICAL (CVSS 9.0) CWE: CWE-284, CWE-639 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the File Manager functionality in Termix contains a critical Broken Access Control vulnerability due to improper validation of the sessionId parameter. The backend trusts a client-controlled identifier without verifying that it belongs to the authenticated user. This allows an attacker to manipulate the value and access active File Manager sessions belonging to other users. Since these sessions are tied to SSH connections to remote VPS instances, exploitation allows unauthorized interaction with another user's remote filesystem. Because the File Manager exposes functionality such as file reading, writing, uploading, and execution, this vulnerability enables direct command execution on another user's VPS (RCE). Version 2.3.2 patches the issue.
CVE ID: CVE-2026-45748 Severity: CRITICAL (CVSS 9.8) CWE: CWE-78 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. The `POST /ssh/tunnel/connect` endpoint in Termix prior to version 2.3.2 builds an SSH tunnel command by interpolating user-controlled host record fields (`endpointIP`, `endpointUsername`, `password`) directly into a shell command without escaping, allowing persistent OS command injection on the source SSH host. Version 2.3.2 patches the issue.
CVE ID: CVE-2026-45750 Severity: CRITICAL (CVSS 9.0) CWE: CWE-639, CWE-78 KEV (actively exploited): NO Description: Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to version 2.3.2, the GET /ssh/file_manager/ssh/resolvePath endpoint in the Termix File Manager component unsafely processes the path parameter and embeds it into a shell command executed over the active SSH session. Because the user-controlled value is placed inside double quotes and only double quotes are escaped, shell command substitution syntax such as $(...) is still interpreted by the remote shell. Version 2.3.2 fixes the issue.
CVE ID: CVE-2026-49492 Severity: HIGH (CVSS 8.6) CWE: CWE-78 KEV (actively exploited): NO Description: Markdown Preview Enhanced before 0.8.28 opens external files and links from the preview through a shell and does not validate untrusted inputs taken from the markdown document - the diagram filename attribute, imported file paths, and the latex_engine code-chunk attribute. On Windows, a crafted markdown document can inject operating system commands that execute when the document is previewed. Fixed in 0.8.28 by passing these inputs as literal arguments instead of through a shell and validating them before use.
CVE ID: CVE-2026-49493 Severity: HIGH (CVSS 8.6) CWE: CWE-94 KEV (actively exploited): NO Description: Markdown Preview Enhanced before 0.8.28 parses Bitfield fenced code blocks with interpretJS(), which evaluates the block content as code via vm.runInNewContext(), allowing arbitrary code execution. A crafted markdown document containing a malicious bitfield code block executes attacker-controlled code on the server side when the document is rendered or exported. Fixed in 0.8.28 by parsing bitfield register definitions with JSON5.parse(), since they are purely data.
CVE ID: CVE-2024-56462 Severity: HIGH (CVSS 8.8) CWE: CWE-530, CWE-552 Affected: cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:-:*:*:*:*:*:*, cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_10:*:*:*:*:*:*, cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_11:*:*:*:*:*:*, cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_12:*:*:*:*:*:*, cpe:2.3:a:ibm:qradar_security_information_and_event_manager:7.5.0:update_pack_13:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 002 could allow a privileged user to upload a malicious backup archive that could be restored and used to gain access to the underlying operating system.
CVE ID: CVE-2024-40684 Severity: CRITICAL (CVSS 9.8) CWE: CWE-521 Affected: cpe:2.3:a:ibm:operations_analytics_log_analysis:1.3.5.0:*:*:*:*:*:*:*, cpe:2.3:a:ibm:operations_analytics_log_analysis:1.3.5.1:*:*:*:*:*:*:*, cpe:2.3:a:ibm:operations_analytics_log_analysis:1.3.5.2:*:*:*:*:*:*:*, cpe:2.3:a:ibm:operations_analytics_log_analysis:1.3.5.3:*:*:*:*:*:*:*, cpe:2.3:a:ibm:operations_analytics_log_analysis:1.3.6.0:*:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM Operations Analytics - Log Analysis 1.3.5.0, 1.3.5.1, 1.3.5.2, 1.3.5.3, 1.3.6.0, 1.3.6.1, 1.3.7.0, 1.3.7.1, 1.3.7.2, and 1.3.8.0, 1.3.8.1, 1.3.8.2, 1.3.8.3, 1.3.8.4 IBM SmartCloud Analytics - Log Analysis does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.
CVE ID: CVE-2025-62319 Severity: CRITICAL (CVSS 9.8) CWE: CWE-89 Affected: cpe:2.3:a:hcltech:unica:*:*:*:*:*:*:*:*, cpe:2.3:a:hcltech:unica_audience_central:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: Boolean-Based SQL Injection is a type of blind SQL injection where an attacker manipulates SQL queries by injecting Boolean conditions (TRUE or FALSE) into application input fields. Instead of returning database errors or visible data, the application responds differently depending on whether the injected condition evaluates to true or false. This allows an attacker to inject arbitrary SQL into backend configuration queries executed within the application.
CVE ID: CVE-2026-9035 Severity: MEDIUM (CVSS 6.5) CWE: CWE-22 Affected: cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:-:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:fixpack1:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:-:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential arbitrary file read in the asperahttpd component. An authenticated user may be able to take advantage of this vulnerability to access files in the server’s local storage that they should not have access to.
CVE ID: CVE-2026-8175 Severity: CRITICAL (CVSS 9.8) CWE: CWE-122 Affected: cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:-:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:fixpack1:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:-:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could be exploited to cause a denial of service and potentially lead to authentication bypass or remote code execution.
CVE ID: CVE-2026-8179 Severity: HIGH (CVSS 8.8) CWE: CWE-121 Affected: cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:-:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:fixpack1:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:-:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a buffer overflow in the asperahttpd component. This vulnerability could allow an authenticated user to execute arbitrary code on the system.
CVE ID: CVE-2026-8180 Severity: HIGH (CVSS 7.5) CWE: CWE-476 Affected: cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:-:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_endpoint:4.4.7:fixpack1:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:*:*:*:*:*:*:*:*, cpe:2.3:a:ibm:aspera_high-speed_transfer_server:4.4.7:-:*:*:*:*:*:* KEV (actively exploited): NO Description: IBM Aspera High-Speed Transfer Endpoint 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Server 3.7.4 through 4.4.7 Fix Pack 1 and IBM Aspera High-Speed Transfer Endpoint are affected by a potential denial of service in the asperahttpd component. An unauthenticated user can cause the asperahttpd service to crash.
CVE ID: CVE-2026-45739 Severity: MEDIUM (CVSS 4.3) CWE: CWE-200, CWE-201 Affected: cpe:2.3:a:strawberry:strawberry_graphql:*:*:*:*:*:python:*:* KEV (actively exploited): NO Description: Strawberry GraphQL is a library for creating GraphQL APIs. In versions 0.288.4 through 0.315.3, Strawberry's bundled GraphiQL template wrote values from the GraphiQL headers editor into the browser URL query string. If a user entered a sensitive header, such as `Authorization: Bearer `, the value could become visible in browser history, copied links, and server/proxy/CDN access logs after a page reload or shared request. Version 0.315.4 patches the issue.
CVE ID: CVE-2026-6369 Severity: MEDIUM (CVSS 5.7) CWE: CWE-306, CWE-732 Affected: cpe:2.3:a:canonical:livepatch_client:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An improper access control vulnerability in the canonical-livepatch snap client prior to version 10.15.0 allows a local unprivileged user to obtain a sensitive, root-level authentication token by sending an unauthenticated request to the livepatchd.sock Unix domain socket. This vulnerability is exploitable on systems where an administrator has already enabled the Livepatch client with a valid Ubuntu Pro subscription. This token allows an attacker to access Livepatch services using the victim's credentials, as well as potentially cause issues to the Livepatch server.
CVE ID: CVE-2024-47273 Severity: MEDIUM (CVSS 4.3) CWE: CWE-22 Affected: cpe:2.3:a:synology:hyper_backup:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.
CVE ID: CVE-2024-47263 Severity: MEDIUM (CVSS 4.1) CWE: CWE-22 Affected: cpe:2.3:a:synology:hyper_backup:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.
CVE ID: CVE-2023-52951 Severity: MEDIUM (CVSS 5.9) CWE: CWE-319 Affected: cpe:2.3:a:synology:note_station_client:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: A cleartext transmission of sensitive information vulnerability in Synology Note Station Client before 2.2.4-703 allows man-in-the-middle attackers to obtain user credential.
CVE ID: CVE-2022-49042 Severity: HIGH (CVSS 7.8) CWE: CWE-829 Affected: cpe:2.3:a:synology:hyper_backup_explorer:*:*:*:*:*:*:*:* KEV (actively exploited): NO Description: An inclusion of functionality from untrusted control sphere vulnerability in MinGW DLL component in Synology Hyper Backup Explorer before 3.0.1-0156 allows local users to execute arbitrary code via unspecified vectors.
CVE ID: CVE-2026-38978 Severity: MEDIUM (CVSS 5.3) CWE: CWE-113 KEV (actively exploited): NO Description: transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.
CVE ID: CVE-2026-37460 Severity: HIGH (CVSS 7.5) CWE: CWE-20 KEV (actively exploited): NO Description: Missing input validation in the rfapiRibBi2Ri() function (rfapi_rib.c) of FRRouting (FRR) stable/10.0 to stable/10.6 allows attackers to cause a Denial of Service (DoS) via supplying a crafted BGP UPDATE message.
CVE ID: CVE-2026-35433 Severity: HIGH (CVSS 7.3) CWE: CWE-190, CWE-20 KEV (actively exploited): NO Description: Improper input validation in .NET allows an unauthorized attacker to elevate privileges locally.
CVE ID: CVE-2026-11326 Severity: MEDIUM (CVSS 6.0) CWE: CWE-284 KEV (actively exploited): NO Description: OpenAI Atlas before 1.2025.288.15 exposed privileged browser APIs to web content on *.openai.com origins. A cross-site scripting vulnerability in forum.openai.com could be used to access these functions, allowing access to browser history information and the ability to open or close tabs. OpenAI Atlas 1.2025.288.15 narrows access to these APIs to *.chatgpt.com; users should upgrade to 1.2025.288.15 or later.
CVE ID: CVE-2026-11178 Severity: MEDIUM (CVSS 4.3) CWE: CWE-346 KEV (actively exploited): NO Description: Insufficient policy enforcement in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11177 Severity: HIGH (CVSS 8.8) CWE: CWE-416 KEV (actively exploited): NO Description: Use after free in Omnibox in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11176 Severity: MEDIUM (CVSS 6.5) CWE: CWE-346 KEV (actively exploited): NO Description: Inappropriate implementation in Media in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11175 Severity: HIGH (CVSS 8.8) CWE: CWE-451 KEV (actively exploited): NO Description: Incorrect security UI in Messages in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11174 Severity: MEDIUM (CVSS 5.3) CWE: CWE-693 KEV (actively exploited): NO Description: Inappropriate implementation in Site Isolation in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11172 Severity: HIGH (CVSS 8.8) CWE: CWE-451 KEV (actively exploited): NO Description: Incorrect security UI in Contact Picker in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11170 Severity: HIGH (CVSS 8.1) CWE: CWE-693 KEV (actively exploited): NO Description: Inappropriate implementation in Chromoting in Google Chrome on Linux prior to 149.0.7827.53 allowed a remote attacker to perform OS-level privilege escalation via malicious network traffic. (Chromium security severity: Medium)
CVE ID: CVE-2026-11169 Severity: HIGH (CVSS 8.1) CWE: CWE-91 KEV (actively exploited): NO Description: Inappropriate implementation in XML in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted XML file. (Chromium security severity: Medium)
CVE ID: CVE-2026-11168 Severity: MEDIUM (CVSS 6.5) CWE: CWE-200 KEV (actively exploited): NO Description: Inappropriate implementation in Extensions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
CVE ID: CVE-2026-11167 Severity: CRITICAL (CVSS 9.6) CWE: CWE-250 KEV (actively exploited): NO Description: Inappropriate implementation in WebView in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)