rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-8467 Unauthenticated remote code execution via HEEx template injection in phoenix_storybook playground
Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in HEEx template generation.

The psb-assign WebSocket event handler in 'Elixir.PhoenixStorybook.Story.PlaygroundPreviewLive':handle_event/3 accepts arbitrary attribute names and values from unauthenticated clients. These values are passed to 'Elixir.PhoenixStorybook.Helpers.ExtraAssignsHelpers':handle_set_variation_assign/3, which stores them verbatim. When rendering, 'Elixir.PhoenixStorybook.Rendering.ComponentRenderer':attributes_markup/1 interpolates binary attribute values directly into a HEEx template string as name="<val>" without escaping double quotes or HEEx expression delimiters. An attacker can supply a value containing a closing quote followed by a HEEx expression block (e.g. foo" injected={EXPR} bar="), which causes EXPR to be treated as an inline Elixir expression. The resulting template is compiled via EEx.compile_string/2 and executed via Code.eval_quoted_with_env/3 with full Kernel imports and no sandbox, giving the attacker arbitrary code execution on the server.

This issue affects phoenix_storybook from 0.5.0 before 1.1.0.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: phenixdigital
product: phoenix_storybook
cpes: cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: phenixdigital
product: phoenix_storybook
cpes: cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Nick Mykhailyshyn
lang: en
value: Cenk Kücük
lang: en
value: Christian Blavier
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-20T13:35:29.018Z
CVE-2026-8468 Unbounded buffer accumulation in multipart header parsing causes denial of service in plug
Allocation of Resources Without Limits or Throttling vulnerability in plug_project plug allows denial of service via unbounded buffer accumulation in multipart header parsing.

'Elixir.Plug.Conn':read_part_headers/2 in lib/plug/conn.ex does not obey its :length parameter. There is no upper bound on the size of the accumulated buffer. By contrast, the sibling function read_part_body has an explicit byte_size(acc) > length guard that stops accumulation once a limit is reached. No such guard exists in read_part_headers. An unauthenticated remote attacker can exhaust server memory by sending a crafted multipart/form-data request, causing a denial of service.

This issue affects plug from 1.4.0 before 1.15.4, 1.16.3, 1.17.1, 1.18.2, and 1.19.2.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: elixir-plug
product: plug
cpes: cpe:2.3:a:plug_project:plug:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: elixir-plug
product: plug
cpes: cpe:2.3:a:plug_project:plug:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: José Valim
lang: en
value: José Valim
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-14T10:29:51.062Z
CVE-2026-8469 Unauthenticated denial-of-service via BEAM atom table exhaustion in phoenix_storybook
Allocation of Resources Without Limits or Throttling vulnerability in phenixdigital phoenix_storybook allows unauthenticated denial-of-service via BEAM atom table exhaustion.

Multiple LiveView event handlers convert user-supplied event parameter strings to atoms using String.to_atom/1 without validation: 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_set_variation_assign/3 interns every key of the psb-assign params map; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':handle_toggle_variation_assign/3 interns the "attr" value from psb-toggle events; 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_variation_id/2 interns elements of "variation_id"; and 'Elixir.PhoenixStorybook.ExtraAssignsHelpers':to_value/4 interns raw string values for attributes declared as :atom or :boolean. BEAM atoms are never garbage-collected, so each unique attacker-controlled string is a permanent allocation. Once the atom table ceiling (~1,048,576 atoms) is reached, the entire BEAM node aborts, taking down all applications running on it.

This issue affects phoenix_storybook from 0.2.0 before 1.1.0.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: phenixdigital
product: phoenix_storybook
cpes: cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*
default_status: unaffected
vendor: phenixdigital
product: phoenix_storybook
cpes: cpe:2.3:a:phenixdigital:phoenix_storybook:*:*:*:*:*:*:*:*
default_status: unaffected
Credits: lang: en
value: Peter Ullrich
lang: en
value: Christian Blavier
lang: en
value: Jonatan Männchen / EEF
Published: 2026-05-20T13:35:27.914Z
CVE-2026-8474 Possible to run a Cross Site Scripting request on the login API available on Stormshield SNS appliances.
A vulnerability was discovered on Stormshield Network Security 





  *  4.3.0 to 4.3.41, 
  *  4.8.0 to 4.8.15, 
  *  5.0.0 to 5.0.5








It is possible to execute a reflected XSS attack on the login API available on Stormshield SNS appliance by executing a script on the victim's machine. The risks include the theft of cookies or other sensitive data, as well as the modification of page behavior, for example, by redirecting the victim to malicious websites.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting')
Affected products: vendor: StormShield
product: StormShield Network Security
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: 2026-06-01T07:47:54.875Z
CVE-2026-8477 
Improper enforcement of the sealed-entry workflow in the entry sensitive-data retrieval feature in Devolutions Server allows an authenticated user with access to a sealed entry to retrieve its sensitive data without triggering the unseal audit notification via a crafted API request.

This issue affects :

  *  Devolutions Server 2026.1.6.0 through 2026.1.16.0
  *  Devolutions Server 2025.3.20.0 and earlier
Problem types: cwe_id: CWE-841
description: CWE-841 Improper enforcement of behavioral workflow
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-05-22T15:27:34.768Z
CVE-2026-8479 
IEC 60870-5-104 used in bidirectional mode in RTU500 is vulnerable
for a NULL pointer dereferencing, if a specially crafted
sequence of messages is sent for a certain time, causing
Denial of Service impact.
Product is only affected if IEC 60870-5-104 functionality in
bidirectional mode (BCI) is configured.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL pointer dereference
Affected products: vendor: Hitachi Energy
product: RTU500 series CMU firmware
default_status: unaffected
Published: 2026-05-26T11:54:09.962Z
CVE-2026-8485 Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation
Uncontrolled Memory Allocation vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Problem types: cwe_id: CWE-789
description: CWE-789 Uncontrolled Memory Allocation
Affected products: vendor: Progress Software
product: MOVEit Automation
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 5.9
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Airbus SecLab
lang: en
value: Anaïs Gantet
lang: en
value: Delphine Gourdou
lang: en
value: Quentin Liddell
lang: en
value: Matteo Ricordeau
Published: 2026-05-20T14:06:57.546Z
CVE-2026-8486 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Flooding.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of resources without limits or throttling
Affected products: vendor: Progress Software
product: MOVEit Automation
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Airbus SecLab
lang: en
value: Anaïs Gantet
lang: en
value: Delphine Gourdou
lang: en
value: Quentin Liddell
lang: en
value: Matteo Ricordeau
Published: 2026-05-20T14:11:30.771Z
CVE-2026-8487 Incorrect default permissions vulnerability in Progress Software MOVEit Automation
Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Problem types: cwe_id: CWE-276
description: CWE-276 Incorrect default permissions
Affected products: vendor: Progress Software
product: MOVEit Automation
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: Airbus SecLab
lang: en
value: Anaïs Gantet
lang: en
value: Delphine Gourdou
lang: en
value: Quentin Liddell
lang: en
value: Matteo Ricordeau
Published: 2026-05-20T14:12:03.406Z
CVE-2026-8488 Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation
Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation.

This issue affects MOVEit Automation: before 2025.0.11, from 2025.1.0 before 2025.1.7.
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of resources without limits or throttling
Affected products: vendor: Progress Software
product: MOVEit Automation
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: Airbus SecLab
lang: en
value: Anaïs Gantet
lang: en
value: Delphine Gourdou
lang: en
value: Quentin Liddell
lang: en
value: Matteo Ricordeau
Published: 2026-05-20T14:14:54.861Z
CVE-2026-8491 Node View Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-034
Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Node View Permissions allows Forceful Browsing.

This issue affects Node View Permissions: from 0.0.0 before 1.7.0, from 2.0.0 before 2.0.1.
Problem types: cwe_id: CWE-754
description: CWE-754 Improper Check for Unusual or Exceptional Conditions
Affected products: vendor: Drupal
product: Node View Permissions
default_status: unaffected
Credits: lang: en
value: Adam Shepherd (adamps)
lang: en
value: BÃ¡lint Nagy (nagy.balint)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
Published: 2026-05-19T22:28:58.101Z
CVE-2026-8492 Translate Drupal with GTranslate - Less critical - DOM clobbering / link manipulation - SA-CONTRIB-2026-035
Modification of Assumed-Immutable Data (MAID) vulnerability in Drupal Translate Drupal with GTranslate allows Resource Location Spoofing.

This issue affects Translate Drupal with GTranslate: from 0.0.0 before 3.0.5.
Problem types: cwe_id: CWE-471
description: CWE-471 Modification of Assumed-Immutable Data (MAID)
Affected products: vendor: Drupal
product: Translate Drupal with GTranslate
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Edvard Ananyan (edo888)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Juraj Nemec (poker10)
Published: 2026-05-19T22:29:14.483Z
CVE-2026-8493 Colorbox Inline - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-036
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Colorbox Inline allows Cross-Site Scripting (XSS).

This issue affects Colorbox Inline: from 0.0.0 before 2.1.1.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
Affected products: vendor: Drupal
product: Colorbox Inline
default_status: unaffected
Credits: lang: en
value: Pierre Rudloff (prudloff)
lang: en
value: Michael Harris (miwayha)
lang: en
value: Bram Driesen (bramdriesen)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Pierre Rudloff (prudloff)
Published: 2026-05-19T22:29:31.032Z
CVE-2026-8495 Date iCal - Critical - Information disclosure - SA-CONTRIB-2026-037
Missing Authorization vulnerability in Drupal Date iCal allows Forceful Browsing.

This issue affects Date iCal: from 0.0.0 before 4.0.15.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Drupal
product: Date iCal
default_status: unaffected
Credits: lang: en
value: Drew Webber (mcdruid)
lang: en
value: JoÃ«l Pittet (joelpittet)
lang: en
value: Greg Knaddison (greggles)
lang: en
value: Dave Long (longwave)
lang: en
value: Juraj Nemec (poker10)
lang: en
value: Drew Webber (mcdruid)
Published: 2026-05-19T22:29:50.850Z
CVE-2026-8496 A cross-site scripting (XSS) vulnerability in Alinto SOGo, version  5.12.7
A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version  5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed.  Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.
Problem types: description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
description: CWE-116 Improper Encoding or Escaping of Output
Affected products: vendor: Alinto SOGo
product: SOGo
Published: 2026-05-13T18:02:54.459Z
CVE-2026-8500 Web::Passwd versions through 0.03 for Perl is vulnerable to RCE
Web::Passwd versions through 0.03 for Perl is vulnerable to RCE.

Web::Passwd is a small CGI application for managing htpasswd files using the htpasswd command.

The user parameter is not validated or escaped, and is used as the last argument on the command line, allowing for command injection.
Problem types: cwe_id: CWE-78
description: CWE-78 Improper Neutralization of Special Elements used in an OS Command
Affected products: vendor: EVANK
product: Web::Passwd
default_status: unaffected
Published: 2026-05-13T22:24:42.216Z
CVE-2026-8501 CVE-2026-8501
Improper access control in the PCTCore64.sys Windows kernel driver from PC Tools Internet Security allows user-mode processes to access the PCTCoreDriver WDM device interface and invoke privileged IOCTL handlers. A local attacker with the ability to access or load the affected driver can exploit this vulnerability to perform sensitive and privileged operations on the target system.
Problem types: description: CWE-782: Exposed IOCTL with Insufficient Access Control
Affected products: vendor: Symantec
product: PC Tools Internet Security
Published: 2026-06-01T16:25:11.611Z
CVE-2026-8502 LearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters
The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.3.6 via the 'return_type' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the plaintext post_password of password-protected courses and the full post_content, post_author, and post_name of unpublished draft, private, and pending courses via the unrestricted SELECT * fallback query. Exploitation requires supplying both c_status=all (to bypass the publish-only post_status WHERE clause) and return_type=json (to prevent the safe DISTINCT(ID) AS ID field override) in a single unauthenticated request to the /wp-json/lp/v1/courses/archive-course endpoint.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: thimpress
product: LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
baseScore: 5.3
baseSeverity: MEDIUM
Credits: lang: en
value: Jamshed Yergashvoyev
Published: 2026-06-06T02:28:36.811Z
CVE-2026-8503 Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids
Apache::Session::Generate::SHA256 versions before 1.3.19 for Perl create insecure session ids.

Apache::Session::Generate::SHA256 generated session ids insecurely. The default session id generator returns a SHA-256 hash of the built-in rand() function, the epoch time, and the PID, that is hashed again. These are predictable, low-entropy sources. Predicable session ids could allow an attacker to gain access to systems.

Note that version 1.3.19 has a fallback without warning to use insecure session generation method if the call to Crypt::URandom::urandom fails. However, this is unlikely as Crypt::URandom is a hardcoded requirement of the module.

This issue is similar to CVE-2025-40931 for Apache::Session::Generate::MD5.
Problem types: cwe_id: CWE-340
description: CWE-340 Generation of Predictable Numbers or Identifiers
cwe_id: CWE-338
description: CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator
Affected products: vendor: GUIMARD
product: Apache::Session::Generate::SHA256
default_status: unaffected
Published: 2026-05-15T11:06:29.777Z
CVE-2026-8507 Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws
Crypt::OpenSSL::PKCS12 versions through 1.94 for Perl have out-of-bounds (OOB) write flaws.

When parsing a PKCS12 file, with a >= 1 GiB OCTET STRING (or BIT STRING) attribute on a SAFEBAG, via info() or info_as_hash(), a heap out-of-bounds write would be triggered with remote-code-execution potential (RCE) due to a signed integer overflow in the size calculation passed to Renew().
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: JONASBN
product: Crypt::OpenSSL::PKCS12
default_status: unaffected
Published: 2026-05-17T18:43:05.863Z
CVE-2026-8509 
Heap buffer overflow in WebML in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-122
description: Heap buffer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:09.937Z
CVE-2026-8510 
Integer overflow in Skia in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:10.435Z
CVE-2026-8511 
Use after free in UI in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:10.918Z
CVE-2026-8512 
Use after free in FileSystem in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:11.336Z
CVE-2026-8513 
Use after free in Input in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:11.781Z
CVE-2026-8514 
Use after free in Aura in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:12.496Z
CVE-2026-8515 
Use after free in HID in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:12.912Z
CVE-2026-8516 
Insufficient validation of untrusted input in DataTransfer in Google Chrome prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-20
description: Insufficient validation of untrusted input
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:13.261Z
CVE-2026-8517 
Object lifecycle issue in WebShare in Google Chrome on Mac prior to 148.0.7778.168 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical)
Problem types: description: Object lifecycle issue
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:13.680Z
CVE-2026-8518 
Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-416
description: Use after free
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:14.023Z
CVE-2026-8519 
Integer overflow in ANGLE in Google Chrome on Windows prior to 148.0.7778.168 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)
Problem types: cwe_id: CWE-472
description: Integer overflow
Affected products: vendor: Google
product: Chrome
Published: 2026-05-14T19:52:14.583Z